Security Audit is the read-only SQL Server security review module. It collects server-level and current database security signals, turns them into structured findings, and summarizes the posture with severity counts, login inventory, maturity level, and maturity score.
This module is most useful when you need a security posture snapshot without leaving the application or making changes on the target server. It complements Dashboard for operational context and provides exportable evidence for audit or remediation planning.
- Run a consolidated security posture audit for the active connection.
- Review risky findings with severity and category labels.
- Inspect server login inventory and basic login health state.
- Summarize posture with maturity level and score.
- Export the result as a structured HTML audit report.
- Top action area
- Left findings panel
- Right logins panel
- Footer summary cards
Audit Findings, Logins, and Patch Posture
The main Security Audit screen combines the issue feed, login inventory, patch posture, and the action row for running or exporting the audit. This is the primary operational view for reading findings from highest risk downward and validating the overall maturity picture.
- Server principals, role memberships, and server permissions.
- Database principals and database permissions.
- Configuration views, credentials, endpoints, and server properties.
- Best-effort Force Encryption and related environment context.
- Login inventory and sysadmin counts.
- Structured security findings with severity and category.
- Maturity score, maturity level, and category breakdown.
- Export-ready audit context for HTML reporting.
- Authentication and authorization posture.
- Surface area and execution risk.
- Network, endpoints, and encryption.
- Logging, audit, patch, and database configuration signals.
- The module is assessment and reporting only.
- It does not remediate findings automatically.
- It does not change SQL Server security configuration by itself.
Server Logins Inventory
The Server Logins panel gives a compact inventory of returned logins and their basic health state. This is a quick operational reference rather than a full login-management surface, and the live UI intentionally truncates the visible list for performance.
Patch Status and Update Context
Patch posture is surfaced as a dedicated operational card so the user can see whether the instance is behind recommended updates. This gives immediate context for security maturity, especially when findings and version posture need to be reviewed together.
- Run Audit starts the security scan for the active connection.
- Save HTML exports the most recent completed result.
- The progress indicator becomes visible only while an audit is running.
- Shows a placeholder before the first audit.
- Shows issue cards with risk-colored borders after execution.
- Shows a positive message when no findings are returned.
- Lists the first returned logins with type and state.
- Uses compact statuses such as Active, Disabled, Locked, and Expired.
- Shows a truncation note when the full inventory is larger than the live panel limit.
- Critical, High, Medium, and Low counts.
- Total Logins and Sysadmins.
- Maturity and Score with tooltip help in the live UI.
- Risk badge, category, title, and description.
- Why it matters and attack scenario guidance.
- Control, compliance, and CIS reference lines.
- Optional detail snippets and recommendations.
- Critical
- High
- Medium
- Low
- Info
- Computes a score from 0 to 100 and a maturity level from L1 to L5.
- Applies weighted penalties based on finding severity.
- Supports standard, hardened, and banking-style profiles.
- Can cap maturity when foundational controls fail.
- Higher-severity findings are surfaced earlier.
- Maturity is a posture summary, not a replacement for issue-by-issue review.
- Patch lag should be interpreted together with the findings list.
Tabbed HTML Security Report
The saved HTML report is richer than the live Qt screen and adds tabbed navigation for Summary, Issues, Cross-Mapping, and Logins. This makes it suitable for sharing with audit, operations, or governance stakeholders outside the desktop application.
- The live Security Audit module has no in-app tabs.
- The saved HTML report adds dedicated client-side tabs.
- This distinction matters when comparing the product screen with the exported output.
- Summary
- Issues
- Cross-Mapping
- Logins
- Generated timestamp and summary cards.
- Environment and connection context.
- Issue list and framework cross-mapping.
- Logins table, surface-area configuration, and maturity breakdown.
- Verification queries appear in the HTML report, not the live issue cards.
- Some contextual fields may be unavailable depending on permissions.
- Save HTML stays disabled until a successful audit result exists.
The available HTML export below reflects the current Security Audit report format produced by the module. At the moment, the asset set contains one saved HTML report example.
Structured HTML audit report with summary cards, issue details, framework cross-mapping, and login inventory.
- Connect to the target SQL Server and database.
- Open Security Audit and click Run Audit.
- Review footer cards for severity and maturity context.
- Read issue cards from highest risk downward.
- Check the login inventory for disabled, locked, or expired accounts.
- Save the result as HTML when the findings need to be shared or archived.
- The module is read-only and does not apply fixes.
- Some checks are best-effort and can be affected by SQL permissions or environment limits.
- The right login panel is intentionally shorter than a full login administration screen.
- Force Encryption and some export context details may be unavailable depending on access rights.
- The live issue list is intentionally shorter than the exported HTML evidence set.