Security Health Check

A Security Health Check shows where your security stands across governance, access management, supply chain risks, resilience and awareness. Combined with vulnerability scanning to identify technical weaknesses and exposures, it gives you a clear view of both strategic and technical risks helping you set priorities and make better-informed security investments.

Know where you stand?

You’re investing in security, but knowing whether you’re focusing on the right risks and priorities is harder than it seems.

Management lacks the bigger picture

Security information is scattered across policies, tools, audit results, penetration test findings and different teams. As a result, there is no clear, connected view of the risks that matter most to the organisation.

Risks lack business context

You know the technical findings, but not what they mean for critical processes, systems and data. This makes it difficult to explain risks to management and make well-informed investment decisions.

Your resilience is hard to measure

Plenty of security measures may be in place, but how well do they work together and where do vulnerabilities still leave you exposed? Without an objective view of your security maturity and technical vulnerabilities, it is difficult to know how resilient the organisation really is.

There is no clear security roadmap

New incidents, audits and vulnerabilities constantly demand attention. Without a clear, connected view of risk, the latest urgent issue can quickly determine where time and budget are spent.

Our approach

A clear security picture requires more than checking boxes. We combine technical signals, your organisation’s perspective and in-depth conversations to build the context needed to make better security decisions.

Kick off and scoping

We start by aligning on scope, expectations, planning and the systems to be assessed. This ensures we focus on the parts of your organisation that matter most from the start.

Vulnerability scan

We scan your external infrastructure for technical vulnerabilities. The results add a technical perspective to the broader assessment of your security posture.

Self-assessment

Your organisation completes a questionnaire covering ten security domains, from governance and access management to incident response, supply chain risks and awareness. The answers provide an initial view of how security is organised across the organisation and form the basis for the in-depth interview.

In depth interview

We talk with IT, security and management about how responsibilities, processes and controls works in practice, including culture and behaviour. This helps us validate the assessment and adds context to what exists on paper.

Reporting and presentation

We bring everything together in a concise report with risk scores, business impact and prioritised recommendations. You leave with a clear view of what needs attention and where to focus your security investments next.

What you get from us

After the Security Health Check, you receive one clear, comprehensive report that brings all the results together:

Recommendations

Clear, actionable recommendations based on risk and business impact

Technical vulnerabilities

An overview of identified technical vulnerabilities, prioritised by severity and risk, with practical guidance on how to address them.

Maturity score

A clear maturity score across ten security domains.

Roadmap

A practical roadmap that translates the findings into prioritised next steps

Your primary point of contact

“Before you decide where to focus or invest, you need to know where you actually stand. A Security Health Check gives you that bigger picture, turning security assumptions into clear, actionable priorities.”

Patrick Huisman

CISO

FAQ

How much time should we expect a Security Health Check to take?

Most Security Assessments take between one and three weeks, depending on the scope and size of your organisation. We align on the scope and planning upfront, so you know what to expect. We align on the scope and planning upfront, so you know what to expect.

Why would we need a Security Health Check if we already conduct pentests?

A pentest focuses on identifying and validating technical vulnerabilities within a defined scope. A Security Health Check looks at the broader security posture: How technical risks relate to governance, access management, resilience, supply chain risks and awareness, to determine where your priorities should lie.

What expertise is involved in the Security Health Check?

The assessment is conducted by both a security consultant and a pentester, combining strategic and organisational insight with hands-on technical expertise. This ensures that technical findings are considered in the context of your broader security posture and business priorities.

Does a Security Health Check include technical testing?

Yes. The check includes a vulnerability scan of your external infrastructure to identify known vulnerabilities and potential exposures. Unlike a pentest, the scan does not actively exploit vulnerabilities or simulate attack scenarios. Its purpose is to provide objective technical evidence that complements the self-assessment and interviews.

Is a Security Assessment an audit or certification?

The assessment provides a substantiated view of your current security posture and helps you determine your priorities. It is not a formal certification audit and does not automatically result in a statement of compliance.

What do we need to provide?

We ask for relevant documentation, such as policies, risk assessments, architecture overviews, incident response procedures and previous assessment results. We also schedule interviews with employees responsible for the security domains being assessed. During scoping, we clarify what information and availability are required.

Combine with

Red Teaming

Put your resilience to the test against realistic attack scenarios across people, processes and technology.

Pentesting

Take a deeper look at technical risks by testing how vulnerabilities could be exploited in practice.

Security Awareness Training

Turn awareness gaps into stronger security behaviour across your organisation.

“The S-Unit combines in-depth expertise with a pragmatic approach. They think along critically, communicate clearly and translate their findings into concrete improvements we can act on straight away. It’s a pleasant way of working that helps us strengthen our information security further. And just as important: thanks to them, I sleep a lot better”

Firas Daoud

TAF – CTO

“The S-Unit understood from the start what we wanted to achieve, even though the path to get there wasn’t entirely clear yet. They took us along in their approach, thought ahead and switched gears quickly when needed. We could trust that it would work out, without having to keep steering. It’s a really pleasant way of working together.”

Martijn Korevaar

Gemeente Rotterdam – IT Risk & Compliance Manager

“We didn’t want to be told that we’re vulnerable. We wanted to see how far a real attacker would get. Instead of a standard report, we got insight into exactly the risks that matter most to us.”

Anonymous

Manager Tech Security

“We received professional help with a pentest of a broad application landscape. Despite the many different functionalities in our landscape, the test was fast and thorough.”

Daan van der Ham

Lead techniek - PO-VO Raad

Do you know where your
security investments make the biggest difference?

Gain insight into your most important security risks and vulnerabilities and determine where your time and budget can make the biggest impact.