Sample report

What you receive.

An excerpt from a vulnerability assessment for a fictional dental practice. Yours reads the same way: what we found, what it means, how to fix it.

FENNEC · VULNERABILITY ASSESSMENT Example Family Dental (fictional) · Page 3 of 18

Nine findings. Two need attention this week.

Most of these are configuration changes your IT provider can make in an afternoon.

2 High

4 Medium

3 Low

F-01 High HIPAA 164.312(e)(1)

What it means: Anyone online can try passwords against the front-desk computer, around the clock.
The fix: Close the port at the firewall. Use a VPN with multi-factor sign-in for remote work.

F-02 High HIPAA 164.312(d)

What it means: One guessed or phished password opens every patient message in the mailbox.
The fix: Turn on multi-factor sign-in for every mailbox. About an hour of work.

F-03 Medium HIPAA 164.308(a)(7)(ii)(A)

What it means: There is no proof the practice could recover its records after ransomware.
The fix: Restore one day of records to a spare machine each quarter and write down the result.

F-04 Medium HIPAA 164.312(a)(2)(i)

What it means: Nobody can tell which person opened a record, which an auditor will ask about.
The fix: Give each person their own account. Turn on automatic lock after 10 minutes.

F-05 Low NIST CSF PR.AC-5

What it means: A patient on guest Wi-Fi can see the office printers and computers.
The fix: Move guest Wi-Fi to its own isolated network. Most office routers can do this.

It starts with a 30-minute gap review. Fixed price from there.