Optimyze offers a free IT security assessment to NZ businesses. Here's exactly what we review, the most common gaps we find, and what the typical outcome looks like for a 20–50 person NZ business.
An IT security assessment from a managed service provider should answer one question: what would an attacker find if they targeted our business, and what would stop them? Optimyze's free assessment covers the areas where that question matters most for NZ small businesses — the controls most likely to be missing and most likely to be exploited.
What We Review
Microsoft 365 configuration: We review your tenant's Secure Score and the specific configuration gaps behind it — MFA deployment, Conditional Access policies, email authentication records, sharing settings, audit logging, and legacy authentication status. This review typically takes 30–45 minutes and reveals the most impactful configuration gaps in the environment.
Endpoint security: We assess what endpoint protection is deployed on business computers, whether it covers all devices, whether updates are current, and whether the solution provides behavioural detection or only signature scanning. We check Intune enrollment status if the business uses Microsoft 365.
Patch status: We assess the OS versions running on business computers and servers, and check the patch status of common applications — Office, browsers, Adobe, Java. We identify any end-of-life systems and their associated risk.
Backup: We review what backup solutions are in place, whether they cover all critical data, whether backups are stored offline or in an immutable format, and when the backup was last tested by restoration.
External exposure: We run a basic external scan of the business's internet-facing assets to identify internet-exposed services (RDP, admin portals, old websites) and visible vulnerabilities.
What We Typically Find
Across assessments of 20–50 person NZ businesses, the most common findings are: MFA not enforced on all users (found in approximately 60% of assessments), DMARC missing or set to p=none (found in approximately 75% of assessments), backup either not tested or not immutable (approximately 50%), at least one end-of-life endpoint or server (approximately 40%), and RDP or other management interfaces exposed to the internet (approximately 25%).
It's uncommon to assess a NZ small business and find all five of these areas addressed correctly. It's common to find three or more with significant gaps.
What Comes After the Assessment
The assessment output is a prioritised report: current state for each area reviewed, specific gap findings with severity ratings, and recommended remediation steps in priority order. The report is written in plain language — it's designed to be read by a business owner, not just an IT specialist.
Businesses that proceed to a managed IT engagement with Optimyze receive remediation of all identified gaps as part of onboarding. Businesses that don't proceed receive the report and recommendations — the assessment has value regardless of the engagement outcome.
The question we're answering in an assessment is: if an attacker researched your business today, what would they try first, and would it work? For most NZ SMBs, the answer is more sobering than expected. That's why the assessment exists.
