01The challenge
A newly joined head of IT inherits an estate built by integrators: a virtualisation cluster running a few hundred virtual machines, a pair of next-generation firewalls, an Active Directory domain, a Microsoft 365 tenant and a backup server. Each system has its own console and its own view of the truth, and none of them looks at the others.
Audits done by hand are a snapshot. By the time the report is written, the estate has moved. The question leadership actually needs answered every day is simpler: what changed since yesterday, and does any of it matter?
02What I built
A scheduled scan that runs before the working day and is read-only from end to end. It never changes a setting, never restarts anything and never remediates on its own.
- Pulls every system through its own interface. The hypervisor over its REST API, the firewall over its SSH command line with display commands only, the directory over LDAP, the backup server over its API. No agents installed anywhere.
- Diffs against the previous run, per system. If one pull fails on a given day, the next day still compares against the last good baseline for that system rather than going blind.
- Grades every finding. Critical means act today, attention means review, change means something moved. The exit code alone tells the scheduler whether anything is critical.
- Cross-references systems. The findings that matter most only appear when two consoles are read side by side, so the scan checks the firewall's accounts against the directory's privileged groups, and firewall rules against their live hit counters.
- Tracks change by account. Every virtual machine created, modified or deleted since the last run is listed with who did it and when, and automated platform churn is summarised so a human action never hides inside it.
- Reports what it could not see. Missing files, unreachable systems and sections that would not parse go into an explicit "unknown" list. A silent pass on something that was never read would be worse than no check at all.
- Alerts only on critical findings, by email through a certificate-authenticated sender restricted to a single service mailbox. Silence means nothing critical was found.
03Outcome
Remediation stays human. Every fix the scan motivates is written up as a reviewable change set with its own rollback, and applied by hand in a maintenance window, lowest-risk change first.
04What I would tell another organisation
Two smaller lessons from the build. First, read every static finding against live evidence: a firewall rule reported as unreachable turned out to carry tens of millions of hits, because the rule above it narrowed by application rather than by port. Second, check the clock on every timestamp you rely on. One API field ran hours behind real time, which quietly shifted every activity report until it was cross-checked against a known event.
The client is not named and system details are generalised. Only findings that have been resolved are described.