Cloud and server hardening review
Linux servers, containers, cloud accounts and the CI that deploys to them.
A hardening review is a configuration audit, done with read access rather than attacks. We read how your servers, containers and cloud accounts are set up and compare that with how they should be set up for what they run. It finds the problems a scan cannot see: an old deploy key that still works, a backup nobody has restored, a database user with rights it never needed.
What we test
- Linux hosts: SSH settings, sudo and user accounts, firewall, unattended upgrades, listening services
- Web servers and reverse proxies: TLS, headers, exposed status pages, directory listing
- Containers: images, privileges, mounted sockets, secrets in environment variables
- Databases: network exposure, roles and privileges, backup and restore
- Cloud accounts and DNS providers: users, API tokens, key rotation, logging
- CI and deployment: who can deploy, where secrets live, self-hosted runner exposure
What do you get at the end?
- Findings with severity, host or resource, the setting as found, and the setting it should be
- Configuration checked against CIS Benchmark guidance where one exists for the platform
- A recheck after the changes are applied
How does the engagement run?
Scope and written authorization first, then testing inside the agreed window, the report, and a retest of what you fix. The steps are the same for every service and are set out on the approach page.
Frequently asked questions
Do you make the changes?
The review is read-only. Your team, or ours under a separate agreement, applies the fixes. We then check the result.
What access do you need?
Read-only access: a non-root account on the servers in scope that can read configuration, read-only roles in the cloud and DNS accounts, and a view of the CI settings. We do not ask for write access for the review, and the access is removed when it ends.
How is this different from a penetration test?
A penetration test shows what an attacker can reach from outside. A hardening review reads the configuration from inside, so it finds problems a test cannot see, such as an unused deploy key that still works or a backup that has never been restored. Many teams run both.
Tell us what you want tested.
A short call, then a signed scope. No testing before that.