Can Breeze RMM scan devices against CIS benchmarks?

Yes. Under Security → CIS Benchmarks → Baselines, create a baseline for Windows, macOS or Linux at level 1 or level 2. Scans run on a schedule or on demand with Trigger Scan. Each device gets a score and a list of failed checks with severity, check ID and what the agent found.

Can one CIS baseline cover all my clients?

Yes. Create it with scope "All organizations (partner-wide baseline)". It carries the All orgs badge and applies to matching devices in every organization you manage.

Can Breeze fix failed CIS checks automatically?

For some checks. On Windows the agent can disable the guest account, turn the firewall on, and set password history to 24. You request fixes through the AI assistant, nothing runs until it's approved, and each one is recorded on the Remediations tab. "Completed" means the command ran. The next scan is what confirms the fix.

How do I give a client evidence of CIS hardening?

Reports → Templates → Security & Compliance Posture. The PDF's Control coverage grid has a CIS hardening line with the average pass rate, how many devices were assessed out of the total, and a 90% target. Devices nobody has scanned show up as a gap, not a pass. The report also covers encryption, patching and EDR.

What does the CIS score in Breeze mean?

A device's score is the share of the baseline's checks it passed on its latest scan. Average Score averages every scanned device, and Failing Devices counts any device with at least one failed check, so it always looks worse than the fleet really is.

How to Run CIS Benchmark Scans and Give Clients the Evidence

Name: How to Run CIS Benchmark Scans and Give Clients the Evidence | Breeze RMM
Uploaded: 2026-10-22
Duration: 3 min 51 s
Description: Breeze RMM scans devices against a CIS benchmark baseline you set once for every client, lists each failed check with what the agent read off the machine, and puts a CIS hardening line on the Security & Compliance Posture report you hand to the client or their insurer.

Breeze RMM scans devices against a CIS benchmark baseline you set once for every client, lists each failed check with what the agent read off the machine, and puts a CIS hardening line on the Security & Compliance Posture report you hand to the client or their insurer.

3:51 Captions: English Open on YouTube

What's in the demo

Security → CIS Benchmarks for Acme Manufacturing: Average Score 79%, Failing Devices 22 (a device with even one failed check counts)
Baselines tab: "Summit Windows Baseline" with the All orgs badge, Windows, L1, version 3.0.0, Every 24h, Active. Trigger Scan → "Scan queued for Summit Windows Baseline"
New Baseline: scope "All organizations (partner-wide baseline)", "Summit macOS Baseline", macOS, L1, version 1.0.0, scheduled scans every 24 hours
Compliance tab, worst score first: ACME-WS-008 at 44% with 5 failed checks
ACME-WS-008 expanded: password history is 0 (should be 24 or more), minimum password length is 8 (should be 14 or more), guest account enabled (high), Windows Firewall not enabled for all profiles (high), audit credential validation not set (medium)
Remediations tab: three fixes on ACME-WS-003 (9.1.1, 2.3.1, 1.1.1), each Approved and Completed a day earlier. The help reads "Each must be approved before execution on the target device."
Compliance search "003": ACME-WS-003's latest scan is 88%, with one low-severity check left (2.3.7, last user name shown at logon)
Reports → Templates → Security & Compliance Posture, created for Acme, generated, and downloaded from Recent Runs
The PDF: 32 devices assessed, posture 80/100, and in Control coverage, "CIS hardening 80% (24/32)" against a 90% target, right under patching

Questions this video answers

Can Breeze RMM scan devices against CIS benchmarks?: Yes. Under Security → CIS Benchmarks → Baselines, create a baseline for Windows, macOS or Linux at level 1 or level 2. Scans run on a schedule or on demand with Trigger Scan. Each device gets a score and a list of failed checks with severity, check ID and what the agent found.
Can one CIS baseline cover all my clients?: Yes. Create it with scope "All organizations (partner-wide baseline)". It carries the All orgs badge and applies to matching devices in every organization you manage.
Can Breeze fix failed CIS checks automatically?: For some checks. On Windows the agent can disable the guest account, turn the firewall on, and set password history to 24. You request fixes through the AI assistant, nothing runs until it's approved, and each one is recorded on the Remediations tab. "Completed" means the command ran. The next scan is what confirms the fix.
How do I give a client evidence of CIS hardening?: Reports → Templates → Security & Compliance Posture. The PDF's Control coverage grid has a CIS hardening line with the average pass rate, how many devices were assessed out of the total, and a 90% target. Devices nobody has scanned show up as a gap, not a pass. The report also covers encryption, patching and EDR.
What does the CIS score in Breeze mean?: A device's score is the share of the baseline's checks it passed on its latest scan. Average Score averages every scanned device, and Failing Devices counts any device with at least one failed check, so it always looks worse than the fleet really is.

A note on the demo: the scan results and the three remediation rows on ACME-WS-003 are prepared demo data in the shape the agent writes. No fix runs on camera. The page's Average Score (79%) and the PDF's CIS hardening rate (80%) are rounded differently. All organization and device names are fictional.

Do this on your own fleet

Everything in the video is in the product you get. Start the Cloud Beta in minutes, or self-host the open-source Community edition for free.

Start Cloud Beta Deploy for Free Book a Demo