.%20TODO(brand):%20replace%20with%20the%20master%20vector%20from%20the%20brand%20files.%20--%3e%3cdefs%3e%3clinearGradient%20id='rudratic-mark'%20x1='0'%20y1='195'%20x2='0'%20y2='828'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20offset='0'%20stop-color='%235a0bd8'%20/%3e%3cstop%20offset='1'%20stop-color='%23a5157c'%20/%3e%3c/linearGradient%3e%3c/defs%3e%3cg%20fill='url(%23rudratic-mark)'%3e%3cpath%20d='M253%20448%20545%20195l60%2070-292%20252z'%20/%3e%3cpath%20d='M348%20558%20473%20450v200L348%20768z'%20/%3e%3cpath%20d='M523%20405%20640%20305l83%2097-141%20120%20153%20128-102%2087-110-97z'%20/%3e%3cpath%20d='m663%20763%2072-61v126z'%20/%3e%3c/g%3e%3c/svg%3e){kind=small}
Free tool
Scan your security baselines, free
Check Microsoft 365, Windows and Linux servers, Docker, Kubernetes and PostgreSQL against CISA and CIS baselines, then fix what fails and scan again to prove it.
- Microsoft 365
- Windows
- Ubuntu / Linux
- Docker
- Kubernetes
- PostgreSQL
Six scanners, one console
Choose a target to see the standard it follows, how it connects and what it checks. The sample run shows how results appear.
Cloud
Servers
Containers
Databases
Microsoft 365 scanner
- 1Quick scanA rapid audit against CISA SCuBA baselines through the Microsoft Graph API.
- 2Lite scanA fuller assessment against Microsoft 365 benchmarks.
- 3Advanced scanAn audit through CISA’s ScubaGear engine across the tenant’s services.
Checks
- Entra ID Conditional Access and MFA policies
- Exchange Online transport rules, spam filters and anti-phishing
- SharePoint Online and OneDrive external sharing
- Teams, Power Platform and Defender for Cloud Apps settings
Windows scanner
Checks
- User Account Control and administrative behaviour
- Defender real-time protection and signature updates
- Windows Firewall configuration and inbound rules
- Local password policy and lockout thresholds
Ubuntu / Linux scanner
Checks
- AppArmor status, profiles and policies
- UFW firewall rules and default policies
- SSH daemon hardening: root login, ports, ciphers
- Ownership and permissions of /etc/passwd and /etc/shadow
Docker scanner
Checks
- Docker daemon TCP socket permissions and TLS settings
- Permissions on daemon configuration files
- Container limits: CPU, memory and privilege isolation
- Health checks and image security settings
Kubernetes scanner
Checks
- API server parameters and network settings
- Scheduler, controller manager and etcd access
- RBAC scopes and namespace isolation
- Kubelet anonymous access and host networking
PostgreSQL scanner
Checks
- pg_hba.conf authentication and client IP rules
- SSL/TLS settings for encrypted connections
- Default administrative privileges and roles
- Logging collector and query tracking settings
Sample run: results are illustrative. Real results come from your own scan.
Server, container and database scanners run as an online scan over the network, with nothing installed, or as an advanced scan: a script you run on the host, for restricted or air-gapped systems, whose results sync back to the dashboard.
Built around the fix, not the report
A scan is the start. ScanX follows the loop a team actually works through.
- 01ConnectSign in with Microsoft for a tenant, or give a host and credentials for a server.
- 02ScanEach control is checked and marked pass or fail.
- 03FixFailures become a list of fixes to make.
- 04Re-scanScan again to confirm the failed controls now pass.
Your credentials and data
- Sign-in
- The app states: “All login information is processed securely and not stored.”
- Storage
- The app states it uses local browser storage only, with no external telemetry.
- Our advice
- Scan with a dedicated, least-privilege account and remove it afterwards; for sensitive hosts, use the advanced script so credentials never leave your network.
Questions
- Is ScanX free?
- Yes. ScanX is a free tool from Rudratic. Open it at scanx.swotpam.com, choose a scanner and start a scan.
- What does the Microsoft 365 scan check?
- It checks a tenant against CISA’s Secure Cloud Business Applications (SCuBA) baselines: Entra ID Conditional Access and MFA, Exchange Online mail protection, SharePoint and OneDrive sharing, and Teams, Power Platform and Defender for Cloud Apps settings.
- Do I have to install anything?
- No. Online scans connect over the network. For restricted or air-gapped hosts you can run the advanced scan script on the host instead, and its results sync back to the dashboard.
- Which standards does it use?
- Microsoft 365 checks follow CISA SCuBA baselines. Windows, Ubuntu, Docker and Kubernetes checks follow Center for Internet Security (CIS) benchmarks, and Kubernetes also covers Pod Security Standards.
Sources: CISA: Secure Cloud Business Applications (SCuBA) project · Center for Internet Security: CIS Benchmarks
Run your first scan
Free, in the browser. For continuous control over privileged access and assets, see the SWOT platform.