What platforms do you assess configurations for?

Scyverge assesses configurations for Linux and Windows servers, databases (MSSQL, PostgreSQL, Oracle, MongoDB), Kubernetes clusters, cloud accounts (AWS, Azure, GCP), and network equipment.

What benchmarks do you follow?

Scyverge follows CIS Benchmarks, vendor hardening guides (Microsoft, Oracle, AWS), NIST guidelines, and industry best practices for each platform assessed.

Configuration
Assessment

Identify security misconfigurations across servers, network devices, cloud environments, and databases. We benchmark against CIS, DISA STIG, and vendor hardening guides to eliminate preventable attack vectors before adversaries find them.

Run a Configuration Audit All Services

CIS Benchmarks (platform-specific) alongside CIS Controls v8 OS + Network + Cloud Hardening Remediation Roadmap Free Re-Assessment

server.conf

SSHProtocol 2 OK

PermitRootLogin yes Critical

PasswordAuth yes High

PubkeyAuth yes OK

X11Forwarding yes High

PermitEmptyPasswords yes Critical

MaxAuthTries 3 OK

Root Login

Password Auth

Empty Passwords

X11 Forward

Testing Areas

What We Assess for Misconfigurations

Benchmark-driven reviews across every layer of your technology stack.

Windows Server Hardening

We assess Windows Server configurations against CIS Benchmarks covering account policies, audit logging, service exposure, registry hardening, and Windows Firewall rules to eliminate attack surface.

Linux Server Hardening

We review Linux distributions against CIS Benchmarks for SSH configuration, sudo policies, service minimisation, file permissions, kernel parameters, and logging configuration.

Database Security Configuration

We audit MySQL, MSSQL, PostgreSQL, Oracle, and MongoDB for default credentials, excessive privileges, unencrypted connections, audit logging gaps, and unnecessary remote access.

Container and Kubernetes Hardening

We review Docker and Kubernetes configurations against CIS Benchmarks for namespace isolation, RBAC policies, secret management, and API server security.

Security Tool Configuration

We validate that your SIEM, EDR, WAF, and endpoint security tools are correctly configured with active detection rules, complete logging, and proper alerting.

Active Directory Hardening

We review AD configuration for password policies, account lockout, audit policies, privileged group membership, and Group Policy security options.

AWS Security Configuration

We assess AWS accounts against CIS Benchmarks for IAM policies, S3 bucket permissions, security groups, VPC configuration, CloudTrail logging, and encryption settings.

Azure Security Configuration

We review Azure subscriptions for RBAC assignments, network security groups, storage account configurations, Key Vault policies, and Azure Monitor logging.

GCP Security Configuration

We assess GCP projects for IAM roles, firewall rules, Cloud Storage permissions, VPC configuration, and Cloud Audit Logs settings.

Identity and Access Management

We review cloud IAM for over-privileged roles, unused credentials, missing MFA, publicly exposed resources, and cross-account trust relationships.

Storage and Data Protection

We audit cloud storage for public access, missing encryption, improper lifecycle policies, and data retention configuration across S3, Blob, and Cloud Storage.

Network Security Configuration

We review VPC configuration, security groups, network ACLs, and routing tables for overly permissive rules and exposure to the internet.

Router and Switch Configuration

We audit Cisco, Juniper, and other network equipment for management plane hardening, SNMP security, routing protocol authentication, and unused service disablement.

Firewall Rule Review

We review firewall rulebases on Palo Alto, Fortinet, and Cisco firewalls for overly permissive rules, shadowed rules, unused rules, and rule documentation gaps.

VPN and Remote Access

We assess VPN configurations for strong cryptography, proper authentication, session timeouts, and split tunnelling risks on remote access infrastructure.

Wireless Security Configuration

We review wireless controller configurations for WPA2/WPA3 settings, EAP authentication, rogue AP detection, and guest network isolation.

VLAN and Segmentation

We validate VLAN configuration, trunk security, native VLAN handling, and cross-segment access controls to ensure proper network isolation.

IDS and IPS Configuration

We review intrusion detection and prevention systems for rule updates, tuning, alert configuration, and coverage of relevant threat signatures.

Methodology

How We Run a Configuration Assessment

A structured, benchmark-driven review that identifies and prioritises every misconfiguration risk across your technology stack.

Phase 01

Scoping and Asset Discovery

We define the in-scope technology stack including OS versions, network platforms, cloud accounts, databases, and containers, selecting appropriate benchmark baselines for each.

Phase 02

Automated Baseline Scan

We run CIS benchmark scripts and SCAP-compliant tools to rapidly collect configuration data across all in-scope systems, identifying deviations from the hardening baseline at scale.

Phase 03

Manual Expert Review

Certified engineers manually validate automated findings, review complex configurations, assess compensating controls, and identify context-specific risks that automated tools miss.

Phase 04

Risk Prioritisation

We score and prioritise every misconfiguration by exploitability, business impact, and ease of remediation, distinguishing critical quick-wins from longer-term hardening initiatives.

Phase 05

Detailed Reporting

We deliver a per-system report with benchmark compliance scores, each misconfiguration finding, risk rating, and exact remediation steps including configuration commands.

Phase 06

Re-Assessment

We provide a free re-assessment after remediation to validate that all identified misconfigurations have been correctly resolved and your hardening score meets the agreed target.

Who It's For

Is a Configuration Assessment Right for You?

Compliance-Driven Organisations

PCI-DSS, ISO 27001, SOC 2, HIPAA, NIST CSF 2.0, and RBI and SEBI frameworks all require hardened configurations as a baseline control. A configuration assessment provides required evidence for auditors and certifying bodies.

Cloud-First and Hybrid Teams

Organisations moving workloads to AWS, Azure, or GCP often accumulate misconfigured resources due to speed of deployment. A configuration review resets the baseline and prevents cloud exposure.

Enterprises Running Legacy Systems

Large organisations with inherited infrastructure including aging Windows servers, legacy network equipment, and unpatched databases benefit from a structured configuration audit that identifies accumulated drift from secure baselines.

FAQ

Questions We Get Asked Often

A configuration assessment identifies security misconfigurations across servers, network devices, cloud environments, and security controls. Unlike penetration testing which exploits vulnerabilities, configuration assessment benchmarks your systems against CIS Benchmarks, DISA STIGs, and vendor hardening guides to find settings that deviate from secure baselines before attackers can exploit them.

We assess configurations for Linux distributions (RHEL, Ubuntu, Debian), Windows Server, databases (MSSQL, PostgreSQL, Oracle, MySQL, MongoDB), Kubernetes clusters and Docker, cloud accounts (AWS, Azure, GCP), and network equipment (Cisco, Palo Alto, Fortinet, Juniper firewalls, routers, and switches).

We primarily use CIS Benchmarks (platform-specific) alongside CIS Controls v8, the global standards for secure configuration. For defence and government sectors, we also offer DISA STIG aligned reviews. For cloud environments, we apply CIS Cloud Benchmarks and vendor-specific hardening guides from Microsoft, AWS, and Google. All findings map to specific benchmark controls.

Vulnerability scanning identifies missing patches and known CVEs in software. Configuration assessment identifies insecure settings even in fully patched systems. For example, a patched server with root login enabled, password authentication on, and weak cipher suites still poses significant risk. Configuration assessment catches these non-vulnerability risks.

Timeline depends on scope. A single operating system platform review takes 2 to 3 days. A comprehensive assessment covering servers, network devices, cloud, and databases typically takes 1 to 2 weeks. We provide a precise timeline after initial scoping based on your environment size and technologies.

ConfigurationAssessment