Somebody Will Check Your Security for Free. Should You Let Them?

Free security checkups are showing up in more places. Some are offered by public agencies or nonprofit organizations. They can give a small business a useful first look at risks in its website or email setup.

"Free" is a reason to ask questions, not a reason to say no. The important questions are who is doing the check, what they will access, and what you will receive afterward.

What these checkups actually offer

The Victoria Police Department's Local Business Cyber Safety Assessments are voluntary and free for small businesses in the City of Victoria and Township of Esquimalt. The process begins with a visit to explain the assessment and obtain consent. VicPD staff then scan public-facing systems, such as websites and email, and provide a report with recommendations. The program is limited to those communities, and the department says only selected applicants will be contacted.

Hong Kong has a separate example. The Privacy Commissioner for Personal Data and HKIRC launched a free Data Privacy and Web Security Scan Programme for schools, NGOs, and small and medium-sized businesses in Hong Kong. Its non-intrusive scans are intended to identify website security risks, weak configurations, and potential exposure of personal data. Participants receive a tailored report and consultancy support. Applications are open until November 16, 2026.

These are bounded assessments, not a promise that every part of a business has been checked. The Hong Kong announcement describes what its scan can look for; it does not report overall results for participating organizations. That distinction matters. A checkup can produce useful findings without proving how common a particular weakness is, or that a business is secure afterward.

Say yes to a clear scope, not open access

A check of public-facing websites and email can be a sensible starting point. It is also narrower than a full review of the business. VicPD describes scanning public-facing systems; that scope alone does not establish whether staff accounts, internal devices, cloud-file permissions, backups, or AI tools are being handled safely.

Before agreeing, ask for the scope in writing:

• Which systems will be checked? List the website, domain, email service, or other systems included.
• What kind of access is required? A scan and an account login are not the same thing.
• What information will be collected and retained? Ask who can see the results and how they will be shared.
• What happens after the scan? Find out whether you receive a written report and what support is available to understand it.
• Who handles changes? Be clear about whether the assessor will only recommend fixes or make them.

Verify the offer through the organization's official website or contact details. Confirm the person's identity through a separate channel. Do not hand over passwords, multi-factor authentication codes, private keys, or unrestricted access just because a check is described as free. If the scope is vague, pause and get it clarified.

A legitimate assessment should be willing to explain what it will do before it begins. Consent should be informed and specific.

A small-business checkup should look beyond the website

For a small business, the useful equivalent is a short, organized review of the systems the business depends on. It does not have to start with a complicated technical exercise. Start with what you use, who can reach it, and how you would recover if something went wrong.

1. Accounts and access

List the accounts used for email, banking, payments, website hosting, social media, file storage, and scheduling. For each, note who owns it and who can sign in.

Check whether people use separate accounts rather than sharing one login. Check whether multi-factor authentication is on for important accounts. VicPD identifies outdated or unpatched systems and compromised accounts without multi-factor authentication as issues observed in its cybercrime work. Its assessment program focuses on identifying weaknesses and recommending improvements.

2. Devices and updates

Write down the devices and services that handle business information. Ask who is responsible for keeping them updated and removing access when someone no longer needs it.

A checkup should make those responsibilities visible. It should not leave you with a list of technical findings and no clear next step.

3. Backups and recovery

Identify what information the business cannot afford to lose: customer records, orders, financial files, creative work, or operating documents. Confirm where copies are kept and who knows how to restore them.

A backup is only useful if it can be recovered. Include a simple recovery test in the review, and record who is responsible for it.

4. AI tools in use

Make a list of AI tools staff use for writing, customer service, research, coding, or administration. Note what information people put into them and who manages the accounts.

The question is not only whether a tool is useful. It is also whether employees know what data they can share, whether access is tied to a business account, and who can turn that access off. TresPies' AI integration guide covers practical decisions involved in building AI features; a governance review applies the same habit of checking purpose, access, and limits to tools already in use.

5. Ownership and handoff

Record who owns the domain, website, payment processor, customer list, social accounts, and source files. Make sure the business can access each one without relying on a former employee, contractor, or vendor.

That is part of security too: knowing who can get in, and making sure the business can still operate if a working relationship ends.

Turn findings into a short action list

After a checkup, sort recommendations into three groups:

1. Do now: Issues affecting important accounts, exposed customer information, or the ability to access business systems.
2. Schedule: Updates or account changes that need a planned time and a responsible person.
3. Ask first: Findings you do not understand or fixes that could interrupt a service.

Do not treat a scan report as a certificate or a guarantee. It is a snapshot of what the assessment checked, at a particular time. Ask what was outside its scope, then decide what to address next.

For some businesses, a free public program may be a useful first step if it is available locally and its scope is clear. For others, a focused independent review may be the better fit. Either way, the useful outcome is concrete: you know what was checked, what was found, who owns each next step, and which accounts and systems remain under your control.

TresPies offers security and secrets audits and AI governance audits as part of its engineering work. The TresPies services page describes those offerings. If you are considering a review, bring a list of the systems you use and the questions you want answered. We can help define a scope and explain what it will, and will not, cover.