What We Look for During a Cybersecurity Assessment of a San Antonio Business
Share
What We Look for During a Cybersecurity Assessment of a San Antonio Business
A cybersecurity assessment should do more than generate a list of technical findings.
For a business, the real goal is to understand where risk exists, which problems matter most, and what should be addressed first.
At Orobi Cybersecurity Solutions, we look at the technology, identities, users, security controls, and business processes that attackers are most likely to take advantage of.
For San Antonio businesses, that often means reviewing Microsoft 365, business email, endpoints, networks, cloud applications, backups, user access, and security monitoring together rather than treating each area as a separate problem.
Here are some of the areas we look at during a cybersecurity assessment.
1. Microsoft 365 Identity and Account Security
For many businesses, Microsoft 365 is one of the most important parts of the entire technology environment.
It may control access to:
- Business email
- OneDrive
- SharePoint
- Microsoft Teams
- Cloud applications
- Administrative accounts
- Customer and company information
During an assessment, we review whether user identities are being protected appropriately and whether access is configured around actual business needs.
That can include reviewing:
- Multi-factor authentication
- Administrative privileges
- Inactive or former employee accounts
- Suspicious sign-in activity
- Legacy authentication
- External sharing
- Application permissions
- User onboarding and offboarding
A business can have good endpoint security and still be exposed if a compromised Microsoft 365 identity gives an attacker access to email or cloud data.
Learn more about Microsoft 365 Security & Business Email →
2. Business Email and Phishing Protection
Email remains one of the most common ways attackers reach employees.
We look at whether the organization has appropriate controls in place to reduce phishing, impersonation, credential theft, and business email compromise risk.
That may include reviewing:
- Email filtering
- Phishing protection
- Executive impersonation controls
- Mailbox forwarding rules
- Email authentication
- User-reported phishing processes
- Suspicious mailbox activity
We also look at whether employees know how to recognize and report suspicious messages.
Security awareness is especially important because even strong technical controls cannot guarantee that every malicious message will be blocked.
Learn more about Business Email Security & Phishing Protection →
3. Endpoint Security, Patching, and Device Management
Laptops and desktops are common entry points for malware, ransomware, credential theft, and unauthorized access.
During an assessment, we want to understand not only whether antivirus is installed, but whether devices are consistently monitored, updated, and managed.
We may review:
- Operating system patching
- Third-party software updates
- Endpoint detection and response
- Local administrator access
- Device encryption
- Unsupported systems
- Remote access tools
- Device inventory
- Security configuration consistency
One common problem is that businesses have security software installed but do not have a reliable way to confirm whether every device is protected, patched, and reporting correctly.
Learn more about Endpoint Security, EDR & MDR →
4. Network and Firewall Security
A cybersecurity assessment should also look at how devices and systems communicate with each other.
Network security can affect how easily an attacker moves from one compromised device to another.
We may review areas such as:
- Firewall configuration
- Remote access
- VPN configuration
- Guest networks
- Network segmentation
- Exposed services
- Wireless security
- Administrative access
The goal is to reduce unnecessary exposure while making sure legitimate users can still access what they need.
Learn more about Network Security & Firewall Services →
5. Backups and Data Recovery
A backup is only valuable if the business can actually restore from it.
During an assessment, we look at what data is being protected, where backups are stored, who can access them, and whether recovery has been tested.
Questions we may ask include:
- What systems and files are being backed up?
- How often do backups run?
- Are backups separated from normal user access?
- Are Microsoft 365 or cloud applications backed up separately?
- How quickly could the business recover after data loss?
- Has a restore actually been tested?
Ransomware, accidental deletion, hardware failure, compromised accounts, and employee mistakes can all create recovery situations.
Understanding the recovery process before an incident happens is much better than discovering backup gaps during an emergency.
Learn more about Data Security & Data Protection →
6. Cloud and SaaS Application Security
Businesses often use more cloud applications than they realize.
Accounting platforms, file-sharing services, CRM systems, HR tools, project-management applications, and AI tools may all have access to business information.
During an assessment, we may review:
- Who has access to cloud applications
- Whether former employees still have accounts
- Whether MFA is enabled
- Third-party integrations
- Administrative permissions
- External sharing
- Suspicious cloud activity
The more cloud applications a business uses, the more important identity and access management becomes.
Learn more about SaaS & Cloud Application Security →
7. Security Monitoring and Alert Response
One of the biggest questions we ask is simple:
If something suspicious happened right now, who would see it?
Many businesses have security tools installed but nobody consistently reviewing what those tools are reporting.
We look at whether the organization has visibility into:
- Suspicious logins
- Endpoint alerts
- Malware detections
- Cloud activity
- User behavior
- Potential ransomware activity
- Security incidents
Good security monitoring is not about reacting to every alert. It is about having a process to identify which activity actually requires investigation.
Learn more about 24/7 SOC & Threat Monitoring →
8. User Access and Offboarding
People change roles. Employees leave. Vendors lose access. Contractors finish projects.
Access should change with them.
During an assessment, we look for accounts or permissions that no longer match the user's actual responsibilities.
Examples can include:
- Former employee accounts
- Shared administrator accounts
- Users with unnecessary permissions
- Old vendor access
- Unused cloud accounts
- Unnecessary mailbox access
Removing unnecessary access reduces the number of accounts an attacker can potentially abuse.
9. Vulnerabilities and Security Testing
Security assessments may also identify systems that need more technical testing.
That can include vulnerability assessments or penetration testing depending on the environment, risk, and business requirements.
A vulnerability assessment typically helps identify known weaknesses or exposed systems.
Penetration testing goes further by attempting to validate whether certain weaknesses can actually be exploited under an agreed testing scope.
Not every business needs the same level of testing, which is why the right approach depends on the organization's technology, risk profile, and compliance requirements.
Learn more about Penetration Testing & Vulnerability Assessments →
10. AI Use and AI Security
AI is becoming part of everyday business operations.
Employees may use ChatGPT, Microsoft Copilot, Gemini, Claude, or other AI tools to write content, analyze information, automate workflows, or support customer service.
During a modern cybersecurity assessment, businesses should also understand how AI is being used.
Questions may include:
- What AI tools are employees using?
- Are employees entering sensitive information into public AI systems?
- Which AI applications have access to business systems?
- Who approves new AI tools?
- What permissions do AI agents have?
- Are automated actions being monitored?
AI can create real business value, but access and data handling still need to be managed appropriately.
Learn more about AI Security & Secure AI Adoption →
What Happens After a Cybersecurity Assessment?
A good assessment should not leave a business with a long list of findings and no idea where to start.
The next step is prioritization.
We typically think about findings based on factors such as:
- How likely is the issue to be exploited?
- What business systems or information could be affected?
- How difficult is the issue to correct?
- Is there an immediate security concern?
- Does the issue affect compliance requirements?
- Can the risk be reduced quickly?
Some findings may require immediate action. Others may become part of a longer-term cybersecurity roadmap.
The goal is to give the business a practical path forward rather than trying to fix everything at once.
How Often Should a Business Get a Cybersecurity Assessment?
There is no single schedule that fits every organization.
The appropriate frequency depends on the size of the business, the sensitivity of its information, compliance requirements, technology changes, growth, and overall risk.
Businesses should also consider another assessment after:
- A significant cybersecurity incident
- A major Microsoft 365 or cloud migration
- An acquisition or merger
- Rapid employee growth
- Major infrastructure changes
- New compliance requirements
How Much Does a Cybersecurity Assessment Cost?
Cybersecurity assessment pricing depends on the size and complexity of the environment, number of users and devices, assessment scope, cloud applications, locations, and whether technical testing is included.
A small business with a straightforward Microsoft 365 and endpoint environment may require a very different assessment than an organization with multiple offices, servers, cloud platforms, or compliance requirements.
The best way to determine scope is to first understand the environment and what the organization wants the assessment to accomplish.
Cybersecurity Assessments for San Antonio Businesses
Orobi Cybersecurity Solutions is a San Antonio-based, veteran-owned cybersecurity and technology company helping businesses identify security gaps and improve the technology they rely on every day.
Our cybersecurity assessments can evaluate areas such as Microsoft 365, business email, endpoints, cloud applications, networks, user access, security monitoring, backups, vulnerabilities, and other areas based on the organization's needs.
Orobi can also work alongside an existing IT department or managed service provider when an organization wants an independent cybersecurity review.
Learn more about Cybersecurity Risk Assessments →
Frequently Asked Questions
What is included in a cybersecurity assessment?
A cybersecurity assessment can review areas such as Microsoft 365, email security, endpoints, networks, cloud applications, backups, security monitoring, user access, vulnerabilities, policies, and other controls depending on the scope of the engagement.
Is a cybersecurity assessment the same as a penetration test?
No. A cybersecurity assessment is typically broader and evaluates security controls, configuration, processes, and risk across the environment. A penetration test is a more focused technical exercise designed to validate whether specific weaknesses can be exploited under an agreed scope.
Does a small business need a cybersecurity assessment?
Small businesses can benefit from assessments because they often rely heavily on email, cloud services, laptops, and third-party applications without having a dedicated internal security team.
Can Orobi assess Microsoft 365 security?
Yes. Microsoft 365 security can be part of an assessment, including identity protection, MFA, administrative access, mailbox security, external sharing, application permissions, and suspicious sign-in activity.
Can Orobi work with our existing IT company?
Yes. Orobi can work alongside an internal IT team or existing MSP to provide cybersecurity assessments, monitoring, penetration testing, Microsoft 365 security, compliance support, and other specialized cybersecurity services.
What should a business do after a cybersecurity assessment?
The findings should be prioritized based on business impact, likelihood, urgency, cost, and complexity. High-risk issues should generally be addressed first, while lower-priority improvements can become part of a longer-term cybersecurity roadmap.
Want to Understand Your Current Cybersecurity Risk?
You do not have to replace your entire technology environment to improve security.
Start by understanding where the biggest gaps exist and prioritize the changes that matter most.