Cyber Readiness Assessment
External scan, short questionnaire, one interview. A posture report scored against the controls underwriters ask about, plus a ranked remediation roadmap.
Cyber Security Solutions
From assessment to active protection. Every engagement starts by finding out what is exposed, moves to closing the gaps and documenting the controls, and ends with continuous protection.
How it runs
Every engagement moves in the same order.
Assess, deliver, govern, then automate.
Most clients begin with Tier 1, because nothing after it can be scoped honestly without knowing what is exposed. The evidence each tier produces is what stays current for insurers, regulators and clients.
-
Step 1 · Tier 1
Assess
Know where you stand.
-
Step 2 · Tier 2
Deliver
Strengthen the foundation.
-
Step 3 · Tier 3
Govern
Ongoing oversight and protection.
-
Step 4 · What it enables
Automate
AI built on a secure foundation.
The three tiers
Each tier stands on its own.
Pick a tier to see what is in it. Most clients begin with Tier 1.
Find and understand your risks. Three ways of answering the same question: what is actually exposed right now, and which of it matters most.
Penetration Testing
Real-world testing of the network to find gaps an attacker could exploit, with findings ranked by severity and verified after fixes.
Dark Web Threat Assessment
Monitoring for exposed credentials, company data, and emerging threats tied to your domains and people.
Where it leaves you
A ranked roadmap of what to fix first, and a scored report you can hand to an underwriter. Most clients start here.
Build a stronger, more resilient business. The assessment produces a roadmap. This tier is the work of closing it, and of leaving behind documentation that holds up when someone asks to see it.
Policy Review
Evaluate and strengthen security policies, procedures, and controls so they match how the business runs.
Cyber Plan
A customized incident response and business continuity plan: who does what, in what order, when something goes wrong.
Compliance Management
Stay aligned with industry and regulatory requirements, with the evidence organized for audits and renewals.
Remediation
Close the gaps the assessment found, prioritized by risk and confirmed by retest.
Protection becomes a standing job, not a project. Ongoing oversight and protection: 24/7 monitoring, management and response, alongside the controls that keep the environment current once it has been hardened.
Network Operations (NOC)
24/7 network administration, Windows and third-party patching, help desk.
Security Operations (SOC)
Intrusion monitoring and detection, quarantine and remediation, firewalls.
Data Backup
Cloud and on-premises, scheduled and tested.
Endpoint and Email Protection
Anti-virus, spam filtering, and email security.
Access and Passwords
Secure remote access (VPN) and a managed password vault.
Employee Training
Security awareness that changes day-to-day behavior.
Asset Management
Hardware, servers, and network assets, plus managed add-ons such as signage, VoIP, CCTV, and wireless devices.
Where it leaves you
Controls that stay current, and evidence that stays current with them, for insurers, regulators and clients.
Service scope, response times and coverage are defined in each client's agreement.
Penetration testing
A scan finds the door. A test walks through it.
Testing answers a question a vulnerability scan cannot: not only what is exposed, but what an attacker could do with it. Eleven steps in four phases, with findings cross-referenced to the MITRE ATT&CK framework. Open a phase for the steps inside it.
-
01 · Intelligence gathering
Open-source intelligence: the same information an attacker would assemble before choosing where to strike. Domains and sub-domains, IP address ranges, employee names and roles, and the technology in use, gathered from search engines, social media, public registries such as WHOIS, online forums, job postings, published reports, public code repositories, and what vendors and partners expose about you.
02 · Host discovery
The result is an inventory of live hosts and open ports that becomes the map for every later step. Active systems are identified with techniques ranging from ping sweeps to port scans, depending on the conditions agreed for the assessment.
03 · Enumeration
This is where most findings originate. Each discovered service is identified and analyzed for weaknesses in configuration, patching or authentication: unpatched software, default or weak credentials, and misconfigured services.
-
04 · Exploitation
Exploitation proves the weakness is real, not theoretical. Identified vulnerabilities are exploited with the goal of gaining access, showing what a successful attack would mean for the business. Only techniques known to be safe in production environments are used.
05 · Post-exploitation and lateral movement
Demonstrating the downstream consequences is what turns a finding an organization might have deferred into one it fixes. From an initial foothold the test attempts to escalate privileges, harvest credentials and move to other systems, extracting as much as the position allows. Internal assessments are best run from inside the network being tested; testing over a VPN is possible, although certain network-layer attacks may not be feasible from an isolated subnet.
-
06 · Documentation and reporting
Written so that an owner or executive can understand the exposure and an IT lead can act on it. Each finding is documented with its severity score, the evidence gathered, the potential impact and the recommended mitigation. Severity is based on the CVSS score of each vulnerability and may be adjusted for the specific circumstances of the environment.
07 · Validation and verification
Findings are re-tested before the report is delivered. This confirms they exist and that the recommended mitigations will be effective, so the results can be trusted before anyone acts on them.
08 · Client consultation
The outcome is a prioritized remediation plan the client understands and owns. BROCO walks you through the findings, explains the threats in plain terms, and discusses the recommended course of action.
-
09 · Remediation
Remediation may be delivered by BROCO, by your IT team, or jointly. Based on the consultation, BROCO can assist with patching systems, hardening network defenses, and implementing stronger authentication and access controls.
10 · Retesting
Confirms the fixes were successful and that no new weaknesses were introduced in the process. After remediation, the affected systems are tested again.
11 · Final report
The complete record of the engagement, and evidence of your security posture for insurers, auditors, lenders and clients. It records the original vulnerabilities, the remediation steps taken, and the retest results.
Tests are designed to demonstrate the highest realistic impact, so security devices may flag the activity and post-exploitation can, on occasion, interrupt a service. The same safeguards used in a manual engagement apply. Scope, timing and exclusions are agreed in writing before testing begins.
What comes next
Security first, then automation.
An AI system inherits the access, data and controls of the environment it runs in, so testing and remediation come first: they decide what any automation can reach. Already using AI tools? The assessment is still the right next step, because it shows what those tools can already touch. BROCO Tech delivers both, in that order.