VULNERABILITY REMEDIATION & SECURITY HARDENING
Security hardening and vulnerability remediation, aligned with CIS Benchmarks and vendor guidance, with automated hardening and auditing across Windows and Unix.
A vulnerability assessment or penetration test ends at a list of vulnerabilities, which is where the problem starts for most organisations. Who fixes them? Your system administrators have Windows, Linux, databases, firewalls, and cloud in their hands at once, and nobody is an expert in every platform. A finding that reads "insecure configuration" does not tell you what the secure value should be in your environment, and a findings list does not answer that question.
The service fixes the vulnerabilities you already have, working from a penetration test or vulnerability assessment report, ours or another provider's, and hardens to a full baseline, configuring your system components to security best practice from the start, so the attack surface shrinks across the whole estate. If you want the background first, our team has written both an introduction to hardening and a beginner's walkthrough.
Remediation and hardening: what is the difference
The two are usually spoken of together, but they answer different questions, and they are scoped and priced differently.
Remediation
Remediation is reactive. The findings are already in your hands and have to be closed before an audit deadline or the retest window. The scope is clear because it is tied to the finding list, and progress is measured directly: how many are closed.
Hardening
Hardening is proactive, bringing systems to the security baseline they should have had all along. Standards and compliance frameworks tell organisations to do this, and it still rarely gets done, least of all on production. The result is a smaller attack surface across the whole system.
Many findings in a pentest report are loose configurations that a good hardening baseline would have closed at the outset. Organisations that fix finding by finding, round after round, tend to meet the same issues again next time, because the baseline never changes.
What we harden
Scope is set by the number of hosts and the types of component in play, agreed before any work begins. If you are unsure where to start, we recommend beginning at the OS layer and working upward.
Operating systems
Windows Server, Windows clients, the major Linux distributions, and Unix. This layer is usually the right starting point because it disturbs the applications running above it less than the layers higher up.
Server software
Web servers, application servers, and middleware.
Databases
Engine configuration, account privileges, and encryption in transit.
Network devices and firewalls
Rule bases, the management plane, and deprecated protocols still left enabled.
Cloud
Account-level and service-level configuration on the major cloud providers. This is hardening specific cloud components to a baseline.
Containers and orchestration
Images, runtime, and cluster configuration.
Active Directory
Privilege structure, policies, and the settings that so often become a lateral movement path.
If what you need is a review of a whole cloud environment against the shared responsibility model, that is a separate engagement: see cloud security assessment. If you run a component that is not on this list, bring us the problem and we will talk it through.
How we work
Scoping and asset inventory
We agree what components are in your estate, how many hosts, of which types, against which guideline, and what we will not touch.
Anything left out of scope is agreed at this stage.
Baseline audit
We check the current state against the chosen benchmark, so the gap is a number before anything is changed.
You and we then share a reference point for where this started.
Impact assessment and agreed exceptions
Doing every item in the document may not be possible. Risk matters, and so does business operation. Any item that would disrupt live systems or conflict with your existing policy is recorded as an exception with its reasoning.
That record is the documentation your auditor will ask for anyway. Every engagement begins with an impact assessment alongside your team.
Backup, then work in rounds
The existing configuration is backed up every time. We work group by group, always starting outside production.
If something breaks after a change, we restore immediately.
Verify
We audit again after the changes, confirming the settings took effect and the system still works.
Report and baseline document
You receive the results of this round, plus a baseline document your team can apply to newly built hosts on its own.
Periodic re-audit
Optional. Configuration drift happens the moment people start changing systems. We re-check on an agreed cycle so you can see what has slipped away from the baseline.
The first round of hardening can be run as a project, and most organisations re-audit on a cycle.
Automated hardening with Confix
Hardening ten hosts by hand is manageable; hardening three hundred and re-auditing them every quarter is not.
We use Confix, a solution that automates system hardening and auditing across Windows and Unix servers using customisable templates. The template is what turns your organisation's baseline into something concrete, and each new audit round shows immediately which hosts have drifted from the standard.
There are two ways to use it:
As a service
We come in and do the work as a service using the tool.
With your own licence
You take the licence and your own team runs it, with us setting up the templates and training your people at the start. This suits organisations with an in-house infrastructure team that want this as routine work.
What you get
Baseline audit reports, before and after
How many items passed out of how many, at the start of the work and at the end.
A hardening baseline document for your organisation
Every item, what it sets, which source it came from (CIS, vendor, or our team), and why. Your team applies it to newly built hosts directly.
A record of exceptions and their reasoning
The items not applied and the business or technical reason they were not, written so it answers an auditor directly.
Your original configuration, backed up
Ready to restore if a problem surfaces later.
Post-remediation verification
A second audit confirming the settings took effect.
An executive summary
The reduction in risk, at a level management and auditors can read.
Team credentials
- OSCP
- OSCE
- CREST CRT
- CREST CPSA
- GIAC GREM
The work is performed by our in-house team, with certifications earned through hands-on practical examination. That offensive-security background is what makes the hardening decisions sound: we know which settings an attacker actually exploits, so every change we make is one we can justify to you. See the full list of certifications the team holds.
Standards
CIS Benchmarks
Always the first choice. Published by the Center for Internet Security, they cover most of what organisations actually run, are updated regularly, and give each item a rationale, an impact, an audit procedure, and a remediation step.
Vendor recommendations
Where CIS has no benchmark for a component, we work from the manufacturer's own hardening guide, usually the most accurate source for a specialised product.
Our team's experience, on a framework you can point to
Where neither exists, we use CIS Critical Security Controls as the structure, map which features and functions of the component correspond to which control, and add guidance from credible community sources. The result is a baseline drafted specifically for you, with the reasoning recorded for every item.
Where hardening fits
Hardening closes what an assessment finds, so it sits directly downstream of the work that produces the findings:
Consulting
Where the question is not which settings to change but which controls your organisation needs and how to evidence them for an audit, that is the governance side, and our consulting team works there.
Cloud security assessment
A review of a whole cloud environment against the shared responsibility model.
Last reviewed: 12 Oct 2026
Security Hardening
Closing the findings you already have, or bringing systems to a baseline from the start. Tell us which, with the number of hosts and the types of component.
Frequently asked questions
What is security hardening?
Hardening is the work of configuring system components (operating systems, servers, databases, firewalls, cloud services) to security best practice in order to reduce the system's attack surface. In practice that means disabling features and services that are not in use, setting authentication and privileges appropriately, defining firewall rules, keeping logs detailed enough to investigate with, and keeping everything on a version that is still supported.
Can't we fix the vulnerabilities ourselves?
You can, if your team has the time and someone fluent in every platform you run. The difficulty of this work is its breadth: one administrator is rarely an expert in Windows, Linux, databases, firewalls, and cloud at the same time. The other half is deciding which items to apply and which to except, which means weighing security against the impact on live systems. We help at both points, and hand over a baseline your team can carry forward.
Can you work from another provider's pentest report?
Yes. Send us the report and we will scope from it: we do not need to have run the test ourselves to fix what it found. In that case we will also want to discuss the retest arrangement, since verification is cleanest when it is done by whoever performed the original test.
Read more on hardening
ARTICLES/26 Jun 2026
ความเสี่ยงของการทำ Security Hardening เอง และ CONFIX Solution
OS และ Server ที่เพิ่งติดตั้งมักเปิด service และ port ทิ้งไว้เพื่อความสะดวก Security Hardening คือการไล่ปิดสิ่งที่ไม่ได้ใช้ เพื่อลดพื้นที่ให้ผู้โจมตีเข้ามา
ARTICLES/27 Jun 2024
System Hardening คืออะไร เริ่มต้นจาก CIS Benchmark
System hardening คือการปรับตั้งค่า package, server, database, OS, firewall และ cloud service ให้เป็นไปตาม security best practice เพื่อลด attack surface บทความพาเริ่มจากศูนย์
ARTICLES/20 Mar 2020
รอบรู้เรื่อง Remote Access ผ่าน VPN
VPN ทำให้การเชื่อมต่อระหว่างต้นทางกับปลายทางปลอดภัยได้อย่างไร ตั้งแต่ยุคที่องค์กรต้องลาก lease line มาจนถึงเทคโนโลยี VPN ที่ใช้กันทุกวันนี้
Tell us what needs hardening
We recommend beginning at the operating system layer and working upward. Tell us what you run and we will scope it.
