Data Security Community

Hi Imperva Community,

Greetings.

I recently executed the CIS Security Configuration Benchmark for PostgreSQL 16: Default Scan using Imperva DAM. However, the assessment reported several controls as Failed, even though the corresponding security configurations appear to be correctly implemented.

For example, the control related to the latest security patches being applied is reported as failed. However:

• The PostgreSQL instance is running the latest applicable version.
• The benchmark report itself correctly identifies the installed PostgreSQL version.
• The required security patches have already been applied.
  
  

I have observed similar inconsistencies with a few other controls as well.

Could someone please clarify the following?

1. Has anyone else encountered similar false failures while running the CIS benchmark scan for any database?
2. How does Imperva DAM determine whether the installed database version has the latest security patches?
3. Is there a supported method to review or customize the validation logic used by an individual benchmark test?
4. Can a failed control be corrected or marked as compliant after providing appropriate technical evidence?
5. Could this behavior indicate that the benchmark definitions or vulnerability intelligence require an update?

Any guidance on troubleshooting this issue or validating the test logic would be greatly appreciated.

Thank you.