Probability versus severity, written down and owned
We assess the risks to your infrastructure, network and applications, rank them in plain terms and help you decide what to treat, what to transfer and what to accept.
Overview
What a risk assessment gives you
Every security decision is a bet on two things: how likely something is to happen, and how bad it would be if it did. A risk assessment makes that bet explicit, so the budget goes to the risks that matter instead of the ones that are loudest.
We identify what you need to protect, what threatens it and which weaknesses make the threat real. Each risk gets a probability, a severity, an owner and a decision. The method follows established guidance such as ISO/IEC 27005 and NIST SP 800-30, scaled to your size.
The result is a risk register that your people can maintain, not a heat map that fades on a slide. It also feeds the obligations that ask for a risk-based approach, such as ISO/IEC 27001, NIS2 and DORA.
Who it is for
Organisations that need a documented risk assessment for ISO/IEC 27001, NIS2, DORA, a client or an insurer, and teams that have to decide where the next security budget goes. Also useful before a major change: a migration, a new product or a new supplier.
The work, from scoping to evidence.
What we do
Asset and context mapping
The systems, data, processes and suppliers that matter, who owns them and what the business needs from them.
Infrastructure and network
Risks in your network design, servers, endpoints, cloud services and remote access, assessed from architecture and configuration.
Application risk
Risks in the applications you build or rely on: authentication, data handling, integrations and the way they are deployed.
Threats and vulnerabilities
Realistic threat scenarios matched against the weaknesses we find, including results from tests you already have.
Risk register
Each risk with its probability, severity, owner, existing controls and residual rating, in a format you can keep up to date.
Treatment options
For each risk, a recommendation to reduce, avoid, transfer or accept it, with the controls and effort involved.
How the engagement runs
Kickoff
We agree the scope, the risk criteria and the people involved, and sign an NDA first if you need one.
Proposal
A business proposal with the method, the scope and the contract type that suits you.
Discovery
Workshops with owners, document and architecture review, and technical checks where the scope calls for them.
Analysis
Risks scored for probability and severity, compared with your risk criteria and ranked.
Results handover
The register, a business report for management and a technical report for the teams who treat the risks.
Closing
Project close with feedback, and optional consultation as you work through the treatment plan.
What you receive
- Risk assessment method and risk acceptance criteria
- Asset inventory for the assessed scope
- Risk register with owners and ratings
- Risk treatment plan with recommended controls
- Business report for management
- Technical report for the teams doing the work
Questions
Is a risk assessment the same as a penetration test?
No. A penetration test shows how specific weaknesses can be exploited. A risk assessment looks across the whole scope and asks which risks matter most. Test results are good input to a risk assessment, and a risk assessment tells you where testing is worth it.
Which method do you use?
One that fits your size and any standard you report against, typically following ISO/IEC 27005 or NIST SP 800-30. If you already have a method, we work with it.
Can we accept a risk instead of fixing it?
Yes, if it falls within your acceptance criteria and the owner signs off. Accepting a risk is a legitimate decision. Forgetting about it is not.
How often should it be repeated?
At planned intervals and whenever something significant changes. ISO/IEC 27001, for example, expects both. We can help you set a cadence that matches your rate of change.
Related services
- Compliance and certificationISO/IEC 27001ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.
- Governance and riskInformation security auditIndependent information security audits from Black Fox Security against ISO/IEC 27001, 27002, GDPR, PCI DSS, your own policies or a client's questionnaire.
- Offensive securityPenetration TestingPenetration testing by Black Fox Security: black, grey and white box tests against an agreed scope, business and technical reports, and a retest of your fixes.
- Governance and riskThird-party risk managementSupplier risk management from Black Fox Security: inventory, tiering, questionnaires, evidence review and contract clauses, aligned with NIS2 and DORA expectations.
Put your risks on one page
Tell us what you run and what keeps you up. We will help you weigh it.