Power Tuning · Data Security Analysis
Power SQL Security Assessment
EVERY environment we have tested had vulnerabilities.
Shall we test yours?
Every environment we assessed had problems. In yours, all that is missing is a look. 230 security checks on each SQL Server instance, reviewed one by one by experts, with a clear plan to lock down your environment.
Developed by Fabiano Amorim, Microsoft Data Platform MVP and Most Valuable Researcher 2026
The biggest risk
You granted read access. They get everything.
An access that looks harmless can be the way in to full control of your database. That is exactly the kind of path the Power SQL Security Assessment finds before an attacker does.
You granted
SELECT, read-only
So a partner, an employee or an application can query data.
GRANT SELECT ON SCHEMA::dbo TO [partner];
What they can actually do
SYSADMIN
Full control of SQL Server.
- Read, change and delete any data
- Drop entire databases
- Access payroll tables and critical information
- Change data without leaving a trace (balances, amounts, records)
- Turn off auditing and erase the logs, hiding the attack
- Read the backup paths and try to delete them
- Move to other servers across the network
- Reach the server's operating system
For some of these flaws, there is still no published fix. Applying the latest patch is not enough. Your environment needs a close look.
Who is behind the assessment
Fabiano Amorim
Chief Technology Advisor at Power Tuning
A national and international SQL Server reference, Fabiano leads Power Tuning's data security practice. The assessment methodology was born from his research into how databases are actually breached.
- Sysadmin on the 4 largest cloudsDemonstrated privilege escalation paths up to sysadmin on the managed SQL Server of Azure, AWS, GCP and Alibaba.
- Most Valuable Researcher 2026Recognized for security research.
- Microsoft Data Platform MVP since 2011More than 15 years of continuous recognition by Microsoft.
- International speakerWeAreDevelopers World Congress 2026 (North America and Europe), SQLBits and community events.
- Technical authorArticles on SQL Server internals published on Simple Talk (Redgate) and an e-book by the same publisher.
since 2011
The most critical risk
A method so critical that we keep it in absolute secrecy
Among the 230 checks, one verifies whether someone with limited access can take full control of your SQL Server. If your environment is exposed, you find out and get the plan to protect it. The step-by-step of the attack is never written down anywhere.
Why so careful
If this method leaked, it would become a weapon against any company running SQL Server in the world. That is why it never goes into the report, the email or the presentation.
What you receive
- Finding
- Privilege escalation to sysadmin
- Severity
- Critical
- Your environment
- Exposed or protected
- Remediation
- Prioritized mitigation plan
What is never recorded
That is the level of responsibility you want from whoever looks at your database.
What we check
230 checks on each instance
This is not a quick automated checklist. Each instance is assessed in depth, covering configuration, permissions and the T-SQL code running in your environment.
- Authentication and authorization57
- Attack surface reduction26
- Data protection22
- Auditing and logging18
- Environment inventory15
- Backup and recovery10
- Resource usage10
- Network security8
- Host security7
- Installation, updates and patches3
Number of configuration and permission checks in each category.
The analysis result
The problems we found
A real example from an assessed environment. Every finding comes with severity, evidence and a recommendation, so your team knows exactly what to do.
How it works
From data collection to presentation in 2 to 3 weeks
2 to 3 weeks per instance. Most of the time goes into the expert analysis of the results, not into generating the report.
Preparation and collection
Environment scanResults analysis
Validation, severity and riskAction planning
What to do and in what orderPresentation
To your teamWhat you receive
The assessment deliverables
Security mentoring
Your team asks questions directly to ours
Throughout the project, your DBA and infrastructure team can ask our technical team anything about SQL Server security, through a WhatsApp or Teams group, with unlimited questions.
And the results presentation becomes a security workshop: your team learns along the way and comes out stronger, on top of receiving the diagnosis.
Reported vulnerabilities
The flaws Fabiano found at the largest cloud providers in the world
Environments protected by some of the biggest security teams on the planet. Even so, Fabiano Amorim found and reported SQL Server vulnerabilities at every one of them. Several of these reports earned bug bounty rewards paid by the providers themselves.
Azure
SQL Server and Azure58vulnerabilitiesGoogle Cloud
Cloud SQL22vulnerabilitiesAWS
RDS26vulnerabilitiesAlibaba Cloud
RDS9vulnerabilitiesBrazilian SQL cloud
Local provider4vulnerabilitiesYour company
Your environment?Let's find outWhoever finds flaws at the world's largest providers is who you want looking at your environment. It is far better to discover the gaps in a controlled assessment, with a report and a remediation plan, than at the hands of an attacker in production.
Assess my environmentSecurity research
Flaws Fabiano Amorim found, Microsoft fixed
Fabiano researches SQL Server security from the inside and reports vulnerabilities directly to Microsoft. Each one became a fix published in an official patch, applied to environments around the world.
- CVE-2025-53727
- CVE-2025-47954
- CVE-2025-59499
- CVE-2026-26116
- CVE-2026-47295
- CVE-2026-55002
- CVE-2026-66820
- CVE-2026-66819
- CVE-2026-77487
- CVE-2026-77480
- CVE-2026-77483
- CVE-2026-73028
- CVE-2026-66818
- CVE-2026-66816
- CVE-2026-84010
- CVE-2026-116715
- CVE-2026-118110
- and more to come
The Power SQL Security Assessment was created by the people who find the flaws Microsoft publishes.
And there's more
Exclusive bonuses for clients who hire the assessment
Training on the Power Tuning platform
Your team gets the security training, with unlimited vouchers
SQL Server Security courses with Dirceu Resende (taught in Portuguese). Once the project is signed, your whole team gets access to both courses, with no limit on people, at no extra cost.
Monitoring included
3 months of Power Alerts included
Monitoring for your SQL Server: guaranteed backups, SA login attempts and more. Your environment stays watched after the diagnosis.
Our guarantee
If we find relevant flaws
You leave with the plan
Prioritized to lock down the environment, from quick wins to structural actions.
If we find nothing relevant
You don't pay!
The assessment is on us.
Investment
Get a tailored proposal
The investment depends on the number of SQL Server instances in scope, with progressive discounts as the number of instances grows. Talk to our team and receive a proposal for your environment.
- Priced per instance
- Progressive discount from the 3rd instance
- Guarantee: nothing relevant found, you don't pay
The complete package
Everything that is included
- Full scan with the Power SQL Security tool
- 230 security checks on each instance
- Expert analysis of every finding, no false positives
- HTML, Excel and executive PDF reports, signed by Fabiano Amorim
- Prioritized remediation plan and presentation to your team
- Total confidentiality of critical findings
- Security mentoring with our team during the project
- Guarantee: no relevant flaw found, you don't pay
- 3 months of Power Alerts includedbonus
- Security courses on the Power Tuning platformbonus
Why Power Tuning
Those who find the gap also know how to close it
After the report, you are not on your own. The same team that identified the risks can support the remediation.
FAQ
Before you book
Who is the Power SQL Security Assessment for?
For companies that run SQL Server, on-premises or in the cloud, and want to know clearly how exposed their environment is. It is also recommended before audits, after migrations and when the environment has grown without an access review.
How long does it take?
2 to 3 weeks per instance: 2 days of preparation and collection, 1 to 2 weeks analyzing the results, 3 days defining the actions and 1 day presenting to your team.
Is it just an automated scan?
No. The Power SQL Security tool runs 230 checks on each instance, and every finding is analyzed by experts, with no false positives. The analysis is most of the work.
My patches are up to date. Do I still need it?
Yes. For some of the flaws we assess there is still no published fix. Applying the latest patch is not enough to close these paths.
What do I receive at the end?
An interactive HTML report, a detailed Excel workbook and an executive PDF for the C-level, signed by Fabiano Amorim, plus the prioritized remediation plan and a results presentation to your technical team.
What if you find nothing relevant?
You don't pay. If the assessment does not point out a relevant flaw, it is on us.
How are critical findings handled?
With total confidentiality. The method behind the most critical flaw is never recorded in a report, email or presentation, so it cannot be used against any environment.
Does the assessment affect my database operations?
The work is planned together with your team, with scope, windows and access agreed before it starts, so it does not impact day-to-day operations.
How is the assessment priced?
It is priced per SQL Server instance, with progressive discounts from the 3rd instance. Talk to our team to receive a proposal for your environment.
Next step
Let's schedule your Power SQL Security Assessment
Reach out to our team to pick the best date and start the diagnosis. Choose the channel you prefer.
Book a meeting
Pick a time and talk to a consultant about your scenario.
Pick a timeChat on WhatsApp
Get your questions answered right now by our sales team.
Open chatNo commitment. You talk directly with people who know SQL Server security.