G
Risqure
AI vCISO Platform · Uruk Technology Solutions
📄 Sample Report — Demo Only
Executive Security Report
Acme Retail Pty Ltd · Retail & E-Commerce
25–50 employees · Sydney, NSW
Prepared: 7 April 2026 · Confidential
● Board & Management Only
Board Talking Points
Key Messages for the Board
Current security posture scores 42/100 — below the SME average of 54
Maximum financial exposure from identified risks: $340,000 AUD
Two critical risks require board-level attention and immediate action
Cyber insurance renewal should be reviewed against this risk profile
Recommended 90-day remediation investment: $8,000–$15,000 (vs $340k exposure)
Risk Register
critical
No Multi-Factor Authentication on Email & Cloud Systems
$50,000–$120,000
Finding
Business email compromise is the #1 cause of financial loss for SMEs in Australia. Without MFA, a single stolen password gives attackers full access to email, files, and banking portals.
Recommendation · Low effort · Immediate (within 7 days)
Enable MFA on Microsoft 365 / Google Workspace within 7 days. Use Microsoft Authenticator or Google Authenticator. This is free and takes under 2 hours.
critical
Customer Payment Data Stored Without Encryption
$80,000–$200,000
Finding
Customer payment records stored in unencrypted spreadsheets or databases violate PCI-DSS requirements. A single breach triggers mandatory notification, fines, and potential class action.
Recommendation · Medium effort · Within 30 days
Migrate payment data to a PCI-DSS compliant processor (Stripe or Square). Delete any locally stored card data immediately.
high
Staff Have Not Received Security Awareness Training
$30,000–$80,000
Finding
92% of breaches start with a phishing email. Without regular training, staff cannot identify suspicious emails, fake invoices, or social engineering attempts.
Recommendation · Low effort · Within 30 days
Enrol all staff in a 1-hour online security awareness course (KnowBe4 or Proofpoint offer SME packages from $8/user/year).
high
No Formal Incident Response Plan
$20,000–$60,000
Finding
Without a documented plan, businesses take 3–5x longer to recover from incidents, incurring greater financial damage and reputational harm.
Recommendation · Low effort · Within 14 days
Risqure can generate a basic Incident Response Plan from your assessment data. Review and customise it with your team.
medium
Software & Operating Systems Not Patched Regularly
$10,000–$40,000
Finding
Unpatched systems are a common entry point for ransomware. Regular patching closes known vulnerabilities before attackers can exploit them.
Recommendation · Low effort · Within 30 days
Enable automatic updates on all Windows/macOS devices. Schedule a monthly patch review for servers and line-of-business applications.
Compliance Gap Analysis
Australian Essential Eight
Application Whitelisting
✗ Fail
Patch Applications
~ Partial
Configure Office Macros
✗ Fail
User Application Hardening
~ Partial
Restrict Admin Privileges
✗ Fail
Patch Operating Systems
~ Partial
Multi-Factor Authentication
✗ Fail
Daily Backups
✓ Pass
Privacy Act 1988 (Australia)
Privacy Policy Published
✓ Pass
Data Breach Response Plan
✗ Fail
Consent for Data Collection
~ Partial
Data Minimisation Practices
✗ Fail
Key Gaps Identified
Multi-factor authentication not enforced on any system
No documented data breach response procedure
Office macros not restricted — high ransomware risk
Admin privileges not restricted to necessary users only
No formal data retention and disposal policy
90-Day Remediation Roadmap
Month 1 — Immediate Wins
Enable MFA on all cloud accounts (Microsoft 365 / Google)
Disable Office macros or restrict to signed macros only
Enrol all staff in phishing awareness training
Document and test your data backup restore process
Month 2 — Close Critical Gaps
Remove payment data from local storage — migrate to Stripe
Create a simple Incident Response Plan (use Risqure template)
Review and restrict admin account privileges
Enable automatic OS and application patching
Month 3 — Build Foundations
Implement a formal acceptable use policy
Schedule quarterly security reviews
Review cyber insurance coverage against actual risk profile
Begin ISO 27001 or Essential Eight Maturity Level 1 gap assessment
Quick Wins — Do This Week
Immediate Actions (Free or Low Cost)
Enable MFA — free, takes 2 hours, eliminates 99% of account takeover risk
Run a free phishing simulation (Google has a free tool)
Check Have I Been Pwned for all staff email addresses
Enable full-disk encryption on all laptops (BitLocker/FileVault — free)
Review who has admin access — remove anyone who doesn't need it