They believed they had 10 devices. We found 45.
A car dealership was not sure how exposed it really was. Here is what a full cyber risk assessment turned up, and the prioritized plan that came out of it.
from kickoff to a clear, prioritized remediation plan.
The challenge
A car dealership came to us with a common feeling: things mostly worked, but no one could say how exposed the business really was. Their previous provider had never given them a straight inventory, and leadership was making decisions about security and spend without a clear picture. They believed they had about ten devices on the network.
That gap between what a business thinks it has and what is actually running is where most risk hides. Old systems keep working quietly. Passwords never get tightened. Credentials leak and no one knows. None of it shows up until the day it costs you.
What we did
We ran a full cyber risk assessment that looked at the whole environment at once, not just the parts that were easy to see. That meant vulnerability scanning, dark web monitoring for exposed credentials, device and lifecycle health, identity and Active Directory posture, and alignment against recognized security benchmarks.
The picture came back quickly, and it was bigger than expected. The network held 45 devices, not ten. Several servers and applications were years past vendor support and no longer receiving security updates. The password policy allowed very short passwords, no complexity, and unlimited login attempts. Company credentials were already sitting in known dark web compromise data. Alongside the gaps were real strengths to build on, including multi-factor authentication and modern workstations.
The outcome
Within days, leadership had something they had never had before: an honest, complete view of their exposure and a plan they could act on. We translated the findings into a three-tier roadmap that put the most dangerous, cheapest-to-fix issues first, password policy, unsupported systems, and compromised credentials, ahead of longer-term modernization.
The assessment rated the environment high risk, but high risk you can see and plan around is a very different thing from high risk you are blind to. The business moved from guessing to a prioritized plan, and from a vague worry to a clear set of next steps, before any of it became an incident.
A clear-eyed cyber risk assessment is the fastest way to know where you actually stand. If you want the same straight read on your environment, that is where we start.