📋 GRC compliance for CMMC 2.0, CPCSC, CPA Canada, IIROC…SaaS discovery for data governanceFree enriched web chat widget🚀 Enriched remote support without your laptop

Cybersecurity Assessment

Turn everything Lavawall knows about a company into a single security assessment report you can review, edit and hand to the client.

Where to find it
Reports › Report
Who can use it
Anyone who can see the page
Plan
Vulnerability assessment
For
Everyone

What the page is for

The Cybersecurity Assessment page gathers security data for the selected company into one report. It opens with an Executive Summary and then groups findings into sections such as devices and infrastructure, missing patches, configuration issues, devices needing replacement, identity and account issues, domain and email security, cloud security, suspicious IP addresses, active threats, ransomware hunting and vulnerability scan results. A section only appears when there is data for it.

The Security Assessment Report section is the formal write-up. You can add your own findings (for example, physical security or training observations) with a severity, recommendation, management response and mitigating controls, set the audit period, reorder sections, and then export the report to Word or copy it.

Nessus is optional. If you import Nessus scans on the Nessus Scanner page, the report adds vulnerability scan sections, including a trend across scans and a list of vulnerabilities that were fixed. Domain and email findings appear once the company's domains have been scanned on the Domain Scan Results page.

What you see

The Cybersecurity Assessment page, with the toolbar, executive summary, security assessment report, report config, finding sections and add finding numbered 1 to 6.
The Cybersecurity Assessment page. Numbers match the list below.
  1. Toolbar: Refresh, Print, Nessus Upload & Config, Expand/Collapse All and Copy to Clipboard.
  2. Executive Summary: a plain-language overview of what the assessment covered and the main results.
  3. Security Assessment Report: the formal report, with Export .docx, Copy Report, Branding and Report Config.
  4. Report Config: audit period, custom sections and findings, section order, scope and inclusion settings.
  5. Finding sections: collapsible sections for each area, from Device & Infrastructure Overview to Vulnerability Scan Findings, Vulnerability Scan Trend, Remediated Vulnerabilities and Compliance Posture.
  6. Add Finding: the dialog for writing your own finding.

How to use Cybersecurity Assessment

How to produce a report

  1. If you have not already, scan the company's domains on the Domain Scan Results page, so the domain and email findings are included.
  2. Select the company in the company picker.
  3. Wait for "Gathering security data..." to finish, then read the Executive Summary.
  4. Use Expand/Collapse All or click a section heading to review each area.
  5. Open Security Assessment Report and click Export .docx for a Word document, or Copy Report to paste it elsewhere. Print prints the whole page.

How to set the audit period

  1. In Security Assessment Report, click Report Config.
  2. Under Audit Period, type a label (for example "2026-Q1") and click the check button.
  3. Enter a Start and End date and click the check button. The report uses this range to show which Macs were out of date during the assessment and how many were updated by the end. Resolved issues stay in the report for the whole period.

How to add your own finding

  1. In Report Config, under Custom Report Sections & Findings, click Add Finding.
  2. Choose a Report Section, or pick New section heading and choose a preset (such as Physical Security or Backup & Recovery) or type your own, then choose its Position in Report.
  3. Enter the Finding Title and choose a Severity. Click Guide me to answer a few questions and get a CVSS-aligned rating, or (what each level means) for definitions.
  4. Write the Description, Recommendation, Management Response and Mitigating Controls.
  5. Click Save Finding. Use Add Heading to create an empty section first if you prefer.

How to tailor what the report includes

  1. Open Report Config.
  2. Drag sections in Section Order to reorder them, or click Reset.
  3. Under Assessment Scope, tick the areas the Executive Summary should say were covered. Reset returns to the areas detected from the data.
  4. Toggle domains under Domain Scan Inclusions and email domains under Personal Email Domains.
  5. Set the Administrator Threshold (how many admin accounts count as excessive) and the monthly Licence Cost per Seat in Canadian dollars to show what dormant and suspended accounts cost each year. Leave the cost blank to omit it.
  6. Give friendly names to addresses under IP Address Names. They appear throughout the report.
  7. After reviewing, you can move suspicious IP or external sharing details to an appendix, include the Discovered SaaS Register as an appendix, turn Combined Findings groups on or off, and add non-compliant controls from Compliance Assessment Findings.

Tips

  • Nessus is optional. If you use it, upload a recent scan before building the report so the vulnerability sections are current. If more than one scan exists, a scan picker above the vulnerability section lets you choose which one it uses.
  • Combined Findings reports a control once even when several frameworks assess it. Turn a group off to list those controls separately.
  • Use Branding to set the logo and colours used on branded output.
  • Copy to Clipboard copies a prompt you can paste into an AI assistant to draft a narrative assessment. That section is not printed.

Troubleshooting

  • A section I expect is missing. Sections only appear when the company has data for them, for example Vulnerability Scan Findings needs an imported Nessus scan.
  • Domain and email findings are missing. Scan the company's domains on the Domain Scan Results page first. The findings appear in the report after the scan.
  • The report still shows an old issue. Issues resolved during the audit period stay in the report for that period by design.
  • Dormant account costs are not shown. Enter a Licence Cost per Seat in Report Config.
  • Too many admin accounts are flagged. Raise the Administrator Threshold for larger organizations.

Task guides that use this page

Still need help?

Search the support centre, or contact our support team and tell us which page you were on.

Names, companies, devices and figures in the pictures are examples. Other product and company names are trademarks of their respective owners.

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.