CyberTwin
Coverage · Vendor depth

How deeply we read each vendor

You upload a configuration export; CyberTwin reads it and runs that vendor’s checks. It never scans your network. How much we can tell you depends on the vendor, so this table shows it vendor by vendor: the checks that run, the highest grade a finding can reach, whether findings feed attack paths, how often a finding cites the line it came from, and what we do not read yet. It is generated from the product’s own code, so it changes when the code does.

Vendors
37
configuration exports we read
Checks
1,913
across all vendors; each file runs its own vendor’s set
Can reach PROVEN
3
Fortinet FortiGate, Palo Alto Networks PAN-OS and OPNsense
Feed attack paths
14
the rest stay in the review

How to read the table

 PROVEN
Read from your export and re-checked by parsing the same file again, so anyone can confirm the finding from the file. Only Fortinet FortiGate, Palo Alto Networks PAN-OS and OPNsense reach it today.
 OBSERVED
Read from your export, with the setting it comes from, but not re-checked by a second parse. Anything inferred rather than read, such as attack paths and dollar ranges, is labelled MODELED wherever it appears.
Lines cited
The share of findings that cite the exact line of your file, measured on our sample exports run the same way a customer upload runs. Rounded down. The other findings still name the setting they come from.
Attack paths
Whether this vendor’s findings are drawn into the paths an attacker could take to your crown jewels. Findings from the other vendors stay in the review.

Firewalls and network10 VENDORS

  1. Fortinet FortiGate

    show full-configuration text export

    Checks
    59
    Highest grade
     PROVEN
    Attack paths
    Feeds paths
    Lines cited
    82%
    42 of 51 findings

    Known limits

    • Multi-VDOM exports are read as partial: the settings inside config global and each VDOM are not read yet, and the review says so.
    What the checks cover
    • Policies 12
    • Auth 9
    • Crypto 6
    • Interfaces 5
    • System 5
    • Intent 4
    • Password policy 4
    • VPN 4
    • Logging 3
    • HA 2
    • Inspection 2
    • NAT 2
    • SNMP 1

    Sections the parser read in our sample export: system global · system password-policy · system ntp · system auto-install · system admin · system interface · firewall policy · log setting · log syslogd setting · system ha · ips global · vpn ssl settings · system autoupdate schedule · system snmp community · vpn ipsec phase1-interface

  2. Palo Alto Networks PAN-OS

    PAN-OS XML running config (export) · `set`-format export

    Checks
    50
    Highest grade
     PROVEN
    Attack paths
    Feeds paths
    Lines cited
    Not measured

    Known limits

    • Panorama exports: rules from the pre- and post-rulebases are read, but their evaluation order is not modelled yet.
    • Security profile groups are read by name. The profiles inside a group are not checked yet.
    • Line coverage is not measured: none of our sample exports for this vendor parses today.
    • If your export leaves a section out, the review does not flag it as partial yet.
    What the checks cover
    • Policies 8
    • Management 6
    • Admin 4
    • Password 4
    • VPN 3
    • Decryption 2
    • GlobalProtect 2
    • HA 2
    • NAT 2
    • Security profile 2
    • Updates 2
    • Captive portal 1
    • CLI 1
    • Dataplane 1
    • DNS security 1
    • Ethernet 1
    • Inspection 1
    • Management profile 1
    • NTP 1
    • SNMP 1
    • Threat prevention 1
    • URL filtering 1
    • User-ID 1
    • Zone 1

  3. Cisco ASA / Firepower

    show running-config text export

    Checks
    42
    + 3 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Feeds paths
    Lines cited
    22%
    14 of 62 findings

    Known limits

    • 3 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • AAA 5
    • Logging 4
    • Management 4
    • Password 3
    • SSH 3
    • VPN 3
    • ACL 2
    • Crypto 2
    • NAT 2
    • NTP 2
    • SNMP 2
    • Banner 1
    • Cluster 1
    • Console 1
    • DHCP 1
    • ICMP 1
    • Inspection 1
    • Object group 1
    • Routes 1
    • Threat detection 1
    • TLS 1

    Sections the parser read in our sample export: running-config · access-lists

  4. Cisco Meraki

    Dashboard API JSON export

    Checks
    52
    + 2 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Feeds paths
    Lines cited
    0%
    0 of 22 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • 2 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Login 11
    • SSID 4
    • VPN 4
    • SNMP 3
    • Alerts 2
    • API 2
    • Client 2
    • Content filtering 2
    • Firmware 2
    • IPS 2
    • NAT 2
    • Switch 2
    • Syslog 2
    • Admin roles 1
    • AMP 1
    • DHCP 1
    • Firewall 1
    • Geofence 1
    • Layer 7 firewall 1
    • Local status page 1
    • Monitoring 1
    • Org 1
    • Policies 1
    • Umbrella 1
    • Wi-Fi 1

  5. Sophos XGS

    XGS XML config export

    Checks
    60
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    1%
    1 of 58 findings

    Known limits

    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    What the checks cover
    • Auth 7
    • Email 5
    • Management 5
    • VPN 4
    • Policies 3
    • Backup 2
    • Logging 2
    • NAT 2
    • SNMP 2
    • Threat 2
    • TLS 2
    • WAF 2
    • Web 2
    • Admin 1
    • API 1
    • App control 1
    • ATP 1
    • AV 1
    • Certificates 1
    • DOS 1
    • Firewall 1
    • Firmware 1
    • HA 1
    • Heartbeat 1
    • Inspection 1
    • IPS 1
    • Lifecycle 1
    • Notification 1
    • SSH 1
    • Synchronized security 1
    • Time 1
    • Users 1
    • Zone 1

  6. pfSense

    config.xml backup

    Checks
    45
    + 2 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    4%
    4 of 83 findings

    Known limits

    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    • 2 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Admin 8
    • OpenVPN 4
    • SSH 4
    • IPsec 3
    • Firewall 2
    • Packages 2
    • Unbound 2
    • Users 2
    • ACME 1
    • Auth 1
    • Backup 1
    • Captive portal 1
    • Console 1
    • DHCP 1
    • Firmware 1
    • IPv6 1
    • Logging 1
    • NAT 1
    • Notification 1
    • NTP 1
    • PKI 1
    • SNMP 1
    • Suricata 1
    • Upgrade 1
    • WireGuard 1
    • Other checks 1

  7. OPNsense

    config.xml backup

    Checks
    27
    + 3 guidance only
    Highest grade
     PROVEN
    Attack paths
    Not yet
    Lines cited
    75%
    6 of 8 findings

    Known limits

    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    • 3 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • IPsec 2
    • NAT 2
    • OpenVPN 2
    • SSH 2
    • Admin 1
    • Alias 1
    • Auth 1
    • Captive portal 1
    • Console 1
    • Cron 1
    • DNS 1
    • Firewall 1
    • Firmware 1
    • Gateway 1
    • HTTP proxy 1
    • IDS 1
    • Logging 1
    • SNMP 1
    • Suricata 1
    • Tunables 1
    • Users 1
    • WireGuard 1
    • Other checks 1

  8. Check Point GAIA / R81+

    `show configuration` text

    Checks
    45
    + 1 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    16%
    7 of 43 findings

    Known limits

    • Findings stay in the review. They do not feed attack paths yet.
    • 1 more item is guidance only: an export cannot show it, so it is not counted as a check.
    What the checks cover
    • Password 8
    • Audit 4
    • Policies 3
    • SNMP 3
    • SSH 3
    • Backup 2
    • Banner 2
    • Management 2
    • NTP 2
    • System 2
    • Web 2
    • AAA 1
    • Admin 1
    • DNS 1
    • HA 1
    • Idle 1
    • Interfaces 1
    • IPS 1
    • Portal 1
    • Proxy 1
    • SmartLog 1
    • Tracking 1
    • User admin 1

    Sections the parser read in our sample export: gaia-system · access-policy

  9. Juniper SRX

    `show configuration` text · JSON RPC export

    Checks
    44
    + 2 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    2%
    1 of 37 findings

    Known limits

    • Findings stay in the review. They do not feed attack paths yet.
    • 2 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Login 6
    • SSH 5
    • IKE 4
    • Logging 3
    • Services 3
    • AAA 2
    • Host 2
    • IDP 2
    • NTP 2
    • Policies 2
    • SNMP 2
    • ALG 1
    • Archival 1
    • Banner 1
    • Firewall 1
    • IPsec 1
    • NETCONF 1
    • Root 1
    • Screen 1
    • Security 1
    • System 1
    • UTM 1

    Sections the parser read in our sample export: system · security

  10. WatchGuard Firebox

    XML config export

    Checks
    51
    + 2 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    0%
    0 of 43 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    • 2 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • VPN 7
    • Default packet handling 4
    • Management 4
    • Logging 3
    • Auth 2
    • Certificates 2
    • Geolocation 2
    • IPS 2
    • Policies 2
    • Proxy 2
    • Threat 2
    • Admin 1
    • Apps 1
    • Botnet 1
    • Branch office VPN 1
    • DNS 1
    • Firewall 1
    • Firmware 1
    • Gateway AntiVirus 1
    • HTTPS 1
    • IntelligentAV 1
    • NAT 1
    • Reputation Enabled Defense 1
    • Services 1
    • SNMP 1
    • ThreatSync 1
    • Time 1
    • Users 1
    • WebBlocker 1
    • Other checks 1

Identity6 VENDORS

  1. Microsoft Entra ID Conditional Access

    Microsoft Graph JSON export

    Checks
    35
    + 5 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Feeds paths
    Lines cited
    9%
    3 of 31 findings

    Known limits

    • If your export leaves a section out, the review does not flag it as partial yet.
    • 5 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Policies 7
    • Session 4
    • Apps 3
    • MFA 3
    • Guest users 2
    • Auth flows 1
    • Geolocation 1
    • Named locations 1
    • Posture 1
    • Privileged 1
    • Risk 1
    • Sign-in 1
    • Terms of use 1
    • Other checks 8

    Sections the parser read in our sample export: conditionalAccessPolicies

  2. Okta

    Okta API JSON export (policies + rules)

    Checks
    53
    + 5 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Feeds paths
    Lines cited
    Not measured

    Known limits

    • Line coverage is not measured: none of our sample exports for this vendor parses today.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • 5 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Password 9
    • MFA 6
    • Apps 5
    • Users 4
    • OAuth 3
    • Admin 2
    • Event hooks 2
    • Factor 2
    • Recovery 2
    • Session 2
    • API 1
    • Brand 1
    • Delegated auth 1
    • Detection 1
    • Group 1
    • IDP 1
    • Legacy 1
    • Lifecycle 1
    • Policies 1
    • SCIM 1
    • Sign-on 1
    • System 1
    • Threat 1
    • ThreatInsight 1
    • Trusted origins 1
    • Zone 1

  3. AWS IAM

    aws iam get-account-authorization-details · Single IAM policy doc

    Checks
    52
    Highest grade
     OBSERVED
    Attack paths
    Feeds paths
    Lines cited
    15%
    3 of 19 findings

    Known limits

    • If your export leaves a section out, the review does not flag it as partial yet.
    What the checks cover
    • Policies 17
    • Users 9
    • Role 6
    • Root 3
    • Identity center 2
    • Password policy 2
    • Access analyzer 1
    • Identity 1
    • Org 1
    • Permission set 1
    • Role trust 1
    • Server certificate 1
    • Other checks 7

    Sections the parser read in our sample export: users · roles · policies

  4. Google Workspace

    Admin SDK / API JSON export

    Checks
    53
    + 1 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    0%
    0 of 51 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    • 1 more item is guidance only: an export cannot show it, so it is not counted as a check.
    What the checks cover
    • Gmail 15
    • Admin 4
    • Drive 4
    • 2SV 3
    • Apps 3
    • Alerts 2
    • Calendar 2
    • DLP 2
    • Groups 2
    • Mobile 2
    • Password 2
    • Recovery 2
    • API 1
    • Audit 1
    • Auth 1
    • Chat 1
    • Data 1
    • GWS 1
    • Session 1
    • Sites 1
    • Other checks 2

    Sections the parser read in our sample export: orgUnitPath · workspace_settings · orgUnits · dlpRules · contextAwareAccessLevels · authentication · passwordPolicy · recovery · admins · session · apiAccess · thirdPartyApps · marketplaceSettings · appsMarketplaceInstallPolicy · domainWideDelegation · gmail · drive · calendar · sites · chat · groupsSharing · groupsExternalAccess · groupCreation · takeout · mobileManagement · deviceManagement · screenLock · requireScreenLock · alerts · suspiciousLoginAlerts · auditLog

  5. JumpCloud

    JumpCloud API JSON export

    Checks
    48
    + 4 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Feeds paths
    Lines cited
    0%
    0 of 46 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • 4 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Directory 6
    • IAM 6
    • MFA 5
    • Password 4
    • Systems 4
    • Radius 3
    • API 2
    • Conditional access 2
    • Logging 2
    • Policies 2
    • SCIM 2
    • SSO 2
    • Admin 1
    • Commands 1
    • Crypto 1
    • Event log 1
    • LDAP 1
    • SSH 1
    • Users 1
    • Other checks 1

    Sections the parser read in our sample export: organizationName · settings · fdeEnforced · directoryInsights · logExport · ldap · scim · radius · ssh · conditionalAccessPolicies · applications · apiKeys · users · systems · devicePolicies · commands · eventLogStream · policies

  6. Auth0

    Tenant settings JSON

    Checks
    70
    + 2 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    0%
    0 of 24 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    • 2 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Tenant 27
    • Client 9
    • Policies 6
    • API 4
    • Action 3
    • Connection 3
    • Apps 2
    • MFA 2
    • Password 2
    • Role 2
    • Session 2
    • Token 2
    • Email 1
    • Legacy 1
    • Management API 1
    • PKCE 1
    • Signup 1
    • Other checks 1

    Sections the parser read in our sample export: friendly_name · isDevelopment · flags · default_redirection_uri · custom_domains · error_page · clients · attack_protection · guardian · logStreams

Email security4 VENDORS

  1. Microsoft Defender for Office 365

    PowerShell ConvertTo-Json export

    Checks
    52
    + 4 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Feeds paths
    Lines cited
    0%
    0 of 40 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • 4 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Anti-phishing 12
    • Anti-spam 11
    • Safe links 10
    • Safe attachments 4
    • Connectors 2
    • Preset 2
    • Safe docs 2
    • Alert 1
    • Connection filter 1
    • DKIM 1
    • Outbound 1
    • Outbound spam 1
    • Shared mailbox 1
    • Transport 1
    • Transport rule 1
    • Other checks 1

    Sections the parser read in our sample export: anti-phish · anti-spam · safe-links · safe-attachments

  2. Mimecast

    Policy JSON export

    Checks
    57
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    0%
    0 of 57 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    What the checks cover
    • URL protect 5
    • Auth 4
    • Admin 3
    • Audit 3
    • Bypass 3
    • Anti-spoofing 2
    • Attachment 2
    • Attachment protect 2
    • DLP 2
    • DMARC 2
    • DNS auth 2
    • TTP 2
    • API 1
    • Archive 1
    • Auto allow 1
    • AV 1
    • Backup 1
    • Brand exploit 1
    • Connectors 1
    • Continuity 1
    • DKIM 1
    • Encryption 1
    • Geolocation 1
    • Greylisting 1
    • Impersonation 1
    • Impersonation protect 1
    • Internal Email Protect 1
    • Logging 1
    • Permitted senders 1
    • Policies 1
    • Remediation 1
    • Secure messaging 1
    • Spam 1
    • SPF 1
    • Threat feed 1
    • User impersonation 1
    • Users 1

    Sections the parser read in our sample export: account · exportType · policies · dns_authentication · spf_softfail_action · dmarc_action · dmarc · spamScoreThreshold · auto_allow · greylisting · greylisting_enabled · geo_blocking · blocked_countries · antivirus · av_scanning_enabled · dkim_signing · brand_exploit · threat_intel_feed · detected_action · encryption_policy · secure_messaging · large_file_send · auto_remediation · automatic_remediation · cluster_tracking · campaign_tracking_enabled · internal_email_protect · admin_authentication · password_policy · api_application · sync_and_recover · backup · logging · siemConnection · siem_export_enabled · audit_export · connector · archive · continuity · user_managed_allow_list_count · userAllowListCount

  3. Proofpoint

    Policy export (JSON or PPS YAML)

    Checks
    46
    + 7 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    0%
    0 of 45 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    • 7 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Admin 6
    • TAP 4
    • Connectors 3
    • DLP 3
    • Anti-spoofing 2
    • Audit 2
    • DMARC 2
    • Impostor 2
    • Policies 2
    • Quarantine 2
    • Spam 2
    • Trap 2
    • Alerts 1
    • API 1
    • Archive 1
    • Attachment Defense 1
    • Closed loop 1
    • Continuity 1
    • DKIM 1
    • Email encryption 1
    • Email firewall 1
    • Logging 1
    • Module 1
    • Sandbox 1
    • Smart search 1
    • SPF 1

    Sections the parser read in our sample export: name · action · rules · targetedAttackProtection · urlDefense · attachmentDefense · sandbox · dmarc · spf · dkim · impostor · impersonation · becDefense · antiSpoof · allowList · spamfilter · bulkThreshold · dlp · emailEncryption · archive · connectors · connector · tlsMinVersion · trap · clear · apiToken · endUserDigest · siemIntegration · defaultAction · autoForward · continuity · quarantineRetentionDays · smartSearch · sso · adminMfa · localConsoleUsers · adminRoles · sessionTimeoutMinutes · passwordPolicy · auditLog · syslog · alerting

  4. Abnormal Security

    Policy JSON export

    Checks
    51
    + 7 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    0%
    0 of 49 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    • 7 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Scope 6
    • Audit 5
    • Allowlist 4
    • Access 3
    • Account takeover 3
    • API 3
    • Remediation 3
    • Phishing 2
    • Posture 2
    • Security posture management 2
    • Abuse mailbox 1
    • BEC 1
    • Detection 1
    • Email domains 1
    • Exec impersonation 1
    • Executive list 1
    • Invoice fraud 1
    • Malware 1
    • Quarantine 1
    • Reply chain 1
    • Safelist 1
    • Scam extortion 1
    • SCIM 1
    • Spam 1
    • Spoofing 1
    • User allowlist 1
    • Vendor fraud 1
    • VIP 1

    Sections the parser read in our sample export: policies · allowlist · userAllowlist · executives · webhookUrl · scimSync · remediationWindowHours · atoSuspendDelayMinutes · lookalikeBlock · behavioralAnomaly · siemIntegration · webhooks · enrolledMailboxes · botDetection · autoRemediation · detectionMode · aiSecurityMailbox · ipSafelist · sso · mfaRequired · rbac · auditLogRetentionDays · securityPostureManagement · oauthAppMonitoring · internalEmailScanning · attachmentAnalysis · urlAnalysis · misdirectedEmail · graymail · apiIntegration · permissionScope · detectionPaused · vipAutoSync · quarantine

Endpoint5 VENDORS

  1. Microsoft Defender for Endpoint

    Security baseline JSON (Intune or PowerShell export)

    Checks
    44
    + 2 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Feeds paths
    Lines cited
    0%
    0 of 40 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • 2 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • AV 10
    • Policies 6
    • Live response 3
    • Exclusions 2
    • Air 1
    • Alerting 1
    • AppLocker 1
    • ASR 1
    • Cloud protection 1
    • Compliance 1
    • Controlled folder 1
    • Device control 1
    • EDR 1
    • Exploit protection 1
    • Macro 1
    • Network protection 1
    • Realtime 1
    • Response 1
    • Signature 1
    • Smart App Control 1
    • SmartScreen 1
    • Tampering 1
    • WDAC 1
    • Web 1
    • XDR 1
    • Other checks 2

    Sections the parser read in our sample export: policyName · deviceConfiguration · liveResponseEnabled · liveResponseRole · liveResponse · indicators · deviceGroups

  2. CrowdStrike Falcon

    Prevention policy JSON

    Checks
    73
    + 7 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Feeds paths
    Lines cited
    0%
    0 of 20 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • 7 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Prevention 29
    • Policies 5
    • API 3
    • Exclusions 3
    • Sensor update 3
    • Console 2
    • Content update 2
    • Identity protection 2
    • Linux 2
    • Logging 2
    • USB 2
    • Cloud workloads 1
    • Device control 1
    • FileVantage 1
    • Firewall 1
    • Firmware 1
    • Host groups 1
    • Mac 1
    • Maintenance token 1
    • Malware 1
    • Next-gen AV 1
    • RBAC 1
    • RTR 1
    • Script 1
    • Spotlight 1
    • Suppress 1
    • Uninstall 1
    • USB control 1
    • Zero trust 1

    Sections the parser read in our sample export: tenant · platform_name · preventionPolicies · linuxPreventionPolicy · macPreventionPolicy · contentUpdatePolicy · sensorUpdatePolicy · sensor_visibility_exclusion · filevantage · responsePolicy

  3. SentinelOne

    Policy JSON export

    Checks
    45
    + 5 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    0%
    0 of 42 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    • 5 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Engine 8
    • Policies 5
    • Exclusions 4
    • Agent 3
    • Console 3
    • Deep visibility 2
    • Mitigation 2
    • Anti-tamper 1
    • Behavioral AI 1
    • Cloud security 1
    • Device control 1
    • Engine version 1
    • Firewall 1
    • Global allowlist 1
    • Lateral movement 1
    • Logging 1
    • Network quarantine 1
    • Ranger 1
    • Remote shell 1
    • Script control 1
    • Snapshot 1
    • Static AI 1
    • Upgrade 1
    • USB 1
    • Users 1

    Sections the parser read in our sample export: siteId · siteName · sentinelOne · console · users · agent · policies · globalAllowlist · exclusions

  4. Microsoft Intune

    Configuration profile JSON export

    Checks
    69
    + 2 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    0%
    0 of 67 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    • 2 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Compliance 20
    • App protection 16
    • Defender 9
    • Config 8
    • Apps 6
    • Endpoint 5
    • Device enrollment 1
    • Password 1
    • SCEP 1
    • Update 1
    • Windows update rings 1

    Sections the parser read in our sample export: tenant · compliancePolicies · configurationProfiles · appProtectionPolicies

  5. Jamf Pro

    Configuration profile XML/plist

    Checks
    71
    + 7 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    1%
    1 of 70 findings

    Known limits

    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    • 7 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Restrictions 11
    • Server 11
    • Login window 7
    • Passcode 6
    • Profile 6
    • FileVault 3
    • Firewall 3
    • Software update 3
    • Policies 2
    • Screensaver 2
    • AirDrop 1
    • Apps 1
    • Audit 1
    • Gatekeeper 1
    • Kerberos 1
    • Management 1
    • Notifications 1
    • Password 1
    • Safari 1
    • Screen 1
    • Smart group 1
    • SSH 1
    • System Integrity Protection 1
    • Terminal 1
    • Time 1
    • Time Machine 1
    • Update 1

SIEM3 VENDORS

  1. Microsoft Sentinel

    ARM template / JSON export of analytic + automation rules

    Checks
    42
    + 10 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Feeds paths
    Lines cited
    4%
    1 of 24 findings

    Known limits

    • If your export leaves a section out, the review does not flag it as partial yet.
    • 10 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Coverage 10
    • Analytic 8
    • Workspace 6
    • Rules 4
    • Automation 2
    • Connectors 2
    • Detection 2
    • Threat intel 2
    • Entity 1
    • Fusion 1
    • Incident 1
    • RBAC 1
    • Tables 1
    • UEBA 1

    Sections the parser read in our sample export: alertRules · automationRules

  2. Splunk Enterprise Security

    savedsearches.conf / correlation searches export

    Checks
    35
    + 23 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    28%
    7 of 25 findings

    Known limits

    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    • 23 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • TLS 6
    • Auth 4
    • Cluster 3
    • Indexes 3
    • Rules 3
    • HEC 2
    • Management 2
    • RBAC 2
    • Search 2
    • Adaptive response 1
    • Audit 1
    • Correlation 1
    • Coverage 1
    • License 1
    • Notable event 1
    • Saved searches 1
    • Scheduling 1

  3. Elastic Security

    Detection rules NDJSON export

    Checks
    55
    + 18 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    11%
    10 of 86 findings

    Known limits

    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    • 18 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Rules 16
    • Coverage 11
    • Endpoint 7
    • Cluster 3
    • Kibana 3
    • Audit 2
    • Authentication 2
    • Lifecycle 2
    • TLS 2
    • Alerts 1
    • Detection rules 1
    • Exceptions 1
    • Fleet 1
    • Response 1
    • Risk engine 1
    • Threat intel 1

Cloud4 VENDORS

  1. AWS Config / Security Hub

    aws configservice describe-config-rules + Security Hub findings

    Checks
    94
    Highest grade
     OBSERVED
    Attack paths
    Feeds paths
    Lines cited
    0%
    0 of 88 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    What the checks cover
    • Monitoring 16
    • IAM 12
    • S3 9
    • CloudTrail 5
    • Org 5
    • Security groups 5
    • RDS 4
    • EC2 3
    • ELB 3
    • KMS 3
    • Lambda 3
    • Root 3
    • VPC 3
    • DynamoDB 2
    • EKS 2
    • Redshift 2
    • Access keys 1
    • ACM 1
    • API Gateway 1
    • Config 1
    • EBS 1
    • EFS 1
    • GuardDuty 1
    • NACL 1
    • Password policy 1
    • SageMaker 1
    • Secrets Manager 1
    • Security hub 1
    • SNS 1
    • SSM 1

    Sections the parser read in our sample export: ConfigRules · Findings · PasswordPolicy · ConfigurationRecorders · GuardDuty · SecurityHub

  2. Azure Policy + Defender for Cloud

    Policy assignments + Defender secure score JSON

    Checks
    87
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    0%
    0 of 83 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    What the checks cover
    • Storage 10
    • SQL 9
    • App Service 8
    • Key Vault 8
    • Defender 7
    • AKS 5
    • VMs 5
    • NSG 4
    • Activity log 3
    • RBAC 3
    • Cosmos DB 2
    • Diagnostic settings 2
    • Disk 2
    • Functions 2
    • Network 2
    • PostgreSQL 2
    • Private Link 2
    • Bastion 1
    • Deployment 1
    • Entra ID 1
    • IAM 1
    • Lock 1
    • Management groups 1
    • MySQL 1
    • PIM 1
    • Role assignments 1
    • Score 1
    • VNet 1

    Sections the parser read in our sample export: subscriptionId · secureScore · defenderForCloud · policyAssignments · policyExemptions · defenderRecommendations · managementGroup · activityLogExport · activityLogAlerts · networkWatchers · resourceLocks · managementLocks · bastionHosts · guestUsersReviewedDate · guestUserReviewEnabled · aad · diagnosticSettings · storageAccounts · sqlServers · postgresqlServers · mysqlServers · cosmosAccounts · keyVaults · appServices · functionApps · aksClusters · virtualMachines · networkSecurityGroups · virtualNetworks · roleAssignments · customRoles · privateLinkResources

  3. GCP Security Command Center

    SCC findings + organization policies JSON

    Checks
    84
    + 4 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    0%
    0 of 77 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    • 4 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • IAM 14
    • Cloud SQL 12
    • Logging 11
    • Compute 8
    • GKE 6
    • Firewall 5
    • GCS 5
    • KMS 3
    • Network 3
    • Audit 2
    • BigQuery 2
    • Cloud Functions 2
    • Org 2
    • VPC 2
    • API 1
    • Audit logging 1
    • Bucket 1
    • DNS 1
    • Org policy 1
    • Other checks 2

    Sections the parser read in our sample export: sccTier · findings · iamPolicy · identitySettings · apiKeys · organizationPolicies · servicePerimeters · sinks · logMetrics · alertPolicies · logBucket · dnsPolicies · networks · sslPolicies · firewalls · computeInstances · computeProject · buckets · kmsKeys · auditConfigs · subnetworks · cloudFunctions · cloudSqlInstances · gkeClusters · bigQueryDatasets

  4. GitHub Advanced Security

    GitHub Advanced Security combined JSON

    Checks
    19
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    0%
    0 of 19 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    What the checks cover
    • Secret scanning 5
    • Code scanning 4
    • Branch protection 3
    • Actions 2
    • Dependabot 2
    • Settings 2
    • Org 1

    Sections the parser read in our sample export: code_scanning_alerts · secret_scanning_alerts · dependabot_alerts · settings

Backup2 VENDORS

  1. Veeam Backup & Replication

    Veeam job configuration JSON

    Checks
    51
    + 5 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    1%
    1 of 51 findings

    Known limits

    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    • 5 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Server 12
    • Repositories 7
    • Console 4
    • Config backup 3
    • Encryption 3
    • Air gap 2
    • Immutability 2
    • Job 2
    • Network 2
    • Application aware 1
    • Backup & Replication 1
    • Cloud connect 1
    • Copy job 1
    • Credentials 1
    • Host 1
    • Linux 1
    • MFA 1
    • Notification 1
    • Restore test 1
    • Retention 1
    • SLA 1
    • Test 1
    • Updates 1

    Sections the parser read in our sample export: veeam · version · latestUpdatesInstalled · passwordRotationEnabled · trafficEncryptionEnabled · trustUnknownLinuxHosts · sharedCredentials · appAwareProcessing · tenantQuotaGB · keyStorage · immutability · sureBackup · encryption · mfa · syslogForwarding · backupNetwork · sureBackupEnabled · recoveryVerification · backupCopyJobs · serverHardening · console · configurationBackup · jobs · repositories

  2. Rubrik

    SLA Domain JSON export

    Checks
    34
    + 12 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    0%
    0 of 34 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    • 12 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • SLA 6
    • Cluster 3
    • Objects 3
    • Archive 2
    • Auth 2
    • RBAC 2
    • SSO 2
    • API 1
    • Encryption 1
    • Logging 1
    • MFA 1
    • Quorum 1
    • Ransomware detection 1
    • Sensitive data discovery 1
    • Session 1
    • Snapshots 1
    • Support tunnel 1
    • Time 1
    • TLS 1
    • Users 1
    • Other checks 1

    Sections the parser read in our sample export: clusterName · mfaEnforced · ssoEnabled · samlEnabled · defaultAdminEnabled · localAdminEnabled · minPasswordLength · sessionTimeoutMinutes · tlsMinVersion · apiTokenExpirationHours · supportTunnelAlwaysOn · supportTunnelState · idpSigningCertExpiresInDays · ransomwareDetection · cloudVault · replicationTargets · ntpServers · ntpEnabled · quorumAuthorization · syslogForwarding · auditLogForwarding · sensitiveDataDiscovery · users · customRoles · slaDomains · protectedObjects · archiveLocations

Web application firewalls2 VENDORS

  1. Cloudflare WAF

    WAF rules JSON (Cloudflare API)

    Checks
    40
    + 6 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Feeds paths
    Lines cited
    2%
    1 of 38 findings

    Known limits

    • If your export leaves a section out, the review does not flag it as partial yet.
    • 6 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Managed rules 4
    • Rate limit 3
    • TLS 3
    • API shield 2
    • DNS 2
    • HTTPS 2
    • Security level 2
    • Access 1
    • Account 1
    • Auth 1
    • Bot fight 1
    • Bot management 1
    • Browser integrity check 1
    • Cache 1
    • Certificates 1
    • Custom rule 1
    • DDoS 1
    • DNSSEC 1
    • Email obfuscation 1
    • Firewall 1
    • HSTS 1
    • Leaked credentials 1
    • Origin 1
    • OWASP 1
    • Rules 1
    • SSL 1
    • WAF 1
    • Workers 1
    • Other checks 1

    Sections the parser read in our sample export: zone · account · settings · minTlsVersion · securityLevel · dnssec · cacheLevel · logpush · apiShield · hsts · botFightMode · super_bot_fight_mode · bot_management · certificate_transparency_monitoring · authenticated_origin_pulls · managed_rules · managedRulesets · owasp_core_ruleset · exposed_credentials_check · cf_managed · leaked_credentials_detection · http_ddos_managed · customRules · firewallRules · rateLimitRules · rate_limits · access · workers · dns

  2. AWS WAF

    Web ACL JSON

    Checks
    34
    + 10 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    0%
    0 of 31 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    • 10 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Managed rules 10
    • ACL 4
    • Logging 4
    • Rate based 3
    • Body inspection 1
    • Captcha 1
    • CORS headers 1
    • Country block 1
    • Custom rule 1
    • Default action 1
    • Geo block 1
    • Rate limit 1
    • Size restriction 1
    • Token domains 1
    • Visibility 1
    • Web ACL 1
    • Other checks 1

    Sections the parser read in our sample export: WebACL · LoggingConfiguration · PreProductionWebACL

Data loss prevention1 VENDOR

  1. Microsoft Purview DLP

    DLP policy JSON export

    Checks
    44
    + 11 guidance only
    Highest grade
     OBSERVED
    Attack paths
    Not yet
    Lines cited
    0%
    0 of 38 findings

    Known limits

    • Findings name the setting they come from, not its line number.
    • If your export leaves a section out, the review does not flag it as partial yet.
    • Findings stay in the review. They do not feed attack paths yet.
    • 11 more items are guidance only: an export cannot show them, so they are not counted as checks.
    What the checks cover
    • Scope 7
    • Endpoint 5
    • Rule 5
    • DLP 4
    • Label 4
    • Audit 3
    • Detect 3
    • Policies 3
    • Records 3
    • IRM 2
    • Action 1
    • Endpoint DLP 1
    • Other checks 3

    Sections the parser read in our sample export: dlpPolicies · sensitivityLabels · retentionLabels · endpointDLPSettings · mandatoryLabeling · advancedAudit · auditConfig · insiderRisk · labelPolicy

How this table is made

Try the demoSee plans
  • From the code, not a spreadsheet. A script reads the vendor registry, the checks, the re-parse set and the attack-path wiring, then writes this table. A test fails the release when the table and the registry disagree.
  • Checks are what an export can show. Items an export cannot show, such as whether a test was ever run, are listed as guidance and not counted.
  • Lines are measured, not promised. Each sample export we hold that is built to raise findings is run with secret redaction on and the file-type check enforced, as a customer upload is. Where no such sample parses, the table says “Not measured”.
  • Limits are listed, not hidden. When a limit is lifted in the code, it leaves this page with the same release.