HARDENING · CONSULTING SERVICES
Close the drift that crept in after go-live
Controls are rarely wrong on the day they are installed. This extracts what your infrastructure is set to do now — FortiGate, Palo Alto and Cisco devices, Kaspersky EDR, M365 and cloud tenants, PLC and SCADA — compares it against vendor hardening guides and CIS benchmarks, and closes the misconfiguration gaps that are the leading root cause of real-world breaches, often before any exploitation has occurred.
ENGAGEMENT AT A GLANCE
SubjectServers, network, firewalls, cloud, ICS
AccessRead-only review; changes on agreement
OutputRisk-rated findings + re-check
YOU RECEIVE
Configuration extracted from every in-scope device and tenant
Baseline comparison against vendor hardening guides and CIS benchmarks
Risk-rated findings with the evidence for each
Remediation guidance your team can execute
A re-check pass once the changes have landed
WHAT'S COVERED
Scope of the engagement
01
Firewall rule base
Every FortiGate, Palo Alto or Cisco rule read: what it permits, whether anything still uses it, and how much any/any is left over from a migration nobody cleaned up.
02
EDR policy & exclusions
Whether protection is enforcing or merely reporting, and what has been excluded from scanning and then quietly forgotten.
03
Cloud & M365 tenants
Tenant settings measured against the hardening baseline — identity, sharing, logging and the defaults that were never revisited after the migration.
04
PLC & SCADA
Industrial control systems reviewed from extracted configuration and documentation rather than by probing live controllers, so the review does not touch the process.
05
Benchmark comparison
Each system measured against the vendor hardening guide and the relevant CIS Benchmark, with every deviation recorded and risk-rated.
06
Remediation & re-check
Guidance written in enough detail to execute, then a re-check pass to confirm that what was changed closed what was found.
COMMON QUESTIONS
Before you ask
Will you change anything without asking?
No. The review itself is read-only. Every change is agreed in advance, scheduled into a window and given a rollback path before it is made.
We have thousands of firewall rules. Is that in scope?
Yes, and it is usually where the findings are. Large rule bases are analysed for shadowed, redundant, overly permissive and unused rules rather than read one at a time by eye.
Can you do the remediation as well as the review?
Yes. The same engineers who found the gaps can implement the fixes, or hand your team the guidance with the change detail written out. Both are quoted separately from the review itself, and the re-check pass follows either way.
THE DELIVERABLE
What lands on your desk at the end
Before you sign, ask us exactly what the report contains — it is the fastest way to judge whether the work is worth buying.
REPORT CONTENTS
Executive summary written for a board, not for engineers
Finding-by-finding results with the evidence for each
Benchmark deviation matrix per device, tenant and control system
Remediation guidance in execution order
Re-check results against every original finding
WHAT WE NEED FROM YOU
Read-only access or configuration exports for the in-scope systems
A named owner per device, tenant or platform
Current change-management windows and approval process
Any vendor support contracts relevant to the estate
FRAMEWORKS THIS EVIDENCES
CIS BenchmarksVendor hardening guidesISO/IEC 27001:2022 Annex APCI DSS v4.0.1 (where in scope)
Findings are mapped to control references so the report can be handed to an auditor without translation.
Ready to secure your business?
Book a consultation with our engineers. Bring your architecture and your constraints — we'll tell you what we would do first, and why.
WHAT A CONSULTATION LOOKS LIKE
01
A conversation with an engineer
Not a sales call. Bring your architecture and your constraints.
02
A written gap summary
Prioritised, with what we would do first and why.
03
No obligation, no follow-up sequence
If it is not a fit we will say so on the call.
Not ready to talk? See the company facts — entity details, offices and our NTRA certification.
One inbox, answered by an engineer — not a routing queue.