Perform a comprehensive IT risk assessment across six critical security domains: Infrastructure Security, Data Protection, Access Control, Compliance, Incident Response, and Vendor/Third-Party Risk. Returns a risk score, domain-level breakdown, and prioritized remediation roadmap.
Built by a CISSP/CISM certified security professional at ToolWeb.in
TOOLWEB_API_KEY — Get your API key from portal.toolweb.incurl must be available on the systemPOST https://portal.toolweb.in/apis/security/it-risk-assessment
Infrastructure Security (3 controls):
infra_segmentation — Network segmentation maturity (e.g., "None", "Basic flat network", "VLANs implemented", "Micro-segmentation with zero trust")infra_firewall — Firewall and perimeter defense (e.g., "None", "Basic firewall", "Next-gen firewall with IPS", "Full NGFW with threat intel feeds")infra_patching — Patch management (e.g., "None", "Ad-hoc patching", "Monthly patch cycle", "Automated patching with SLA tracking")Data Protection (3 controls):
data_classification — Data classification program (e.g., "None", "Informal", "Defined policy", "Automated classification with DLP")data_encryption — Encryption at rest and in transit (e.g., "None", "Partial - transit only", "Full encryption at rest and transit", "End-to-end with key management")data_backup — Backup and recovery (e.g., "None", "Manual backups", "Automated daily backups", "Immutable backups with tested restores")Access Control (3 controls):
access_mfa — Multi-factor authentication (e.g., "None", "MFA for VPN only", "MFA for all remote access", "MFA everywhere including internal")access_pam — Privileged access management (e.g., "None", "Shared admin accounts", "Individual admin accounts", "Full PAM with session recording")access_review — Access reviews and recertification (e.g., "None", "Annual review", "Quarterly reviews", "Continuous access monitoring")Compliance (3 controls):
comp_policies — Security policies and procedures (e.g., "None", "Informal guidelines", "Documented policies", "Reviewed and updated annually")comp_regulatory — Regulatory compliance (e.g., "None", "Aware of requirements", "Partial compliance", "Fully compliant with audits")comp_training — Security awareness training (e.g., "None", "One-time training", "Annual training", "Continuous training with phishing simulations")Incident Response (3 controls):
ir_plan — Incident response plan (e.g., "None", "Informal process", "Documented IR plan", "Tested IR plan with tabletop exercises")ir_monitoring — Security monitoring and SIEM (e.g., "None", "Basic log collection", "SIEM with alert rules", "24/7 SOC with automated response")ir_threat — Threat intelligence (e.g., "None", "Ad-hoc awareness", "Subscribed threat feeds", "Integrated threat intel with automated blocking")Vendor/Third-Party Risk (3 controls):
vendor_assessment — Vendor security assessments (e.g., "None", "Self-assessment questionnaires", "On-site audits for critical vendors", "Continuous vendor monitoring")vendor_contracts — Security requirements in contracts (e.g., "None", "Basic NDA", "Security clauses included", "Comprehensive security SLAs with penalties")vendor_monitoring — Ongoing vendor monitoring (e.g., "None", "Annual review", "Quarterly reviews", "Continuous monitoring with risk scoring")curl -s -X POST "https://portal.toolweb.in/apis/security/it-risk-assessment" \
-H "Content-Type: application/json" \
-H "X-API-Key: $TOOLWEB_API_KEY" \
-d '{
"infra_segmentation": "<value>",
"infra_firewall": "<value>",
"infra_patching": "<value>",
"data_classification": "<value>",
"data_encryption": "<value>",
"data_backup": "<value>",
"access_mfa": "<value>",
"access_pam": "<value>",
"access_review": "<value>",
"comp_policies": "<value>",
"comp_regulatory": "<value>",
"comp_training": "<value>",
"ir_plan": "<value>",
"ir_monitoring": "<value>",
"ir_threat": "<value>",
"vendor_assessment": "<value>",
"vendor_contracts": "<value>",
"vendor_monitoring": "<value>",
"sessionId": "<generate-unique-id>"
}'
Generate a unique sessionId (e.g., UUID or timestamp-based).
⚡ IT Risk Assessment Report
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Overall Risk Score: [XX/100]
Risk Level: [Critical/High/Medium/Low]
📊 Domain Scores:
🏗️ Infrastructure Security: [score]
🔒 Data Protection: [score]
🔑 Access Control: [score]
📋 Compliance: [score]
🚨 Incident Response: [score]
🤝 Vendor Risk: [score]
🚨 Critical Gaps:
[List highest-risk findings]
📋 Top Remediation Actions:
1. [Action] — Priority: [Critical/High]
2. [Action] — Priority: [Critical/High]
3. [Action] — Priority: [Medium]
📎 Full report powered by ToolWeb.in
TOOLWEB_API_KEY is not set: Tell the user to get an API key from https://portal.toolweb.inUser: "Run an IT risk assessment for our company"
Agent flow:
Infrastructure: How would you describe your network segmentation, firewall setup, and patch management?"
Quick assessment shortcut: If the user says "we're mostly basic" or "we're a startup with minimal security", the agent can fill in reasonable defaults like "Basic" or "None" for most fields and confirm with the user before calling the API.
Created by ToolWeb.in — a security-focused MicroSaaS platform with 200+ security APIs, built by a CISSP & CISM certified professional. Trusted by security teams in USA, UK, and Europe and we have platforms for "Pay-per-run", "API Gateway", "MCP Server", "OpenClaw", "RapidAPI" for execution and YouTube channel for demos.
共 2 个版本