SQL Server Security Review
SQL Server grants exactly what its server roles, database roles and linked server mappings allow, nothing more. We test sysadmin membership, impersonation, linked server mappings and surface-area configuration directly. CREST-certified testers, fixed price from £2,740 for a 2-day single-system scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Membership of the sysadmin fixed server role can perform any activity on the instance, and that permission cannot be denied to a member of it, so who holds it sets the ceiling for everything else we test.
Why SQL Server security comes down to who holds sysadmin, not what the schema says
Microsoft’s own documentation states that members of the sysadmin fixed server role can perform any activity in the server, and permissions cannot be denied to members of this role. That single membership list is often the real access-control boundary, whatever the database-level roles say underneath it. Authentication compounds the risk: Windows Authentication is the default authentication mode and is always available, but where mixed mode is enabled the built-in sa account authenticates independently of any Windows account, and Microsoft’s own guidance is that this well-known account should not be enabled unless an application specifically requires it, with a strong password enforced if it is. We map every login’s server-role membership and check whether mixed mode and the sa account are switched on for a reason that still applies.
Impersonation moves the same question down to database level. executing EXECUTE AS on a login requires IMPERSONATE permission on that login, and EXECUTE AS on a database user requires IMPERSONATE on that user, so a login granted IMPERSONATE broadly can step into a far more privileged context than its own grants suggest. The TRUSTWORTHY database property adds a second route: it is off by default, and Microsoft’s own security warning states that when TRUSTWORTHY is on and the database owner is a member of sysadmin, a member of the db_owner role can elevate their permissions to sysadmin, both conditions being required. We test which logins hold IMPERSONATE grants and which databases have TRUSTWORTHY switched on, and why.
Linked servers extend that same trust across instances. Microsoft’s documentation notes that the default mapping created when a linked server is added forwards the local login’s own credentials to the remote server, and this can be replaced with a single remote login and password shared by every local login mapped to it, so one linked server can quietly become the widest door into another instance. The rest of the surface area is disabled rather than misconfigured by default: xp_cmdshell is disabled on new SQL Server installations, and OLE Automation Procedures ship off too, so either being switched on is worth investigating in its own right. Where the instance is Azure SQL Database or Managed Instance rather than a server you manage, that boundary moves again, since Azure SQL Database uses its own server-level roles and Managed Instance supports linked servers only to a limited set of targets. For estates running more than one database engine, see our wider database security review.
SCOPE
What we review in a SQL Server instance
Server Roles, Sysadmin Membership and the SA Account
Membership of the sysadmin fixed server role lets an account carry out any activity on the instance, and Microsoft’s documentation is explicit that permissions cannot be denied to a member of that role, so we map exactly which logins hold it before reviewing anything else. Where mixed mode authentication is configured, we check whether the built-in sa account is enabled and how its password is managed, since Microsoft recommends leaving it disabled unless an application specifically requires it.
Database Users and Fixed Database Roles
We map every database user against the fixed database roles it belongs to, including db_owner, and check that role membership matches what each account is meant to do inside that specific database rather than being inherited from an older build or a copied login script. Server-level access and database-level access are reviewed separately, since a login can be unprivileged at server level while still holding db_owner on the database that matters.
Impersonation, EXECUTE AS and TRUSTWORTHY Databases
EXECUTE AS lets one login or user run as another, and Microsoft’s documentation states that impersonating a login requires IMPERSONATE permission on that login while impersonating a database user requires IMPERSONATE on that user. TRUSTWORTHY is off by default, but Microsoft’s own security warning notes that turning it on for a database whose owner is a sysadmin member lets a db_owner member escalate to sysadmin, so we check IMPERSONATE grants and TRUSTWORTHY settings together rather than in isolation.
Linked Servers and Login Mappings
Adding a linked server creates a default mapping that, per Microsoft’s documentation, forwards the connecting login’s own credentials to the remote server; that default can be replaced with a fixed remote login and password shared by every local login mapped to it, which turns the linked server into a single, often over-privileged, route onto the remote instance. We test how each linked server in scope is mapped and what the remote login it connects as can actually do.
xp_cmdshell, CLR Integration and OLE Automation
xp_cmdshell and OLE Automation Procedures both ship disabled on new SQL Server installations, so either being switched on is itself worth investigating rather than assumed to be deliberate. CLR assemblies add a further route: Microsoft’s own guidance is that a SAFE-marked assembly can still reach external resources or acquire sysadmin privileges, which is why clr strict security now treats SAFE and EXTERNAL_ACCESS assemblies as UNSAFE by default, and we check whether that setting has been loosened and what any installed assembly is signed or trusted to do.
Service Account Identities
The account SQL Server and SQL Server Agent run as decides what a compromise of the database engine can reach on the wider network, and Microsoft’s own guidance favours a managed or group-managed service account over a shared domain account precisely because those remove the need to manage the password by hand. We review what account each service runs as, what it can reach outside the instance, and whether a linked server or Agent job depends on that same account holding more reach than the task needs.
Encryption: TDE, Always Encrypted and TLS
Transparent Data Encryption encrypts the data and log files at rest using a database encryption key, and Microsoft’s documentation notes that backups of a TDE-enabled database are encrypted with that same key, so losing the certificate that protects it makes both the live database and its backups unrecoverable. Always Encrypted is checked separately, since Microsoft defines dedicated permissions for managing column master and column encryption keys apart from querying the encrypted columns themselves, and we test whether connections are forced onto TLS rather than allowed to fall back to an unencrypted one.
Backups and Backup File Access
BACKUP DATABASE and BACKUP LOG permissions default to members of the sysadmin fixed server role and the db_owner and db_backupoperator fixed database roles, and Microsoft’s documentation notes that the SQL Server service account itself needs write access to wherever the backup is written. We review who holds those roles, where backup files or devices end up, and who can read or restore them once they exist.
SQL Server Agent Jobs and Proxies
SQL Server Agent’s own msdb roles run from SQLAgentUserRole up to SQLAgentOperatorRole, and Microsoft’s documentation notes that a member of the most privileged role can start, stop or disable any local job without being able to change who owns it, so we check Agent role membership against what each account actually needs to do. Where a job step uses a proxy, we review the credential behind it and which subsystems that proxy is granted access to, since a broadly scoped proxy lets a job step run with more reach than the step itself needs.
Azure SQL Database and Managed Instance Differences
Azure SQL Database uses its own server-level roles rather than the on-premises fixed server role set, and Managed Instance supports linked servers only to a limited group of targets, such as other Managed Instances, SQL Database, Azure Synapse SQL pools and SQL Server instances, not to files or other database platforms. We confirm during scoping which of these you run, what the platform manages for you, and test the logins, roles and configuration you control against that boundary.
OUR PROCESS
Microsoft SQL Server Security Review: From Scope to Attestation
Scope and Access
We agree which SQL Server instances, databases and Azure SQL resources are in scope, plus a login for every privilege tier you want tested and, where relevant, an admin or Azure portal account to confirm configuration.
Role and Configuration Mapping
We map every login’s server-role and database-role membership, linked server login mappings, and surface-area configuration against what each account and feature is actually meant to do.
Manual Testing
A CREST-certified tester manually tests authentication configuration, impersonation and TRUSTWORTHY settings, linked server login mappings, and Agent job and proxy configuration, chaining findings where they compound.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST SQL Server pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Microsoft SQL Server Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 8 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test SQL Server For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Microsoft SQL Server Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our SQL Server instance?
We need at least one authenticated login for every privilege tier in scope, from an ordinary application login through to a login that can query server and database role membership, linked server configuration and surface-area settings for review. A sysadmin or Azure portal account is useful for confirming configuration but is not used to run the manual test itself.
Will testing touch live data?
We test the databases you nominate, working against your actual roles, permissions and configuration rather than a copy, so we agree exclusions such as destructive statements, bulk data changes or production backup jobs before testing starts. We do not run destructive tests or export real customer data without that agreement in writing.
How long does a SQL Server security review take?
A single instance with a small number of databases in scope sits in our 2-day single-system scope, with a report typically landing around 5 working days after kickoff. More databases, linked servers, or a mix of on-premises and Azure instances, moves into a larger scope with more testing days.
Do you test on-premises SQL Server and Azure SQL the same way?
The testing questions are the same: logins, roles, impersonation, linked servers, surface area and encryption. What differs is the boundary, since Azure SQL Database and Managed Instance move server-level configuration and the underlying host to Microsoft, so we confirm during scoping exactly which platform you run and test to that boundary.
What is out of scope for a single-system SQL Server review?
We never test the underlying host, hypervisor or infrastructure of a managed Azure SQL service, or SQL Server’s own source code, and a separate connected system such as an identity provider or a backup platform is scoped and quoted separately. We test the logins, roles, configuration and code running on the instance and databases you nominate.
Do your cloud provider’s rules restrict what you can test on Azure SQL?
Yes, where the instance runs on Azure SQL Database or Managed Instance. Microsoft’s penetration testing rules of engagement for its cloud services permit testing your own tenant and the assets you’re authorised for, provided you don’t access data or systems you don’t own, don’t use credentials that aren’t yours, and don’t disrupt the service for other tenants, and we confirm the current version of those rules during scoping and test inside them.
Do you test xp_cmdshell, CLR assemblies and other surface-area features?
Yes, checking whether disabled-by-default features such as xp_cmdshell and OLE Automation Procedures have been switched on, and reviewing any installed CLR assembly’s permission set, is part of the standard engagement. Testing the CLR runtime or SQL Server’s own binaries, rather than how these features have been configured and used on your instance, is out of scope.
Are your testers CREST certified?
Yes. Every SQL Server engagement is carried out by UK-based, CREST-certified testers, and your report and attestation letter are recognised by auditors and insurers accordingly.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your SQL Server review
SQL Server grants exactly what its server roles, database roles and linked server mappings allow, nothing more. We test sysadmin membership, impersonation, linked server mappings and surface-area configuration directly. CREST-certified testers, fixed price from £2,740 for a 2-day single-system scope, quoted within 24 hours.
