October is always busy when it comes to security, and this year we took a look at how some older security guidance no longer holds up, and followed that by examining what can happen at one organization when small security gaps connect into a crisis.
That still leaves a big question: Where does a Trusted Advisor start?
If you’re already selling security, you know it all starts with a conversation. If you don’t have security in your portfolio, the good news is that you don’t need to be a security expert to begin that conversation. What you need is knowing what to listen for in those moments.
Let’s close out Cybersecurity Awareness Month with five areas worth exploring.
Start with the Business, Not the Tech
The case study in our previous blog gave us a few questions worth keeping, the first being: What else can fail when a control fails?
That mindset should anchor every security conversation. Before you ask about firewalls or MFA, ask what needs to continue working, such as revenue, operations, customer commitments and compliance deadlines. What would a day of downtime cost? Does their cyber policy require anything that can’t be met today? Once you know what a business can’t afford to lose, every technology question that follows has a reason behind it, and your customer will see it, too.
-
Users: Who Has the Keys?
People are still the front door. Humans played a role in 62% of breaches in Verizon’s 2026 Data Breach Investigations Report, whether through phishing, stolen credentials or simple mistakes.
- How does everyone log in, and does that include vendors and contractors?
- What happens to someone’s access the day they leave?
- Who has admin rights, and does anyone review that list?
What you’re listening for: SMS-only MFA, vendor accounts nobody manages, and former employees who still have access. Each one points to identity and access management, stronger MFA, and third-party risk management. Don’t forget the users who aren’t on your customer’s payroll. As our case study showed, a vendor’s credentials can be the doorway.
-
Devices: What’s Actually Out There?
- Do you have a current list of every device that connects to your network?
- Are personal phones and laptops used for work?
- How do you know each device is patched and protected?
What you’re listening for: “We think so” is a common answer here, and that’s an opportunity. You can’t protect a device you don’t know exists. Unmanaged and personal devices point to endpoint detection and response, mobile device management, and managed IT.
-
Applications: Who Owns What?
- How many cloud apps does your team use, including the ones IT didn’t buy?
- Who’s responsible for each app’s security settings and access?
- If a key app went down tomorrow, how would the business keep running?
What you’re listening for: App sprawl, shadow IT and apps nobody clearly owns. These open the door to SaaS security, single sign-on, and continuity planning.
-
Network: How Far Could They Get?
- If one account were compromised, what else could it reach?
- How do remote employees and vendors connect?
- Who’s watching for unusual activity at 2 am?
What you’re listening for: A flat network where everything can reach everything, a VPN as the only line of defense, or nobody watching after hours. The question isn’t just how to keep attackers out. It’s how far they get once they’re in. That points to segmentation, zero-trust access, SD-WAN and SASE, and 24/7 managed detection and response.
-
Data: Could You Prove You’d Recover?
- Where does your most critical data live?
- When did you last restore from a backup, not just run one?
- If you were hit tomorrow, who makes the first call, and to whom?
What you’re listening for: Backups that have never been tested and no written incident response plan. Remember that in our case study, the backups existed, but recovery didn’t. This is where backup as a service, DRaaS, and incident response planning come in.
Listen for “I Don’t Know”
The most valuable answer in any of these conversations isn’t a yes or a no. It’s I’m not sure or IT handles that.
Those answers aren’t dead ends. They’re where the next conversation starts, and often where the biggest opportunity lives. Don’t rush past them. Write them down and come back to them.
Let Pathfinder Run the Conversation for You
AVANT’s cybersecurity assessment tool in Pathfinder walks you and your customer through these same five areas, including third-party risk and recovery, in a structured conversation built on NIST CSF 2.0.
As you go, the live Cyber Defense Matrix fills in, showing what your customer already has in place, where there’s room to upgrade and where the critical gaps are. Every “I don’t know” gets captured instead of forgotten. Annual value estimates show you where to focus, and the exportable PDF gives your customer’s leadership one shared picture to act on.
And because every assessment is saved, the conversation doesn’t end when the meeting does. Revisit it regularly, see what’s changed and pick up right where you left off. When you’re ready for next steps, one click brings your AVANT team in.
Cybersecurity Awareness Month wraps up this week, but the threats don’t take the rest of the year off – and neither should these conversations.