Security Planning

Baseline review, operations security review, or pen test?

Most small and mid-sized teams do not need to start with the biggest engagement. The right first step depends on whether the problem is basic security hygiene, environment layout, or the need to prove exploitable risk.

Jeremy Kenitz Apr 10, 2026 7 min read

If you run a contractor, facilities, field-service, or small manufacturing business, the most common mistake is jumping straight to a pen test when the environment still has obvious cleanup work. That usually creates a more expensive report, not a better outcome.

Start with a baseline review

Best when the main questions are email security, MFA, exposed services, web basics, and general posture.

Start with an operations review

Best when office systems, Wi-Fi, cameras, vendor access, and device separation are part of the real problem.

Start with a pen test

Best when you need to validate exploitable risk, test a target environment, or answer a stronger outside requirement.

When a Security Baseline Review makes sense

A baseline review is the best fit when the environment needs a strong first pass and the most likely wins are identity, email, external exposure, and core cloud setup. This is usually the right first move for teams that know they need help but are not sure where the biggest risks are yet.

When an Operations Security Review makes sense

This review is designed for mixed environments. If cameras, guest Wi-Fi, office systems, vendor access, remote admin tools, or shop devices are all living too close together, an operations review is usually the smarter first step.

When a pen test makes sense

A pen test is the right choice when you already have enough of the basics in place and need to know what an attacker could actually do. It is also the better choice when clients, insurers, or internal stakeholders need a more formal assessment.

A simple rule: if the biggest problem is "we need to clean up the basics," start with a baseline review. If the biggest problem is "our environment is messy and mixed," start with an operations security review. If the biggest problem is "we need to know what is actually exploitable," start with a pen test.

Do not overbuy the first step

Most teams benefit more from a well-scoped first engagement than from the largest possible assessment. A good first project should create clarity, reduce obvious risk, and make the next decision easier.

Need help picking the right first step?

Tell us what you are dealing with and we will point you to the best first engagement.