Since the summer release, Assure has gained the controls that sit between knowing about a risk and closing it: blocking what should not run, seeing what changed on a device or a server, and seeing what leaves the network. Every one of them runs from the same outbound-only agent, lands in the same audit trail and is switched on per client.
Live on the production platform now.
Unapproved applications blocked by Windows itself, through App Control for Business. Every rule starts in audit and shows what it would block, and is enforced only when an admin confirms it. Copies already installed show as Prohibited in the Risk Register. Live since 4 October 2026.
A daily snapshot of 48 Cyber Essentials Plus mapped settings on every device, diffed on the server, so the change that would have failed you at assessment is a finding the next morning. Detection only, with a drift feed, fix-by dates and a PDF report. Live since 4 October 2026.
Dated snapshots of every Windows Server: apps, firewall rules, ports, accounts, shares, certificates, updates, services, tasks, IIS and SQL Server. See any server as it was on any day, compare two dates, and export the report. Secrets are redacted on the server itself. Live since 4 October 2026.
What each device sends to the internet, by process, destination, port and country, every 15 minutes. Metadata only. New on 6 October: seven standard reports, from data leaving the network to unusual ports and flagged countries, for 24 hours, 7, 30 or 90 days, as CSV or PDF. Live since 5 October 2026.
Which sites the business runs on, with Span and Active time always shown together. It runs in the user's own session in six browsers, and cannot be switched on for a client until a DPIA reference and the staff notice are recorded. Live since 5 October 2026.
On our development estate now, and next to reach production.
The July release widened Assure from the packaging and risk core into cloud licences, endpoint protection and Cyber Essentials Plus readiness.
Grouped the way the console was then: Cyber Essentials Plus Pre-Assessment, cloud, security and health checks.
Score any client against the five Cyber Essentials Plus controls, mapped to the certification test cases. Automated checks and agent probes rate every device, surface exactly what fails, and build an action plan and a compliance journey that tracks the firewall changes, upgrades and CVEs cleared on the way to a pass.
Cloud-side SAM through Microsoft Graph: per-user activity and which platforms - desktop, mobile, web - each person actually uses. Finds inactive licences, duplicate/overlapping licences, unused seats, and desktop licences used only on web or mobile - every finding costed in pounds. Reuses your Intune connection, read-only.
Microsoft Defender and anti-malware health from the device agents - protection state, real-time scanning, signature age, tamper protection and risky exclusions, scored per device with no cloud connection required. Connect Defender for Endpoint to add alerts, incidents and exposure.
Drill into any single machine: installed apps with the minutes they're actually used, zombie-app categorisation and licence-reclaim potential. Spot the software nobody opens and the seats you're paying for twice, device by device.
An agent that reviews the estate and proposes the next fixes - patch this, remove that, reclaim these seats - as reviewable recommendations with the evidence behind them. Autonomy tiers and a kill switch keep you in control: it suggests, you approve.
A curated library of maintenance, diagnostics and patching actions you can run on any managed device, from the console, without a single inbound connection to the client network.
New Integrations area connects APaaS Assure directly to the tools UK estates actually run on.
Connect with a per-tenant app registration and pull managed devices and detected applications straight from Microsoft Graph. Test the connection in one click, sync on demand, and watch new software land in your estate view minutes later. Credentials are encrypted at rest and write-only.
Upload an installed-software report from the SCCM console and we aggregate per-device rows into your estate automatically - flexible column handling included. Site configuration is stored ready for the APaaS on-prem gateway, so live pull arrives without re-onboarding.
Drag and drop Intune exports, SCCM reports, Tenable exports or generic ITAM lists - the format is auto-detected, previewed, and imported with full audit history. Re-uploads are always safe: the newest data wins, nothing is double-counted.
The dashboard has been rebuilt around the question every IT leader asks first: what changed, and what should we do about it?
RMM tools run scripts but don't know your risk. Vulnerability scanners know your risk but can't fix anything. ITAM suites know your licences but neither. APaaS Assure now does all four jobs in one console: unified inventory from agent, Intune, SCCM and ITAM sources · KEV-aware risk with SLA clocks · 5Rs licence rationalisation · and curated, integrity-pinned remote remediation - built in the UK, for UK Cyber Essentials Plus estates.
UK-based onboarding · No procurement friction
