We audited our PC and network — and found settings we only thought we had

What this post is (and isn't)

In the previous post, we sorted what you need to protect onto five shelves. This post is a record of how we actually reviewed two of them — "devices" and "just in case" — in our own environment.

In October 2026 we reviewed Exapolicy's environment in three layers. There is nothing special about it: it is built around the kind of broadband router you would find in any home. This post covers what we found, the measures we took, and the settings we only thought we had.

Layer	What it includes
Development environment	The PC we develop on, and the development server running on it
Office infrastructure	The router, a NAS used for backup, and a printer
Devices on Wi-Fi	PCs that connect over Wi-Fi and are also used outside

• This is a different layer from deciding what you send to an AI service (which is what our own product, Covenant, deals with).
• We checked everything with read-only commands and admin screens, and after each change we re-ran the same check to confirm it.
• These are results from one environment. Others will differ.
• We don't name devices or describe settings or the network layout in detail. What we do write down are steps you can run on your own machine. Examples are for Windows.

1. Why we looked

Reports of personal data leaking from companies keep coming. As companies harden their side, individuals and very small businesses may become a more attractive target.

We narrowed down what would actually hurt to two things:

What could hurt	What an individual or small business can do
Ransomware (encrypts your files and demands payment)	Keep a point you can roll back to, even if the files are encrypted
DDoS (floods a target with traffic)	You can't stop one yourself. What you can do is make sure your own devices don't become part of the attack

2. What we found

Here is the "before" state, by layer. None of it was one big mistake. It was a mix of factory defaults and permissions granted one at a time for convenience. And in that state, the PC and the router worked perfectly well. Working and being protected are two different things.

Layer	What we found	What could happen
Development	File shares were open to "Everyone"	If one password leaks, much of it can be rewritten from inside the LAN
Development	A development server (a local LLM) was reachable from the whole LAN, with no authentication	Any device on the LAN could run, delete or replace models
Development	Remote access accepted connections from anywhere	More ways in
Development	Tamper Protection (which stops malware from turning off your antivirus) was off	Ransomware typically tries to disable security software first
Devices on Wi-Fi	Inbound app permissions were also active on public networks (the result of answering "Allow access?" over time)	Someone on the same café Wi-Fi could reach those apps
Office infrastructure	The backup target was always connected and writable	Ransomware encrypts the PC and the backup at the same time

3. Corrective actions

Development environment (PC)

Item	Why it matters	What we did
Tamper Protection	Ransomware tries to turn off antivirus first. Make sure it can't	Turned it on
Guest account	A way in that anyone can use. If you don't use it, there's no reason to keep it	Disabled it
File share permissions	Left at "Everyone", one leaked password is enough to rewrite a lot	Limited to the owner and administrators
Development server	A server without authentication, open to the LAN, can be operated from any device on that network	Made it reachable only from the PC itself, and removed the inbound rule
Remote access	A convenient way in is a way in for an attacker too. Limit who can connect	Allowed only from the office LAN and the VPN range. From outside, go through the VPN (no ports opened on the router)

Devices on Wi-Fi

Item	Why it matters	What we did
Inbound app permissions	On public Wi-Fi, strangers share your network. With the same permissions as at home or the office, they can reach you too	Zero on public networks; allowed only on the office LAN

Office infrastructure (router)

Item	Why it matters	What we did
Firmware updates	The router is the entrance to the network. Old firmware keeps publicly known weaknesses open	Set to update automatically
Admin password and port forwarding	These are the entrance settings themselves. Check that no unintended forwarding is left	Checked
UPnP (lets devices open ports on their own)	Devices can open a way in from outside without you knowing	Turned off
WPS (push-button Wi-Fi pairing)	Convenience in exchange for making it easier to join the Wi-Fi	Turned off
Admin access from the internet side	If the admin screen is visible from outside, it becomes a target	Turned off

Office infrastructure (backup)

Item	Why it matters	What we did
Snapshots (point-in-time copies you can restore from)	If files are encrypted or deleted, you can't get them back without a point to roll back to	Scheduled daily snapshots, kept at daily, weekly and monthly intervals, so we can roll back a few months
Where snapshots can be deleted from	If the PC can delete them, they go too when the PC is taken over	They can't be deleted from the PC side. Even if the PC is taken over by ransomware, the rollback points remain

Of everything we changed, we think that last row is the protection that matters most against ransomware.

4. Gaps in our settings

This was the biggest lesson. In both cases, we found out only by re-running the same check after the change.

4-1. Snapshots had stopped on one volume — about two years ago

We believed the schedule existed. When we opened the snapshot list, the latest snapshot on one volume was about two years old. For that whole time, that volume had no point to roll back to.

→ Don't check whether a schedule exists. Check the date of the latest snapshot.

4-2. We removed a setting and rebooted — and the old setting kept running

We removed the setting that exposed the development server to the LAN, and rebooted the PC. When we checked again, it was still reachable from the LAN.

The cause was a process left running in the background. It survived the reboot and kept the old setting. Only after ending that process from Task Manager and starting it again did the server listen on the PC alone.

→ Don't check whether you rebooted. Check which address it is listening on right now.

5. Sync is not backup

Syncing a folder to the cloud or to a NAS is convenient. But if ransomware encrypts your files, the encrypted files get synced too.

When you look at a setup as protection against ransomware, check two things:

1. Can you go back to an earlier point in time? (Are versions kept?)
2. Can those versions be deleted from the PC? (Would they survive the PC being taken over?)

6. Let's check your own machine (Windows)

All of these are read-only commands. None of them change any setting. Run them in PowerShell as administrator.

What is listening, and on which address

Get-NetTCPConnection -State Listen |
  Select-Object LocalAddress, LocalPort, OwningProcess |
  Sort-Object LocalPort

A LocalAddress of 0.0.0.0 or :: means the service is reachable from outside the PC (the LAN). 127.0.0.1 or ::1 means the PC only. Match the OwningProcess number to the PID on the Details tab of Task Manager to see which app it is.

Inbound rules that are also active on public networks

Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow |
  Where-Object { $_.Profile -match 'Public|Any' } |
  Select-Object DisplayName, Profile

Windows classifies networks as Private (e.g. home or office) or Public (e.g. a café). These rules accept inbound connections even on public Wi-Fi. Windows' own rules will also show up in large numbers, so focus on apps you installed yourself. Anything you don't use, or can't explain, is a candidate for review.

File share permissions

Get-SmbShare | ForEach-Object { Get-SmbShareAccess -Name $_.Name }

An AccountName of Everyone with AccessRight of Full means the share is wide open at the entrance.

Tamper Protection and the Guest account

Get-MpComputerStatus | Select-Object IsTamperProtected
Get-LocalUser -Name Guest | Select-Object Name, Enabled

If IsTamperProtected is False, you can turn it on under Windows Security → Virus & threat protection → Manage settings → Tamper Protection.

Backup

• In your NAS (or backup tool) admin screen, look at the date of the latest snapshot, not just whether a schedule exists
• Check that the backup drive isn't always connected and writable

Router

• In the admin screen, look at UPnP, WPS, remote (internet-side) administration, and port forwarding
• Check that firmware updates are automatic

Summary

In this post we looked at the "devices" and "just in case" parts of what you need to protect, split into three layers — development environment, office infrastructure, and devices on Wi-Fi — and shared what we actually reviewed. Even with a setup built around an ordinary broadband router, the mix of factory defaults and convenience permissions left things to fix. And when we re-ran the same checks after our changes, we found two settings we had only thought we had. Here is what to check:

Layer	What to check
Development	What is running that can be reached from outside the PC / any share open to "Everyone" / whether antivirus can be turned off
Devices on Wi-Fi	What you allow on public networks
Office infrastructure (router)	Devices can't open holes on their own / updates haven't stopped / the admin screen isn't visible from outside
Office infrastructure (backup)	Can you roll back / can those versions be deleted from the PC / the latest date

A setting is only a belief until you confirm it. After you change something, run the same check again. That was the single most important lesson from this review.

This post is part of a series on security steps an individual or a very small business can take. It was first published in Japanese on Zenn.

---

Exapolicy LLC builds Covenant, an AI governance app for individuals that checks what you are about to send to an AI service against rules you define, on your own machine, before it is sent. Covenant is not a ransomware or DDoS defense. This post is a record of a review of our own environment; following these steps does not guarantee you won't be affected.