How to Choose a SQL Server Security Consultant

A SQL Server security review is only as good as the people doing it. This guide lists what to look for when you choose a consultant, the questions to ask before you sign, and the warning signs that an offer is a generic scan with a consulting price tag.

1. Deep product knowledge, not only general security experience

Most serious weaknesses in SQL Server are not missing patches but how permissions, ownership and features interact. Look for a consultant who can explain these in detail:

• The permission model: effective permissions through roles, ownership chaining, impersonation, module signing and cross-database access, not just a list of sysadmin members.
• Escalation paths: how an attacker moves from a low-privileged login to control of the instance or the operating system, for example through linked servers, SQL Server Agent jobs or unsafe assemblies.
• Auditing: which actions SQL Server Audit records, and which ones it misses.
• Encryption: TLS in transit, TDE and backup encryption, Always Encrypted, and how keys and certificates are managed.

Good indicators: published technical articles, conference talks on SQL Server security, Microsoft certifications at the expert level, and experience on the product side.

2. Findings about your risk, not a checklist score

Benchmarks such as CIS or DISA STIG are a good baseline, but a report that only lists settings that differ from a baseline leaves the hard work to you. A good assessment:

• calls out where individual weaknesses combine into a real attack path in your environment,
• separates real risk from noise, with a clear severity for each finding,
• gives concrete remediation steps with an estimated effort,
• covers the environment around SQL Server as well, such as the operating system, Active Directory and the network,
• can support your audit and compliance work, without claiming to certify anything.

Ask for a redacted sample report before you sign.

3. Safe handling of your systems and data

A security consultant should make your environment safer, not add risk. The most telling question is about permissions. Many people simply assume an assessment needs sysadmin. An in-depth assessment usually does, because specific checks cannot see certain settings otherwise. But a good consultant can explain which checks need which permission, and what you would not see if you grant less. Some checks only need read permissions such as VIEW SERVER SECURITY STATE and VIEW ANY SECURITY DEFINITION. Our free Get-SqlSafe script, for example, documents exactly which permissions it needs.

Also ask:

• Do the collection tools only read, or can they change configuration? Do they install agents?
• Can the work be done with metadata only, with pseudonymized names, or entirely on site?
• How is data transferred and stored, who can access it, and when is it deleted?
• Will they sign your NDA and, in healthcare, a HIPAA Business Associate Agreement (BAA)?
• If AI tools are used, on what data, under which terms, and can you opt out?

4. Who actually does the work

Many firms sell with senior names and deliver with junior staff. Ask who will run the assessment and write the report, whether those people are named in the proposal, and whether subcontractors are involved. Background checks should be standard for anyone with access to your systems.

5. Clear scope, fixed price

A good proposal states the scope, the deliverables, the schedule and a fixed price before any work starts. Be careful with open-ended hourly offers for an assessment, and check whether the price is per server or for the whole environment. Also ask whether a re-check after remediation is included, so you can show auditors that the risks were actually reduced.

6. The right fit for your situation

• A first look: a free self-guided script or a short health check is a good start for a small environment.
• A security program or an upcoming audit: a full assessment with executive and technical reports that your compliance team can work with.
• Complex, regulated or high-stakes environments: an on-site assessment led by a senior specialist, with remediation support.

How Sarpedon Quality Lab fits these criteria

• Product depth: our assessments are designed and supervised by Andreas Wolter, a former Microsoft Senior Program Manager for SQL Server security who led the design of parts of the SQL Server permission model and is one of only seven Microsoft Certified Solutions Masters (MCSM): Data Platform. They also build on the experience of the team: a former Principal Program Manager at Microsoft, responsible for SQL auditing, who helped define the U.S. Department of Defense security requirements for Azure SQL Database (the DISA STIG), and a Microsoft MVP since 2010 with 32+ years of SQL Server experience in finance, online entertainment and healthcare, who built automation that manages more than 2 million permissions across thousands of databases, lets teams run SQL Server infrastructure without sysadmin privileges, and designed a completely air-gapped SQL Server system.
• Risk-focused findings: about 90 to more than 140 checks depending on the tier, focused on privilege escalation paths, including the operating system, Active Directory and backup security in Premium and White Glove. In Premium, we also help you align the report with your compliance requirements. See the methodology and checks.
• Safe handling: read-only tools, metadata-only, pseudonymized or on-site options, NDA and BAA. The scan for unprotected sensitive data runs locally in your environment; the data itself never leaves it. Details on our Security & Trust page.
• Fixed price: one fixed project price for the agreed scope, starting at $4,900 for small environments, with a written proposal before any work starts. Start free with the Community Edition (27 core checks).