Security posture degrades continuously through normal operations. New services deploy without hardening. WAF rules get added and never cleaned up, creating evaluation order problems. Rate limits get raised in response to legitimate traffic spikes and never restored. The hardening loop is the operational process that counteracts this drift: a four-phase cycle that runs quarterly and catches what normal operations introduce.
Phase 1: Measure
Run a full DDactic assessment to produce the current OPI score and finding list. Compare the score and finding count to the previous measurement. Any new findings that were not in the previous scan represent hardening that was lost or services that were deployed without hardening. Assign new findings a source (which deployment or configuration change introduced them) to feed back into the deployment process and prevent recurrence.
The measurement phase should take under 4 hours for a full DDactic scan. The scan output is the authoritative list of work for the current loop iteration -- no additional discovery required.
Phase 2: Close
Execute the hardening sprint against the current finding list. Start with quick wins (high OPI impact, low effort) and work down by OPI impact within each effort tier. The close phase runs in the engineering sprint cadence -- typically 2-4 weeks. Not all findings need to close in a single loop iteration; strategic items with high effort may span multiple quarters. The target for each loop is to close all quick wins and the top 3-5 sprint items by OPI impact.
Phase 3: Verify
For each closed finding, run the verification procedure specified in the finding output: the specific test (request sequence, introspection query, direct origin IP probe) that confirms the fix is working. Do not wait for the next full scan to verify -- verify each fix within 24 hours of deployment. Fixes that fail verification are treated as open findings and returned to the close phase immediately.
Verification is the most frequently skipped phase. The operational pressure to move to the next sprint item creates incentive to assume the fix worked. Skipping verification means the OPI improvement from the close phase is not confirmed, and the next measurement may show no improvement despite significant engineering work. Verification takes 15-30 minutes per finding and prevents wasted work.
Phase 4: Repeat
Schedule the next measurement at the beginning of each quarter. The loop runs at quarterly cadence for organizations with stable infrastructure and after each major deployment for organizations with frequent infrastructure changes. The quarterly cadence catches seasonal drift and ensures that OPI improvements from the previous close phase are not eroded by new findings before they are documented.
Over 4-6 loop iterations, organizations that run the hardening loop consistently see OPI scores converge to 75-85 and stabilize, with only 2-5 new findings per loop from deployment gaps. This convergence is the measurable evidence that the process is working: not a one-time assessment result, but a sustained posture over time.
Start Your Hardening Loop
A DDactic assessment provides the first measurement in the loop. Schedule your quarterly cadence from there.
Run a Free Scan