Balbix identifies multiple types of exposures - including CVEs, end-of-life (EOL) detections, misconfigurations, and failed controls. While misconfigurations and failed controls can appear similar, they have important differences. Understanding these differences is key for accurate reporting and treatment.
Controls
Controls are security checks that return a Pass, Fail, or other status for each instance. They are usually written in the language of the specific check being performed.
Example: “Ensure that ‘Data encryption’ is set to ‘On’ on a SQL Database.”
Balbix provides full visibility into control compliance results in the Controls > Validation Summary view, including:
Counts of passed and failed controls
Detailed status for each control instance
When failed control instances are detected, Balbix enriches them with security context, computes an Exposure Score, and highlights them in two locations:
Controls > Findings - a unified view of all failed control findings across sources for prioritization, investigation, and remediation
Exposure Management > Asset Vulnerabilities - where they are shown as Type = Failed Control, enabling consistent triage alongside other exposure types
Control findings may map to frameworks such as CIS Benchmarks, but they can also include custom checks or other compliance standards.
Misconfigurations
Misconfigurations are security weaknesses that only exist as issues - there are no “passed” states.
Example: “SSH Weak Algorithms Supported”
When misconfigurations are detected, Balbix also enriches them with relevant metadata, assigns an Exposure Score for risk-based prioritization, and highlights them within the associated domain, such as Exposure Management > Asset Vulnerabilities, where they are shown as Type = Misconfiguration.
This ensures misconfigurations are triaged and remediated consistently alongside other exposure types.
Data Mapping with API-based Connectors
Balbix’s API-based connectors ingest a wide range of relevant data from each source (based on availability), including:
Inventory details
Business context (e.g., tags)
Findings such as vulnerabilities, misconfigurations, EOL software, and/or control compliance results
If available, control results are usually provided via a dedicated API endpoint or module. Balbix ingests them separately from misconfigurations to preserve their Pass/Fail status and any associated framework or policy metadata.
Data Mapping with Flex Connectors
For CSV data snapshots ingested through Flex connectors, specific mappings are provided for control compliance findings. These mappings must include the Pass/Fail status as part of the data structure.
Summary
Failed Controls: Security checks with Pass/Fail results. Found in Controls > Findings and exposure views as Failed Control. Often mapped to frameworks like CIS Benchmarks.
Misconfigurations: Security weaknesses that only exist as issues (no “passed” state). Found in exposure views as Misconfiguration.
Connectors: Balbix ingests both types, but only controls include Pass/Fail compliance data and framework/policy context.