We test individual servers in depth: what they expose to the network, how they're patched and configured, and what an attacker could do once they have a foothold on one.
That covers Linux and Windows servers, physical or virtual, in your own data centre or in the cloud. We use the CIS Benchmark for each platform as a reference and tell you which differences matter for your systems.
Every port and service the server offers, the version it runs and whether it needs to be reachable at all.
Missing operating system and application updates, checked against known vulnerabilities and whether they can be exploited in your setup.
Settings compared with the CIS Benchmark for the platform. We report the differences that matter for your systems, rather than every line of the checklist.
Starting from an ordinary account, we try to become administrator or root through weak permissions, services or scheduled tasks.
Passwords, keys and tokens left in files, scripts, environment variables or backups where an attacker could read them.
Whether the server records the events you would need to spot an attack and investigate it afterwards.
Each finding comes with the evidence behind it, a CVSS rating, the business impact and a concrete fix. Where it applies, that includes the requests and responses or the configuration details that show the problem. It's written so you can pass it to an engineer unchanged.
Two pages in plain language on the business impact and the priorities, written for your board or your customer's security team.
A working session with your engineers where we go through the findings, answer questions and agree how to prioritise the fixes. We can record it if you like.
Usually both. An unauthenticated test shows what an outsider sees. A credentialed test, with an account we agree on, finds far more in the same time, especially missing patches and weak settings.
Not for most of the test. For the configuration review we ask for a read-only account that can see the settings, or for you to run a script we provide and send us the output.
Yes, the same way as physical ones. For cloud servers we also check the security groups and access rules around them.
Not without your agreement. We don't change settings or install software unless you approve it first. If we prove an attack works, we tell you what we did and remove anything we left behind.
Book a scoping call, and we'll send you a fixed quote as soon as we've agreed what to test.