Configuration audits
Many breaches start with a misconfiguration.
A default password, an open port, a storage bucket left public. We audit your servers, cloud and network against CIS, NIST and ISO benchmarks and tell you what to change first.
What we audit.
Server configuration
Windows, Linux and Unix servers checked setting by setting against hardening baselines.
Cloud environments
Assessment of AWS, Azure, and GCP configurations against CIS benchmarks.
Network devices
Firewall, router and switch configurations reviewed for security gaps.
CIS benchmarks
Validation against Center for Internet Security configuration standards.
Compliance mapping
Findings mapped to NIST, ISO 27001 and the regulations that apply to you.
System hardening
Step-by-step guidance for applying the hardened settings.
Why configuration audits?
Fewer ways in
Find and fix the configuration weaknesses attackers look for first.
Proof of compliance
Evidence that your systems meet CIS benchmarks and the other frameworks you report against.
Fewer incidents
Properly configured, hardened systems give attackers less to work with.
Better performance
Identify misconfigurations that may impact system performance and reliability.
A clear report
Each deviation listed with why it matters and how to fix it, in priority order.
A baseline to measure against
Documented baseline configurations, so you can track improvements over time.
How an audit runs
Scope, baseline, assess, fix, then check that the fixes worked.
Scope definition
We agree which systems, networks and cloud environments are in the audit.
Baseline
We pick the right benchmark and security standard for each type of system.
Configuration assessment
Each system's settings are checked against its benchmark, line by line.
Gap analysis
We list every deviation from the benchmark and from your compliance requirements.
Remediation planning
Recommended changes for each issue, ranked by risk.
Verification
Once changes are made, we check that they actually closed the gaps.
Find the settings left open.
Tell us what you run: servers, cloud accounts, network gear. We'll tell you which benchmarks apply and what an audit would cover.