Cyber Health Check.

A web app for Sydney cybersecurity firm Gridware that turns its onboarding audit into a 30-question health check with an instant scored report, and lets insurance brokers send it to their own clients.

Client: Gridware Cyber Security
Deliverable: Web app, design + build
Year: 2019

Cybersecurity Health Check report: a Gridware Score of 4.1 out of 5, rated Adaptive, with a low-to-high risk scale

Questions in the health check30
Kinds of user: clients, and the insurance brokers who send them the check2

Cue 01

The brief

Gridware works with some of the biggest names in Australia on governance and compliance, incident response, phishing training and penetration testing. Every new client starts with an audit of how ready they are for a cyber attack, and a report showing which areas need support first based on the biggest threats. That audit was done by hand.

Cue 02

The approach

We built a tool that asks the same questions a Gridware consultant would and scores the answers into a report. It also needed to work for insurance brokers, who manage many clients: they log in, send health checks out and watch the results come back.

Cue 03

The result

Clients answer 30 questions and get a scored report straight away, with a risk breakdown and a comparison against their industry. Brokers send checks on a credit system and see every result from one dashboard.

Question 2 of 30 on staff security training, with Yes, No, Partial and Not Applicable answers and keyboard shortcuts — One question at a time, answerable from the keyboard: y, n, p or x

Two ways in

Cue 01

Clients

A client takes the health check, gets their report and can download it. The same login gives them a library of policy documents filtered by framework, and an incident response guideline to follow if they are breached.

Cue 02

Brokers

A broker invites clients by name, company and email, spending one credit per check. Completed checks appear on their dashboard with the score and rating, and each links to the full report.

Cue 03

The report

Scores run from 1 to 5, each with a named maturity level. The report explains the method, which references ISO 27001, the NIST Cyber Security Framework, OSSTMM and PTES, then shows the risk distribution and where the client sits among its peers.