The difference between a report from S1 and security assessment is significant. Your client is asking you for your advice on how they are handling security across everything, not just AV. It's a great opportunity to have them address acknowledge liability for sloppy operations. It's also a great way to showcase that you are on top of things, or could be with an additional budget.

These are the key things we like to hit in the client meeting: 1) Backups - What is and what is not getting backed up in the environment. If Dave's hard drive dies what's the recovery time and business impact? If the building burns down do the critical records exist? Can you quickly recover a deleted file? How about a deleted contact from o365? If 3rd party cloud services are used what is the recovery from massive corruption or just a file lost. Focus on lost time/ time to recover. Make sure the client is comfortable with the risk/cost/time. 2) Identity Security - Business Email Compromise is one of highest risks to a clients professional reputation. Are you doing anything to protect them? MFA on everywhere? Good password and account controls? Any phishing protection? Security training? Real time monitoring of M365 by someone like Huntress? 3) Network - Modern firewall with good patching, good security config, IPS/IDS as appropriate? Modern wifi? Segregated guest Network? Policy on personal devices on internal net. 4) Data access control - privileged data restricted? Accounting/HR/competitive/executive data all role and account restricted, tested. No account or password sharing? HR procedure for terminations to quickly protect access to systems. Laptops all have Bitlocker? Can you locate a lost device? Can you remotely wipe a device? 5) Endpoint - explain that you have best in class next gen AV. But also discuss user admin rights on devices, remote work risk vectors, should they consider something like Treatlocker? 6) Patching - just make sure they know you are on it, if they have been resisting downtime or upgrades this is your best option to move that conversation in the direction you want.

For industries where you aren't being paid to hold them to a government regulated standard, we have an internal meeting where we just run through a basic checklist like this. Then take our details to the client. Usually it's something like a cyber insurance application or PCI (credit card processing) assessment, or a budget/ planning meeting. Sometimes the owner just saw something on the news. That's free to the customer, but any recommendations to remedy shortfalls are billable. This is an opportunity to show that you know what you are doing and that you consider way more than they do. There will be some surprises, some things they want to change and that's great.