If your network has grown organically over several years — new switches added as needed, a firewall rule added during an emergency and never revisited, a wireless AP installed by whoever was on-site that week — there’s a good chance nobody has a complete, current picture of how it’s actually built. A network assessment exists to build that picture, and to find the gaps hiding inside it.
Here’s what the process actually looks like, step by step.
1. Kickoff and Scoping
Before any technical work starts, we confirm what’s in scope: which sites, which infrastructure (wired, wireless, WAN), and who the technical point of contact is. This is also where access gets arranged — read-only credentials to switches, routers, firewalls, and wireless controllers, plus physical access for the on-site portion.
2. Physical Walkthrough
This step gets skipped by assessments that are purely remote, and it shouldn’t be. Walking the actual site reveals things that never show up in a config file: an unmanaged switch someone added in a closet, a wireless AP with a default password because it was a “temporary” install two years ago, cabling that doesn’t match the documented topology at all.
3. Automated Discovery and Scanning
Network discovery tools map every reachable device, its type, firmware version, and open services. This builds (or corrects) the asset inventory — a surprising number of businesses discover devices during this step that nobody currently on staff remembers installing.
4. Manual Configuration Review
Automated scanning flags candidates; a human analyst confirms them. This is where we review actual switch, router, and firewall configurations line by line — checking for default credentials, overly permissive rules, missing segmentation, and outdated firmware that’s stopped receiving security patches.
5. Wireless Security Review
Wireless gets assessed separately because its risks are different — encryption standard in use, whether authentication is shared-key or enterprise-grade (802.1X), and whether guest networks are actually isolated from internal systems or just appear to be.
6. Structured Interviews
Config review tells you what’s there; interviews with your IT staff tell you why, and what’s already known but unaddressed due to budget or bandwidth. This step often surfaces context that changes how a finding gets prioritized — a “critical” issue your team already has a fix scheduled for looks different than one nobody knew existed.
7. Risk Rating and Analysis
Every finding gets scored using an impact × likelihood model — how bad would it be if this were exploited, and how likely is that given the current configuration. This produces a defensible, consistent severity rating rather than a gut-feel label.
8. Report Drafting and Delivery
The final report includes an executive summary with overall risk rating and top issues, a full findings register with evidence, updated asset inventory and topology documentation, and a prioritized remediation roadmap broken into 0-14 day, 15-45 day, and 45-90 day windows.
9. Live Readout
A written report answers “what,” but a live session lets you ask “why does this matter for us specifically” and “what should we tackle first given our budget this quarter.” We treat this as a required step, not an optional add-on.
If you want to see the format this produces in practice, we’ve published a redacted sample network assessment report from a past engagement.