Build Configuration Reviews
Build and configuration reviews for Windows, Linux and Unix servers, workstations and network devices, checked against the CIS Benchmarks. We find the insecure defaults and drifted settings that turn one compromised machine into many.
What is a build review?
A build review, sometimes called a build configuration review or a hardening review, checks how a server, workstation or device is configured against a recognised benchmark such as the CIS Benchmarks. It covers the services running, the patch level, file and registry permissions, local accounts and password settings, logging, remote access and the things a default installation leaves switched on that should be switched off.
It is done with read-only access to the system rather than by attacking it, so it finds weaknesses a penetration test would only find if an attacker happened to land on that box. Linux, Windows Server, Windows desktop and network devices are all in scope. The output is a ranked list of deviations from the benchmark with the fix for each, which is usually a small number of settings that are wrong across a large number of machines.
What Gets Checked
A build and configuration review compares each system with the hardening benchmark for its platform and records every place it falls short. On Windows that means local accounts and groups, password and lockout policy, services, SMB and remote desktop settings, audit policy and the security features that ship switched off. On Linux and Unix servers it means SSH configuration, sudo rules, file permissions, listening services, kernel parameters and logging. Network devices are checked for management access, insecure protocols and default credentials.
Why Builds Drift
Most estates start from a sensible gold image. Then a server is built in a hurry for a project, an application vendor asks for a service account with local admin rights, a troubleshooting change is never reversed and the image itself falls two years out of date. A server build review finds those problems once, so they can be fixed in the image and the build process rather than one machine at a time.
Where It Fits With Testing
A penetration test shows what an attacker could reach. A build review shows what they would find when they got there. On an internal test the tester sees the machines on the attack path. A build review checks every machine in scope against the same standard, which is why the two work well together.
What You Get From the Review
Every Deviation Listed
Each system compared with its benchmark, with every failed setting recorded alongside the fix.
Fixes at the Source
Findings that repeat across machines are grouped, so one change to the image or group policy fixes them everywhere.
Evidence for Audits
Results mapped to the CIS Benchmarks, which supports ISO 27001 and the secure configuration control in Cyber Essentials.
No Disruption
Read only access or exported configuration. Nothing is changed on your systems.
How the Review Runs
We agree the systems in scope first: servers, workstations, virtual machines, cloud instances or network devices. For an estate built from a common image a representative sample is usually enough, with any servers that were built differently added on top. Configuration is collected with read only access or from files you export, so nothing on the live system changes. Each system is compared with the CIS Benchmark for its platform, alongside vendor hardening guidance and your own build standard if you have one. Findings are rated on what they mean in your environment, because a setting that matters on a server facing the internet may be irrelevant on an isolated one.
At a Glance
Scope Agreement
Servers, workstations, virtual machines, cloud instances or network devices agreed in writing.
Configuration Collection
Read only access or exported files, with no change to live systems.
Benchmark Comparison
Assessed against CIS Benchmarks, vendor hardening guides and NCSC guidance.
Finding Analysis
Findings rated on what they mean in your environment, with a practical fix for each.
Report & Retest
Each finding with risk level and clear remediation steps. Free retest included.
Findings appear in your client portal as we find them. Our day rate is published on the pricing page.
You May Also Be Interested In
Frequently Asked Questions
What is a build configuration review?
A build configuration review assesses how your systems, servers and applications have been configured at the operating system and platform level. It checks whether security best practice has been followed, whether insecure defaults have been changed and whether unnecessary features or services have been disabled. We benchmark findings against recognised standards such as the CIS Benchmarks and NCSC guidance.
Which systems can you review?
Windows and Linux servers, Unix systems, workstations, virtual machines, cloud instances, network devices, containers and application platforms. A review can cover a single critical server or a representative sample across the whole estate.
How does this relate to Cyber Essentials compliance?
Build configuration is one of the five technical controls required by Cyber Essentials. The scheme requires that devices are configured securely, unnecessary software is removed and default passwords are changed. A build configuration review helps you identify gaps before your Cyber Essentials assessment and gives you actionable steps to achieve compliance.
Will the review cause any downtime?
No. Build configuration reviews do not disrupt your systems. We either review exported configuration files or connect with read-only access. No changes are made to your systems during the assessment. Any recommendations are provided in the report for your team to implement at a time that suits your operations.