A good hardening pass isn't about chasing a perfect benchmark number. It's about shrinking the attack surface that actually matters — and making an honest, signed-off call on whatever is left.
"Harden the servers" sounds like a checkbox you tick. In practice it's a day of reading, a handful of deliberate changes, and a short list of decisions someone has to own. Here's how we approach it, and the one habit that matters more than any benchmark score.
The first rule is to trust the machine, not your memory of it. A year-old architecture diagram tells you what someone intended; the running server tells you what's true. So a pass starts by reading the real thing — what's actually listening, who can still log in, which keys still work, where the backups really go. Half the findings in any pass are simply the gap between the diagram and the box.
Most of the win comes from a few unglamorous moves, applied consistently: keys instead of passwords, and separate keys for people and for automation; least privilege by default, so a compromise is boxed in from the start rather than one step away from the whole network; and changes made reversible, so a bad one undoes itself instead of taking a server down at 3 a.m. None of this is exotic. All of it is worth doing before someone else finds the gap.
Attack surface hides in the seams between layers, so we walk all of them rather than stopping at the operating system — identity and access, the application runtime, the network, backups, the build-and-deploy path, and the hypervisor underneath. The usual findings are boring and common: a service account with more reach than its job needs, a token that outlived the thing it was issued for, backups that live only on the machine they're backing up. Boring is good. Boring is fixable.
Here's the honest bit. A hardening pass never ends at zero findings, and pretending otherwise is how you get a false sense of safety. Some risks you fix. Some you deliberately choose to live with, because the fix costs more than the risk or doesn't fit how the place actually runs. The difference between an accepted risk and an oversight is simple: someone wrote it down, with a name and a date against the decision. That register — what we changed, and what we knowingly left — is the real deliverable. A benchmark score tells you how many boxes are ticked; the register tells you the remaining risk was seen, weighed and accepted on purpose.
We run this on our own systems first. Our own network and servers go through the same pass, and keep the same accepted-risk register we would hand you — we would rather find a gap on our own box than on yours.
For schools, multi-site businesses and local governments, "secure" usually shows up as a cyber-insurance questionnaire, an audit finding, or a board asking whether you're exposed. A tick-box hardening job gives you a number that looks good until an examiner or an attacker asks a real question. A clear-eyed one gives you something you can stand behind: fixes where they're worth it, and a straight, documented answer on what's left and why.
Want a clear-eyed hardening pass on your own systems — fixes where they're worth it, and a straight answer on the rest? Book a 30-minute call.
Media78 is a founder-led specialist firm on Florida's Emerald Coast, operating its own network (AS36065) and hardware. Security is the floor, never an upsell.
Book a 30-minute call. We'll tell you what actually reduces your risk
— and what's just there to make a dashboard green.