Every module, in detail.

What it does

• Scores every device daily against the five control themes: firewalls, secure configuration, access control, malware protection and patch management.
• Keeps the snapshot history, so a pass today and a failure six weeks ago are both on record with the dates in between.
• Maps a single set of collected facts to more than one framework, so the same evidence answers more than one auditor.

What it produces

• Assessor-ready report with pass and fail per control, plus the device sample the assessor will ask for.
• Per-device remediation list, ranked, with the owning module for each fix.
• Readiness percentage for the executive page and the board pack.

Needs: the agent on the device. No inbound ports, no ConfigMgr dependency.

Read the full Cyber Essentials Plus module page →

What it does

• Matches advisories to the real installed version on each device rather than to a generic product feed.
• Prioritises by known exploitation first, then EPSS probability, with confidence filtering to drop low-signal guesses.
• Runs an SLA clock per exposure, with breach alerts before the window closes rather than after.

What it produces

• A live register of exposures with install counts, owning devices and days remaining.
• A remediation proposal handed straight to Package Creator or Security Patches.
• Closed-exposure history for the evidence pack.

Needs: the agent and its inventory. Correlation happens server side.

What it does

• Takes an authoritative nightly snapshot rather than trusting the device to report what changed.
• Diffs server side and maps each fact to the control theme it belongs to.
• Turns the change that would have failed you at assessment into a finding the next morning.

What it produces

• Per-device timeline of configuration changes with before and after values.
• Per-theme compliance movement, so a regression is visible as a trend, not a surprise.
• Regressions you acknowledge with a note and a fix-by date, and a printable PDF report.

Needs: the agent. Detection only: it shows and records each change, it never changes a setting.

What it does

• Records apps, firewall rules, the hosts file, listening ports, local accounts, shares, certificates, updates, services, scheduled tasks, IIS, SQL Server, Java and Tomcat.
• Shows the server as it was on a chosen date, or compares two dates side by side.
• Redacts secrets on the server itself, so they never leave it.

What it produces

• A change timeline per server with before and after values.
• A PDF report with an executive summary and prioritised observations, and a CSV export.
• The answer to "what changed on this server, and when" without a ticket archaeology session.

Needs: the agent on Windows Server. Read only, daily and on demand.

What it does

• Enumerates certificates and DNS, checks SPF and DMARC, TLS configuration and security headers.
• Finds risky open ports and publicly exposed JavaScript libraries with known issues.
• Tracks change over time, so a newly exposed service is an alert rather than an annual finding.

What it produces

• An external posture score alongside the internal one on the same console.
• Expiry and misconfiguration warnings with the owning domain.
• Evidence that the perimeter was checked continuously, not once a year.

Needs: your domains and public ranges. No agent involvement.

What it does

• Discovers network devices passively and always on, with an optional read-only identify step that is off by default.
• Checks them for known vulnerabilities, known-exploited entries, end-of-life firmware and Cyber Essentials Plus issues such as open management ports.
• Keeps remediation status across rescans, so a fixed finding stays fixed in the record.

What it produces

• An internal posture score with its trend and the priority actions behind it.
• Findings per device with the reference to the published advisory.
• A branded executive report for the board or the client.

Needs: the agent or the portable collector. Active scanning is opt-in and off by default.

What it does

• Uses App Control for Business, enforced by the Windows kernel, to stop chosen applications installing or running, including renamed copies.
• Starts every rule in audit, showing what it would block, and enforces only when an admin confirms it by typing its name.
• Ships tested rule packs, for example Google Chrome and Steam, and lets you add your own by product name, file name or website.

What it produces

• A blocked-attempts log and an audit report per rule.
• Copies that are already installed shown as Prohibited in the Risk Register, so they cannot hide.
• Exceptions per device, a pause-all switch with no reboot, and protection for Windows, Microsoft and Assure components.

Needs: the agent. No reboot on Windows 11 22H2 and later.

What it does

• Normalises the raw inventory into products and publishers, so eleven versions of one tool are one decision.
• Scores each product on usage, licence cost, risk and support state.
• Lets you override the recommendation at product, department or device level, with the reason recorded.

What it produces

• A rationalisation plan with the saving attached to each decision.
• A retirement queue that Package Creator can action directly.
• An audit trail on every decision and every override.

Needs: the agent for usage telemetry. Licence costs entered once per product.

What it does

• Resolves the latest released version for each product.
• Watches vendor pages you choose for new releases.
• Feeds the upgrade available view, so the next package is already lined up.

What it produces

• A master list of products, versions and download sources.
• Gaps that need a version check, flagged for attention.
• The starting point for AutoPack and Package Creator.

Needs: nothing on the device. It works from the inventory Assure already holds.

What it does

• Inspects the vendor MSI, surfaces properties and features, and builds the transform rather than hand-editing it.
• Generates a PSADT wrapper against your house template, so every package your estate receives looks the same.
• Publishes the finished package to Intune or Configuration Manager from the same console.

What it produces

• A deployable package with detection logic, install and uninstall, and user handling.
• Package documentation generated from what was actually built.
• A version history per application, so the next release is a repeat, not a rebuild.

Needs: your PSADT template defined once, plus the Intune or ConfigMgr connection you already have.

What it does

• Deploys signed PSADT packages to the devices you choose, in rings you control, as Required, Available for self-service, or Uninstall.
• Signs every package and every assignment with separate keys, so the agent refuses a tampered package or one meant for another organisation.
• Confirms each install with a detection rule and by the vulnerability clearing in the Risk Register, not just an exit code.

What it produces

• A per-client App Catalogue and reusable deployment groups that carry over to the next version.
• Success figures per deployment and a reason for every failure, with pause, resume and retry.
• A full audit of who approved, who deployed and what happened on each device.

Needs: the agent. Windows first. Servers are never restarted automatically.

What it does

• Brings applications built for older versions of Windows into the same managed, audited estate as everything else.
• Part of the Assure Console for engineers.
• Built to the same rules as every other module: outbound only, signed and per client.

What it produces

• Details will be published at launch.

Needs: to be confirmed at launch.

What it does

• Scans for missing updates on the device itself and reports what is genuinely absent.
• Installs on approval, within a window you set, on devices that are off the corporate network as readily as on it.
• Re-scans afterwards, so the claim that a patch landed is verified rather than assumed.

What it produces

• Before and after report per device and per update.
• Patch compliance feeding straight into the control assessment.
• Failure reasons decoded, rather than a raw error code.

Needs: the agent. Works alongside your existing update infrastructure or without it.

What it does

• Measures real activity per user across desktop, mobile and browser rather than assigned-licence counts.
• Finds inactive seats, duplicate entitlements and users who only ever use the web client.
• Models the resize before you commit to it, then tracks the saving after renewal.

What it produces

• A costed resize proposal per licence type.
• A tenant health check covering assignment hygiene and orphaned accounts.
• A saving figure the board can see on the executive page.

Needs: read access to your Microsoft 365 tenant via Graph.

What it does

• Runs twelve checks on every client: service state, policy, inventory cycles, cache, certificate and management point contact.
• Decodes failed deployments into the actual cause rather than a status code.
• Repairs the common failures from the console, without a remote session or a desk visit.

What it produces

• An estate-wide client health percentage with the failing devices named.
• A remediation history per device.
• The AssureCM toolkit for the engineers who want to work at the command line.

Needs: an existing Configuration Manager site and the agent on the clients.

What it does

• Pulls device, compliance and app-install state from Graph on a schedule.
• Translates install and compliance failures into a cause and a next action.
• Offers a set of remediation scripts scoped so a first-line engineer can run them safely.

What it produces

• A decoded failure list rather than a dashboard of red tiles.
• Co-management visibility where devices are in both worlds.
• Remediation outcomes on the same audit trail as everything else.

Needs: Graph read access to your Intune tenant.

What it does

• Checks real-time protection, signature currency and tamper protection per device.
• Surfaces risky exclusions, including the broad path exclusions added years ago for an application that has since gone.
• Pulls Defender for Endpoint alerts alongside the estate picture where that licence exists.

What it produces

• Malware-protection evidence for the control assessment.
• An exclusion review list with the age of each entry.
• Devices unprotected today, named, rather than a percentage.

Needs: the agent. Defender for Endpoint alerts need the corresponding licence.

What it does

• Runs published automations through the agent, each pinned by SHA-256 so an altered script simply does not execute.
• Simulates first and shows what would change, before anything is committed.
• Targets a device, a collection or the whole estate, on approval.

What it produces

• Per-run results on the console with output captured.
• Repeatable fixes that stop being tribal knowledge in a script folder.
• A complete record of who ran what, where and when.

Needs: the agent. The catalogue grows without an agent rebuild.

What it does

• Captures flows at kernel level and aggregates by process, destination, port and protocol.
• Enriches destinations with country and flags the regions you care about.
• Drops private ranges and keeps metadata only. No payload, ever.

What it produces

• Top talkers by volume, and new destinations seen in the last 24 hours.
• Flagged-region activity with the owning process named.
• An early signal on software phoning home that nobody approved.
• Seven standard reports, from data leaving the network to unusual ports and flagged countries, for 24 hours, 7, 30 or 90 days, viewable, as CSV or as a PDF.

Needs: the agent, and opt-in per client.

What it does

• Runs in the user's own session, never as SYSTEM, across Edge, Chrome, Firefox, Brave, Vivaldi and Opera.
• Reports Span and Active time side by side, so a tab left open is not counted as four hours of work.
• Cannot be enabled for a client until an impact-assessment reference and notice acceptance are recorded. The database refuses, not just the button.

What it produces

• Category and site-level usage for licence and acceptable-use decisions.
• Evidence of the consent position alongside the data itself.
• Input to application rationalisation where a web app has quietly replaced a licensed desktop one.

Needs: the agent, a recorded impact assessment and notice acceptance, per client.

What it does

• Connects directly over your network. Nothing traverses a vendor relay.
• Prompts the user with a PIN and holds a red banner on screen for the whole session.
• Offers view, or view and control, as separate permissions.

What it produces

• An audit log entry per session: who, which device, how long, and which mode.
• A support path that does not add another agent to the build.

Needs: LAN or VPN reachability, pinned TLS 1.2 or above. Deployed by Intune or ConfigMgr like any other package.

What it does

• Maps which servers, services and databases each server application connects to, in both directions.
• Shows the dependencies between components, so a change or a migration starts from facts rather than memory.
• Lets you work through server and application dependencies one connection at a time.

What it produces

• An interactive dependency map of servers, services and the users behind them.
• A clear view of what would be affected before a server is changed or retired.
• Input to migration, decommissioning and network segmentation plans.

Needs: the agent on the servers in scope.

What it does

• Reads across modules, so an exposure, a drift finding and a broken client are one story rather than three tickets.
• Proposes the specific fix, names the module that will carry it out and estimates the blast radius.
• Waits for approval by default. Autonomy is granted per client, per action class.

What it produces

• A ranked queue of proposals with the reasoning attached.
• A plain-English weekly narrative of what mattered and what was done.
• An approval record on every autonomous action.

Needs: at least one collecting module. It gets better as more are enabled.

What it does

• Draws readiness, open exposure, licence position and rationalisation progress from live data, not a monthly export.
• Narrates the change since last month rather than only the current state.
• Redraws per client for service providers running more than one estate.

What it produces

• A page you can forward unchanged to the board.
• Branded exports for a customer service review.
• The one number the CIO opens first.

Needs: nothing of its own. It reflects whichever modules are on.

What it does

• Records the proposal, the approver, the action and the verified outcome for every change.
• Keeps overrides and the reasons given for them.
• Holds the snapshot history behind every compliance claim.

What it produces

• An evidence pack that is a download rather than a project.
• Full coverage of rationalisation, governance and remediation decisions.

Needs: nothing. It is on for every module, always.