Cybersecurity
Security configuration assessments
Many breaches use no vulnerability at all, only a setting that should have been different. We compare your systems with hardening baselines and tell you which deviations matter.
The problem this service solves
Default settings are tuned for convenience. Over time, administrators add exceptions, enable legacy protocols and leave features on that nobody uses. A baseline gives you something to measure against, and the deviations show where attackers would find easy footholds.
A tool can check a thousand settings in minutes. The value is in deciding which gaps to close, which to accept, and how to make the fix stick through automation rather than a one-time cleanup.
What is in scope
-
Windows and Linux servers
Authentication, services, logging, network settings, file permissions and local accounts.
-
Endpoints
Disk encryption, local administrator rights, firewall, application control and update settings.
-
Databases
Authentication, roles, encryption, auditing and network exposure for common platforms.
-
Network devices
Management plane security, protocols, access lists and firmware currency.
-
Microsoft 365 and identity
Conditional access, mailbox rules, audit logging, external sharing and administrator roles.
-
Cloud services
Account-level settings for AWS, Azure and Google Cloud against CIS Foundations Benchmarks.
How the work runs
Baseline
Agree what good looks like.
-
1
Standard selection
Choose benchmark profiles (e.g. CIS Level 1 or 2) and note departures needed for your business.
Assess
Measure.
-
2
Automated checks
Run benchmark tooling with read-only access.
-
3
Manual review
Check settings that tools cannot evaluate and confirm important results.
Improve
Make fixes durable.
-
4
Prioritization
Rank gaps by exploitability and impact, noting which can break applications.
-
5
Automation guidance
Group policy, configuration management or infrastructure as code to enforce the baseline and detect drift.
What you receive
- Gap report by platform and benchmark control
- Prioritized remediation list with application-impact notes
- Approved exceptions register template
- Automation recommendations
- Retest results
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Read-only access to systems or exports
- A list of platforms and a representative sample of each
- Existing standards and approved exceptions
What this service is not
- A vulnerability scan
- Applying changes in production without your change process
What changes afterwards
- You know which deviations from baseline matter
- Hardened images and policies replace manual fixes
- Drift is detected and reported
Questions people ask
Do you apply the fixes?
We recommend and, if scoped, help automate. Changes go through your change process, because hardening can break applications.
Should we use CIS Level 1 or Level 2?
Level 1 is practical for most environments. Level 2 adds stricter settings for high-security use and may affect functionality. We help decide per system.
Related
-
Vulnerability assessment
Broad, authenticated scanning of networks, servers, endpoints and applications, with validation so the report lists real findings.
-
AWS security
Review of IAM, organizations, networking, storage, logging and workloads in AWS, with a fix plan ordered by what attackers use first.
-
Security engineering and implementation
Hands-on delivery of security controls and platforms: design, deploy, integrate, migrate, test and hand over.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response