Set it once. Secuno keeps it that way.
Configuration profiles that put a setting back when it drifts, monitors that fix what breaks, software that stays installed and BitLocker keys you can find when you need them. For every client, from one section, next to the risks those settings remove.
The fleet at a glance, client by client.
The Devices section covers every client you can reach, with a client filter that follows you through it. The overview has one row per client, worst first, so the question "where do I start today" has an answer.
What each row tells you
Compliance with your profiles, reporting devices and agent coverage, failing and conflicting settings, open and critical alerts, app installs that failed or wait, and how many devices have their keys escrowed. Totals and the worst settings across clients sit above it.
Aim once, reach the right devices
Profiles, monitors and software target chosen clients, every client of a partner (including clients added later) or the whole platform. Inside a client: all devices, a group, tags or named devices, with exclusions by tag or device.
Built for teams that share clients
Someone who reaches only some of a rule's clients sees it read-only, with the other clients counted but not named. Nobody edits what they cannot fully see.
Settings that stay set.
A profile is a set of settings from a fixed catalogue. The agent applies them, checks them every 15 minutes and puts them back when something changed them. You see per device whether each setting holds, and which profile it came from.
- Start from a baseline for Windows workstations, Windows servers or Linux servers, and see how many devices a profile reaches per client before you save it
- Report mode only checks: use it before you enforce anything that could lock people out
- Where two profiles set the same setting, the lowest priority number wins, and a group profile beats a client-wide one on a tie
- Settings that need a restart read pending until the device has restarted
- Removing a setting from a profile leaves the device as it is: nothing is reverted behind your back
- A device where an enforced setting fails gets one risk, resolved on its own once nothing fails
Secuno never fights another tool.
Most clients already have a GPO, an MDM or a previous admin's script. A management tool that overwrites them every 15 minutes causes more incidents than it prevents, so Secuno steps back instead.
Managed elsewhere
A setting a Group Policy or MDM policy owns reads managed elsewhere and is not written. This is judged per ASR rule, per sysctl file and per SSH drop-in, not for a whole area at once.
Conflict, not a tug of war
A setting that something changes back three times in a day reads conflict and is left alone until the profile changes. Routine work such as signature updates and scheduled rotation never counts as drift.
Guard rails on the device
A default inbound block never loosens a profile that already blocks outbound. Turning SMBv1 off keeps the SMB client starting after the restart. Accounts read not applicable on a domain controller, and the agent refuses to disable drivers, system services or anything it depends on itself.
A bad setting meets ten devices, not ten thousand.
Every change to a profile is a new version that moves through stages, each held for a soak time. A gate checks every five minutes and stops the rollout the moment the change starts doing harm.
Pause, resume, advance or publish now when you are sure. Abort sends the published values again as a new version. The console shows each stage, the gate's numbers and every version with what changed. New profiles are staged by default.
The finding and the fix in the same place.
Secuno already tells you what is wrong. Device management closes the loop: the setting that fixes it is one click away, aimed at exactly the devices that fail.
Fix with a profile
A failing CIS check, a failing compliance control or a vulnerability with a vendor workaround opens a new profile filled with the settings that make it pass, aimed at the failing devices.
Evidence that names its source
A compliance control names the profile that enforces it, with the devices that comply and since when. Only a value that passes counts: a 60-minute screen lock is no evidence for a 15-minute rule.
Workarounds that stay applied
Eight of the built-in vendor workarounds can be enforced by a profile with drift correction. A risk then names the devices where a profile already covers it.
Monitors that fix what they find.
The agent samples every minute over the monitor's duration, so a brief spike is not an alert. A breach opens one alert and, if you want, one ticket. When it recovers, Secuno notes it and closes a ticket nobody touched.
Self-healing
A monitor can run an approved script when it breaches, at most three times a day per device by default. The ticket waits 30 minutes: if the script fixed it, the alert is marked self-healed and never becomes a ticket. If the script failed, the ticket opens at once with its output.
Quiet during planned work
A breach that starts during a mute, the client's maintenance window or the first 15 minutes after a restart opens nothing unless it outlasts them. Mutes cover a client or chosen devices, all monitors or one, with a reason, for up to 30 days.
Wired into automation
Breached and recovered are automation triggers, and monitor figures (mean time to recover, self-healed alerts, checks in breach) can go on your own dashboards, with a ready-made Device monitoring template.
The right software, kept that way.
Mark an app required and it stays installed. Installs run through the same queue as patches, inside the maintenance window, with three attempts per device.
Required, one-time or available
Required apps are put back if someone removes them. One-time apps are installed once. Available apps are offered on the device page for one-click install. Push app installs on chosen devices now, also across clients.
Windows and Linux, from trusted sources
winget on Windows, searchable from the console with how many of your devices have each result. On Linux apt, dnf, zypper, flatpak or snap, only from the host's own repositories and after a dry run that refuses any removal. Install an exact version and hold devices at it.
Your own packages, checked twice
Upload MSI, EXE, DEB or RPM packages up to 500 MB. Someone other than the uploader approves them. The agent downloads through a short-lived link valid only for that install, checks the hash before it runs and checks the result afterwards.
The recovery key is there when the laptop is not.
BitLocker recovery keys and local admin passwords are stored encrypted, bound to their client and device. The order of operations is designed so a failure can never leave a device locked with no key on record.
- BitLocker is turned on only after its recovery password was escrowed. Secuno never decrypts a drive or interrupts one that is decrypting
- The managed local admin account is created and its password rotated by the agent, which escrows the new password before it sets it. A failed upload changes nothing
- Revealing a key or password asks for a reason, is audited and notifies the client's super users and the partner's admins
- A revealed secret is rotated eight hours later. Rotate now does it at once
- The Secrets view lists what is escrowed across all your clients
What MSPs ask first.
Does this replace Intune or Group Policy?
It does not have to. Where a GPO or MDM policy already owns a setting, Secuno reports it as managed elsewhere and does not write it. Use Secuno profiles for clients without Intune and for the hardening settings your MDM does not cover, and see compliance for all of them in one place.
Can a profile lock people out?
That is what report mode, the pilot stage and the halt gate are for. Report mode checks without changing anything. A staged rollout reaches your pilot devices first and stops automatically when more than 5% of devices fail a changed setting or go silent.
What happens when I remove a setting from a profile?
Nothing on the device. Secuno stops enforcing it and leaves the current value in place. Reverting settings automatically is not part of this version.
Which platforms are covered?
Windows and Linux. macOS is not supported. On Linux, enabling a host firewall and escrowing LUKS keys are not part of this version; the host firewall is checked, not written.
Where are the BitLocker keys kept?
Encrypted on the Secuno platform in the EU, each key bound to its client, device and volume. Every reveal is audited, notifies the client's and partner's admins, and leads to a rotation eight hours later.
What does it need on the device?
The Secuno agent you already run: Windows agent 0.63 or Linux agent 0.55 and later. No second agent and no separate MDM enrolment. A device on an older agent keeps its protection but is not managed until its agent is updated.
Manage the devices you already protect.
One agent, one console, one place where a finding turns into the setting that fixes it. We will show it on a fleet like yours.