We only use it to prepare your report. Nothing else.
Passwords, backups, staff training, GDPR and NIS2. Find your real weak points in 5 minutes — with a detailed report in your inbox.
The w//b studio security test is a free, 12-question self-assessment for small and medium-sized companies that want a clear picture of their cybersecurity and data protection before something goes wrong. You answer about how your company really works today — passwords, backups, devices, staff, network, GDPR and NIS2 — and the test turns your answers into a score, a list of risks and an order of priorities.
It is written for owners, managing directors, office and operations managers, and whoever looks after IT on top of their real job. No technical knowledge is needed: every question comes with a short explanation in plain language. It works for any sector, and it is especially useful if your company handles client documents, personal data or payments.
The 12 questions are grouped into seven areas. These are the real questions you will answer.
Stolen or reused passwords are the easiest way into a company. The test checks your rules and whether a second factor protects them.
Does the company have a password policy with minimum complexity requirements and periodic changes?
Do you use two-factor authentication on email and on the company’s business systems?
A backup that has never been restored is a hope, not a plan. This is what separates a bad day from losing years of work to ransomware.
Do you take regular backups of data and case files? Do you verify them and have a recovery plan?
Most attacks start in an inbox, not in a server room. Trained staff are the cheapest defence you can buy.
Have staff been trained to spot phishing emails, ransomware and other attacks?
Laptops, antivirus, security updates, WiFi and remote work: the physical doors into your data.
Do company computers and laptops have full disk encryption (BitLocker, FileVault or similar)?
Is the company WiFi separated from the guest network? Does remote work go through a VPN?
How documents reach you and who inside the company can open them.
Do clients send you confidential documents (contracts, ID documents, personal data) over WhatsApp or unencrypted email?
Is access to client data and case files limited by role, so each person sees only what their job requires?
The two documents a data protection authority asks for first: the record of processing (Art. 30) and a plan to notify a breach within 72 hours (Art. 33).
Does the company keep a documented record of processing covering all the personal data it handles (clients, employees, suppliers)?
Is there a defined protocol for what to do if a breach or unauthorised access to client data is discovered?
NIS2 applies to medium and large companies in critical sectors and reaches their suppliers through supply-chain requirements. It also makes management accountable.
Does the company have a cybersecurity policy approved by management, and has it assessed whether NIS2 applies?
Attackers do not choose companies by size: they choose the ones that are easy. An untested backup, a laptop without encryption or a WiFi shared with guests costs little to fix today and a great deal to explain after a breach — to your clients, to your national data protection authority and, if NIS2 applies to you, to the national cybersecurity authority. Five minutes tell you which of these gaps you have and which one to close first.
And if the score is lower than you hoped, you are not on your own. w//b studio has 14 years of experience and more than 75 clients. We turn the priorities in your report into a concrete plan — technical security measures, GDPR documentation and cybersecurity training for your staff — and we carry it out with you.
It has 12 multiple-choice questions and takes about five minutes. You see your result on screen as soon as you answer the last one.
Yes. The test, the score and the report are free, with no obligation. If you want help with what comes out of it, you can book a free 30-minute consultation with our team.
We ask for your company name at the start to personalise the report, and we record your answers so we can prepare it. Your email is optional: you give it only if you want the report in your inbox, after accepting the privacy policy. The test never connects to your systems or scans your network.
A security score, your risk level, the areas where you are exposed with an explanation for each, the areas already in good shape and the recommended next steps in order of priority. You can also receive the full report by email.
No. It is an indicative self-assessment based on your answers: it tells you where to look first, but it does not certify your company. A full audit checks your systems directly and ends with a documented action plan.
Start with the critical points in your report, because they are the ones that expose you most. If you want them fixed properly, contact us: we go through your results with you in a free 30-minute consultation and propose a plan for security, GDPR and NIS2 compliance and staff training.