You cannot secure the data you cannot see.
A Data Risk Assessment is a paid, one-time evaluation of your data estate. In four to six weeks it discovers what sensitive information you hold, classifies it, scores the risk around it, and hands your leadership an evidenced picture of exposure with a roadmap to act on.
The question nobody can answer quickly
Ask a technology leader where the organisation's sensitive data lives and who can open it, and the honest answer is usually an estimate. Not through negligence: data spreads faster than the controls around it. A store is created for a project and outlives it. Access is granted for a role and outlives the person. A folder is opened to the whole company to unblock a deadline on a Friday and nobody closes it on Monday. Multiply that by a decade and the gap between who can reach sensitive data and who should is real, unmeasured, and invisible until something forces the question.
The estate you have, rather than the one on the diagram
Architecture diagrams show systems. Risk lives in the spaces between them: the export somebody saved to a personal drive, the shared mailbox nobody owns, the site that was opened to everyone for one meeting. An assessment maps the estate as it actually is, then marks the places where sensitive content sits behind access that was never designed.
What usually forces the question
Most assessments start with one of these. If two of them are true, the answer is already overdue.
An assistant rollout is scheduled
Copilot and its peers inherit each person's permissions. Anything an employee can open, the assistant can find and summarise in seconds.
A regulator or an auditor asked
Privacy and AI obligations all begin with the same question about sensitive data, and an estimate is not an answer you can file.
An insurer or a client is asking
Cyber renewals and enterprise procurement now ask what you hold, where it sits, and who can reach it, in writing.
A peer was breached
The board's question after somebody else's incident is always the same: could that happen here, and how would we know?
A merger, divestment or migration
Moving an estate is the moment its contents matter most, and the moment nobody has an inventory to hand.
The storage bill keeps growing
Duplicate and expired data carries cost as well as risk, and no policy has ever deleted a file on its own.
What the assessment covers
Discovery and classification
- A scan of up to ten terabytes across the sources you choose
- Cloud and on-premises, structured and unstructured alike
- Classification that reads the content in context, with no rulebook of patterns to maintain
- Priority categories agreed up front: personal, payment, health and intellectual property
Risk and exposure
- Risk scored on permissions, sharing, location and activity
- Files open to far more people than intended
- Accounts that should no longer have access to anything
- Duplicate and stale records carrying risk and cost for no benefit
Assistant readiness
- What assistants such as Copilot can reach today
- Which sensitive stores are open to a wide audience
- Which of those carry no classification at all
- What to close before a rollout rather than after an incident
What you receive
- An executive report: quantified exposure, findings by category and severity
- A programmatic roadmap from the scan to a governed state, phase by phase
- Baseline measures your team can report against as remediation runs
- Thirty days of access to the assessment platform after the readout
The finding that lands hardest
Almost every assessment produces the same shape of answer: the number of people who can reach sensitive data is far larger than the number who need to. That gap is not a scandal, it is arithmetic, and it is the single most useful thing a leadership team can be shown. It converts an abstract worry into a decision about who keeps access to what, and it is the basis of every remediation plan we have run.
What it is not
The assessment does not remediate, enforce or monitor. It changes nothing in your estate. That separation is deliberate: you get an independent picture first, then decide what to fix, in what order, and who does it. It is not a penetration test, which asks whether someone can get in, and not a control audit, which asks whether a control exists. It asks what you hold and who can reach it.
Six meetings, four to six weeks
Every assessment runs on the same rhythm. The meetings are booked up front, which is what keeps the window honest.
- 01
Scoping
Sources, priority categories and the timeline agreed with every stakeholder in the room. The first scan is kept deliberately tight: a sprawling one slows the readout and blurs the story.
- 02
Kickoff
Administrative access granted, sources configured, the first scan running. Access confirmed before this meeting is the single biggest predictor of a clean engagement.
- 03
Assistant readiness workshop
A working session on what Copilot and similar tools can reach in your tenancy, and what they would surface if asked today.
- 04
Technical results
Findings reviewed with your team, validated against the categories that matter to you, and the risk report shared.
- 05
Executive sync
The exposure and the roadmap presented to leadership in the language a board funds: what is at risk, what it would take to fix, and in what order.
- 06
Handover
What happens next, and who owns it. If remediation follows, it starts from this plan rather than a fresh discovery.
What the report is actually for
A report that ends in a filing cabinet has cost you money and bought you nothing. This one exists to unlock three decisions. It tells you what to fix first, ranked by exposure rather than by whoever asked loudest. It gives finance a scope worth funding, because the work is sized against findings rather than a consultant's guess. And it gives the board and the regulator evidence that the organisation knows what it holds, which is the question underneath almost every obligation you are subject to. High counts in the findings are not a failure. They are the map.
From data-risk findings to action in twelve weeks.
The company knew its data risks in outline but not in the specifics that let anyone act: sensitive information (personal, financial, intellectual property, and regulated data) spread across a large estate, exposure and oversharing unquantified, and retention practices leaving redundant data accumulating risk. Four priorities were clear (classify the sensitive, identify the exposure, realign the access, retire the redundant) and the brief was equally clear: findings that turn into action, not another assessment that ends as a report.
The engagement turns the four priorities into delivered work rather than recommendations: a categorised and classified data inventory with labelling guidance, exposure and oversharing identified and remediated as the work runs, access realigned toward least privilege, and redundant data identified for disposal. It closes with a prioritised risk-reduction roadmap, capability-uplift actions, and cost-saving opportunities, leaving the organisation with priorities actioned and a clear path for what comes next.
Read the engagementGet the overview
Leave your details and we’ll email you the download link.
Frequently asked questions
No, and that is the point. It discovers, classifies and scores; it does not change your data. You are left with evidence and a plan, free to remediate with us, with your own team, or not at all.
Most first assessments are deliberately scoped tighter than the limit. We start with the sources that carry the most sensitive data, prove the value there, and expand from a known baseline rather than boiling the ocean once.
No. The assessment is a paid engagement in its own right and ends with a report and a roadmap you own. Where continuing tooling makes sense we will say so and show you why, and you remain free to license it yourself or not at all.
A penetration test asks whether someone can get in. An audit asks whether a control exists. This asks what sensitive data you hold, where it sits, who can reach it today, and what an assistant would surface, then scores that exposure so it can be prioritised.
Light, and front-loaded. You need a technical contact who can grant access to the sources, a decision on which sources are in scope, and attendance at six meetings. The scanning itself runs without touching how your people work.
You do. The report is yours and is treated as confidential. We agree at scoping who inside your organisation receives it, and we brief that group directly at the executive sync.
Remediation is a separate engagement: exposure closed, access realigned toward least privilege, retention put into effect, with the same senior people who ran the assessment. Some clients run it with their own teams from our plan, which is a perfectly good outcome.