Why annual pen tests and banner scanners miss the real risk
A point-in-time penetration test is out of date the next week, and external banner scanners regularly misreport backported Linux patches while missing what actually compromises Australian mid-market businesses: unpatched CISA Known Exploited Vulnerabilities (KEVs), exposed RDP/SMB listeners, stale Microsoft 365 global admins, soft SPF/DMARC policies, risky OAuth app grants, and leaked API keys sitting on server disks.
Four surfaces checked continuously
| Surface | What we check | How remediation stays safe |
|---|---|---|
| 1. Daily Windows & Linux Endpoint Posture (BE Hub Security) | Firewall state, RDP Network Level Authentication, SMBv1, Defender status, SSH root/password login, local admins, listening ports, and installed packages matched locally against OSV, CISA KEV and NVD with zero machine data sent outside your hub. | Pre-checked group fixes run 5 machines at a time, halt after 2 failures, and include a 1-click Undo using the captured pre-fix state. |
| 2. External Attack Surface | Multi-phase nmap service discovery, 600+ protocol-aware scripts, SSH cipher audits and 14,000+ Nuclei templates across your public IPs and domains at a gentle, non-disruptive pace. | Opt-in validation proofs are restricted to 5 read-only adapters and require a human click to run. |
| 3. Host Privilege-Escalation & Redacted Secret Scan | Audits sudo NOPASSWD, dangerous Linux capabilities, exposed Docker sockets, world-writable cron jobs, and 12 secret types (AWS, GitHub, Slack, Stripe, private keys) on disk. | Secret matches are redacted on the host before transmission—raw keys never leave the server. |
| 4. Microsoft 365 & Entra ID Graph Posture | Daily checks of MX, SPF (~all vs -all), DMARC, DKIM, Conditional Access MFA, legacy auth blocks, stale/guest accounts, risky OAuth grants, Secure Score and SharePoint external sharing. | Missing Graph permissions are explicitly marked not assessable—never reported as a false pass. |
Board-ready Essential Eight and monthly PDF reporting
Every month, BE Hub generates a clean executive PDF per company showing the 0–100 security score trend, open vs resolved critical findings, Essential Eight 48-hour critical SLA compliance, and what was fixed under named technician approval.
Book a 48-hour baseline audit See BE Hub pricing ($105/tech)