Most organizations believe they would know if their security program had a serious gap. In practice, many of the most damaging weaknesses come to light only after an incident exposes them, when remediation is more expensive and the reputational damage has already happened.
In a recent Myna Partners’ webinar, Corey Gant, a Director in Myna’s Cybersecurity and Compliance practice with a background in IT internal audit, explained why these gaps stay hidden. He also walked through how a formal cybersecurity assessment brings them to the surface and what organizations should do once the results are in.
How do organizations find security vulnerabilities?
Organizations find security vulnerabilities through five main activities, and most programs rely on some combination of them:
- Vulnerability scans and penetration tests. Scans generally look at the environment from the inside, while penetration tests mostly look from the outside in.
- Continuous monitoring. This covers everything from network and endpoint data to operating system and application logs and identity activity such as failed logins.
- Internal or external audits. These can cover the entire program, a single process, or one specific system.
- Risk assessments. Enterprise or function-level risk assessments identify threats to the organization’s objectives, and many of those threats come from cybersecurity vulnerabilities.
- Cybersecurity assessments. A good assessment evaluates how well each of the other four activities is working.
That last point is the reason assessments matter so much. They are the only activity on the list that looks across all the others and asks whether the program as a whole is doing its job.
Testing pays off as well. IBM’s Cost of a Data Breach Report 2026, conducted by Ponemon Institute, found that offensive security testing such as penetration testing, vulnerability testing, and red teaming lowered average breach costs by $211,339.
Why do cybersecurity weaknesses stay hidden?
Cybersecurity weaknesses usually stay hidden for one of two reasons, which Corey described as coverage gaps and frequency gaps. Either key security activities aren’t happening at all, or they aren’t happening often enough to keep up with change.
The first is a coverage gap. Some organizations simply don’t perform one or more of the activities above. They may have no internal audit function, never run vulnerability scans or penetration tests, or have never completed a formal risk assessment.The second is a frequency gap. The activities happen, but not often enough to keep up with how quickly the environment changes. Vulnerability scans may run too rarely to catch new weaknesses, and risk assessments may be completed so infrequently that the results are out of date before anyone acts on them. Threats can shift overnight, and organizations deploy and retire systems faster than ever. Controls that worked last year can become outdated, asset inventories fall behind, and responsibilities move as people are promoted or teams reorganize. Patching delays leave known vulnerabilities open, and regulations are updated more often than many compliance calendars account for. Dave Cohen added that the rapid adoption of AI is accelerating how quickly attackers can find and exploit these weaknesses.
Corey also warned about a common assumption. An organization that received a good assessment result a year ago may believe it is still in good shape, even though its systems, people, and threats have all changed since then.
Those blind spots are expensive. According to IBM, the average breach in 2026 took 247 days to identify and contain. Breaches that lasted longer than 200 days cost an average of $5.65 million, compared with $4.32 million for those resolved faster.
Why do organizations need a cybersecurity assessment?
Regulation is the most obvious driver, with requirements under HIPAA, NYDFS, and now the CCPA. Customers and business partners increasingly expect proof of security through SOC 2 reports or ISO 27001 certification. Operational needs such as business continuity, financial reporting controls under SOX or J-SOX, reputational risk from breaches and ransomware, and growing third-party and supply chain exposure all add pressure. Cyber insurers are also more active than they were a decade ago, and some will assess a company after a claim to confirm it matches what it attested to when the policy was written.
Supply chain risk deserves particular attention. In IBM’s 2026 research, breaches in which a compromised business partner became the attack vector were the single largest factor increasing breach costs, adding an average of $227,250.
What happens during a cybersecurity assessment?
A cybersecurity assessment typically moves through four phases over eight to twelve weeks. Myna follows the same sequence whatever framework is in scope.
- Planning. Myna plans internally, then works with the client on timeline, resources, and stakeholder contacts. The phase ends with a formal kickoff that brings every key stakeholder together.
- Discovery. The team requests and reviews evidence such as policies and procedures, then holds discovery sessions with subject matter experts to understand the current state of the program.
- Assessment. Myna compares that current state against the requirements of the chosen best-practice or regulatory framework to identify gaps. All of the work is documented in a detailed assessment matrix that records who was interviewed, what evidence was reviewed, each gap, and the recommended remediation.
- Reporting. A summary report written for senior management, the C-suite, and the board covers the methodology, inputs, maturity scores, and high-level findings and recommendations. The detailed guidance for closing each gap lives in the assessment matrix.
For NIST CSF assessments, the report shows maturity tiers for each of the framework’s six functions (Govern, Identify, Protect, Detect, Respond, and Recover) and its 22 categories. When a client has been assessed before, the report also compares the current results with prior years so leadership can see where the program has improved or slipped.
The simplest assessments can finish in about six weeks, but most organizations should plan for eight to twelve. Client involvement is heaviest during discovery, and much of the remaining time is analysis the assessment team completes on its own.
What should you do after a cybersecurity assessment?
After a cybersecurity assessment, the first step is to move every finding into a cybersecurity or enterprise risk register. Corey recommends working through each one in this order.
- Assign an owner to the risk.
- Rate the likelihood that it will occur and the impact if it does. Multiplying the two gives you the inherent risk.
- Compare that inherent risk with your organization’s defined risk tolerance.
- If it falls outside tolerance, choose a treatment. You can remediate the risk, avoid it by exiting the activity, accept it as a cost of doing business, or transfer it through a mechanism such as insurance.
- Prioritize treatments across the whole register, since a mature organization may be managing hundreds or thousands of risks from many sources and limited budget has to go to the riskiest items first.
- Recalculate the residual risk after treatment. If it is still above tolerance, return to step four.
How often should you do a cybersecurity assessment?
Organizations should reassess on a regular cadence set by their compliance obligations and the number of findings from their last assessment. One assessment gives you a baseline, and regular reassessment shows whether the program is maturing. Year-over-year results also give security and compliance leaders a clear story of progress to share with leadership and the board.
The financial case is strong. According to IBM’s Cost of a Data Breach Report 2026, the average breach in the United States now costs $11.5 million, more than double the global average of $4.99 million. That is far more than most organizations will ever spend identifying and fixing gaps ahead of time.
Watch the full webinar
Before the Breach: What a Cybersecurity Assessment Reveals About Your Security Program is available on demand. Watch the recording to see sample assessment reports and hear the panel’s full discussion of legal considerations, CCPA requirements, and post-assessment priorities.
Ready to find out where your program stands? Talk to Myna Partners about a cybersecurity assessment or readiness review.
Frequently asked questions about cybersecurity assessments
What is a cybersecurity assessment?
A cybersecurity assessment is a structured review of an organization’s security program against a framework such as NIST CSF 2.0, ISO 27001, or a regulatory standard. It evaluates how well activities like vulnerability scanning, monitoring, audits, and risk assessments are working, then identifies gaps and recommends fixes.
How long does a cybersecurity assessment take?
Most cybersecurity assessments take eight to twelve weeks. Simpler engagements can finish in about six weeks, depending on the organization’s size and how quickly subject matter experts are available.
What is the difference between a cybersecurity assessment and a penetration test?
A penetration test simulates an attack, mostly from the outside in, to find exploitable weaknesses in specific systems. A cybersecurity assessment is broader and evaluates the whole program, including how often and how well penetration testing is performed.
What does a cybersecurity assessment report include?
A summary report for leadership typically covers the methodology, maturity scores by framework function and category, comparisons with prior years, and high level findings and recommendations. A detailed assessment matrix backs it up with the evidence reviewed and step by step remediation guidance.
What is a cybersecurity risk register?
A risk register is a tool that lists each identified risk with its owner, likelihood, impact, inherent and residual risk, and chosen treatment. Organizations use it to prioritize remediation and track each risk until it falls within their risk tolerance.
Related reading: CCPA Cybersecurity Audits Start in 2027. Is Your Assessment Ready for a Regulator to Read?
