The 2-Minute Security Fundamentals Quiz

Take our 10-question assessment and instantly see how your cybersecurity fundamentals stack up. Each question is worth 10 points—find out if you're at risk or resilient. Click 'Start Quiz' to get your instant score!

Multi-Factor Authentication (MFA): How is it enforced for email/cloud logins?

Enforced for all users, on all critical apps, using an authenticator app, hardware key, or other phishing-resistant method.

Enabled for most users, but primarily using SMS/voice codes.

It's optional, or we're not sure.

None

Email Security: Beyond the basics, how do you stop sophisticated wire fraud?

We use advanced filtering, impersonation protection, and banner external emails.

We rely on our built-in email security (e.g., Microsoft/Google defaults).

We don't have anything beyond the standard spam filter.

None

Data Backups: If ransomware hit right now, how confident are you in recovery?

Very. We have automated, isolated, offsite backups tested within the last 90 days.

Somewhat. We have backups, but haven't tested them recently.

Not confident. Recovery would be slow, or we're unsure of the process.

None

Patch Management: How are critical security updates handled?

Automated and deployed across all systems.

Manually, when we get around to it, or we rely on users to update.

We don't have a consistent process.

None

Endpoint Protection: What runs on your company laptops/desktops?

Next-Gen Antivirus (NGAV) with EDR and 24/7 monitoring.

Traditional, signature-based antivirus software.

Just the built-in Windows Defender, or we're not sure.

None

Employee Onboarding/Offboarding: When an employee leaves, how long until access is cut?

Within hours, with a documented checklist to disable all accounts.

Within a few days, we usually remember to disable their main accounts.

It's ad-hoc; we've probably missed accounts in the past.

None

Wi-Fi Security: How is your corporate Wi-Fi network secured?

Using a WPA2/3 network for corporate-secured devices, and a separate (segregated) guest network.

Single network with a strong password.

It's an open network or uses a very simple password.

None

Admin Rights: How many of your users have local administrator access to their PCs?

None, or only a handful of IT staff with separate admin accounts.

Some of our power users or executives have it for convenience.

Most users have it to install software easily.

None

Security Monitoring: Who is watching your systems for threats outside business hours?

A 24/7 Security Operations Center (SOC) or your IT team with alerts.

Your IT team checks logs during business hours only.

No one is proactively monitoring.

None

10.

Vendor Risk: How do you verify a vendor's email before sending a large payment?

We always call a verified number on file (not the number in the email) using a two-person verification process.

We reply to the email thread to confirm the details.

We assume the email is legitimate if it's from a known contact.

None

1 out of 10

Full Name

Business Email

Company Name

Phone Number

Would you like Michael Hornby, our CEO, to personally walk you through your results and answer your specific security questions?

Yes! I want the free CEO walkthrough.

No thanks! Just show me my results.