When a Security Exposure Review helps
Many avoidable security incidents start with everyday gaps: a mailbox rule nobody noticed, MFA that does not cover every account, an old admin login, untested backups, exposed remote access, unmanaged devices, or supplier access that was never cleaned up.
The review is designed to give you clear, practical security priorities before you choose a focused uplift, provider conversation, remediation project, or managed support path.
Email or payment concern
You rely on email for invoices, payment approvals, supplier requests or customer communication and want to reduce compromise risk.
MFA or admin uncertainty
You think MFA is in place, but you are not sure whether all users, admins, shared accounts and recovery paths are properly covered.
Recovery is assumed
Backups exist somewhere, but restore evidence, scope, ownership, retention or ransomware recovery confidence is unclear.
Quick fit check
Not sure if you are exposed?
If two or more of these are true, the IT Security Exposure Review is likely a useful first step. The scoping call confirms whether the review is the right fit before any paid review work begins.
What you get
Typical review areas
Final review areas are confirmed during scoping before work begins. The review is deliberately fixed-scope so it stays focused, practical and achievable.
| Area | What we are trying to understand |
|---|---|
| Email security | MFA coverage, mailbox forwarding/rules, admin roles, email authentication, suspicious access indicators and practical payment-fraud exposure. |
| Identity and access | Admin accounts, shared accounts, old users, recovery options, joiner/leaver process and privilege exposure. |
| Microsoft 365 / Google Workspace hygiene | Whether core tenant settings, admin access, sharing, audit visibility and security posture are sensible for the business. |
| Devices and endpoint posture | Patch posture, endpoint protection, local admin, encryption, device ownership and unmanaged device exposure. |
| Backups and recovery readiness | Whether recovery is assumed or evidenced, and whether critical data and systems have practical restore confidence. |
| Remote and supplier access | RDP, VPN, remote support tools, vendor access, provider access and exposed access paths. |
| Network and Wi-Fi basics | Router/firewall, Wi-Fi, guest access, DNS/filtering and basic segmentation where relevant to the selected scope. |
Typical engagement shape
Scoping call
We clarify what prompted the concern, which systems matter most, whether anything is urgent, and whether the review is a good fit.
Confirm scope and access
We agree the review areas, evidence method, contacts, timeline and expected deliverables before work begins.
Review and close-out
We run the agreed review, validate key facts, summarise exposure, and provide the prioritised action plan.
Most reviews are scheduled as a short fixed-scope engagement once access, contacts and review areas are confirmed. Exact timing depends on scope and is confirmed before work begins.
Best fit
- NZ businesses that rely heavily on email, Microsoft 365, Google Workspace, remote access or external providers
- Teams concerned about compromised email, stolen credentials, invoice fraud, MFA gaps or supplier access
- Businesses that want to understand practical exposure before choosing remediation, managed services or provider actions
- Organisations that need security priorities without jumping straight into a large cyber programme
Common security issues this review looks for
- Mailbox forwarding, inbox rules or delegated access that nobody is actively monitoring
- Admin accounts, shared accounts or old users with more access than required
- MFA coverage that is incomplete or has risky exclusions
- Backups that exist but have no recent restore evidence
- Remote access or supplier access paths with unclear ownership or weak controls
- Devices with inconsistent patching, local admin, endpoint protection or encryption posture
How we keep the review useful
The review works best when the right people are available, basic environment information can be shared, and read-only access, guided screenshare or evidence exports can be arranged for the agreed review areas.
The review is designed to create clarity before remediation. It is not a formal audit, penetration test, forensic investigation, incident response engagement or guarantee that the environment cannot be compromised.
If follow-up remediation, provider coordination, security uplift or managed support is needed, we scope that separately so expectations, cost, timing and responsibility are clear.
If something may already be wrong
If you believe an account is actively compromised, a payment has been redirected, systems are unavailable, or ransomware is suspected, this may need urgent incident triage rather than a standard review.
Please state this clearly when booking or emailing so the situation can be handled appropriately.
What happens after the review
Depending on the findings, the next step may be a quick security uplift, provider action list, identity and MFA cleanup, backup/restore validation, remote-access hardening, endpoint improvement, or managed security support discussion.
Book a free 30-minute Security Exposure Review scoping call
Use the scoping call to tell us what prompted the concern, what systems you use, and what outcome you need. If the review is a good fit, we will confirm the proposed scope, timing and next step for approval.
Phone: 0800 847 887 · Website: virtusgroup.co.nz