Questions to Ask a Cyber Security Expert
These are good questions to ask a cyber security professional when you are a small business owner, office manager or team lead with an hour of a consultant's time, and the last group is for students and career changers who want to hear about the work itself. The 61 questions follow the order such a meeting usually takes: your likeliest risks, accounts and devices, email and payment fraud, backups and incidents, how to work with the expert, then their career. Reporting duties, insurance conditions and the rules on ransom payments differ by country and by policy, so several questions ask how it works where you are.
Want questions from the whole vault instead? Try the random question generator.
The questions
Each question, and why to ask it
Risks
If you only had a week and a small budget here, what would you change first?
Why ask it
Forcing a constraint produces a ranked answer instead of a full framework, and it shows whether the person can triage. Consultants who cannot start anywhere without a full audit tend to produce long reports and few completed changes.
What is the most likely way an organisation like ours actually gets compromised?
Why ask it
You want the boring, common route rather than the interesting one, because that is where your money should go. An answer built around stolen credentials, invoice fraud and unpatched remote access is a sign of someone who works with real incidents rather than headlines.
Which of our information would do the most harm if it were leaked or lost?
Why ask it
Customer records, payroll, contracts, designs, medical or financial details: the ranking differs for every business, and an outsider cannot know yours without asking. Whatever comes top is where encryption, tighter access and the best backups go first. If the answer is that everything is critical, nothing has been ranked yet.
Where is our data stored, and who has access to each place?
Why ask it
The inventory usually turns up files in personal drives, old file shares and a departed employee's cloud account. Asking for it is unglamorous and tends to surface the largest single risk in the room.
If you were trying to get into our systems, how would you do it?
Why ask it
This turns an abstract discussion into a specific path through your own organisation, usually involving a named service or a particular person's inbox. Note whether they start with technology or with people, since a great many break-ins begin with a person and not with a machine.
Which of our accounts would an attacker go for first, and why?
Why ask it
The answer is often not the chief executive but whoever can approve payments, change a supplier's bank details or export the customer list. Identifying those few accounts is what makes stronger controls affordable, because you protect ten accounts properly rather than a hundred loosely.
What can a stranger see of us from the internet without logging in?
Why ask it
Typical finds are a remote desktop left open, a forgotten test website, an old VPN box and the login page of the accounting system. With your permission a professional can map this from the outside quite quickly, and owners are often surprised by the length of the list. Have each item come back with the name of whoever is responsible for it.
Which of our suppliers could hurt us most if they were breached?
Why ask it
Payroll providers, accountants, booking systems and IT support often hold more of your data or access than anyone internally. Ranking them shows where to ask questions and where a contract clause about notification would be worth having.
What should staff be allowed to paste into AI chat tools and free online services?
Why ask it
Customer details and contracts go into chatbots, translation sites and file converters every day in offices where nobody ever decided that was allowed. A security professional cannot make that decision for you, but can tell you which tools keep what is typed into them and where the settings are. One page naming the approved tools works better than a ban people ignore.
What surprised you at the last organisation like ours?
Why ask it
This gets you a real story rather than a category, and the surprise is often something mundane such as a shared administrator password or a server nobody knew was still running. It is also a fair test of how much comparable work they have actually done.
What are you seeing at the moment that published guidance has not caught up with?
Why ask it
This invites them to speak from current experience and not from a checklist. A specific answer with a caveat about uncertainty is a good sign; a confident sweeping prediction usually means you are being sold something.
What are we already doing well that we should leave alone?
Why ask it
An assessment that lists only faults gives you no idea which habits to protect when staff or systems change. It is a check on balance as well, because someone who has looked properly can nearly always name two or three things that are working.
Accounts and devices
Which of our accounts can reset everyone else's password?
Why ask it
Every setup has a few accounts that control the rest, typically the email tenant administrator, the domain registrar and the password manager. If nobody can list them without going away to check, nobody is watching the accounts that matter most.
Where is multi-factor authentication turned on, and where is it still missing?
Why ask it
Where it is missing is the part worth the meeting. Gaps cluster in the awkward places: shared mailboxes, the finance portal, the domain registrar, remote access, service accounts. Get the gaps written down system by system with a date against each, so they can be ticked off and not merely discussed.
Which kinds of multi-factor authentication are strong enough for us, and which would you steer us away from?
Why ask it
The forms are not equivalent: codes sent by text can be intercepted or redirected, app-based codes are stronger, and hardware keys are stronger again. Hear which one they would insist on for the email administrator and the bank login, and which is good enough for everyone else.
Should we be using a password manager, and which logins go into it first?
Why ask it
The case for one is that people stop reusing a single password across the bank, the email and the supplier portal. Find out who would hold the recovery method and what happens when the person who set it up leaves, because a vault nobody can open is an incident of its own. Passwords that live in a spreadsheet today are the obvious first entries.
Which logins are shared between several people, and what would it take to end that?
Why ask it
With a shared login nobody can say who did what, and the password is rarely changed when someone leaves. Sharing usually began because a service charges per user. A sensible reply names the few places where separate accounts are worth paying for: banking, email administration, anything that holds customer data.
Who has administrator rights on the laptops, and does that include everyday users?
Why ask it
Day-to-day accounts with administrator rights turn one bad click into an installation. The usual arrangement is a separate admin login that comes out only when something has to be installed. If everyone is an administrator because it saves time, that was a decision, not a technical necessity.
What do we do about accounts belonging to people who have left?
Why ask it
An account that still works months after its owner has gone is a standard route in, and nobody notices it being used. Go through the leaver checklist together and settle who runs it, since this fails when it belongs to nobody. The easily forgotten items are the shared mailbox, the supplier portal and the company's social media login.
How should we handle staff using their own phones and laptops?
Why ask it
There is a real trade-off here between control and cost, and the honest answers range from full device management to simply keeping company data out of personal storage. Beware advice that assumes an enterprise budget you do not have.
Which of our systems are no longer getting security updates?
Why ask it
Unsupported software is the quiet risk: an old server, a network appliance nobody logs into, phones that stopped receiving updates two years ago. Reassurance is not what you came for. Leave with an end-of-support date against each item and a decision to replace it, wall it off or accept it knowingly.
Who is responsible for installing updates, and how would we know one had been missed?
Why ask it
Laptops mostly update themselves. The router, the firewall, the printer, the website's plugins and the till often do not. What you are after is one named person and a monthly look, not another tool, and the worst answer is that each user handles their own machine.
Most of our work sits in cloud services, so which parts of securing them are still our job?
Why ask it
The provider keeps the service running, but who can sign in, what is shared by public link and whether a deleted file can be brought back are normally left to the customer. Have the expert open the admin console of your email and file service with you and walk through the sign-in and sharing settings. How long deleted items are kept differs by provider and plan, so look up yours.
What happens if a laptop is stolen from a car this afternoon?
Why ask it
This tests encryption and remote wipe in practice rather than in a policy document. You want three things confirmed: the disk is encrypted, a wipe can actually be triggered, and nothing important exists only on that machine.
Is our office Wi-Fi set up so that a visitor's phone cannot reach our files?
Why ask it
The usual fix is a guest network kept apart from the one the shared drive and printers sit on, and many office routers can do it. While they are looking, find out who knows the main password, when it last changed, and whether the smart television and the door camera are on the staff network.
Email and fraud
What would a phishing email that fooled us actually look like?
Why ask it
Advice about spelling mistakes and odd greetings is out of date, because convincing messages now arrive from genuinely compromised accounts and reference real invoices and real projects. Have them draft the message they would send your bookkeeper, using only what your website and public profiles give away.
What stops one compromised email account from turning into a fraudulent payment?
Why ask it
Diverting a payment needs no malware at all: a real email thread, a new set of bank details and one person in a hurry. The defences are mostly procedural, such as confirming any change of bank details on a number you already hold and a second approver above a set amount. If the answer is only technical, the gap is in your process and not in your software.
If somebody rang the office pretending to be me, how would we check?
Why ask it
Voice and video are cheap to fake now, so recognising the voice proves little. What holds up is a rule agreed in advance: any urgent request for money or a password gets a callback on a number already on file, however senior the caller sounds. Staff also need to hear from you that hanging up on someone who sounds like you will never get them into trouble.
Could someone send email that appears to come from our own domain?
Why ask it
A domain can publish settings, known as SPF, DKIM and DMARC, that tell other mail servers which senders are genuine, and on a small firm's domain they are often missing or left in a mode that blocks nothing. They are public, so the expert can look yours up on the spot. Before anything is tightened, list the services that send mail in your name, such as the newsletter tool and the invoicing system, or their messages will start bouncing.
What should someone do in the first five minutes after clicking something they regret?
Why ask it
The instruction should be short enough to print on a card: who to tell, whether to disconnect, what not to delete. Speed matters more than certainty here, so the wording has to make a false alarm feel like a normal thing to report. Then follow the report itself, because a warning that sits unread until Monday has helped nobody.
Could someone be quietly reading one of our mailboxes, and where would we look to find out?
Why ask it
An intruder in an email account often adds a rule that forwards messages out or hides replies, then waits for a conversation about an invoice. Have them show where those rules and the record of recent sign-ins live in your mail system. The mailboxes of whoever pays suppliers and whoever signs contracts are the ones to check first.
Which security training changes behaviour, and which just produces a certificate?
Why ask it
A yearly slideshow with a quiz proves attendance and little else. What tends to stick is short and specific, such as ten minutes on a changed-bank-details request for the people who pay invoices. Find out how they would tell it had worked, for instance staff reporting suspicious messages sooner.
Incidents
What happens to us tomorrow if everything is encrypted tonight?
Why ask it
Asking for the practical consequence forces a walk through payroll, orders, customer contact and records, which is where the real dependencies appear. It also reveals whether anyone has ever thought about how the business would operate on paper for a week.
Have our backups ever been restored as a test, and could an intruder reach them too?
Why ask it
A backup that has never been restored is an assumption, not a safeguard, and it is common to find them incomplete or reachable from the same compromised network. Ask specifically whether a copy is kept offline or cannot be altered, and when the last successful restore was.
How long would a full restore take, and how much recent work would be gone?
Why ask it
Those are two separate numbers: the time until people can work again, and the age of the newest copy that can be recovered. The owner should set both, because a firm that cannot invoice for three days is in a different position from one that can wait a week. If nobody can quote either figure, book a timed test restore.
How would we know if someone were already inside?
Why ask it
An intrusion can sit unnoticed for weeks, and the first word sometimes comes from a bank, a customer or a supplier and not from your own systems. You are listening for what is being logged, who looks at it and how often, because monitoring nobody reads is the same as no monitoring.
Who do we call in the first hour of an incident, and in what order?
Why ask it
This should be a written list of names and numbers, including someone technical, your insurer, and whoever can authorise taking systems offline. If it does not exist, producing it is the cheapest useful thing to come out of the conversation.
What do people do in a panic that makes a breach worse?
Why ask it
Wiping a machine destroys the record of what happened, and discussing the problem over a compromised email account tells the intruder they have been seen. Some insurers also expect to hear before anyone is hired or any demand is answered, so check what your own policy says. Keep the list of things not to do on the same sheet as the phone numbers.
If we received a ransom demand, who decides what happens next?
Why ask it
There is no general right answer to give here, and whether a payment is lawful or must be reported can depend on your country and on who is demanding it. What the conversation can settle is who has the authority, who advises them (insurer, lawyer, incident responder) and how each is reached at night. Naming the decision-maker in advance saves the hours an argument would cost.
What are we required to tell customers or regulators, and how quickly?
Why ask it
Notification duties depend on where you operate, what sector you are in and what data is involved, so treat the expert's answer as a pointer and have it confirmed against the regulator's own guidance or by a lawyer. Settle who would draft the notice too, because drafting is slower than people expect while the clock is running.
What does our insurance require us to be doing?
Why ask it
Cyber policies often name controls you are expected to have, multi-factor authentication and working backups among them, and an insurer may question a claim if they were missing. Policies differ, so read the conditions of your own and not only the headline cover, and keep the incident hotline somewhere you can find it when systems are offline.
Would you run a practice incident with us, and who should be in the room?
Why ask it
This is usually called a tabletop exercise: an hour around a table with an invented scenario, such as the finance laptop locking on payroll day. It finds gaps cheaply, like the insurer's number being stored on the locked machine or only one person being able to reach the bank. Whoever handles money and whoever speaks to customers belong there, not only the person who looks after IT.
Working together
How much of this can we run ourselves, and what genuinely needs a specialist?
Why ask it
The dividing line matters for cost and for whether the work survives after the engagement ends. Be wary of an answer that puts everything on one side or the other, since routine hygiene is usually internal and detection and response usually are not.
How do you charge, and what would a first review of a firm our size come to?
Why ask it
Day rates, fixed-price assessments and monthly retainers all exist and suit different needs: a fixed price for a defined review, a retainer if you want someone to ring when things go wrong. Get the scope written beside the figure, including how many hours of your own staff's time it assumes.
Looking at what we already pay for, what should we stop?
Why ask it
Small organisations often carry overlapping tools bought after previous scares, none fully configured. A consultant willing to recommend cancelling something is more credible than one who only adds, particularly if they would earn nothing from the removal.
Do you earn anything from the products or providers you recommend?
Why ask it
Reselling is common and is no mark against anyone. You simply need to know which recommendations carry a margin, and whether there is an alternative they do not sell. Someone used to being asked answers in a sentence.
What will we have in writing when you finish?
Why ask it
Settle this before the work starts: findings in priority order, the evidence behind each, a rough cost and who should carry it out. A redacted sample from an earlier client shows you the real thing. Reports written for auditors are hard to act on, so request a single page the owner can read as well.
What access to our systems will you need, and what happens to it afterwards?
Why ask it
Anyone assessing you ends up holding passwords, an administrator account or a copy of your configuration, which makes them a supplier whose own security matters to you. Three things to hear: an account in their own name and not a borrowed one, a description of how they store what they learn, and written confirmation at the end that the access is gone. A confidentiality agreement is ordinary and should not cause offence.
Do we need a penetration test yet, or would it only confirm what you can already see?
Why ask it
A penetration test is a paid, authorised attempt to break in, and it is worth most once the basics are in place. If multi-factor authentication is missing and the backups are untested, the test will report exactly that at a higher price. A straight professional will say when it is premature, and also when a customer contract or an insurer makes it necessary anyway.
Is there a security standard worth following at our size, and would customers want proof of it?
Why ask it
Several countries publish a baseline scheme for small organisations, and some customers and tenders call for a named certificate. Which one applies depends on where you operate and whom you sell to, so have them say what they see requested locally. Even where no certificate is needed, a published baseline is a free checklist to borrow from.
How often should we repeat this review, and what should prompt one sooner?
Why ask it
Once a year is a common rhythm, but the triggers matter more: a new system, an office move, a merger, a key person leaving, an incident at a supplier. A follow-up that earns its place is what they would re-check first next time, since that is where they expect today's fixes to slip.
Their career
How did you get into cyber security, and would you take the same route today?
Why ask it
Plenty of people arrived sideways, from IT support, networking, software, the military or law, so the first half tends to produce a story. The second half is the one a student or career changer needs, because entry routes shift and the person can say which doors are still open.
What does an ordinary week look like in your job?
Why ask it
Security covers very different jobs: watching alerts in an operations centre, testing systems, writing policy, advising clients. Follow up with what last week held in particular, which gets a truer picture than a description of the role. The share of it spent in meetings and writing reports surprises people who know the work from films.
Which skills do you use every day that nobody mentioned while you were training?
Why ask it
Expect to hear about writing clearly, explaining risk to whoever controls the budget, and patience with old systems that cannot be replaced. It is a good one for students because most of those can be practised now, without a lab or a job.
Which certifications or courses were worth the money, and which would you skip?
Why ask it
Opinions differ sharply by specialism and by the job market in each country, so treat the answer as one view and compare it with what local job adverts list. Bring up the free routes too, such as a home lab, capture the flag contests and open source work, and which of those they would do in place of a paid course.
What do you look for when you hire someone for their first security job?
Why ask it
It puts the person on the hiring side of the table, a view that job adverts do not give. Listen for evidence over credentials: something built, broken or written up that an applicant could show them. If they have never hired, the best junior colleague they worked with makes the same point.
What do you do on your own phone and home network that most people do not?
Why ask it
Personal habits get past the official advice to what a professional thinks is worth the bother. The answers are usually modest: a password manager, updates switched on, a separate email address for banking, a backup that is tested. What they do not bother with is just as instructive.
What do people outside the field most often get wrong about it?
Why ask it
This suits a class visit, a panel or an interview for an article, because it invites a correction and not a lecture. You may hear that real attacks are more mundane than ingenious, or that the job is more persuading colleagues than outwitting criminals. Press for an example from their own work.
Is there an incident you worked on that changed how you do the job, as far as you can talk about it?
Why ask it
Much of this work is confidential, so offering the way out inside the question gets a better story than pressing for names. The part worth writing down is rarely the attack itself. It is what they now check first because of it.
What is the hardest part of the job to live with?
Why ask it
Nights on call, being blamed for an incident you warned about, and being noticed only when something fails all come up. It is a fair thing to ask if you are weighing the career, and most professionals answer it candidly. Follow with what keeps them in it.
If I wanted to start learning this month, what would you have me do first?
Why ask it
A good reply is an assignment: build a virtual machine and break it, read the public write-up of one real incident, go to a local meetup. Do it, then write to tell them how it went. That second message is how a single conversation turns into a mentor.
How to use these questions
Practical guidance for the conversation itself
Getting a useful answer
Choose the groups that fit your hour
An owner meeting a consultant should begin with Risks and go to Incidents next, since those two produce the list of fixes and the plan for a bad day. Accounts and devices and Email and fraud are the detail behind that list, and Working together is for the end, once you know whether you want this person back. A student or career changer talking to a security professional for a class, an article or an informational chat can go straight to Their career and borrow two or three from Risks, asked about organisations in general. Either way, send your five most important questions a few days ahead.
Describe your organisation before you ask anything
Headcount, what systems you rely on, whether you take card payments, whether you hold health or financial data, and who currently looks after IT. Without that, the advice you get will be generic, and generic security advice is how a ten-person firm ends up paying for tools nobody switches on.
Ask for findings in priority order with effort attached
A list of thirty issues is not a plan. Ask for the top five with an estimate of cost and time for each, and ask which single one they would do if you could only do one.
Insist on plain language
If you cannot explain a recommendation to a colleague in two sentences, you will not be able to get it approved or maintained. Ask for the reason behind each item, not just the item.
Agree what finished looks like
Security work drifts without a defined end point. For each action, write down who does it, by when, and how you will verify it was done, then check the list again in a month.
What the answers tend to reveal
- Whether they ask about your business before recommending anything. A consultant who starts with products has not started with your risk.
- Whether their advice includes process changes and not only purchases. Payment verification and leaver checklists cost nothing and prevent common losses.
- How they talk about the people who make mistakes. Contempt for users tends to produce controls that get bypassed.
- Whether they will tell you something is good enough. An expert who finds every part of your setup unacceptable is either right or selling, and it is worth getting a second view.
- Whether they mention testing restores, not just taking backups. People who have lived through a failed restore bring it up without being asked.
Common pitfalls
Buying from fear
Alarming statistics and worst-case stories are effective sales technique and poor prioritisation. Ask what the most likely loss is for an organisation your size, and spend against that rather than against the most dramatic scenario.
Treating a certificate as security
Passing an audit or holding a standard demonstrates that a process exists on a given date. It is useful for winning contracts and it is not the same as being difficult to attack, and the two budgets should be discussed separately.
Leaving the plan with the consultant
Whatever you agree needs an internal owner, even a part-time one. Recommendations that depend entirely on an outside party stop happening when the invoice ends.
Not asking about conflicts of interest
Many consultants resell the products they recommend, which is not automatically wrong but is worth knowing. Ask directly whether they earn anything from the tools on their list.
Follow-ups worth keeping ready
- "What would that cost us, including the time from our side?" Internal effort is the cost most often left out of a quote.
- "Who owns that once you have left?" Exposes recommendations that quietly depend on the consultant staying.
- "What breaks for staff if we do that?" Controls that make ordinary work difficult are the ones people work around.
- "How would we check in six months that it is still working?" Turns a one-off fix into something you can verify.