A 20-minute weekly security review for a small IT team
Regular scanning helps when someone turns observations into decisions. A short recurring review can catch new exposure while keeping the work manageable.
Before the meeting
Keep the last report and the prior one available. Bring the inventory of public domains, approved internal ranges, device licenses and open remediation items. Invite someone who can change the firewall, DNS and endpoint policies, or give those people specific follow-ups.
The 20-minute agenda
- Minutes 0–4: changes. Start with the alert email, or the gold “What changed” list at the top of the latest report: what appeared, disappeared or changed since the last completed scan? Confirm timestamps and incomplete checks before calling a result resolved.
- Minutes 4–8: coverage. Are new hosts, domains, IPs or discovered devices outside the approved scope or license count? A scan cannot describe the devices it did not assess.
- Minutes 8–13: access and exposure. Check unexpected public services, especially remote access and any newly opened port; confirm that needed access goes through the intended controls. Review identity and MFA settings in their own admin tools.
- Minutes 13–17: maintenance. Check vendor update queues and reboot state using endpoint management. For “verify patch level” findings, confirm the installed package against the vendor’s security notices, then sign the finding off in Torva as Verified so it leaves next week’s list. Make sure automatic Windows and Microsoft 365 updates are installing, rather than reading each patch alert. Check whether a changed service, firewall rule or TLS setting needs attention.
- Minutes 17–20: ownership. Choose a few changes, assign owners and due dates, and note how each will be verified.
Run it from the dashboard
Start with the grades and “What changed”: anything new since last week, and any actively exploited issue at the top. Then work “What to fix” by tab (Update software, Change a setting, Reduce exposure). Open each issue for its fix steps and affected devices, mark it in progress when someone takes it on, or send it to your IT provider by email. Glance at “Things to review”, informational items to confirm are expected. Once a month, download the Executive summary for leadership; it lists any risks you’ve accepted, by severity, with their review dates.
Record just enough evidence
For each work item, save the finding, affected assets, proposed change, who approved and performed it, completion time, and the follow-up result. If a system needs an exception, write its business reason, compensating controls, owner and review date. Keep the original record when a later scan changes.
Edge and Core run daily or weekly, depending on the schedule selected, and Complete adds a weekly scan of all 65,535 public TCP ports. A manual update can help check a completed change sooner. A scan is one input into this review, alongside endpoint, identity, backup and change-management records.
Make the next fix clear. See a sample report with actionable findings and compare plans.
Further reading
Keep learning
One security fix can address several findings: how to group the work · Why configuration can drift after an update or hardware change · All guides