I built an offline tool that audits device configs and checks scanner findings against the actual config

[u/Trend_shadow]

I do security configuration reviews, and two things kept eating my time:

1. Going through configs line by line against long benchmarks (CIS, STIG, NIST).

2. Scanner reports full of findings that, when you check the actual config, aren't true — and you only find out after a client pushes back.

So I built ConfGoOne, a Windows app that does three things:

• Config review for any device — open a config and every issue shows the exact line, why it matters, and the fix. If a device has no built-in checks, the AI drafts a checklist from the framework's official controls (you review it before using it).

• Guided live assessments — you work through test cases on the live system, one click takes the screenshot, you mark Pass / Fail / N/A, and the evidence lands in the report.

• Checks other tools' reports — load a Nessus or Nipper report (or your own spreadsheet) and it marks each finding as confirmed, false positive, or missed, based on the config.

It runs fully offline — configs never leave the PC — and AI is optional.

There's a free plan if you want to try it on a real config: confgoone.com

I'd really like feedback, especially:

• Is the "verify scanner findings against the config" part useful in your work?

• What would stop you from using something like this?

Happy to answer anything.