What it does
Every enrolled Windows and Linux machine is checked once a day, read-only. The results become findings, each machine gets a score out of 100, and any fix needs a person's approval. Security is switched on per company, so you choose where it runs.
It needs agent 0.9.62 or later on the machine.
What it checks
- Firewall state
- Remote access exposure: RDP and its sign-in check, SSH root login and password login
- Local admins and sudo users
- Defender and SMBv1 on Windows
- Automatic updates and brute-force protection on Linux
- Listening ports and the programs behind them
- Installed software
Anything a machine could not be asked is listed as "not checked", with the reason. It is never counted as fine.
Known flaws in installed software
Installed software is matched against public advisories: each Linux distribution's own notices, CISA's known-exploited list, and the NVD. A match is marked confirmed, likely or possible. "Possible" matches are listed apart and not scored. Each finding gives the cause, what happens if it is left, and the fixed version, or "no fix yet".
The matching runs in your hub from public data. Nothing about your machines is sent out.
Matching is strongest on Linux. On Windows it relies on program names and the NVD, so treat a Windows match as a lead to confirm.
The score
A machine starts at 100. Each open finding costs 25 if critical, 10 if high, 3 if medium and 1 if low. A company's score is the average of its checked machines. Accepted findings don't count. Flaws with no fix yet are listed, but they only lower the score if they are critical.
Fixes you approve
One approval fixes one problem across many machines. Untick any machine you want left out. Fixes run five at a time and stop after two failures until someone looks. Each machine is checked again to prove the fix worked, and a fix can be undone. The hub refuses changes that would lock you out, such as cutting off a running service or removing the last admin's access.
- Windows: firewall, Defender, SMBv1, RDP sign-in check
- Linux: automatic updates, SSH root and password login, firewall
A checklist with owners and dates
Each finding shows who handles it (BE AI with a fix, patching, or a technician), an assignee and a due date: 2 days for critical, 7 for high, 30 for medium and 90 for low. Marking an item done doesn't close it. Only the next check does. "Action plan" has BE AI write the order to tackle a company's findings in.
Reports
A monthly PDF per company shows the score, what is new, what was fixed and by whom, what was accepted and why, what is open and what is overdue. It is mailed as a link to company admins, with an off switch for each company. Overdue items also appear in the weekly digest and the reports.
You stay in control
Accept a finding with a reason, or leave a whole machine out with a reason. Both are recorded and can be reversed. Customer logins see only their own machines, and fixing follows their permissions.
What it does not do
It doesn't scan your network from outside, run penetration tests or investigate a compromise. FreeBSD, pfSense and macOS machines show as "not checked", and OpenWrt router coverage is partial.