Contractor asks for a security scorecard and learns it has nothing to score
A growing low-voltage systems design-build contractor. Outcome verified
The problem
A growing low-voltage systems design-build contractor had reached the point where leadership sensed cybersecurity mattered but had no idea where the company stood. Good pieces existed, yet nobody owned security, and management wanted a benchmark and a first-year plan. Once on site it was clear there was no program to score; a scorecard would have read zero on every line.
Why it mattered
Sensitive employee, customer and operational data sat in a hosted platform with weak passwords and no MFA, and in a custom application whose developer admitted skipping security. Employees handed over credentials in a phishing test.
What we did
Vizius dropped the scorecard and instead documented the concrete gaps between how the environment was run and what its own testing could exploit, ranking findings by risk and by cheapest highest-impact fix. It named the root issue as the absence of any program and recommended outsourced oversight rather than an unaffordable hire.
What changed
Leadership received 19 prioritized findings, phishing results and a roadmap. Within a month it contracted a fractional CISO program to close the gaps, and the first monthly dashboard showed phishing credential-sharing down from 9 to 1.
- Construction and engineering
- Midsize company
- CIS Controls