A cyber security risk assessment is a decision-making process, not a scan. It asks what the business depends on, what could realistically go wrong, how badly that would hurt, and what you are going to do about it.
This guide describes a version small Australian businesses can actually complete — a few hours of structured thinking, documented well enough to review next quarter — and shows where automated external checks fit as evidence.
List the systems and information the business genuinely depends on: the website, business email, payment and accounting systems, customer records, staff devices, cloud services and the suppliers behind each. Note who owns each item and who can grant access to it.
Keep the scope proportionate. A short, accurate list you maintain is worth more than an exhaustive inventory compiled once and abandoned.
Work from scenarios you can picture rather than abstract categories: an administrator account reused across services and later phished, a supplier invoice altered after email impersonation, a website plugin exploited by automated scanning, a laptop lost with saved credentials, or a hosting failure with untested backups.
Australian government guidance from the ACSC and business.gov.au describes the patterns most often reported by small businesses, which is a reasonable starting point for a business without incident history of its own.
For each scenario, estimate how likely it is and what the impact would be across four dimensions: financial cost, operational downtime, obligations to customers or regulators, and reputation. A simple low, medium or high scale is sufficient — the discussion produces more value than the number.
Rate impact assuming the controls you actually have today, not the ones you intend to implement. Optimistic ratings are the most common way an assessment produces a comfortable but useless result.
Every risk gets one of four treatments: reduce it with a control, avoid it by stopping the activity, transfer part of it through insurance or contract terms, or accept it with a documented reason. Accepting a risk consciously is legitimate; ignoring it is not.
Write down who owns each treatment and when it is due. Unowned actions do not happen, and an assessment with no owners is a document rather than a control.
The Australian Signals Directorate's Essential Eight describes mitigation strategies including patching applications and operating systems, multi-factor authentication, restricting administrative privileges, application control and regular backups. Small businesses are not obliged to adopt it wholesale, but it is a useful benchmark for whether the obvious controls are covered.
Where your website is in scope, the OWASP Top 10 and ACSC website guidance provide the equivalent technical checklist for the web layer.
Record each risk with its rating, treatment, owner, due date and review date in one place — a spreadsheet is fine. Review it quarterly and whenever something material changes: a new system, a new supplier, staff departures, an incident or a near miss.
The register is also the artefact that makes conversations with insurers, clients and auditors straightforward, because it shows the reasoning rather than just an outcome.
An external scan supplies evidence for the website and domain portion of your assessment: certificate and transport configuration, security headers, DNS and email authentication records, and publicly reachable services. That is concrete input for likelihood ratings that would otherwise be guesswork.
ScoutLab's Free Scan, Deep Scan and Monitoring cover those externally visible signals only. They do not perform malware or blacklist detection, are not a manual penetration test, do not constitute a full organisational risk assessment, do not provide compliance certification, and do not guarantee security. Internal systems, staff practices, devices and contracts remain yours to assess.
The Free Scan documents externally visible website and domain signals you can attach to a risk assessment. It does not assess internal systems or staff practices, does not detect malware or blacklisting, and does not guarantee security.
Run the free website security checkThere is no universal legal requirement, but many businesses need one for insurance, client contracts or tender processes. Even without that pressure, a short documented assessment is the cheapest way to decide where limited security effort should go.
No. A scan produces technical findings about externally visible configuration. A risk assessment considers assets, likelihood, business impact and treatment decisions across the whole business, using scan results as one input.
Review the register quarterly and whenever something material changes — a new system or supplier, staff departures, or an incident or near miss. Annual-only reviews tend to lag behind how quickly small businesses change tooling.
Website security is layered. External checks can surface useful public signals, but secure development, patching, access control, backups and appropriate testing remain separate responsibilities.
