Resources · Scripts & Tools
The same baselines and templates we use in engagements, free to download and use. Every file lists its SHA-256 checksum — verify before you run, exactly as you'd expect a security firm to tell you.
Applies a conservative CIS-subset baseline to standalone Windows 11 machines: UAC, SmartScreen, SMB signing, LSA protection, Defender ASR rules, PowerShell logging, and audit policy. Includes a -ReportOnly audit mode and creates a restore point before changing anything.
SHA-256
9f8fc8afb7c314bf3e54369c7d9be3206097dc99b8e578e87936344baa8ec810Baseline hardening for Debian/Ubuntu servers: SSH daemon lockdown, UFW default-deny firewall, kernel and network sysctls, auditd with starter rules, and unattended security updates. Includes a --report-only audit mode and validates the SSH config before reloading.
SHA-256
d57d78d9e565f724e47c8fe922b2b644667d196f26a925203fcfcae1f97e556dThese tools apply conservative defaults, but every environment is different — read the script, run report-only mode first, and test before production. Want a reviewed, managed rollout instead? Talk to us.
Looking for guides and checklists instead? Back to all resources.
These scripts apply conservative defaults, but every environment is different. We can assess, tailor, and operate hardening across your fleet — talk to us.