What is a build and configuration review?
A build and configuration review checks a system against a defined hardening standard, line by line, to find settings that leave it weaker than it should be. Incursion reviews Windows, Unix and Linux, and macOS builds for UK organisations, delivered by named consultants with UK Cyber Security Council professional titles.
What we test
Operating system hardening against the relevant CIS Benchmark or your own build standard.
Patching and update configuration, including the registry keys and policies that make a control real rather than nominal.
Local accounts, privileges, password policy and administrative access.
Services, scheduled tasks, software inventory and unsupported components.
Endpoint protection, logging, disk encryption and removable media controls.
Gold images, standard laptop builds, servers and specific high-value hosts.
Why it matters
Penetration tests find what an attacker can reach; build reviews find why. A standard laptop build with one wrong policy is a thousand laptops with the same flaw. Reviewing the build once is the cheapest way to fix a fleet, and it is the review that most directly supports Cyber Essentials Plus, where a missing registry key on a sampled machine is a common cause of failure.
How we run it
Scoping. Your account manager and an active penetration tester work with you to agree the scope of your test on a scoping call. The quote is fixed to it.
Testing. A named, suitably qualified consultant does the work, and you get a direct line to them before, during and after the engagement. Critical and high-risk issues are verified and reported immediately.
Reporting. Easily digestible summaries sum up the whole engagement and support detailed technical findings, written so your team can replicate and fix them. Delivered within 5 working days.
Free retesting. One day of free retesting for every five days of consultancy, taken within 90 days of report delivery, so you can be sure the fixes worked.
Scoping notes
We need administrative access to a representative system, or the image itself. Tell us which standard you want to be measured against; if you do not have one we use the CIS Benchmark for the platform. Reviews take half a day per build, with a minimum engagement of one day.
What you get
A named consultant with a UK Cyber Security Council professional title, who scoped the work and delivers it.
A report within 5 working days: executive summary, technical summary, and observation, impact and remediation for every finding.
Immediate notification of critical and high-risk issues, once we have verified them.
Free retesting: one day for every five days of consultancy, within 90 days of the report.
A walkthrough call with the consultant for your team, on request, at no extra cost.
Frequently asked questions
Which platforms do you cover?
Windows desktop and server, Unix and Linux distributions, and macOS.
Which standard do you review against?
Your own build standard if you have one, otherwise the CIS Benchmark for the platform.
Is this the same as a vulnerability scan?
No. A scan reports missing patches. A build review checks configuration: policy, permissions, services, encryption and the settings that determine whether a patch or a control is actually enforced.
Ready to scope a test?
Book a call. Our sales team will set it up and handle the proposal; an active penetration tester agrees the scope with you. No obligation.