Security Brutalist Gap Assessment

This tool helps you evaluate gaps in your security program using a simplified Security Brutalist checklist.

Please respond to each question and provide either the supporting information or the answer. Only check the boxes if you have an answer, whether it's "yes" or "no." If you're unsure or still working on it, leave the box unchecked. Once you're done, click the "Assess" button. You can then export the results in multiple formats.

1. Define Mission-Critical Functions What are the few core functions this business must protect for survival? Clarify acceptable disruption (risk appetite) in terms of downtime, loss, or exposure. Clarified what failure looks like?

2. Map Current Structural Defenses What resiliency processes (backups, failovers, incident response, recovery) exist? Recovery processes tested? What preparedness activities are regularly executed (testing, rehearsal, exercises)? Confident in recovery under pressure?

3. Catalog Existing Controls & Processes Controls in actual use: List what is actively being done to prevent, detect, and respond to threats. Controls mapped to prevent/detect/respond? Maintenance cost understood? (Capture the rough effort/cost to maintain each control) Redundant/overengineered controls flagged?

4. Understand Current Risk Assessment What model (formal or informal) is used to evaluate risk? Use of data vs intuition clarified? (How is likelihood vs. impact judged today?) Risk decision ownership clear? (Who makes the judgment, and using what data?) Control ↔ risk reduction is explicit?

5. Identify Brutalist Gaps For each core function, ask: Are we relying on complex tools where a simpler one would suffice? Are there controls/processes that look good on paper but don’t materially reduce risk? Where do we lack visibility or recovery capability if something goes wrong? Top 3 critical failure points known?

6. Prioritize by Impact Gaps ranked by real exposure? (Based on magnitude of exposure to mission-critical functions) Low-impact issues ignored? (Disregard “nice to have” improvements) Focus on core function risk only? (Controls that deliver structural reduction in risk)

7. Simplify and Realign Redundant controls removed? Non-material efforts stopped? Investment focused on impact? Each control answers "what risk changes?"