Why configuration can drift after an update or hardware change
A routine change can affect more than the component you meant to update. A replacement firewall, a new website release or a firmware change can alter which services respond and how they are configured.
What to double check
- Public access: compare the ports observed on the verified domain's public addresses. An open connection deserves owner review; it does not establish a vulnerability on its own. Torva sends an alert when a new public port is observed, and Complete’s weekly full-range scan covers all 65,535 TCP ports.
- Web and TLS: inspect certificates, redirects, accepted TLS versions and supported security headers after a web server or proxy change.
- Email DNS: confirm SPF and DMARC records, especially after changing mail providers or DNS hosting.
- Internal services: from an approved Core range, review reachable devices, selected service observations and any newly reported software versions after a network or hardware change.
A practical change check
- Record what changed, when, and which public domain or internal range should be affected.
- Run a fresh scan and compare it with an earlier scan of the same scope. Investigate new responses and changed settings.
- Group related observations into one work item where they appear to share a control; verify ownership before treating them as one root cause.
- Make the adjustment through your normal change process. Scan again to confirm each affected endpoint, and record any address that did not respond.
Read the limits with the result
A scan only speaks for the checks and endpoints it reached. A quiet result on a filtered or sleeping device is inconclusive. Configuration scores summarize supported observations; review the evidence and coverage before closing a change.
Torva Edge and Core provide recurring observations and fix guidance to support this routine. They do not replace your change approvals or the broader security assessment your organization needs.
Try the workflow: Start with the free public domain check, then see Edge and Core for recurring, authorized checks.
Keep learning
Group related fixes · External vs. internal checks · Weekly security review · All guides