A configuration and hardening review assesses how securely your systems are configured, measured against a recognised baseline — the CIS Benchmarks. Rather than attacking the systems, we inspect their settings across servers, cloud platforms, network devices and databases to find insecure defaults, unnecessary services, over-permissive access and missing hardening, then hand you a prioritised roadmap to reach a secure baseline. It is the proactive complement to a penetration test: hardening reduces the attack surface before it can be exploited, and a pentest proves what remains. Secure configuration is also expected evidence under frameworks like PCI DSS, the NCA controls and the CIS Controls.
// 01 What is a configuration & hardening review?
A configuration and hardening review is a systematic inspection of how securely your systems are set up. Where a penetration test tries to break in, a hardening review reads the configuration and compares it against a known-good secure baseline, identifying every setting that increases risk unnecessarily — a service that need not be running, an insecure default that was never changed, a permission broader than the task requires. The output is not an attack narrative but a clear, prioritised list of what to change to bring each system to a secure state.
This proactive approach matters because misconfiguration is one of the most common root causes of real breaches. Systems rarely ship secure by default; they ship convenient by default, and the gap between the two is exactly where attackers operate.
// 02 Measured against the CIS Benchmarks
We assess against the CIS Benchmarks — the consensus-developed secure-configuration standards published by the Center for Internet Security, and the most widely recognised hardening baselines in the industry. There is a benchmark for almost every common platform, each specifying precisely how it should be configured to minimise its attack surface. Measuring against a published standard rather than opinion gives the review two advantages: the recommendations are defensible and vendor-neutral, and the results map cleanly to compliance frameworks that reference secure configuration.
Servers & endpoints
Windows and Linux configuration — services, accounts, logging, patch and access settings against the CIS OS benchmarks.
Cloud platforms
AWS, Azure and GCP against the CIS Foundations Benchmarks — IAM, logging, storage and network configuration.
Network devices
Firewalls, switches and routers — management access, hardening and rule hygiene.
Databases
Database configuration — authentication, encryption, permissions and auditing against the CIS database benchmarks.
// 03 Hardening review vs penetration test
These are complementary, and the smart sequence is usually to harden first, then test. A hardening review is proactive and comprehensive — it examines every relevant setting against a baseline, whether or not any given one is currently exploitable, and closes the whole class of misconfiguration risk. A penetration test is adversarial and demonstrative — it proves what an attacker can actually do with what remains. Hardening to CIS first removes the low-hanging misconfigurations, so the subsequent penetration test spends its time on the deeper, more interesting weaknesses rather than flagging basic hygiene issues.
// 04 What we commonly find
Insecure defaults left unchanged
Default accounts, passwords and settings that ship enabled and were never hardened.
Over-permissive access & services
Unnecessary services running and access broader than any task requires, widening the attack surface.
Missing logging & monitoring config
Audit logging disabled or incomplete, leaving no trail if an attacker does get in.
Weak encryption & protocol settings
Outdated protocols and weak cipher configurations left enabled for compatibility.
// 05 Compliance value
Secure configuration is not just good practice — it is expected evidence under most frameworks. PCI DSS requires secure configuration standards, the NCA ECC and its companions expect hardening as a baseline control, and the CIS Controls themselves place secure configuration among the foundational safeguards. A CIS-benchmarked hardening review therefore produces evidence that maps directly to those obligations, which we document alongside the technical findings — see our requirements finder for how testing and hardening map across frameworks.
// 06 Frequently asked questions
What is a hardening review?
A systematic inspection of your systems' configuration against a secure baseline (CIS Benchmarks), finding insecure defaults and over-permissive settings, with a prioritised roadmap.
What are the CIS Benchmarks?
Consensus secure-configuration baselines from the Center for Internet Security, covering OS, cloud, network devices and databases.
How is it different from a pentest?
A pentest attacks; a hardening review inspects configuration proactively. Harden to CIS first, then test what remains.
Why does it matter?
Misconfiguration is a leading breach cause, and secure configuration is expected evidence under PCI DSS, the NCA controls and the CIS Controls.