Most business owners have never had a clear answer to a simple question: how secure is my business, really? Not in vague terms like "pretty good" or "we have antivirus," but an actual number they can point to, track over time, and act on.
That's what the Cyber Health Score is built to do.
What the score measures
The Cyber Health Score is a number from 0 to 100, calculated from a plain-language assessment covering 20 categories of business security. These aren't abstract IT concepts. They're things like whether employees use multi-factor authentication, whether backups have actually been tested (not just scheduled), whether an old employee's access gets removed when they leave, and whether anyone would know who to call if something looked wrong.
Each category carries a different weight, because not every risk matters equally. A business with weak multi-factor authentication is exposed to a different level of risk than one without a formal cybersecurity insurance policy. The scoring model reflects that. Categories tied to the most common ways Canadian small and medium businesses actually get breached, like phishing, credential theft, and unpatched systems, carry more weight than lower-impact categories.
How the number is calculated
Every question in the assessment has three possible answers: Yes, No, or Not Sure. A "Yes" always represents the more secure practice. Each answer earns points, those points are totaled per category, and each category's result is combined into a single weighted score.
The result is a score between 0 and 100, which falls into one of four risk tiers:
A lower score doesn't mean a business is careless. Most businesses land somewhere in the middle. It usually means there are a handful of specific, fixable gaps that haven't been addressed yet, often because nobody had a clear picture of where to start.
Why a single number is useful
Cybersecurity advice is often either too technical to act on or too generic to matter. A Cyber Health Score gives a business a starting point that's specific to them: what's already working, what the biggest gaps are, and what to prioritize first.
It's also something a business can track. Improving a Cyber Health Score from a 45 to a 75 over six months is a concrete way to see that security work is actually paying off, not just a recurring invoice.
What happens after the score
Once the assessment is complete, the result includes more than just the number. A short summary explains the most significant risks found, a handful of practical recommendations are prioritized by impact, and the business receives a full report by email.
From there, the next step depends on the risk tier. Higher-risk results are followed up quickly, since those gaps tend to be the ones that turn into real incidents. Lower-risk results are a good sign, but rarely mean there's nothing left to improve.
The goal isn't to hand a business a grade and walk away. It's to give them a clear, honest starting point, and a practical path forward from wherever they currently stand.