September 28, 2026
ILLUSTRATIVE SAMPLE · FICTIONAL SHOP
Where you stand — shop and household together
Your shop's core systems are strong. Your biggest exposure is uncertainty: on 31 of 104 questions, no one in the room could say yes or no. That is usually a bigger risk than a single missing control, because you can’t manage what no one has checked.
How to read 54%: we asked 136 questions covering your shop, home network, remote work, AI habits, and household devices; 104 applied to you (32 did not — for example, questions about children in the household). A full “yes” counts fully, “partial” counts half. This is a conversation guide, not an audit score.
The same picture, by area
What is working well
- Sign-in protectionMFA on email, admin accounts, and key apps. Admins use stronger, phishing-resistant sign-in.
- Devices kept currentAutomatic patching and endpoint protection on all devices. Old systems retired or isolated.
- Email defensesSpam and phishing filtering, spoofing protection, and office macros blocked.
- BackupsEncrypted, with one copy kept offline. Restores have been tested, not just assumed.
- Access controlStaff are added and removed promptly, daily accounts have no admin rights, and a password manager is used.
Your next steps
Pick one person, ideally Priya, and write down their name. They coordinate vendors and keep a short list of rules for passwords, devices, and customer and job data.
There is no policy on which AI tools staff may use with customer quotes or job files, and no shared habit for verifying an unexpected urgent call or voice message before acting on it. The same verification habit protects a wire transfer at the shop and a family emergency call at home.
No staff training has run, and no simulated phishing emails have been sent. A short yearly session plus quarterly test emails is a solid start.
Home smart-home devices share the same network as work devices, and the shop VPN isn’t used consistently on every network a device connects to. A guest network at home, and a rule to always use the VPN off-site, close both gaps.
Nobody could confirm the shop’s Microsoft 365 security configuration, or whether home routers used for remote quoting and design work have current firmware and a changed default password.
Phone numbers for your IT provider, ERP/software vendor, cyber insurer, and attorney on one sheet, plus who decides what, and who watches for trouble after hours.
Why this Snapshot also looks at home and family
- Voice and video scam verification (dunno — both at home and at work): the same channel-verification habit that stops a deepfaked “urgent wire transfer” call also stops a deepfaked family emergency call. Neither is in place yet.
- Financial account alerts (dunno, 5 of 5): transaction alerts on personal bank and payment accounts weren’t confirmed. The same instinct — know immediately when money moves — applies to shop accounts.
- Connected devices at home (no, 2 of 5; dunno, several more): a car and a few smart-home products share data with third parties by default, unreviewed. Not urgent, but worth a look once the items above are handled.
Questions to ask your vendors (6 areas)
| Area | Ask this | Who to ask |
|---|---|---|
| ERP / quoting software | “Who backs up our job files, quotes, and production data, how often, and when did you last test a restore for us? What is your outage plan?” | ERP/software vendor |
| Microsoft 365 and email | “Can you show me who has admin access, and which mailboxes forward outside the shop? Who sees a suspicious sign-in?” | Managed IT provider |
| Shop network and remote access | “What is exposed to the internet from our shop, and who is watching it at 2 a.m. on a Saturday?” | Managed IT provider |
| Backups | “Show me the last file you restored from our backup, and how long a full recovery would take.” | IT provider and ERP vendor |
| Home networks used for remote work | “What is the rule for the router firmware, guest network, and VPN when someone quotes or does CAD from home?” | Shop leadership, with IT provider |
| AI tools and scam verification | “What can staff put into an AI tool, and what is our rule for verifying an unexpected urgent call before acting on it?” | Dave and Priya |