diff --git a/ben-bot/CMakeLists.txt b/ben-bot/CMakeLists.txt
index 2266ce45..096328e5 100644
--- a/ben-bot/CMakeLists.txt
+++ b/ben-bot/CMakeLists.txt
@@ -18,6 +18,10 @@ target_link_libraries (ben_bot PRIVATE ben_bot::libbenbot)
 
 add_executable (ben_bot::ben_bot ALIAS ben_bot)
 
+if (MSVC)
+    target_compile_definitions (ben_bot PRIVATE _CRT_SECURE_NO_WARNINGS)
+endif ()
+
 #
 
 include (CheckIPOSupported)
diff --git a/config/cmake/All.cmake b/config/cmake/All.cmake
index a821d66d..8eada52f 100644
--- a/config/cmake/All.cmake
+++ b/config/cmake/All.cmake
@@ -14,6 +14,7 @@ include_guard (GLOBAL)
 
 include ("${CMAKE_CURRENT_LIST_DIR}/Sanitizers.cmake")
 include ("${CMAKE_CURRENT_LIST_DIR}/Coverage.cmake")
+include ("${CMAKE_CURRENT_LIST_DIR}/Hardening.cmake")
 include ("${CMAKE_CURRENT_LIST_DIR}/Warnings.cmake")
 
 # General settings
diff --git a/config/cmake/Hardening.cmake b/config/cmake/Hardening.cmake
new file mode 100644
index 00000000..724ea46b
--- /dev/null
+++ b/config/cmake/Hardening.cmake
@@ -0,0 +1,56 @@
+# ======================================================================================
+#
+# ░▒▓███████▓▒░░▒▓████████▓▒░▒▓███████▓▒░       ░▒▓███████▓▒░ ░▒▓██████▓▒░▒▓████████▓▒░
+# ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░      ░▒▓█▓▒░░▒▓█▓▒░      ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ ░▒▓█▓▒░
+# ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░      ░▒▓█▓▒░░▒▓█▓▒░      ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ ░▒▓█▓▒░
+# ░▒▓███████▓▒░░▒▓██████▓▒░ ░▒▓█▓▒░░▒▓█▓▒░      ░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░ ░▒▓█▓▒░
+# ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░      ░▒▓█▓▒░░▒▓█▓▒░      ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ ░▒▓█▓▒░
+# ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░      ░▒▓█▓▒░░▒▓█▓▒░      ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ ░▒▓█▓▒░
+# ░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░░▒▓█▓▒░      ░▒▓███████▓▒░ ░▒▓██████▓▒░  ░▒▓█▓▒░
+#
+# ======================================================================================
+
+include_guard (GLOBAL)
+
+if (MSVC)
+    add_compile_options (/sdl /DYNAMICBASE /guard:cf)
+    add_link_options (/NXCOMPAT /CETCOMPAT)
+
+    return ()
+endif ()
+
+if (CMAKE_CXX_COMPILER_ID MATCHES "GNU|Clang")
+    get_cmake_property (debug_configs DEBUG_CONFIGURATIONS)
+
+    if (NOT debug_configs)
+        set (debug_configs Debug)
+    endif ()
+
+    list (JOIN debug_configs "," debug_configs)
+
+    set (config_debug "$<CONFIG:${debug_configs}>")
+    set (config_release "$<NOT:${config_debug}>")
+
+    add_compile_options ("$<${config_release}:-U_FORTIFY_SOURCE>")
+
+    add_compile_definitions (_GLIBCXX_ASSERTIONS "$<${config_release}:_FORTIFY_SOURCE=3>")
+
+    include (CheckCXXCompilerFlag)
+
+    check_cxx_compiler_flag (-fstack-protector-strong HAVE_fstack_protector_strong)
+    if (HAVE_fstack_protector_strong)
+        add_compile_options (-fstack-protector-strong)
+    endif ()
+
+    check_cxx_compiler_flag (-fcf-protection HAVE_fcf_protection)
+    if (HAVE_fcf_protection)
+        add_compile_options (-fcf-protection)
+    endif ()
+
+    if (LINUX OR CMAKE_CXX_COMPILER_ID MATCHES "GNU")
+        check_cxx_compiler_flag (-fstack-clash-protection HAVE_fstack_clash_protection)
+        if (HAVE_fstack_clash_protection)
+            add_compile_options (-fstack-clash-protection)
+        endif ()
+    endif ()
+endif ()
diff --git a/tests/CTestCustom.cmake b/tests/CTestCustom.cmake
index 3bef6d00..666c6311 100644
--- a/tests/CTestCustom.cmake
+++ b/tests/CTestCustom.cmake
@@ -26,8 +26,14 @@ set (CTEST_CUSTOM_MAXIMUM_NUMBER_OF_WARNINGS 100)
 # this matches forward- or back-slashes
 set (slash "[/\\]")
 
-list (APPEND CTEST_CUSTOM_COVERAGE_EXCLUDE @CMAKE_PREFIX_PATH@ "@FETCHCONTENT_BASE_DIR@"
-      "${slash}_deps${slash}" "tests${slash}"
+list (
+    APPEND
+    CTEST_CUSTOM_COVERAGE_EXCLUDE
+    @CMAKE_PREFIX_PATH@
+    "@FETCHCONTENT_BASE_DIR@"
+    "${slash}_deps${slash}"
+    "tests${slash}"
+    "_cmrc"
 )
 
 list (
@@ -42,7 +48,4 @@ list (
     "libutil${slash}src${slash}memory${slash}PageAlignedAlloc_Windows.hpp"
     # MSVC warnings about the Visitor class's move operators being implicitly deleted
     "util::Visitor<"
-    # warnings about std::getenv() being deprecated/thread-unsafe
-    "main.cpp.+getenv"
-    "note: 'getenv' has been explicitly marked deprecated here"
 )
diff --git a/tests/perft/CMakeLists.txt b/tests/perft/CMakeLists.txt
index 6df37e8a..a657f8b9 100644
--- a/tests/perft/CMakeLists.txt
+++ b/tests/perft/CMakeLists.txt
@@ -40,11 +40,15 @@ foreach (data_file IN LISTS testcase_files)
         )
         # cmake-format: on
 
+        set (test_name "ben_bot.perft.${filename}.${depth}")
+
         add_test (
-            NAME "ben_bot.perft.${filename}.${depth}"
+            NAME "${test_name}"
             COMMAND Python::Interpreter "${CMAKE_CURRENT_LIST_DIR}/perft.py" "--test=${data_file}"
                     "--engine=$<TARGET_FILE:ben_bot>" "--depth=${depth}"
         )
+
+        set_tests_properties ("${test_name}" PROPERTIES REQUIRED_FILES "$<TARGET_FILE:ben_bot>")
     endforeach ()
 
     set_property (DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS "${data_file}")
diff --git a/tests/position-solver/CMakeLists.txt b/tests/position-solver/CMakeLists.txt
index d2bf4d15..4df00d03 100644
--- a/tests/position-solver/CMakeLists.txt
+++ b/tests/position-solver/CMakeLists.txt
@@ -43,12 +43,17 @@ foreach (epd_file IN LISTS testcase_files)
             CONFIGURATIONS Release
         )
 
+        # cmake-format: off
         set_tests_properties (
             "${test_name}"
-            PROPERTIES ATTACHED_FILES_ON_FAIL "${engine_log}" RESOURCE_LOCK BenBotPositionSolver
-                       # allow 10 minutes after the go command is received
-                       TIMEOUT_AFTER_MATCH "600;: << go"
+            PROPERTIES
+                ATTACHED_FILES_ON_FAIL "${engine_log}"
+                RESOURCE_LOCK BenBotPositionSolver
+                REQUIRED_FILES "$<TARGET_FILE:ben_bot>"
+                # allow 10 minutes after the go command is received
+                TIMEOUT_AFTER_MATCH "600;: << go"
         )
+        # cmake-format: on
 
         set_property (DIRECTORY APPEND PROPERTY ADDITIONAL_CLEAN_FILES "${engine_log}")
     endforeach ()
diff --git a/tests/rampart/CMakeLists.txt b/tests/rampart/CMakeLists.txt
index 06c6ac42..d6c4ce49 100644
--- a/tests/rampart/CMakeLists.txt
+++ b/tests/rampart/CMakeLists.txt
@@ -51,5 +51,5 @@ foreach (data_file IN LISTS testcase_files)
                       "--test=${data_file}" "--exec=$<TARGET_FILE:rampart>"
     )
 
-    set_tests_properties ("${test_name}" PROPERTIES REQUIRED_FILES "${data_file}")
+    set_tests_properties ("${test_name}" PROPERTIES REQUIRED_FILES "$<TARGET_FILE:rampart>")
 endforeach ()