Edge and WAF Security Assessment
196 questions on the CDN, firewall and origin estate, answered by people and scored per control.
196 controls · 10 pillars · 40 categories · assessed by people
196 questions on the CDN, firewall and origin estate, answered by people and scored per control.
196 controls · 10 pillars · 40 categories · assessed by people
The edge is where your organisation meets the internet, and in most estates it was configured by whoever happened to be on call. This assessment produces an independent, scored account of how traffic is filtered, who is able to change that filtering, and what is recorded when it fails. It speaks directly to the availability and operational resilience questions that NIS2 and DORA now put in writing.
196 questions across 10 pillars and 40 categories, worked through with whoever holds the edge platform accounts, DNS and the origin network. There is no bundled collector and nothing is run against your estate: if you already hold output from a separate web application firewall tooling run it can be imported as supporting evidence, but otherwise every answer comes from the people who own the configuration. Expect a short series of sessions and a score per pillar, which fits neatly before a penetration test or an annual resilience review.
Covers edge estate inventory and change control, platform administrator authentication and API token scope, registrar locks and dangling DNS records, edge TLS policy and edge-to-origin encryption, managed rule set deployment and enforcement mode, rule exceptions and bypass paths, bot classification and rate limiting of sensitive endpoints, origin reachability restriction, authenticated origin pull and tunnel-based private connectivity, identity-aware access policy and service token lifecycle, client-side script integrity, edge compute and edge object storage exposure, and log delivery, content and retention. Answers come from configuration an assessor is shown during the session; no collector reads it on your behalf.
196 controls across 10 pillars and 40 categories. Every one is scored, and a control nobody can answer is recorded as unanswered rather than counted as a pass.
There is no bundled collector for this assessment: an assessor works the 196 questions with the people who hold the edge platform accounts, DNS and the origin network, recording the configuration they are shown. Output from a separate web application firewall tooling run can be imported as supporting evidence, but nothing is scanned as part of the assessment itself.
Because it reads configuration rather than live traffic, it cannot tell you whether a given rule set would have stopped a specific attack, only whether that rule set is deployed, enforcing, and free of bypasses.
Public services are judged on staying up, and this assessment scores the rate limiting, automated traffic enforcement and volumetric defence that keep them up.
Customer-facing financial endpoints attract credential stuffing and card testing, so bot classification and rate limiting of sensitive endpoints are scored in their own categories.
Critical infrastructure operators often terminate internet traffic across more than one edge platform, and the first pillar asks simply whether a single inventory of them exists.
Patient portals and student systems sit on the open internet, and 22 scored questions cover the origin protection and private connectivity in front of them.
A fixed fee for the engagement, not an annual licence. The band follows the size of the bank: this one is broad at 196 controls.
£4,500
Per engagement, excluding VAT.
£12,000
Per engagement, excluding VAT.
Hold three or more and the Combined Security View is produced at no extra charge: it is derived from the banks you already hold rather than assessed again. See the full assessment rate card, or build a quote with this assessment in it.
There are 16 of them, and the honest answer is that most organisations need two or three rather than all of them. Tell us what you run and what you are being asked to prove.