The short answer: An IT audit looks broadly across devices and licences, accounts and access rights, backups, networks, email, updates, physical security, and supplier contracts. The outcome is a risk-prioritised list of findings, not a hundred-page report. A penetration test, by contrast, goes deep: it is a simulated attack on one specific target. In a business that has never tested recovery from backup and does not know who has an administrator account, a penetration test will merely confirm—at considerable expense—what you already know. Audit first, fix the fundamentals, and only then commission a penetration test.
Small businesses usually arrive at the question „Should we have an audit done?" in uncomfortable circumstances: a customer has sent them a questionnaire, a bank is asking about cybersecurity, or something has happened to another business they know. And the first proposal on the table is often a penetration test because it sounds specific and measurable.
But that is the wrong order. The CIS Controls framework has eighteen areas: asset inventory is Control 1, while penetration testing is Control 18—the last one. The set of safeguards that CIS describes as essential cyber hygiene for the smallest organisations with limited resources (Implementation Group 1, comprising 56 safeguards) contains no penetration-testing safeguards at all; they appear only in the more advanced IG2 and IG3 groups. The following sections explain what is covered in an audit of a business with 5–50 employees and no in-house IT team.
IT audit vs. penetration test: what is the difference?
| IT audit | Penetration test | |
|---|---|---|
| What it examines | The company’s entire IT environment: devices, licences, accounts, backups, network, email, suppliers, and physical access | One target: the external perimeter, a web application, the internal network, or employees’ resistance to phishing |
| Method | Inventory, configuration checks, and interviews with the people who use the systems | A simulated attack—finding and actually exploiting weaknesses to demonstrate their impact |
| Outcome | A prioritised list of findings with an estimate of the work required to address them | A report explaining what the attacker managed to achieve and how they got there |
| When it makes sense | Always as the first step, and then after major changes | Once the fundamentals are in place and you want to verify that they hold up |
| Typical scope | Broad: everything the company operates | Deep: a narrowly defined target, agreed rules, and a specified time window |
| What it does not reveal | Whether a specific weakness can actually be exploited and how far an attacker could get | Anything outside the agreed scope—such as a missing backup, expiring support, or a former employee’s account |
Put simply, an audit answers „What do we have, and what is wrong with it?„, while a penetration test answers „Can this specific part withstand a real attack?" The second question only makes sense once you know the answer to the first.
Step 1: Inventory devices, software, and licences
The process starts with an inventory because you cannot protect something you do not know you have. The audit establishes who has which laptop and whether it belongs to the company or the employee. It checks which operating system it runs and whether that system is still supported—Windows 10 reached the end of support on 14 October 2025, and machines still running it no longer receive security patches. It also records how many servers there are and where they are located, as well as any NAS devices, printers, cameras, and routers. Finally, it identifies what runs in the cloud and whose payment card is being charged for it.
Then come the licences: how many Microsoft 365 licences the company has and how many people actually work there. In small businesses, these figures almost never match. The company is either still paying for people who left two years ago, or someone is working under a personal licence that the company cannot access. The findings follow a consistent format: the number of workstations running unsupported software, the number of paid licences compared with active users, and any systems for which nobody in the company has administrative access.
Step 2: Accounts and access rights — who can access what?
This is usually where the largest number of findings emerges, while remediation tends to be the least expensive—it is generally a matter of configuration rather than purchasing new equipment.
The audit identifies who has administrator privileges and whether they need them for their daily work or merely have them because „the previous IT person set it up that way." It also checks the accounts of people who no longer work for the company: email, accounting, invoicing, e-commerce, cloud services, and VPN access. Departures are usually handled only through payroll, not IT.
Multi-factor authentication (MFA—in addition to a password, a second form of verification, typically a code in a mobile app) is checked wherever it is available at no extra cost: email, cloud services, remote access, and website administration. The audit also looks for shared passwords—a single „company" password used by five people cannot be changed without affecting everyone.
Supplier accounts are a separate issue: domain registration, hosting, and DNS. If the domain is registered to a former contractor’s personal email address, that is not merely a technical problem but a legal one. The article on what to do when your IT administrator leaves explains how to regain control of these accounts.
Step 3: Backups — do they exist, and has anyone tried restoring them?
The question is not „Do you make backups?"—the answer is almost always yes. The real question is: When did someone last restore data from a backup and verify that it was usable?
NÚKIB’s ransomware guidance defines the minimum as follows: the 3-2-1 rule (at least three copies on two different devices, with one stored outside the organisation), at least one backup kept offline at any given time, an established recovery plan, and regular testing to confirm that backups can actually be restored.
The audit therefore asks specific questions. Are only files backed up, or are the accounting system’s databases and server configurations included as well? Can the backup storage be reached from the same network and with the same account used for everyday work? (If so, ransomware will encrypt it along with everything else.) How long are backups retained? Attackers often remain in a network for days or weeks, so a short retention period may mean restoring the company to a point when the attacker was already present. And how long can the company operate without its systems? Only that answer can determine whether the existing backup arrangement is adequate. The article ransomware in a business: the first 24 hours explains what happens during the first hours after an incident.
Step 4: Network, router, and Wi-Fi
A router or firewall supplied by the internet provider may remain untouched for years. The audit checks whether the manufacturer still releases firmware for that model, whether its administration interface is accessible from the internet, and whether the default password is still in use.
Next comes segmentation: dividing the network into sections that do not need to communicate with one another. NÚKIB considers this a fundamental safeguard. In a „flat" network, where workstations, servers, printers, and personal phones all share the same space and can see one another, malware can spread without obstruction. A realistic minimum is a separate guest Wi-Fi network and a separate segment for cameras, printers, and other devices that nobody updates.
The Wi-Fi password is a separate item: if it has not changed since the company moved into its current premises, every former employee and temporary worker still knows it.
This audit only records the condition of cabling, network cabinets, and port labelling; the procedure itself is covered in the article on auditing computer networks and cabling.
Step 5: Email and domain — SPF, DKIM, and DMARC
Three DNS records determine whether anyone can send email in your name:
- SPF specifies which servers are authorised to send email for your domain. If it is missing, messages can be sent from anywhere.
- DKIM adds a digital signature to outgoing messages. The recipient verifies it against the public key in your DNS and can confirm that the message was not altered in transit.
- DMARC tells the recipient what to do when a message fails the previous checks—take no action, quarantine it, or reject it—and can send reports about the senders using your domain.
A fraudulent invoice supposedly „from the managing director" or a request to change a bank account number does not require an intrusion into the network. An inadequately protected domain is enough. The audit checks these records and recommends an implementation order that prevents legitimate email from the online store or invoicing system from being disrupted.
Step 6: Updates, endpoint protection, and physical access
The audit determines whether updates are installed at all and who is responsible for monitoring them. This is not limited to the operating system—browsers, PDF readers, accounting software, network-device firmware, and website plugins also fall behind.
For endpoint protection, the audit distinguishes between conventional antivirus software, which compares files against known signatures, and EDR (Endpoint Detection and Response), which also monitors behaviour and can reconstruct what happened on a workstation. EDR is not mandatory for a small business, but there is a significant difference between „we have antivirus„ and „someone reviews what it reports."
Physical security is often overlooked: a server in an unlocked room or under the stairs, an untested uninterruptible power supply (UPS), retired drives and laptops being disposed of without their data being erased, and unencrypted drives in machines used outside the company.
Step 7: Suppliers and contracts
The final area concerns dependencies rather than technology. The audit checks whether there is a written contract or whether everything is agreed over the phone. What response time has been agreed if something goes down, and is it documented anywhere? Who is registered as the owner of the domain, hosting account, and cloud tenants? And can the managing director find a list of access credentials when needed?
There is nothing inherently wrong with having a single self-employed external contractor provide IT services. The problem arises when that person is the sole repository of all knowledge about the company’s IT—and then falls ill, changes careers, or becomes involved in a dispute over an invoice.
Some companies must also consider a regulatory layer. Whether the new Czech cybersecurity regulations apply to your business is covered in the article on zákon č. 264/2025 Sb. and NIS2; it is also relevant to suppliers of companies subject to the law.
What the owner actually receives after the audit
A good small-business audit should not result in a hundred-page bound report. It should produce something the company can start working with on Monday morning:
- A list of findings, each explaining in one sentence what is wrong and what risk it creates—without jargon.
- Priorities: what must be addressed immediately, what should be handled within weeks, and what is simply a note for the future.
- An estimate of the work required, so the company can decide what to do now and what can wait for the next budget.
- An inventory of devices, licences, and accounts—a table that can be maintained over time.
- Answers to two questions: how long it takes to restore operations from backup and how much data could be lost in the worst case.
Once the owner has this information, they can decide what to purchase. An audit that ends with the sentence „We recommend a comprehensive solution" has not done its job.
When a penetration test makes sense—and when it is a waste of money
A penetration test is a useful tool when applied in the right situation. At the wrong time, it is an expensive way to learn what you already knew.
It is a waste of money when:
- you have no inventory of devices and accounts—the tester has no baseline against which to interpret the results;
- you have never tested recovery from backup—that represents a greater risk than anything the penetration test is likely to find;
- you already know that systems are unpatched or machines are running unsupported software—the finding will simply confirm this;
- nobody is available to remediate the findings—the report will end up in a drawer;
- you are commissioning it solely to answer a customer questionnaire, with no intention of changing anything.
It makes sense when:
- the fundamentals are in place and you want independent verification that they hold up;
- you operate a custom system—a web application, portal, or online store that processes payments—where configuration checks are insufficient and someone needs to try bypassing the controls;
- you have systems exposed to the internet, such as a VPN or remote desktop, and want to know how far an attacker could proceed from them;
- a customer or insurer requires the test and you have the capacity to remediate the findings.
Before commissioning one, three things must be clear: exactly what will be tested (addresses, applications, and scope), from where (externally or internally, as though the attacker were already inside the network), and what is permitted—whether the tester may only identify vulnerabilities or actually exploit them. NIST describes the technical testing methodology in SP 800-115.
One useful question to ask before placing the order is: If someone told me tomorrow that they had gained access, would I know how they got in, and would I have a usable backup from which to rebuild the company’s systems? Anyone who can answer yes is ready for a penetration test. Anyone who cannot will save money by starting with an audit—and then repeating it once a year.
ITHOPE provides initial IT audits for small businesses in Brno and the surrounding area covering exactly this scope. We work through steps 1 to 7 above, verify the state of your backups—including a test restoration—and provide a list of findings ranked by priority. You can learn more about follow-up IT management and backup services and our other services in the Business IT section. If the audit shows that a penetration test makes sense, we will say so—and we will be equally clear if it does not.
Sources
- The 18 CIS Critical Security Controls — the ordering of areas in version 8.1 of the framework.
- CIS Controls Implementation Group 1 — 56 essential cyber-hygiene safeguards for organisations with limited resources.
- CIS Control 18: Penetration Testing (v8.1) — classification of safeguards within the IG2 and IG3 groups.
- NÚKIB: Ransomware — doporučení pro mitigaci, prevenci a reakci (v1.2, 22. 5. 2023) — the 3-2-1 rule, offline backups, recovery testing, and segmentation.
- Microsoft Lifecycle: Windows 10 Home and Pro — end of support on 14 October 2025.
- NIST SP 800-115: Technical Guide to Information Security Testing and Assessment — testing methodology.
Where to find us
ITHOPE is a company based in Brno, Czechia: we do data recovery from disks, RAID and NAS, PC and laptop service and IT for business, all in our own lab at Viniční 3587/216, 615 00 Brno.
Phone +420 775 556 063 (24/7 line). You can bring the device in person, or send it by courier (Zásilkovna, PPL).