What you are listening for: a named tool, a named team, and a defined escalation process. "We have antivirus and alerting" is not 24/7 monitoring. If the answer is that alerts go to a ticketing queue and get reviewed during business hours, your environment is unmonitored outside of business hours.

Mean time to detect (MTTD) is how long it takes to identify that a threat is present. Mean time to respond (MTTR) is how long it takes to contain it. These are measurable numbers. Industry average MTTD without a dedicated security function is around 200 days.

A proper assessment tests whether controls are actually enforced, not just configured. If they have done one, ask for the report. If they have not, ask when it will be scheduled.

The ASD recommends patching internet-facing applications within 48 hours of a critical vulnerability being published. Operating systems within 48 hours for extreme risk, two weeks for everything else. Monthly patching cycles leave known vulnerabilities open for up to 30 days.

MFA being available is not the same as MFA being enforced. Legacy authentication protocols bypass MFA entirely. If basic authentication, IMAP, or POP3 are still permitted in your Microsoft 365 environment, MFA is protecting less than you think.

How many accounts have domain admin or local admin rights? How is that list reviewed? Are IT staff working day-to-day from admin accounts?

You want a specific process: who gets the alert, who investigates, what the containment steps are, how quickly isolation happens, and how you as the business are notified. A provider with a real process will answer this without hesitation.

Backups that have never been tested may not restore. Backups stored on the same network as the systems they protect can be encrypted by ransomware along with everything else.

A security-aware IT provider brings things to your attention before you think to ask. New threat patterns relevant to your industry. Configuration gaps found during routine work. Emerging risks.

This is the most important question. Most IT providers have genuine limits to their security capability and the honest ones will tell you where those limits are. Knowing what your current provider does not cover tells you where the gaps are, which is information you need to manage your risk properly.