How secure is your team when work is moving?
A member of staff is moving through a routine part of the day when something appears that matches the task in front of them. The name is known, the wording feels right, and the request fits with what is already happening. Responding to it seems like the most sensible way to keep the work moving, so the decision gets made.
Not because anyone is being careless, and not because somebody has ignored obvious warning signs. It gets made because, in that moment, nothing feels unusual enough to interrupt the flow of work. It feels like handling the job properly.
That is where this risk check begins.
In most organisations, exposure does not usually sit inside dramatic incidents or clearly suspicious behaviour. It forms inside ordinary decisions that feel reasonable at the time, then repeat quietly across emails, systems, messages, shared access, approvals, and everyday communication. This tool helps you look at where those moments may already be appearing in your own environment.
What to expect
There are 12 short questions, built around situations that show up naturally in day-to-day work. It takes around two minutes to complete.
There is no technical jargon, no scoring designed to catch people out, and no pressure to present your organisation in the best possible light. The purpose is to help you look at what work actually feels like when people are busy, familiar routines are in motion, and decisions need to be made without stopping everything to analyse them.
As you move through the questions, the aim is not to search for ideal answers or prove that everything is covered. The useful part is noticing what feels recognisable. Where a question sounds familiar, there is usually a reason. It often points to a gap that is not obvious on paper but shows up in practice, in the small moments where someone acts because the task makes sense, the request seems normal, or pausing feels less reasonable than continuing.
That is why honest reflection matters more here than perfect responses.
What this is really exploring
Most organisations do not face cyber risk simply because people lack awareness. The deeper issue is that risk appears inside normal work, where judgement is being used in real time.
A message arrives that looks legitimate. A request lines up with an existing task. Access is shared to keep something moving. A decision is made because it feels proportionate, helpful, and consistent with the situation in front of the person making it. That is what this risk check is really exploring.
It is not asking whether your team has heard the right advice before. It is asking whether everyday conditions inside your organisation make it easy for small, reasonable decisions to create exposure over time. When these moments go unexamined, they do not stay isolated. They repeat across people, teams, platforms, and routines. What feels like a one-off decision is often part of a wider pattern that already exists in the background.
That is why the questions matter. They help bring hidden gaps closer to the surface, so you can see whether the way work is currently being done is quietly creating risk that nobody has needed to name yet. Once that becomes visible, it becomes much easier to decide what needs checking next.
