Skip to content
SCG Solutions

Cybersecurity Risk Calculator

A free 20-question cyber risk self-assessment for UK businesses. Review access, devices, backups and working practices to identify the controls you need to check.

Contact details are required to view your score. Sending your results to SCG Solutions is a separate action you choose after seeing them.

  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6

1. Access and User Security

Is MFA required for all users? *

Employees should provide a second form of authentication, like a code sent to their phone, when accessing Cloud services such as Microsoft 365. Without MFA, accounts are at higher risk of being compromised.

Are employee accounts regularly reviewed to remove unnecessary privileges and leavers? *

Employees should only have the access they need, and accounts for those who have left the company must be removed. Keeping outdated or excessive permissions increases security risks.

Are there separate Administrator and Standard User accounts? *

Employees with administrative privileges should have a dedicated admin account instead of using their everyday login. Using a separate account for admin tasks reduces the risk of privilege misuse and credential theft.

Is there monitoring and alerting in place to detect potential threats? *

The organisation should have security measures in place to identify logins from unusual locations or anonymous VPN's and take action, such as alerting admins or disabling the account. Without this attackers could access systems unnoticed and escalate an attack.

Are emails scanned for malicious links and attachments? *

Emails should be automatically scanned for malicious content like phishing links, malware, or spam without purely relying on the email vendor security (such as 365 only). Without email security measures, employees are more vulnerable to cyber threats.

Cyber Risk Level

Complete Assessment

Answer all questions to see your risk level

Understanding your cyber risk score

This questionnaire helps an owner, office manager or IT lead prepare a practical security conversation. It checks what you know about your controls; it does not connect to your systems, scan devices or test whether an attacker could get in.

What the questionnaire covers

  • Access and identity: multifactor authentication, leavers, administrator accounts, monitoring and email protection.
  • Devices and networks: updates, firewall reviews, guest Wi-Fi separation, asset records and endpoint protection.
  • Data and recovery: offsite backups, restore tests and a documented recovery plan.
  • People and governance: training, phishing exercises, policies, risk reviews and insurance conditions.

How the score works

The 20 weighted questions total 81 points. A “yes” earns the question’s points; “no” and “don’t know” earn none. The displayed percentage is the missing share of those points, rounded to a whole number: lower means fewer gaps reported. For example, 40 points out of 81 produces a 51% control-gap score.

That percentage is not the probability of a cyber attack or a prediction of financial loss. Even a low score depends on accurate answers and does not prove that a control works. This is not an audit, penetration test or Cyber Essentials certification assessment.

Prepare useful answers and next steps

Check with whoever manages your Microsoft 365 accounts, devices and backups. If you cannot verify a control, choose “don’t know” and ask for evidence rather than guessing. After the questionnaire, complete the required business-contact fields and permission checkbox to view your score. The separate send-results button requests a follow-up from SCG Solutions; viewing the result does not send it.

Turn uncertain answers into a list of owners, checks and target dates. Priorities may include account protection, supported-device updates, managed EDR, tested recovery and Cyber Essentials readiness. The right order depends on your systems and current gaps, not just the overall band.

Cyber risk calculator questions

Is this cyber risk calculator free?

There is no charge to use the questionnaire. Required contact details and the permission checkbox must be completed to view the result. Sending your result and requesting a follow-up is a separate explicit action; you do not need to purchase a service to use the calculator.

Is the score a probability of a cyber attack?

No. It is not an attack probability or a financial-loss estimate. The percentage is the weighted share of questionnaire controls you did not confirm. A low score is not proof that your systems are secure, and a high score is not evidence that an incident has occurred.

Does the calculator provide Cyber Essentials certification?

No. It can prompt a discussion about controls and readiness, but it is not a Cyber Essentials assessment, certification or technical test. Certification requires the relevant assessment through an IASME-licensed Certification Body. Your scope and evidence need to be checked separately.

What should we do if we do not know an answer?

Select “don’t know” and ask your IT owner or supplier to verify the control. Record the evidence, who is responsible and when it was last checked. A documented restore test or account review is more useful than assuming a product licence means the control is configured and working.

What do you need?

It's easy to talk to us

0330 175 7670