Configuration & Build Reviews

Configuration and build reviews for firewalls, servers and workstations

We assess your device configurations and standard builds against CIS Benchmarks and vendor hardening guidance, identify security gaps, and prioritise remediation. Individually scoped, with a fixed price agreed before work starts.
Get a Quote Book a Scoping Call

Accreditations and memberships

CREST member company, accredited for penetration testing CREST-accredited penetration testing Cyber Essentials certified UK Cyber Security Council member

Configuration Review

What is a configuration review?

A penetration test shows what an attacker can exploit. A configuration review looks at the settings that make a system hard or easy to attack in the first place, and checks them against a recognised baseline. It assesses how devices are configured rather than attempting to break into them.

We review the builds and devices you use, such as a standard server image or a firewall, against CIS benchmarks and vendor hardening guidance, and report where the configuration differs from them, with remediation guidance in order of risk.

Typical review targets

  • Firewalls & network devices
  • Windows & Linux servers
  • Workstations & laptops
  • Standard build images
  • Security settings & policies

Why review builds?

Every device inherits its settings from a build. A weakness in a build image or a firewall rule set is repeated wherever it is used, so correcting it once improves every system that shares it.

Who Needs This

Who needs a configuration review?

Any organisation that builds servers and workstations from standard images, or relies on firewalls and network devices to protect its systems.
Get a Configuration Review

Organisations with standard builds

A server or workstation image used across many machines is a single point to get right. Reviewing the build checks the settings every machine inherits.

Owners of firewalls and network devices

Firewalls and network devices sit between systems and attackers. A review checks their settings, management access and hardening.

Compliance and assurance work

ISO 27001, PCI DSS and Cyber Essentials include expectations around secure system configuration. A configuration review can provide evidence of how selected builds and devices compare with recognised security baselines, supporting your wider compliance and assurance work.

Teams preparing for an internal test

Correcting baseline configuration weaknesses first makes a later internal penetration test more productive, because the test can concentrate on harder-to-find attack paths.

Scope & Coverage

What a configuration review covers

Scope depends on the builds and devices you use, and we confirm it during scoping. These are the areas we typically review.

  • Firewalls and network devices

    Configuration, management access and hardening of firewalls and other network devices, assessed against vendor hardening guidance.

  • Windows servers

    Server builds assessed against the relevant CIS benchmark, covering the security settings that decide how hard the server is to attack.

  • Linux servers

    Server builds assessed against the relevant CIS benchmark, covering configuration, services and access settings.

  • Workstations and laptops

    Standard end-user build images and endpoint settings assessed against the relevant CIS benchmark.

  • The benchmarks and guidance we use

    CIS Benchmarks for servers and workstations, vendor hardening guidance, and NCSC guidance as a reference. We confirm which apply to your estate during scoping. For cloud accounts, subscriptions and projects, see our cloud penetration testing service.

Our Methodology

How we conduct a configuration review

A configuration review is a structured comparison between how your systems are set up and how a recognised benchmark says they should be.
01

Scoping

We agree the builds and devices in scope, the benchmarks that apply and how we will collect the configuration. Reviews are remote by default, and on-site where devices can't be reached remotely.
02

Collection

We gather the configuration of the in-scope builds and devices in the way agreed during scoping.
03

Assessment

We assess each build or device against the agreed CIS Benchmark or applicable vendor hardening guidance, using relevant NCSC guidance as an additional reference where appropriate. A consultant reviews the differences and their security implications.
04

Prioritisation

Findings are rated by the risk they create for your environment, rather than listed as pass or fail, so you know which fixes to make first.
05

Reporting & Debrief

You receive an executive summary and technical report documenting the configuration gaps identified, their risk, and recommended remediation. A debrief call follows so you can discuss the findings and agree priorities.

Pricing

Configuration reviews are scoped individually

The price depends on the number of distinct builds and devices reviewed. We scope each review and agree a fixed price before work starts. Tell us the following in your quote request and we'll reply within one business day to confirm the scope, then send a fixed-price proposal. See the pricing guide for the services we publish prices for.

  • What you want reviewed

    How many distinct server builds, workstation images and firewalls or network devices are in scope.

  • What they run

    Operating system versions and firewall or device vendors, so we can confirm which benchmarks and guidance apply.

  • How we can reach them

    Whether devices can be reviewed remotely, or whether some need an on-site visit.

Ready to scope your configuration review?

Tell us which builds and devices you want reviewed, and we'll agree a scope and a fixed price.
Book a Scoping Call

Common Questions

Configuration review: frequently asked questions

We scope configuration reviews individually and agree a fixed price before work starts. The number of distinct builds and devices drives the effort.

Our penetration testing pricing guide compares costs across the services we publish prices for.

A configuration review compares how your systems are set up with a recognised benchmark. A penetration test simulates what an attacker may be able to do through attempted exploitation of weaknesses.

See internal penetration testing and external penetration testing for more details on our network penetration testing services.

The price scales with the number of distinct builds and devices, so our recommendation is to perform configuration reviews on a sample of individual device builds.

Tell us how many server builds, workstation images and firewalls or network devices you have, and we confirm what needs reviewing during scoping.

For servers and workstations we use the CIS Benchmarks. For firewalls and network devices we use vendor hardening guidance, and we reference NCSC guidance. We confirm which apply to your estate during scoping.

Reviews are done remotely by default. We work on-site where the devices can't be reached remotely, such as in segmented networks.

Our CREST accreditation is for penetration testing. A configuration review is a separate service, and we don't claim CREST accreditation for it. Configuration reviews are typically performed alongside internal network penetration testing.

A re-check of corrected settings can be included by agreement. Tell us when requesting a quote if you want us to verify remediation, and we'll confirm the scope and cost in the proposal.

You can request a quote using the form on our quote page. Include the number of distinct builds and devices, the operating systems and vendors involved, and whether any need an on-site visit.

We reply within one business day to confirm your scope, then send a fixed-price written proposal.