Complete device visibility. From BIOS to browser extension.
The Secuno agent collects a device inventory every hour, with a full sweep every night, and a security heartbeat every 5 minutes. Then it answers the question inventory alone cannot: of everything on this device, what can an attacker actually reach?
Every layer of the endpoint, captured
The Secuno agent reads directly from the Windows registry, SMBIOS, WMI, and the Component Based Servicing stack, not via surface-level API queries. The result is a device picture no network scanner can produce.
OS identity & hardware baseline
OS name with accurate Windows 11 detection, build number, UBR revision, patch level, CPU architecture, IP and MAC. Hardware via SMBIOS: manufacturer, model, serial number, BIOS version, uptime, and last boot time.
Full software & patch inventory
Every installed application from all three Windows registry hives: 64-bit, 32-bit, and user-specific. Name, version, publisher, install date, architecture, and path. All KB articles with installation status read from the Component Based Servicing stack. Deduplicated by name, version, and publisher.
Security posture: AV, BitLocker, Firewall, Defender
Antivirus name, enabled state, and definition currency. BitLocker encryption method and conversion status per drive (XTS-AES-128/256). Windows Firewall state per network profile. Eight granular Windows Defender sub-protection states (realtime, behaviour, script scan, cloud protection, network IPS, and more) tracked individually and mapped to risk severity. Tamper protection state tracked; disabling it automatically opens a risk. Quick and full scan age collected and fed into the device compliance score.
Network adapters, open ports & processes
All IPv4 and IPv6 adapters with connection state and loopback detection. Open TCP and UDP ports with protocol, address, port number, PID, and process name. Full process list with PID, parent PID, and thread count via direct system enumeration.
Browser extensions: 6 browsers
Chrome, Edge, Brave, Vivaldi, Opera, and Firefox, read per user and profile. Extension ID, name including translated variants, version, and description. Risky or unknown extensions are visible immediately without any manual review.
Change detection across 8 dimensions
Every inventory cycle is compared against the prior measurement across software, KB patches, browser extensions, open ports, AV state, BitLocker, Firewall, and system identity. Every change is reported with old and new value and a precise timestamp.
An open port is not an exposure until something can reach it
Asking whether a device listens on an alarming port number cannot tell a service bound to loopback apart from one hanging off the internet. Secuno asks three separable questions instead, and the answers multiply rather than pile up.
Which way does the attack come in?
The attack path is derived from the CVSS vector, not the score. A network RCE against a listening service and a browser bug that needs a user to click are both nominally “network” and are nothing alike. A CVE that carries no vector string is recorded as unknown rather than assumed.
Can an attacker actually reach it?
A reachability tier from 0 to 4 is built from socket bind addresses, firewall profile state, inbound-allow rules, adapter addressing and the client's documented perimeter firewall. Tier confidence is tracked separately, so a device that has not checked in for six weeks is not scored as though its port list were current.
Do the controls block that path?
A control only counts against the vector it actually blocks. Disk encryption stops a stolen laptop and does nothing for a network RCE. Exposure and controls are multiplicative rather than additive, so a fully hardened host can no longer outrank a bare one.
Which device drives the score?
When one vulnerability affects many devices, the worst affected device sets the score. Previously the same CVE could score differently depending on which device happened to be first in the list.
A documented perimeter, not an aspiration
Inbound filtering, segmentation and egress control are things an endpoint agent structurally cannot observe. Each client documents its firewall in a thirty-question questionnaire an operator can actually answer and someone else can audit, and the scoring axes are derived from the answers, each shown with the sentence it came from, rather than asked outright. The result caps the tier for every device behind it, and a record nobody has checked against the running configuration is discounted where that changes the answer.
The evidence, not just the number
Each device stores its tier and the assessment behind it, so the list sorts and filters on exposure directly, and a risk can still show the evidence its score was built from after the device has since changed.
What a client's websites show the internet
The agent sees a device from the inside. Web Exposure checks each client's published websites from the outside, within a deliberately narrow boundary, and turns what it finds into evidenced findings, a grade from A to F and scored risks in the same register.
Every exposure becomes a scored, owner-assigned risk
Every data point collected here flows automatically into CVE correlation and risk scoring. The full correlation engine, scoring, and remediation workflow live on the Vulnerability Management page; the AI and infrastructure model lives on the Security page.
Operational control over every agent
Deploy, quarantine, revoke, and monitor agents across your entire client portfolio from a single interface. No endpoint access required for fleet management.
Enrollment tokens
Create tokens with label, expiry date, and maximum use count. Shown once in the UI and never retrievable again. Only the hashed value is stored server-side. Prevents unauthorised agent registration without any agent-side configuration.
Quarantine & revocation
Place individual devices in quarantine, lift it, or permanently revoke them from the device overview. Direct operational control over your agent fleet without touching the endpoint itself.
Offline queue, no data loss
Up to 1,000 events are stored locally on the device when the agent loses connectivity. Sent in sequence upon reconnection. Inventory continuity is maintained through temporary network outages without operator intervention.
Configurable offline alerting
Agents that stop reporting trigger a notification after a configurable threshold: default 20 minutes, adjustable per partner environment from Partner Settings. Fires once per silence period, not on every check cycle.
Full device visibility across your entire client portfolio
We walk you through agent deployment, CVE correlation, and risk workflow live, in a demo environment matched to your portfolio size.