Security
How safe is your business? Out of 100.
Eight areas checked, from sign-in and email to backups and staff training, then monitored every day. Every finding is explained in plain words, with readiness for Cyber Essentials and ISO 27001, incidents, policies and an evidence pack. Read only: Xevrion never changes your systems.
14 days free No payment details No sales calls
- Devices and backups77%
- Website security75%
- Email security63%
- Data and retention50%
- Identity and sign-in48%
- Connected apps45%
- Incident readiness30%
- Staff training25%
Your score
- Today
- 53 Fair · 94% of points checked
- After the first five fixes
- 74 Good
Every finding, in plain words.
Why it matters, the evidence, the steps to fix it and who should do it, from the eight areas.
- DKIM signatureGoogle, switched on
- Website certificate61 days left
- SPF recordEnds ~all, not -all
- DMARC recordp=none
Read only
Public records and one visit to your home page. Nothing changes.
- Daily backupsYes
- Tested a restoreNo
- Fake-email trainingNo
- Password managerPartly
What only you can answer
Plain questions, scored the same way.
- 90 days ago
- 36 Weak
- Today
- 53 Fair
A score kept every day
So you can see it rise as fixes are made.
- WedTom Harbour marked DMARC as being fixed: IT support adds the record this week.
- MonSarah Vale answered 11 security questions.
- MonXevrion checked the email records and the website.
Accept a risk, with a reason
Every status change is recorded, with who and when.
Screens show an example company, Harbour & Vale Logistics, with demo data.
One number, and why it is that number.
Each area is worth fixed points, and the score is worked out from the evidence alone, so the same evidence always gives the same score. Fix something and watch it rise.
See the fix planA security score rising as fixes are made: eight areas, the open findings and the fix plan with the score after each fix.
Example company · demo dataThe product working on an example business. Names and figures are made up.
Entry 01 · what it is worthRisks closed, with the score before and after each fix.
The evidence
What a breach costs, and how most start.
From the UK government's 2025 survey of businesses. Security shows the expected yearly loss (the UK national average for a business, not a prediction) next to your score, and marks the fixes that guard against phishing.
Breaches and their cost
Published statisticNational figures for UK businesses, not a prediction for yours, and not Xevrion results. Every source, date and caveat.
Cyber Essentials, plans and insurance
Published statisticFrameworks shows how near you are to Cyber Essentials; Incidents helps you write a one-page plan; the evidence pack gives insurers this context beside your own answers. Every source, date and caveat.
The eight areas
100 points, shared out by risk.
Each area answers one plain question.
| Area | Points | The question it answers |
|---|---|---|
| Identity and sign-in | 20 | Can someone sign in as you with only a stolen password? |
| Email security | 15 | Can someone send email that pretends to be you? |
| Website security | 10 | Is your website safe for visitors to use? |
| Connected apps | 10 | Do the apps linked to your accounts still need their access? |
| Data and retention | 10 | Do you know where customer data is, and who can see it? |
| Devices and backups | 15 | Could you carry on if a laptop was lost or files were locked? |
| Staff training | 10 | Would your team spot a fake email? |
| Incident readiness | 10 | Do you know what to do on a bad day? |
What is checked
What Xevrion checks, and what you tell it.
Checks read evidence; questions ask what only you can know.
| Check | Who | How |
|---|---|---|
| Two-step sign-in | Xevrion checks | Who signs in with only a password; every owner; the rule for everyone; how long a sign-in lasts |
| SPF, DMARC and DKIM | Xevrion checks | Your email domain's public records, read from public DNS |
| Certificate, HTTPS and headers | Xevrion checks | One visit to your website's home page |
| Connected apps | Xevrion checks | Apps that need attention, and apps unused for 90 days |
| Administrators | Xevrion checks | How many people can change everything |
| Backups, updates and devices | You answer | Daily backups, a tested restore, updates, encryption and virus protection |
| Training and passwords | You answer | Fake-email training in the last 12 months, and a password manager |
| A plan for a bad day | You answer | A one-page plan, emergency numbers on paper and cyber insurance |
The fix plan
The order to fix things in.
- 01Xevrion
Checks and answers
Read-only checks, and the questions only you can answer.
ResultThe evidence
- 02Xevrion
Every finding explained
Why it matters, the evidence, the steps and who should do it.
ResultFindings in plain words
- 03Xevrion
Biggest risk first
The fixes that remove most risk for the least effort come first, with the score after each.
ResultA fix plan
- 04You fix
Mark each fix
Being fixed, fixed, or accepted with a reason. Checks confirm what they can.
ResultA higher score
Xevrion does this stepYou approve or decideNothing leaves your business without the approvals you set.
Beyond the score
Frameworks, monitoring and a bad day, covered.
Eight views in one place.
| View | What it does |
|---|---|
| Frameworks | Readiness for Cyber Essentials, the NCSC 10 Steps, the NCSC Cyber Assessment Framework and ISO 27001 Annex A, with what is missing |
| Monitoring | Every day: email records, MTA-STS, DNSSEC, CAA, the certificate, encryption version, headers, open admin pages and domain renewal. Lookalike domains once a week |
| Identity | Who signs in without two-step sign-in, sign-ins open too long, administrators and connected apps' access, with one-click fixes |
| Breached accounts | Your domain checked with Have I Been Pwned once it is set up, and a password check that never sends the password |
| Incidents | A log worked through four playbooks: a fake email, a lost device, an account taken over and ransomware |
| Policies | Plain-English drafts for acceptable use, passwords, incident response and data retention, with versions and who has read them |
| Evidence pack | One report for your insurer or auditor: score, readiness, findings, evidence and history |
Control
Honest about what it knows.
Read only
No check changes your systems. A person makes every fix.
Nothing claimed
Unanswered questions and checks not yet run earn no points.
Every change recorded
Who marked a finding, when, and why it was accepted.
Kept every day
The score is kept once a day, so you can see it rise.
Questions
About Security.
Does the check change anything on our systems?
No. Every check is read only: it reads your email domain's public records and visits your website's home page once. Nothing on your systems is changed, and a person makes every fix.
Why is our score lower than we expected?
A question nobody has answered, or a check not yet run, earns no points, so the score never claims more than is known. Answer the questions in Security and run a check, and the score shows what is really in place.
Where do the fix steps come from?
Each finding has plain steps written for a small business, and names who should do it, such as whoever manages your domain. Where it helps, they point to free guidance from the National Cyber Security Centre.
Does readiness mean we are certified?
No. Readiness shows how much of what Xevrion can see lines up with each framework. Cyber Essentials is certified through an IASME certification body, and ISO 27001 by an accredited auditor. The evidence pack helps with both.
Can we accept a risk instead of fixing it?
Yes. Mark the finding as accepted with a reason, and it is recorded with who accepted it and when. An automatic check is only cleared by the next check that passes.
One platform, seven parts
- 01Customer CareReplies to every customer email, ready for you to approve.Open
- 02Automations40 ready-made, or designed by Xevrion AI from your own words.Open
- 03SecurityA score out of 100, every finding explained, the fixes in order.You are here
- 04Business mapHow your business runs, and what a change would do.Open
- 05Automated WorkRuns your repeat jobs, step by step, and asks first.Open
- 06Valuable InsightsWhere your money is heading, and what to do about it.Open
- 07Value LedgerEvery result in pounds, with the record behind it.Open
See your own score.
Free for 14 days, with Security and every service included.
14 days free No payment details No sales calls