ControlsInsight: Features and Benefits

Track and communicate your security progress with ControlsInsight

Nexpose Integration

Combines ControlsInsight's intelligent threat models with Nexpose Vulnerability reporting and RealContext™ to improve your security with the least effort.

Automated Assessment

Measure how well critical security controls are deployed and configured across your servers and desktops.

Intelligent Threat Model

Analyze your security posture using an intelligent model relating the latest threats to effective mitigating controls.

Prioritized Action Plan

Improve enterprise security with a dynamic action plan for controls deployment, prioritized based on risk.

Controls Trending

Monitor controls deployment trends and track progress in reducing risk across your organization.

Flexible Reporting

Choose from different reporting options for communicating security metrics and priorities with the business.

Try ControlsInsight Today with a Free 7-Day Trial


Nexpose Integration

ControlsInsight leverages your existing Nexpose deployment to automatically assess your controls effectiveness and give a complete picture of security risks, allowing you to get-up-and-running and start securing your enterprise faster. A direct linkage between Nexpose and ControlsInsight combined with a dedicated ControlsInsight role in Nexpose streamlines usability for InfoSec professionals. Nexpose and ControlsInsight delivers a comprehensive vulnerability management program.

Automated Controls Assessment

Complete Risk Assessment

Get visibility into risk profile of assets based on both vulnerabilities and effective countermeasures in place.

Seamless Integration

Automatically import asset data from sites set up in Nexpose and select for segmented controls assessment; leverage RealContext™ to focus on what matters to you and your organization.

Fast Unified Scan

Reduce impact on network with a single scan for vulnerabilities, misconfigurations, and mitigating controls.

Automated Controls Assessment

ControlsInsight centralizes critical enterprise controls information to measure how well they are deployed and configured across your organization, giving you a complete picture of defenses you have in place. See the controls we assess

Automated Controls Assessment

Automated Collection

Increase efficiency with automated collection of critical security controls information without agents or connectors.

Controls Monitoring

Track security patches, applications, configurations and mitigation settings throughout the enterprise in one central place.

Trust But Verify

Verify accuracy and effectiveness of security tools, projects and processes with a second source of information.

Intelligent Threat Model

ControlsInsight analyzes your security posture using an intelligent model relating the latest threats to effective mitigating controls based on best practices, so you'll always know how secure your enterprise is. Separate threat models for servers and desktops ensure these two asset types are analyzed and scored based on their unique security needs. See the controls we analyze

Intelligent Threat Model

Dynamic Analytical Model

Updated dynamically with the most effective mitigating controls mapped to the threats they defend against.

Aligned with Best Practices

Supported by leading security experts and best practices such as the SANS Top 20 Critical Security Controls.

Simple Security Grade

Quantify the effectiveness of controls in place at protecting your enterprise with grade out of 10. Individual grade for desktops and servers.

Prioritized Action Plan

ControlsInsight prioritizes controls deployment based on ability to reduce risk specifically for your environment, enabling you to create an action plan for the greatest impact on improving enterprise security. See the controls we prioritize

Prioritized Action Plan

Remediation Workflow

Build and improve processes for identifying, prioritizing and remediating risks based on controls in place.

Step-by-Step Guidance

Reduce time to action with detailed implementation instructions and useful references for the importance of each control.

Actionable Reporting

Create reports with information needed for IT operations to deploy each control comprehensively across identified assets.

Flexible Reporting

ControlsInsight provides different reporting options for communicating security metrics and priorities with the business, helping you to talk the same language and get alignment across the organization. ControlsInsight leverages RealContextâ„¢ and enables security teams to contextualize information and report in a language/format that is tailored to simplifying the experience for the rest of the business. ControlsInsight users can now associate business context to the security risks on assets by leveraging four new classifications for assets. See the controls we report

  • Asset Ownership: Who in the organization is responsible for owning and/or remediating this asset. This could be a business unit, an individual user, a group, or any combination thereof.
  • Asset Location: Where is the organization is this asset located? This could be a physical location, city, country, datacenter, etc.
  • Asset Criticality: How important/critical is this asset to my organization?
  • Custom: Any other information, outside of ownership, location and criticality, that may be of importance to your business

Flexible Reporting

Executive Reporting

Communicate security performance with an overview of controls metrics and prioritized action plan.

Export Asset Data

Create personalized reports by exporting detailed asset data to CSV format for further analysis.

Third Party Integration

Integrate controls assessment and trending data into third party solutions via the open REST API.

Security Controls Assessment

Desktop Controls
  • Anti-virus installed, enabled and DAT file up-to-date: McAfee, Symantec, Sophos, Trend Micro, Microsoft, Kaspersky
  • Browsers up-to-date: Google Chrome, Microsoft Internet Explorer, Mozilla Firefox
  • High-risk applications up-to-date: Adobe Reader, Flash, Java, Microsoft Office
  • Operating systems up-to-date: Windows 7, 8, Vista, XP
  • Passwords hardened: Strong local password policy, unique admin password
  • Code execution prevention deployed: EMET, ASLR, DEP, SEHOP
  • User Access Control enabled
  • Browsers fully hardened: URL reputation scanning, third-party URL filtering
  • USB access blocked
  • Windows firewall enabled
  • Email client attachment filtering enabled
Server Controls
  • Code execution prevention
  • Compilers and libraries not installed
  • Configuration management in use
  • Default credentials removed
  • Desktop applications not installed
  • IPv6 disabled if not managed
  • Limited egress
  • Obsolete services disabled
  • Operating system up to date
  • Passwords hardened
  • Service processes run as a limited user
  • Single critical role installed
  • User Account Control enabled
  • Web services use dedicated or remote database
ControlsInsight Logo

Why ControlsInsight?

Many organizations have thousands of security controls in place to defend against the real and current threats they face but limited visibility into how well they've been deployed and how effective they are. With ControlsInsight, you can assess the effectiveness of controls at protecting your enterprise, and track your progress in reducing risk across the organization. ControlsInsight is the only solution that uses 2 unique threat models to analyze how secure you are and give a dynamic action plan, prioritized to address the most significant risks.