@carnage4life CIS benchmarks get used this way a lot. The example bits of code are simplified for the sake of clarity, and are neither complete nor in some cases safe to run unaltered on production systems.

For example, the sshd configuration checks do not check how sshd is actually configured (trivial, since sshd will happily spit out a full running config), but rather that certain keywords are present in the main config file. Easy to induce false results.