Free IT health check
How exposed is your business IT?
11 plain-English questions about how your business handles logins, devices, email, backups and staff. It takes a few minutes, no technical knowledge is needed, and your results appear on screen before I ask for anything.
11 questions · A few minutes · No email needed
What it covers
The same five areas as The Standard, the baseline I run for managed clients.
- Identity
- Who can sign in, and how easily a stolen password gets someone in.
- Devices
- Whether laptops are updated, protected and recoverable if lost.
- Whether your domain can be spoofed, and who holds admin access to your email platform.
- Documentation & continuity
- Whether you can get data and access back when something goes wrong.
- People
- The habits that stop a convincing email becoming a loss.
How the score works
Each answer earns credit, weighted by how much that protection matters. Multi-factor sign-in and backups carry the most weight. If you enter your domain, its email authentication is checked from the outside and counted too.
‘Not sure’ earns a little credit and becomes something to find out. A few answers cap the score. With no multi-factor sign-in it can’t go above 59, so a strong area can’t hide a critical gap.
What it isn’t
It isn’t an audit, and nothing logs in to your systems. There are no benchmarks or “better than most businesses” claims, because there’s no data to support them. Run by Ewan, a Brisbane IT consultant.
Common questions
- Is this a proper IT risk assessment?
- No. It's a self-assessment built on your answers and a public check of your domain. A proper risk assessment has someone look inside your systems, confirm the settings and talk to the people involved. This check tells you where to look first.
- Does it check my Microsoft 365 security?
- Not directly. Nothing logs in to Microsoft 365 or Google Workspace. The questions cover the settings that matter most, such as multi-factor sign-in and who holds admin access, and the domain check reads your email authentication records from the outside. The paid Security Deep-Dive Audit is the version that looks inside.
- Do I need to give my email address?
- No. Your score and priorities appear on screen first. You can choose to have the full breakdown emailed to you afterwards.
- What happens to my answers?
- They stay in your browser tab unless you ask for the breakdown. If you do, they go to my support system so I can email your report and, if you ask, get in touch. They're never sent to analytics and never sold.
- What if I'm not sure about some answers?
- Choose 'Not sure'. It costs some points, but it's listed as something to find out rather than a failure. If too much is unconfirmed, the result says so instead of guessing.
More free tools
- Email Spoofing Test →Can scammers send email as your business?
- Cyber Insurance Readiness Check →Would you pass your insurer's questionnaire?
- AI Search Readiness Test →Can ChatGPT find your business?
- Full Security Health Check →How exposed is your domain overall?
All tools are genuinely free. No signup, no spam. See the full list → · Found something to fix? See all fixed prices →