Skip to content

Configuration review goes deeper than vulnerability scanning: it compares the actual running configuration of devices and platforms against established hardening baselines, item by item. Where scanners surface "you have a vulnerability", configuration review surfaces "this control should be on, and it is off".

Reviews typically cover a mix of asset types, Windows and Linux servers, network devices, hypervisors, databases, endpoint security platforms, sampled across the estate. Findings map to CIS Benchmarks or to your internal hardening standard, with remediation guidance built around the platform's own configuration model.

What's at stake.

Hardening decays without measurement

Configuration drift is the slow erosion that happens between audits. Without periodic review, the hardened build from two years ago no longer reflects production reality.

Auditors increasingly ask for CIS-aligned evidence

CIS-Benchmark-aligned evidence is becoming the de-facto baseline auditors and customers expect, particularly in regulated sectors.

A structured, intelligence-led path through every engagement.

Every engagement follows the same disciplined path through the Velocity platform, so quality, traceability, and reporting are consistent across teams.

Scoping

Define assets, environments, Rules of Engagement, and acceptance criteria with the technical and security stakeholders.

Execution

Manual and tool-assisted testing by CREST-accredited consultants, with evidence captured at each step.

Validation

Every finding is reproduced, risk-rated under CVSS, and confirmed by a second consultant before reporting.

Reporting

Cryptographically signed reports with test-case traceability, severity ratings, reproduction steps, and remediation guidance.

Debrief & Retest

Stakeholder walk-through of findings, prioritisation support, and a retest cycle on remediated issues.

Mapped to recognised baselines.

CIS Benchmarks
Vendor hardening guides (Microsoft, Cisco, Red Hat, VMware)
ISO 27001:2022
PCI DSS v4.0

Test Your Defences Against Adversarial Expertise

Talk to a CREST-accredited consultant about your next penetration testing engagement.