Success Story
Security hardening a bank can hand to an auditor.
How Crafty Penguins brought a US commercial bank's enterprise Linux fleet to a documented, high-90s compliance score, server by server, control by control.
Protect & comply
Harden the estate. Keep it that way.
Baselines, access, patching, and the controls your industry actually requires, SOC 2, HIPAA, CIS, or "we just want to stop being scared of an audit." We lock in a posture that holds up in production, then stay on it so it doesn't drift by Friday.
Sounds like
"We failed the audit. We need to pass the next one."
What it looks like
You might recognize one of these.
Security hardening usually arrives with a finding, a customer questionnaire, or a close call, not a quiet afternoon on the roadmap.
The audit findings are specific
SSH, sudo, patch lag, shared accounts, missing evidence. The list is sitting in someone's inbox.
Every server is a little different
Golden images never quite stuck. Drift is the real configuration management system.
Access is a pile of exceptions
Standing admin, leftover VPN users, keys nobody will revoke because "we might need them."
Patching is heroic
It happens when someone has a weekend, not on a cadence you can show an examiner.
Why it's hard
Hardening fails. Nobody owns it next quarter.
A weekend of CIS scoring is easy. Keeping the same baseline on the next fifty hosts, after the next ten engineers, is the job, and it's a job that doesn't end at go-live.
01
Production will fight a naive lockdown
Apps break. Vendors need ports. If the baseline isn't designed for how you actually run, it gets quietly undone.
02
Evidence is part of the control
If you can't show who changed what, and when it was patched, the control didn't happen as far as the auditor is concerned.
03
Drift is the default
Without a repeatable image, a patch window, and someone still on the hook for exceptions, last quarter's harden is this quarter's finding.
How we approach it
Harden it with you. Then keep running it.
We harden against how your systems actually run, then stay as the team that keeps the baseline honest, patching, access, evidence, and the next review.
-
01
See what's really there
Hosts, access paths, patch state, and the findings that already exist. No assumed inventory.
-
02
Set a baseline you can live with
CIS-aligned where it fits, exceptions documented, applications still able to run.
-
03
Apply it and prove it
Roll the baseline, close the findings that matter, keep evidence as we go.
-
04
Stay on the posture
Patch cadence, access review, new hosts that start hardened, and a partner who still owns it when the next letter arrives.
What you get with us
A posture we keep holding up.
✓
Baselines that stay locked in
New hosts start from the same standard. Old ones get pulled into it, and stay there.
✓
Intentional access, on an ongoing review
Fewer standing admin paths. Clearer who can do what. Someone still checking.
✓
Patching as a cadence, not a project
A window we run with you, not a heroic weekend you inherit.
✓
Evidence ready for the next ask
Questionnaire, audit, customer, and the one after that, because we didn't leave.
Adjacent challenges
Often part of the same conversation
Challenge · Protect & comply
Backup & Disaster Recovery
Backups that actually restore. DR plans that have been tested. The unglamorous discipline of being ready for the day you hope never comes, but is statistically certain to.
Read moreChallenge · Protect & comply
Data Sovereignty
When your data has to live in a specific country, Canada, the EU, somewhere your customers or regulators require. We architect, host, and run Linux infrastructure that stays put.
Read moreChallenge · Build & migrate
Infrastructure Migrations
Moving workloads off old platforms, cleanly, with the data intact and the change window respected. AWS to VMware, on-prem to cloud, one Linux distribution to another. We've done the trip before.
Read moreGet started
Need the next audit to go differently, and stay that way?
Tell us the findings, the framework, and what's in production. 30 minutes, no obligation, we'll tell you what has to change, and what it looks like to keep us on it.