What Does a Cyber Security Consultant Find in Week One? 

Hiring a cyber security consultant does not make your business secure overnight. Before recommending new tools or making major changes, a consultant needs to understand how your systems work, where sensitive information is stored and which security gaps could put your business at risk. 

The first week is mostly about discovery. A consultant reviews the existing IT environment, checks basic security controls, talks to the relevant teams and identifies issues that may need immediate attention. 

The exact scope depends on the size of the business and the services agreed, but here are seven areas a cyber security consultant may examine in the first week. 

1. User Accounts and Access Permissions

One of the first areas to review is who can access your business systems and data. 

Over time, employees change roles, temporary accounts stay active and access permissions grow broader than they need to be. These gaps raise the risk of unauthorised access. 

A cyber security consultant may review: 

• Active and inactive user accounts. 

• Administrator privileges. 

• Multi-factor authentication (MFA) coverage. 

• Access permissions for sensitive files and applications. 

• Accounts belonging to former employees or external parties. 

For example, an employee may still have access to a shared folder of confidential business information long after moving to another department. 

Spotting these issues early helps the business prioritise access reviews and strengthen account security. 

2. Network Security Weaknesses

Your network connects employees, devices, applications, servers and business data. If security controls are weak, a problem with one device or account can spread to other parts of the environment. 

During the first week, a consultant may review network diagrams, firewall configurations, remote access arrangements and the separation between different network zones. 

The review may identify: 

• Unnecessary network access. 

• Weak or outdated firewall rules. 

• Poor separation between guest and corporate networks. 

• Unsecured remote access arrangements. 

• Network devices running outdated firmware. 

Not every finding means an attacker is already inside. Some simply point to weaknesses that could make an attack easier if left alone. Controls such as network access control help close many of these gaps by checking which devices are allowed onto the network. 

The consultant should explain which findings carry the greatest risk and recommend sensible next steps. 

3. Outdated Systems and Missing Security Updates

Unpatched software and unsupported systems leave businesses open to known security vulnerabilities. 

A cyber security consultant may check whether operating systems, business applications, servers and network devices are getting the right updates. 

The review may uncover devices that have missed security patches, applications running unsupported versions, or systems that no longer receive vendor updates. 

However, patching decisions should take into account compatibility, business criticality and whether tested updates are available. Some changes may need a maintenance window to avoid disrupting operations. 

The goal is to identify the systems that need attention and set a sensible order for fixing them. 

4. Endpoint Protection and Device Security

Employees use laptops, desktops and mobile devices to access business systems every day. These devices can become entry points for cyber threats if they are not properly managed. 

A consultant may review endpoint protection coverage, device management practices, local administrator rights and security configurations. 

Questions may include: 

• Are company devices covered by endpoint protection? 

• Are security tools updated and working properly? 

• Are devices receiving security patches? 

• Are unauthorised applications restricted? 

• Can the business identify devices that are missing from its inventory? 

This review shows whether the organisation has enough visibility and control over the devices connecting to its systems. 

5. Backup and Recovery Arrangements

Backups are essential, but having a backup system does not guarantee your data can be recovered when you need it. 

A cyber security consultant may review backup coverage, access permissions, job status, retention settings and any recovery test results. 

The review may highlight failed backup jobs, critical systems that are not covered, or backups that can be reached with the same compromised accounts as the main environment. 

Where appropriate, the consultant may recommend stronger backup protection and regular recovery testing. 

These findings matter because a cyber incident, hardware failure or accidental deletion can disrupt business operations if recovery arrangements fall short. 

6. Email Security and Phishing Exposure

Email is still a common route for phishing attempts, malicious attachments and credential theft. 

During the first week, a consultant may review email security settings and the controls protecting employee accounts. 

This can include checking email authentication settings, spam and phishing protection, suspicious forwarding rules and MFA coverage. 

The consultant may also look at how employees report suspicious messages and how the IT team responds to them. 

For example, if employees have no clear way to report suspicious emails, potential threats may go unnoticed or take longer to investigate. 

The findings help the business improve both its technical controls and employee awareness. 

7. Security Monitoring and Incident Response Gaps

Even with security tools in place, businesses need to know whether suspicious activity is being detected, reviewed and escalated properly. 

A consultant may assess available security logs, monitoring coverage, alert handling procedures and incident response documentation. 

Common gaps may include: 

• Important systems not sending security logs to a central platform. 

• Alerts that are not regularly reviewed. 

• No clear process for escalating suspected incidents. 

• Limited visibility into endpoint or network activity. 

• No documented procedure for responding to a serious security incident. 

These gaps make it harder to spot and investigate suspicious activity quickly. 

Depending on the findings, the consultant may recommend better logging, stronger monitoring processes or support from a Security Operation Centre (SOC). To see what that support looks like in practice, read our guide on how a Security Operation Centre responds to a cyber crisis. 

What Happens After the First Week? 

The first week should produce more than a list of technical weaknesses. A useful assessment helps management understand which issues matter most and what to do next. 

A cyber security consultant should ideally provide: 

• Initial findings: A summary of the security gaps identified during the agreed assessment. 

• Risk prioritisation: A clear split between urgent issues and improvements that can be planned later. 

• Recommended actions: Practical steps to address the findings. 

• Responsible parties: Clarity on which actions belong to the consultant, the internal IT team or another provider. 

• Next steps: A proposed timeline for further investigation, remediation and improvement. 

Many consultants organise these findings around a recognised standard such as the NIST Cybersecurity Framework, which helps businesses understand and manage cybersecurity risk in a consistent way. 

Not every issue can be confirmed within five working days. Some findings need deeper testing, extra access or input from other teams. The consultant should explain these limits rather than make unsupported claims about the organisation’s security. 

How ACEiT Helps Businesses Strengthen Cybersecurity 

ACEiT offers cybersecurity capabilities including security consulting, managed security services, threat intelligence, network security and Security Operation Centre services through AceTeam Connect, the group’s managed cybersecurity arm. 

For businesses reviewing their security posture, an initial assessment shows where the biggest gaps are and which improvements deserve attention first. This may involve reviewing existing controls, understanding potential exposure and identifying where extra monitoring or protection would help. 

The aim is to make security improvements based on your actual environment and business requirements, instead of investing in tools without a clear purpose. If you are still deciding whether outside help is worth it, here are five reasons businesses bring in outside security expertise. 

Unsure where your business stands on cybersecurity? Talk to ACEiT and explore how its cybersecurity services can help you identify gaps, prioritise improvements and strengthen your organisation’s security.