---
title: "Understanding Failed Controls vs. Misconfigurations"
slug: "controls-and-misconfigurations"
updated: 2026-10-22T15:02:28Z
published: 2026-10-22T15:02:28Z
canonical: "docs.safe.security/controls-and-misconfigurations"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safe.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Understanding Failed Controls vs. Misconfigurations

Balbix identifies multiple types of exposures - including CVEs, end-of-life (EOL) detections, misconfigurations, and failed controls. While misconfigurations and failed controls can appear similar, they have important differences. Understanding these differences is key for accurate reporting and treatment.

### **Controls**

Controls are security checks that return a Pass, Fail, or other status for each instance. They are usually written in the language of the specific check being performed.

**Example:** *“Ensure that ‘Data encryption’ is set to ‘On’ on a SQL Database.”*

Balbix provides full visibility into control compliance results in the Controls > Validation Summary view, including:

- Counts of passed and failed controls
- Detailed status for each control instance

When failed control instances are detected, Balbix enriches them with security context, computes an Exposure Score, and highlights them in two locations:

- Controls > Findings - a unified view of all failed control findings across sources for prioritization, investigation, and remediation
- Exposure Management > Asset Vulnerabilities - where they are shown as Type = Failed Control, enabling consistent triage alongside other exposure types

Control findings may map to frameworks such as CIS Benchmarks, but they can also include custom checks or other compliance standards.

### **Misconfigurations**

Misconfigurations are security weaknesses that only exist as issues - there are no “passed” states. **Example:** *“SSH Weak Algorithms Supported”*

When misconfigurations are detected, Balbix also enriches them with relevant metadata, assigns an Exposure Score for risk-based prioritization, and highlights them within the associated domain, such as Exposure Management > Asset Vulnerabilities, where they are shown as Type = Misconfiguration.

This ensures misconfigurations are triaged and remediated consistently alongside other exposure types.

### **Data Mapping with API-based Connectors**

Balbix’s API-based connectors ingest a wide range of relevant data from each source (based on availability), including:

- Inventory details
- Business context (e.g., tags)
- Findings such as vulnerabilities, misconfigurations, EOL software, and/or control compliance results

If available, control results are usually provided via a dedicated API endpoint or module. Balbix ingests them separately from misconfigurations to preserve their Pass/Fail status and any associated framework or policy metadata.

### **Data Mapping with Flex Connectors**

For CSV data snapshots ingested through Flex connectors, specific mappings are provided for control compliance findings. These mappings must include the Pass/Fail status as part of the data structure.

### **Summary**

- **Failed Controls**: Security checks with Pass/Fail results. Found in *Controls > Findings* and exposure views as Failed Control. Often mapped to frameworks like CIS Benchmarks.
- **Misconfigurations**: Security weaknesses that only exist as issues (no “passed” state). Found in exposure views as Misconfiguration.
- **Connectors**: Balbix ingests both types, but only controls include Pass/Fail compliance data and framework/policy context.