SQL Server Security Audit

A SQL Server security audit is a structured review of how your SQL Server instances are configured and who can do what in them, judged by how an attacker could actually use each weakness. It finds excessive permissions, privilege escalation paths, weak or missing encryption, gaps in auditing and outdated or unsupported versions, and gives you prioritized findings with concrete remediation steps. Ours is read-only and covers about 90 to more than 140 checks, depending on the tier.

What a SQL Server security audit covers

• Logins and authentication: which identities exist and how they authenticate, including mapping your NTLM usage ahead of Microsoft’s deprecation timeline.
• Permissions and least privilege: role memberships and effective permissions, not just a list of sysadmin members.
• Privilege escalation paths: routes from a low-privileged login to control of the instance, for example through unsafe linked servers, ownership chaining, impersonation or module signing.
• Configuration: instance and database settings, assessed by whether they are exploitable in your environment, not only whether they differ from a baseline.
• Encryption: encryption in transit and at rest, legacy and weak encryption, and your encryption chain checked against current cryptographic standards, including post-quantum readiness.
• Patch level and end of support: whether your instances are on current updates, and which run a SQL Server version that is out of support or close to it, such as SQL Server 2016 (extended support ended in July 2026) and SQL Server 2017 (ends October 12, 2027).
• Auditing and logging: how auditing is actually configured, including gaps that would let access or data exfiltration go unnoticed.
• The environment around SQL Server (Premium and White Glove): Active Directory service accounts and groups, the operating system, backup security, and a scan for unprotected sensitive data that runs locally in your environment.

For the check categories and a tier-by-tier comparison, see the methodology and checks.

How the audit works

1. Scope and proposal: you tell us about your environment, and we send a written proposal with scope, schedule and one fixed project price before any work starts. We sign your NDA, or provide ours, before any technical detail is exchanged.
2. Tailoring: a short conversation with your infrastructure or DBA team, so the checks fit your environment.
3. Data collection: our collection tools only read. They make no changes to configuration or data and install no agents. We tell you in advance which permissions each tool needs and why. If you want, we pseudonymize server, database and user names before anything leaves your environment, or work entirely on site.
4. Analysis and report: senior specialists review the results and write the report. When it’s urgent, the report can be ready as soon as the next business day after data collection.
5. Walkthrough and re-check: we go through the findings with your team in a remote Q&A session. After you have fixed the issues, a Delta-Check re-runs the audit and shows what changed. One Delta-Check is included in Premium.

Security audit, security assessment or checklist?

The terms are often used for the same thing. Here is how they differ in practice:

• Compliance audit: an auditor checks your organization against a standard such as HIPAA, PCI DSS or ISO 27001. We are not a certifying body. Our findings give you the technical evidence for SQL Server that supports that audit.
• Security assessment: what this page describes. On our site, the SQL Server security assessment page lists the tiers and starting prices. A “SQL Server security audit” or “security check” from Sarpedon Quality Lab is the same service.
• Checklist or benchmark scan: a CIS or STIG scan, or a script, checks settings one by one against a baseline. That is a useful start, but benchmarks are written by people, and some recommendations are outdated or overrate a risk. For a self-guided first look, use our SQL Server security and high availability checklist or the free Community Edition (27 core checks).

What you receive

• An estate-wide summary with your findings consolidated and prioritized across all servers, for management and risk decisions.
• A summary and a detailed technical report per server, with the evidence for each check and the affected objects.
• A clear rating for every finding: PASS, OBSERVE, WARNING or FAIL, to separate real risk from noise.
• Concrete remediation steps with an estimated effort, not generic best practices.
• Attack-path awareness: we call out where misconfigurations and permissions combine into an exploitable path.

A redacted sample report is available on request. Tell us about your environment and we’ll send it to you.

Who does the audit

Our audits are designed and supervised by Andreas Wolter, a former Microsoft Senior Program Manager for SQL Server security who led the design of parts of the SQL Server permission model and is one of only seven Microsoft Certified Solutions Masters (MCSM): Data Platform. He leads every White Glove audit personally, on site. Meet the team.