IT Security Assessment: What It Reveals and How It Works

Our CISO Nikola Đinić explains what matters when it comes to scope, assessment areas and deriving concrete measures.

For me, an IT security assessment only delivers value once it is clear which security gaps have priority and need to be closed first. The report itself is only an interim result. What matters is what follows from the findings.

The current threat landscape shows why this is becoming increasingly important: According to the AI Security Study 2026 by the TÜV Association and the German Federal Office for Information Security (BSI), one in six companies (17 %) reports AI-powered cyber attacks or fraud attempts. 40 % of those affected cite automated attack scripts that attempted to break into IT systems on their own. This increases the pressure to consistently remediate known vulnerabilities. The study therefore recommends reducing attack surfaces, prioritising vulnerabilities and security updates, securing access and preparing recovery procedures.

This is exactly where a cyber security assessment has to start: not only identifying risks, but deriving clear priorities and concrete measures from them. As CISO of CONVOTIS, I therefore evaluate assessments primarily by what is actually implemented afterwards. In this article, I explain what an assessment delivers, how it works and how to recognise suitable offers.

What an IT security assessment delivers

An IT security assessment evaluates a company’s entire IT: infrastructure, resilience, IT organisation and security controls. It combines technical vulnerability scanning with documentation of the infrastructure and interviews with the people responsible. The result is threefold: a vulnerability report, up-to-date documentation of the IT infrastructure and a management report with prioritised findings and recommendations.

For budget holders, the third point is what counts. The security assessment report shows which risks are critical, which gaps should be closed first and where investments in cyber security have the greatest impact.

Vulnerability assessment vs penetration testing vs security assessment

An IT security assessment comprises different testing methods that answer different questions. A vulnerability scan identifies potential security gaps, a penetration test examines whether they can actually be exploited. A comprehensive assessment goes further and also evaluates organisational processes, responsibilities and the resilience of the IT.

These differences are decisive when choosing a provider, because the three services differ significantly in scope, methodology and results.

The methods pursue different objectives and can complement each other effectively. Vulnerability scanning provides indications of potential security gaps, including false positives or vulnerabilities with little actual risk. A penetration test specifically checks whether such gaps can be exploited under realistic conditions.

An IT security assessment additionally considers organisational and structural risks. These include, for example, missing documentation, incomplete asset management, unclear responsibilities or gaps in emergency planning. Which aspects are examined in detail depends on the scope of the assessment. A cyber security assessment from CONVOTIS covers four key areas.

The four assessment areas

A 360° assessment evaluates the IT against defined controls (security measures) in four areas:

• IT infrastructure: condition, scalability and future readiness of the infrastructure.
• IT continuity and resilience: how well operations continue during disruptions.
• IT organisation: IT procedures and the structure of the IT organisation, such as central device management, asset management, software distribution and internal IT audits.
• IT security: effectiveness of existing security controls.

The process: from inventory to management report

01 · Scope and preparation

This is where the quality of the entire assessment is decided. We record locations and the number of employees per location, servers and storage, cloud services in productive use and the number of remote employees. This is complemented by a network diagram or a list of all devices with IP address and location.

02 · On-site interviews

Over one to two days on site, we talk to the people responsible: technical management, the information security officer, external cloud managers if required and, at times, executive management. The interviews show how processes are actually lived, not just how they are documented. For me, the interviews are the most revealing part. This is where it becomes clear whether documented processes actually work in day-to-day operations.

03 · Technical assessment

For vulnerability scanning, a test device is connected to the network. Using local administrator access to Active Directory, the domain controller and the VM host, the team examines the infrastructure. The technical evaluation is carried out remotely over a period of up to two weeks.

04 · Evaluate and prioritise

Each control is evaluated against two criteria: How far has it been implemented, and how relevant is it to the company? This results in a health score for each area. Each control is rated as critical, moderate or good. Missing asset management weighs more heavily with ten locations than with a single office.

05 · Management presentation

The management report summarises the health score, findings and recommendations and prioritises critical and urgent risks. On average, four weeks pass between evaluation and presentation.

How to choose a cyber security assessment provider

An IT security assessment should not stop at technical vulnerabilities. What matters is whether the provider also considers the IT organisation, existing processes and resilience. Before commissioning an assessment, I therefore check which areas are actually examined, how the evaluation is carried out and whether the results include concrete recommendations for action.

Equally important is a management report that puts technical findings into understandable context, prioritises risks and provides a reliable basis for investment decisions.

What determines the effort of an IT security assessment

The effort depends primarily on the size and complexity of the IT landscape. Relevant factors are the number of locations, servers and endpoints, the cloud services in use and the scope of the technical assessment and interviews.

A clearly defined scope is therefore the basis for a comparable offer. It specifies which systems and locations are included, how in-depth the assessment is and which results the provider must deliver.

Sovereignty: where findings and raw data are stored

An assessment report documents a company’s access paths, vulnerabilities and network structures. This makes it one of the most sensitive documents in the company. Every offer should therefore state where raw data, testing tools and reports are stored and which jurisdiction the provider is subject to.

At CONVOTIS, assessments are carried out by teams based in Europe, and results remain on European infrastructure under the control of the . Assessments are part of our Security Consulting and range from one-off tests to ongoing support. For companies subject to NIS2 or DORA, an assessment is one building block in demonstrating the effectiveness of the security measures both regulations require.

What needs to be in place internally before the start

The quality of an assessment also depends on preparation within your own company. Before the start, I clarify four points internally: an up-to-date network diagram or device list with IP addresses and locations, named contacts for the interviews, the necessary administrator access for the technical assessment and a date for the on-site days.

However, the assessment is not complete once the management report has been presented. The identified risks must be evaluated, prioritised and incorporated into existing risk management processes. Critical vulnerabilities require clear responsibilities, concrete measures and binding deadlines.

The health score per assessment area gives management additional orientation. If assessments are carried out regularly using a comparable methodology, it becomes possible to track where the security posture has improved and where action is still needed.

For me, what happens after the assessment therefore remains decisive: whether critical vulnerabilities are actually remediated and the effectiveness of the measures is verified. Only then does the real value become apparent.