Scan Databases with cnspec

Your databases hold the data an attacker actually wants, and most of the risk lives in configuration rather than in the data itself: an account with no password, a server bound to every interface, a privilege granted to PUBLIC, encryption left off, audit logging never enabled. cnspec connects to a database with a read-only credential and assesses that configuration against security and compliance best practices.

cnspec never reads your application data. Every database provider inventories the server through its catalog, its administrative commands, or its management API.

New to cnspec? Read the Quickstart to install cnspec and run your first scan.

Managed and cloud data platforms

Scan the control plane of a managed service: who can reach it, who administers it, and how its credentials are governed.

Self-managed databases

Scan a database you run yourself, over its own protocol, with a least-privileged auditing account.

Search and vector engines

Pick the right provider

Several technologies have both a managed and a self-hosted provider, and they audit different things:

Scanning a managed service's control plane and scanning the database inside it are complementary. A ClickHouse Cloud service with a locked-down IP allow list can still have a passwordless user inside it, and only clickhousedb will find that.

A note on configuration files

Some databases can also be assessed from their on-disk configuration with the os provider, which reads option files without opening a database connection. That approach sees what the server will load on its next restart; the providers on this page see what the running server actually has in effect. Where both exist, they answer different questions and are worth running together.