Cybersecurity assessment
Cybersecurity audit for portfolio companies.
Active testing runs only on request, with written authorization.
A cybersecurity audit for portfolio companies separates public exposure from controls that need authorized review. Meo Advisors starts with passive public evidence, records gaps and requests the evidence needed to resolve them. Active testing runs only on request with written authorization. The result is a prioritized risk register and a hardening plan.
In short
- A portfolio-company audit connects supported cyber findings to owners, hardening work and decisions.
- Passive public evidence starts the review; scans, penetration testing and internal checks need written authorization.
- Missing evidence stays an open question, with the record or authorized check needed to resolve it.
What is a cybersecurity audit?
A cybersecurity audit reviews a company’s exposure and security evidence against an agreed scope. For a portfolio company, it should show which findings need action, who owns them, and which questions still need records or authorized testing.
A cybersecurity audit is a scoped review of security evidence, findings and unresolved questions against the company’s operating needs and agreed criteria.
Meo starts with passive public sources. The cybersecurity due diligence hub explains the wider deal-stage review; this page focuses on the audit and hardening work for a portfolio company.
What is an audit checklist?
An audit checklist is a set of review questions tied to evidence, scope and access requirements. A cyber checklist should distinguish what is visible from outside from what needs company records or written authorization.
- Confirm the company’s public domains, services and the owners responsible for them.
- Record the source and date of each certificate, endpoint or public-page observation.
- Request the internal evidence needed to assess access controls, recovery arrangements and incident response.
- Keep supported findings separate from open questions, and assign an owner to each action.
Use the copyable cybersecurity due diligence checklist to turn the agreed scope into review tasks.
Which parts of an audit need the company's authorization?
Port scans, vulnerability scans, penetration testing, login attempts and internal checks need written authorization before they start. Meo runs authorized testing only on request and within the agreed written scope.
| Visible from outside | Needs authorized access |
|---|---|
| External exposure review | Penetration testing on request, with authorization |
| Internet-facing endpoints | |
| Certificates and security headers |
Before authorization we use passive public sources only: DNS, certificate transparency, third-party internet-scan datasets, and the target’s public pages at normal browsing rates. No port scans, vulnerability scans or login attempts without written authorization.
Agree the systems in scope, permitted activity, timing, contacts and stop conditions in writing. A public endpoint is an observation to review, not permission to test it.
Is a cyber security audit mandatory?
The answer depends on the company’s regulatory, contractual and sector obligations. A general cybersecurity audit does not establish that every applicable requirement has been met; counsel should identify the obligations and evidence the company needs.
In healthcare, HHS guidance describes a required risk analysis for electronic protected health information. That analysis has a broader evidence requirement than a passive external review. See HHS risk analysis guidance. Legal reference, not legal advice.
What can the outside view establish?
Passive public sources can identify internet-facing endpoints, certificate observations and security-header signals. They cannot establish the effectiveness of internal controls or prove how far an attacker could reach.
| Layer | What we check |
|---|---|
| Marketing & Digital Visibility | AI answers and search ranking; Listings and reviews; Paid media; Pricing |
| Technology & Infrastructure | Technical debt; Vendors and SaaS subscriptions; Tags and measurement; Page speed |
| Cybersecurity | External exposure review; Internet-facing endpoints; Certificates and security headers; Penetration testing on request, with authorization |
Any penetration testing shown in the cyber layer runs only on request, with written authorization. A visible signal becomes a supported finding only to the extent the evidence allows.
The healthcare breach-cost figure is an external industry benchmark. It is not an estimate of this company’s loss or the savings an audit would produce.
How much does a cybersecurity audit cost?
Meo’s deep-dive diligence range is $15–50K, depending on depth and the areas covered. The cyber scope, evidence requests and any separately authorized testing are agreed in the scoping call; the range is not a fixed quote for every cyber audit.
- Diligence · 01Instant auditFreeAutomated, from public informationA snapshot of one target or portfolio company.
- Diligence · 02Deep-dive diligence$15–50KBy depth and areas coveredMarketing and CX initial audit in 24–72 hours; add technology and cyber, recruiting and more.Book a 30-minute scoping call
- Beyond diligence · 03Implementation$100–200KTypically 6–12 weeksForward-deployed engineers ship AI programs on local models or cloud models hosted in your environment.
- Beyond diligence · 04MaintenanceOngoingYour team or oursIn-house if you have a team, or run by MEO for a fraction of the equivalent labor cost.
The initial marketing and CX timetable in the ladder applies to that scope. Cyber review timing depends on the agreed work, access and authorization.
How does a portfolio-company cyber audit run?
The audit starts with the business question and evidence boundary, then turns supported findings into a hardening plan. The review records what was examined, what remains open and how each proposed fix will be verified.
- Agree the operating priorities, review criteria and public properties in scope.
- Collect passive public evidence and request the records needed to resolve internal questions.
- If requested, agree written authorization before any active testing or internal check.
- Rank supported findings by impact, effort, confidence and scope, then assign actions and owners.
What does the cyber audit deliver?
The audit delivers a prioritized risk register, the evidence behind each finding, and a list of open questions with the records needed to answer them. Agreed hardening work receives an owner and a way to verify completion.
| Risk | Likelihood | Impact | Owner |
|---|---|---|---|
| Lead-form consent wording | High | High | Marketing lead |
| Exposed admin login | Medium | High | IT lead |
The register above is illustrative. See the sample diligence deliverables for the format of the readout and plan.
Meo Advisors Editorial writes and maintains this page. Its numbers are Meo Advisors’ own statements or cited external benchmarks, and every mock is labelled Illustrative. See the editorial policy and corrections process.