IT health check, IT audit or penetration test: which do you need?
IT providers use these names loosely, and that makes it hard to know what you're buying. They're actually quite different jobs. Here's what each one is, how long it takes, and the situations where you need it.
Last updated
The short answer
An IT health check is a quick, practical snapshot that ranks risks and fixes. An IT audit is a formal, documented review against a named standard, used when an insurer, client or buyer wants evidence. An Essential Eight assessment checks eight specific security controls against a maturity level. A penetration test is an authorised, simulated attack to prove whether systems can be broken into. Most small businesses should start with a health check.
Why the difference matters
Buying the wrong one wastes money either way. A penetration test on a business that hasn't turned on multi-factor authentication finds what a health check would have found for a fraction of the cost. A quick health check won't satisfy a client whose contract asks for evidence against the Essential Eight. Knowing who's asking, and why, tells you which one to get.
The four types side by side
IT health check
A snapshot of backups, logins, updates, devices, network and cloud setup. Takes days. You get a ranked list of risks and fixes. Best first step for most small businesses.
IT assessment or review
Wider than a health check. It also looks at whether your systems still fit the business, what they cost and what you'll need in two or three years. You get a roadmap and budget.
IT audit
Formal and evidence-based. Every device, licence and account is recorded and controls are measured against a standard like the Essential Eight. Takes weeks. You get documents someone else can rely on.
Essential Eight assessment
Checks the Australian Signals Directorate's eight mitigation strategies against a maturity level, using its assessment guide. There's no official certificate, but clients and tenders increasingly ask for it.
Penetration test
An authorised, simulated attack within an agreed scope. It shows whether someone can actually get in. Needs written permission and a specialist, and makes most sense once the basics are in place.
Which one fits your situation
- "I just want to know if we're OK": an IT health check.
- "We're growing and need a plan and budget": an IT assessment.
- "A buyer, insurer or board wants it in writing": an IT audit.
- "A client contract or tender mentions the Essential Eight": an Essential Eight assessment.
- "We hold valuable data and want proof nobody can get in": a penetration test, after the basics are covered.
A sensible order
- Start with a health check. Find and fix the obvious gaps first. It's the cheapest way to remove the most risk.
- Move to an audit or Essential Eight assessment when asked. Once the basics are sorted, a formal review goes faster and reads better.
- Add a penetration test if your risk calls for it. Businesses with customer portals, valuable data or contractual requirements get the most from one.
How WaTo can help
- We run IT health checks, IT audits and Essential Eight assessments for Adelaide businesses.
- We'll tell you honestly which one you need, including when the cheaper option is enough.
- If you need a penetration test, we help you scope it and work with the specialist on the fixes.
Common questions
Is the Essential Eight being replaced?
The Australian Signals Directorate published ASD Essentials in October 2026 as its successor. It swaps maturity levels for priority phases. It's aimed mainly at government, critical infrastructure and large organisations, there's no transition deadline yet, and ASD says to keep current uplift programs going. For most small businesses the Essential Eight is still the right yardstick for now.
Can one provider do the health check and the fixes?
Yes, and it's common. If you want an independent view, you can also take the report to a different provider. A good report should make sense to anyone.
Does a vulnerability scan count as a penetration test?
No. A scan is an automated tool that lists known weaknesses. A penetration test is a person actively trying to exploit them. Scans are often part of a health check or audit.
Which one do insurers want?
Most small business cyber insurance proposals ask questions rather than demanding a report. A health check usually gives you honest answers to them. Larger policies sometimes ask for evidence, which is where an audit helps.
How WaTo can help with this
Guides on this topic
- What a useful IT health check looks at
- What is the Essential Eight?
- How much does an IT health check cost?
- Cyber insurance IT readiness: what to have in order first
Sources & references
WaTo Consulting. Last reviewed 2026-10-24. Review when ASD publishes transition dates for ASD Essentials.
Not sure which one you need?
Tell us who's asking and why. We'll point you at the right one, even if it's the smallest.
Mon to Fri, 8:30am to 5pm
