Compliance
Compliance shows how your organisation measures up against frameworks such as SOC 2, ISO/IEC 27001:2022, Cyber Essentials and NIS2. Every result comes from a check: a query that runs against your devices, identity providers and cloud accounts through the connections you already have.
Checks read from Huntbase's normalised surfaces, such as hb_devices and hb_users, so the results from every connected product are merged. If you already use a compliance product such as Vanta, its device and test results appear next to the results from Huntbase's endpoint agent.
Enable a compliance package
A package is a set of checks mapped to one or more frameworks.
- Open Library, then the Compliance section.
- Choose a package, for example Baseline: SOC 2 · ISO 27001 · Cyber Essentials.
- The detail panel lists the frameworks and checks. For each check it shows which of your connected products feed it. No source connected means none of your connections can answer that check yet.
- Click Enable for my org. You need to be an organisation admin.
Huntbase schedules the package's checks straight away. The first results usually appear on Compliance › Overview within a few minutes.
To stop a package, open it again and click Disable. The schedules stop, but the last results are kept.
Compliance is measured per organisation. If your scope is Personal, the pages ask you to choose an organisation.
Read the overview
- Headline numbers: how many controls are passing, failing or have no data. Click a number to open the Controls tab filtered to that status.
- Frameworks: the share of each framework's controls that pass.
- Failing controls: the controls with the most failing targets. Click one to open it.
A control is a framework requirement, such as ISO 27001 A.8.24 or SOC 2 CC6.1, that at least one check maps to. A control is only as good as its worst check.
| Status | Meaning |
|---|---|
| Passing | Every target of every check passes. |
| Failing | At least one target fails. |
| Sources disagree | Two products report different results for the same target. For example, Vanta says a laptop is encrypted, but the endpoint agent sees BitLocker suspended. This counts as failing. |
| No data | No connected product has answered the check yet. |
Investigate a control
The control page shows:
- Checks: each check that maps to the control, with its result counts. Run now starts a fresh evaluation.
- Failing targets: the devices, users or resources that fail, with one chip per product that reported on them.
- Remediation: what to change to pass.
- Hunts on this control: hunts started from the control, and hunts that count as evidence for it.
- Blast radius: what a failing device can reach in the entity graph (users, privileged users, credentials, data and other hosts), with a link to open it in the graph.
Two buttons work with Scout:
- Ask Scout opens a chat about the control. Scout uses its compliance tools to group the failures by cause, point out where sources disagree, and suggest a fix. When a library action can fix the failure, such as turning the firewall on, Scout proposes an action run for you to approve.
- Investigate with Scout starts a hunt seeded with the failing targets. Use it when a failure could mean compromise, for example encryption turned off on one laptop, or a known exploited vulnerability on software you run. The hunt is tagged with the control, so it appears under Hunts on this control.
Hunts as evidence
Some controls ask you to show that you look for threats, for example ISO 27001 A.5.7 (threat intelligence) or NIS2 Article 21(2)(b) (incident handling). Huntbase checks these with your hunt history: a hunt counts once it has a recorded verdict. These controls pass as long as your team, or Scout, keeps hunting.
Known exploited vulnerabilities
The No software affected by a known exploited vulnerability check runs in the entity graph. It looks for software on your devices that is affected by a vulnerability on the CISA Known Exploited Vulnerabilities list, and confirms the installed version is in the affected range before failing. It maps to Cyber Essentials security update management, ISO 27001 A.8.8 and NIS2 Article 21(2)(e).
Framework content
Framework codes and short titles are Huntbase's own wording. Huntbase doesn't reproduce the text of the standards. Keep your own copy of each standard for the full requirement.