Network Security Assessment Tool
Know exactly how secure your network devices are, from their configuration. ConnectMyAssets checks every device against CIS Benchmarks and security best practices: insecure protocols, default credentials, missing hardening, and management exposure. Each device gets a score, every finding gets a fix.
- ✓CIS Benchmark checks for Cisco, Juniper, Fortinet, Palo Alto
- ✓Insecure protocol detection: Telnet, SNMPv1/v2c, HTTP, FTP
- ✓Default and weak credential detection across your entire fleet
- ✓Missing hardening: logging, NTP, banners, ACL restrictions
- ✓Security score per device (0-100) with fleet-wide trending
- ✓Remediation commands per finding, ready for bulk deployment
Most Network Security Issues Are Configuration Issues
Network devices accumulate misconfigurations over time. A Telnet service enabled years ago and never disabled. An SNMP community string set to "public" during initial setup. A management interface without access restriction because it "was only temporary". NTP never configured on a fleet of branch routers. These are not exotic vulnerabilities: they are configuration hygiene issues that affect a large proportion of network devices in real-world environments, and they are completely invisible to external vulnerability scanners because they look correct from the outside. ConnectMyAssets finds them by reading the configuration directly, the same way an attacker would after gaining initial access, or the way an auditor does during a penetration test. Finding them first, and having the remediation commands ready, is what the security assessment is for.
Configuration-Based Security Analysis
From CIS Benchmark checks to remediation guidance, everything your security or network team needs to assess and improve device hardening.
CIS Benchmark Compliance
ConnectMyAssets checks your device configurations against the Center for Internet Security (CIS) Benchmarks for Cisco IOS, Cisco NX-OS, Juniper JunOS, Fortinet FortiOS, and Palo Alto PAN-OS. Controls include: SSH version 2 required, Telnet disabled, warning banners present, idle session timeout configured, password minimum complexity enforced, privilege levels correctly assigned, and management access restricted to authorized subnets. Each check produces a PASS or FAIL verdict with the exact configuration line that triggered the finding, so remediation is straightforward.
Insecure Protocol Detection
Detect cleartext and legacy protocols that should not be running in a production environment. ConnectMyAssets identifies: Telnet enabled on any interface, SNMPv1 or SNMPv2c without source restriction (accepting queries from any host), HTTP management interface active, FTP server running, TFTP server enabled, CDP or LLDP enabled on external interfaces, and Finger or Ident services still present. Each finding is categorized by severity. Telnet or HTTP on an internet-facing device is critical. SNMPv2c without restriction on an internal device is high. These findings are easy to miss in manual reviews but trivially detectable via configuration analysis.
Default and Weak Credential Detection
Identify devices still using factory default credentials or predictable SNMP community strings. ConnectMyAssets checks for the most common default usernames and passwords across all supported vendors, SNMP community strings "public" and "private" which remain active on a significant portion of network devices in production, and enable passwords that match common weak patterns. For devices where ConnectMyAssets has read access to the configuration, it parses the credential configuration and flags any match against the known-default and known-weak lists. This check alone frequently uncovers critical security issues in environments that have grown organically over years.
Missing Hardening Checks
Detect the absence of security controls that should be present on every production network device. ConnectMyAssets checks for: logging not configured or pointing to no syslog server, NTP absent (devices without accurate time cannot produce reliable audit logs), no authentication banner configured (a legal requirement in many jurisdictions), management plane accessible from any source without ACL restriction, no AAA authentication configured for device access, SSH not configured or using weak key exchange algorithms, and no service password-encryption. Missing hardening is as dangerous as active misconfiguration: devices without logging produce no forensic evidence during an incident, and devices without ACL-restricted management are one credential away from full compromise.
Security Score per Device
Every device in your inventory receives a security score from 0 to 100, calculated from the number and severity of findings detected. Critical findings (Telnet enabled, default credentials) have a heavy weight. High findings (SNMPv1 unrestricted, no logging) have a moderate weight. Medium and informational findings contribute proportionally less. The score makes it easy to prioritize remediation: sort by score ascending to find your most exposed devices first. Scores are tracked over time, so you can see whether your security posture is improving after remediation campaigns. A fleet-wide average score gives you a single number to report to management or to track against a target.
Remediation Guidance
For every finding, ConnectMyAssets provides the exact configuration commands to apply to resolve it, tailored to the vendor and firmware version of the affected device. Disabling Telnet on a Cisco IOS device requires different commands than on a Fortinet FortiGate: ConnectMyAssets generates the right syntax for each. Remediation commands can be reviewed in-platform and, for organizations using the bulk deployment feature, applied directly to the affected devices via a deployment job. This closes the loop from detection to remediation within a single platform, with an audit trail that proves both the finding and its resolution.
How It Works
Connect Your Devices
Add your network devices to ConnectMyAssets using SSH read-only credentials or API access. The platform uses agentless collection: no software to install on the devices. Devices periodically connect to the ConnectMyAssets appliance and sync their running configuration over an encrypted session. For large fleets, devices can be onboarded in bulk via CSV or synchronized automatically from your IPAM or CMDB. The platform supports all major vendors: Cisco, Juniper, Fortinet, Palo Alto, Aruba, Arista, and more. Once configured, devices sync on your defined schedule, daily or more frequently, so the security analysis always reflects the current configuration state.
Run Security Analysis
ConnectMyAssets analyzes the collected configurations against CIS Benchmarks, insecure protocol rules, credential checks, and hardening controls. The analysis runs automatically on a schedule you define and also triggers after every configuration change detected in your environment. Results appear in the security dashboard with findings grouped by severity: critical, high, medium, and informational. Each finding shows the affected device, the specific configuration line that triggered it, the security rule it violates, and the recommended remediation command. You can filter findings by device, site, vendor, severity, or finding type to focus on the most important issues first.
Remediate and Track
Act on findings using the remediation commands provided for each issue. For organizations using bulk deployment, findings can be converted directly into deployment jobs: ConnectMyAssets generates the remediation template pre-filled with the correct commands for each affected device, ready for dry-run and deployment. After remediation, the next configuration collection and analysis cycle will re-evaluate the device and update its security score. The platform tracks finding history so you can see when a finding was first detected, when it was remediated, and whether it has recurred. Over time, the trending score view shows your security posture improvement across the fleet.
Frequently Asked Questions
Common questions about network security assessment
What is the difference between a vulnerability scanner and this tool?
A traditional network vulnerability scanner (like Nessus or Qualys) probes devices over the network to detect open ports, banner information, and known CVEs in firmware versions. It tests what is externally visible from the network perspective. ConnectMyAssets performs configuration-based security assessment: it reads the actual device configuration files and checks them against security rules. This approach finds issues that a network scanner cannot see, such as a weak SNMP community string that is syntactically valid but predictable, a missing login banner that does not affect network behavior, NTP absent from the configuration, or a management interface with no access restriction that has never actually been scanned by an attacker. Both approaches are complementary: vulnerability scanning covers what is exposed, configuration analysis covers how the device is set up.
Which security frameworks are supported (CIS, NIST, etc.)?
ConnectMyAssets includes built-in rule packs based on CIS Benchmarks (Cisco IOS, Cisco NX-OS, Juniper JunOS, Fortinet FortiOS, Palo Alto PAN-OS), NIST SP 800-41 (guidelines on firewalls and firewall policy), and ANSSI best practices for network device hardening. The platform also maps findings to NIS2 Article 21 requirements and ISO 27001 Annex A controls where applicable. For organizations with custom internal security standards, you can define additional rules using the custom compliance rule engine: specify a configuration pattern that must be present or absent, the affected device types, and the severity level. Custom rules appear alongside the built-in framework checks in the unified findings view.
Can the tool automatically fix the issues it detects?
ConnectMyAssets provides the exact remediation commands for each finding, but automatic one-click fixes require deliberate opt-in via the bulk deployment feature. The reason for this design is that configuration changes on production devices carry risk, and we believe human review should remain in the loop for security-critical changes. The workflow is: the assessment identifies a finding, ConnectMyAssets generates the remediation command for that specific device and vendor, you review it in a deployment job with dry-run preview, then approve and execute. For organizations running regular hardening campaigns, this workflow is very efficient: you can address all critical findings across 200 devices in a single reviewed and approved deployment job rather than 200 individual manual sessions.
How do I track security posture improvement over time?
ConnectMyAssets stores the security score and finding history for every device. The security dashboard shows the current score for each device and the fleet average, along with a trend chart showing how scores have evolved over a configurable time period (last 30 days, last 90 days, last year). You can filter the trend view by site, vendor, or device group to see improvement in a specific segment of your infrastructure. For compliance reporting, the platform generates a point-in-time security posture report showing all findings, their statuses (open, remediated, accepted risk), and the score evolution. This report can be exported as PDF or CSV and used as evidence for ISO 27001, NIS2, or internal security governance reviews.
Does the analysis impact production devices?
No. Configuration collection is read-only and device-initiated: devices periodically connect to the ConnectMyAssets appliance and sync their running configuration. No configuration changes are made during collection. The connection is short-lived and uses minimal resources. For devices where even read access must be carefully controlled, you can configure a dedicated read-only management account for ConnectMyAssets with the minimum privilege level required to sync configuration data. Collection can also be scheduled outside business hours if you prefer to minimize any network management overhead during peak times.
How do I export results for an external security audit?
ConnectMyAssets provides several export options for security assessment results. You can export a full findings report in PDF format, suitable for handing directly to an external auditor, showing all findings with severity, device details, the specific configuration line that triggered each finding, and the remediation recommendation. A CSV export is available for deeper analysis or for importing into a GRC (governance, risk and compliance) platform. You can also export a per-device security score report and the trend view data. For specific frameworks like ISO 27001 or NIS2, the export includes a mapping table showing which findings correspond to which framework controls, making it easier to demonstrate coverage and gaps to an auditor.
Find Out How Secure Your Network Devices Actually Are
Telnet, default SNMP communities, missing NTP, open management interfaces: configuration-based security assessment finds the issues that vulnerability scanners miss, with remediation commands ready to deploy.