One instance. Every client. Every layer.
Seven modules on a single deployment: inventory, correlation, response, tickets and reporting. Tenant isolation is enforced by the database itself, not just by application code, so a partner runs a portfolio of clients without a copy of the infrastructure for each one.
From endpoint to tenant boundary, in one path
There is no integration layer in the middle and no second system to reconcile against. What the agent collects is what the engine correlates, and what the engine scores is what the report prints.
- 01Endpoint
Windows and Linux agent
- Ed25519-signed rule sets
- DPAPI key storage on Windows
- SHA3-256 hashing
- TLS 1.3 transport
- 02Uplink
Collector
- Inventory every hour
- Heartbeat every 5 minutes
- Urgent uplink on detection
- A channel per priority
- 03Core
Correlation engine
- CPE-first version matching
- 350,000+ known CVEs
- EPSS and KEV prioritisation
- Risk scoring on private AI
- 04Boundary
Tenant boundary
- Isolation enforced by the database
- 7 roles across 3 tiers
- Risk, ticket and report
- Audit trail with geolocation
// one path, four stages, all of it inside our own infrastructure in the Netherlands
A scored risk with an owner, a ticket in the same workflow, and a report drawn from the same data model as the risk you closed.
No analyst mapping a feed by hand. No professional services project per client. No second tool for the work the first one produced.
Every stage runs on our own infrastructure in the Netherlands. Client data does not cross that boundary.
From manual triage to automatic remediation
Hours spent cross-referencing CVE feeds against installed software manually.
Every installed version is matched automatically against 350,000+ CVEs. CVE sources sync throughout the day, device inventory runs every hour, and correlation runs on each inventory. Risks appear with owner, due date, and remediation steps.
Patch tickets closed and forgotten, with no verification that the fix held.
Every remediated risk is re-checked on the next inventory. If the software is still present, the risk reopens automatically before anyone notices.
Board reports assembled in spreadsheets the night before the presentation.
Seven report types in one click. Branded PDF, CSV, or JSON. Scheduled delivery. Audit trail included.
Seven modules, one deployment
Each module reads and writes the same data model, so a risk becomes a ticket becomes a report without an export in between. Pick a module to see what it does.
Vulnerability Management
The correlation engine matches every installed version against known CVEs from CVE.org, NIST NVD, the GitHub Advisory Database and the Linux distributions' own advisories, enriches each result with KEV and EPSS, and opens a scored risk with an owner.
- CPE-first correlation on every inventory
- EPSS and KEV prioritisation
- Automatic ticket creation with owner and due date
- Reopens automatically if the fix does not hold
Exposure Management
Externally visible risk is tied back to real internal assets, so an open port does not sit as a loose finding but enters the queue as a device with an owner. Web Exposure adds the outside-in view: what any browser sees on the sites a client publishes.
- Listening ports correlated per device
- Blast radius across the portfolio
- Firewall profiles and Defender exclusions surfaced
- Configuration drift ranked per client
- Web Exposure: certificates, TLS and headers graded A to F per site
Detection & Response
Signals from the signed agent are assembled into an attack story: one incident with a verdict, a timeline and the recommended action. Containment runs from its case: isolate the device, kill the process or its whole tree, quarantine the file.
- Attack stories that tell the technician what to do next
- Process ancestry as a chain, not isolated executions
- MITRE ATT&CK techniques on the finding
- Case age, time to acknowledge and SLA breach
- Cross-client IOC blocks across the fleet
Multi-Tenant Management
Global Admin to Partner Admin to Client, with seven roles and isolation enforced by the database itself. A new client is live in minutes, without a professional services project.
- 7 distinct roles across 3 tiers
- Isolation enforced by the database, not just the application
- Partners manage portfolios in full isolation
- One deployment, no infrastructure per client
Ticketing & Helpdesk
Every risk lands as a ticket in the same workflow, with internal notes, attachments and a knowledge base on three visibility levels. No second tool for the work the first one produced.
- Status flow: Assigned, In Progress, Waiting, Completed
- Internal notes and attachments
- 10 closure reasons
- Knowledge base with 3 visibility levels
Reporting & Audit
Seven report types in your own house style, with an audit trail underneath. The report you hand your client comes out of the same data model as the risk you closed.
- Risk Summary, Vulnerability, Compliance, Executive, Period Comparison, Microsoft 365 Posture, Custom
- PDF (branded), CSV, JSON
- Full audit trail with geolocation
- Scheduled delivery per client
Custom Risk Rules
Your own rules with AND/OR clauses that stay report-only until you promote them. You see the matches before a single risk is created.
- AND/OR logic across multiple clauses
- Dry-run preview of the matches
- Escalation when a risk stays unresolved
- Remediation notes per rule
// one platform price; M365 ITDR and threat intel are optional modules
One instance. Your entire client portfolio.
Your entire client portfolio managed through a single Secuno instance, each client with strict database-level isolation. Global Admin sees all. Partners see their own portfolio. Clients see only their own data.
- Three-tier hierarchy: Global Admin, Partner, Client, each scoped at database level
- Portfolio Intelligence: real-time risk distribution and CVE blast radius across all clients
- A client-by-CVE matrix: how many devices each client still has unpatched, ranked by exposure
- One deployment. No per-client infrastructure.
What the agent collects, and what it refuses to do
A Windows service agent, with a Linux agent at near-parity, takes an inventory every hour, a full sweep every night and a heartbeat every five minutes. A finding that cannot wait for the next cycle goes out immediately on its own channel. Everything it accepts back is signed.
- 01OS and hardware info
- 02Network adapters
- 03Active Directory / Entra ID
- 04Installed software
- 05KB patches
- 06Browser extensions
- 07Antivirus status
- 08BitLocker / encryption
- 09Firewall profiles
- 10Listening ports
- 11Running processes
- 12Active sessions
- 13Local user accounts
- 14Local groups
- 15Shared folders
- 16Defender exclusions
- 17Startup programs
- 18Scheduled tasks
- 19Hardware (BIOS / serial)
- 20Change tracking
- 21Process ancestry
- 22Event log signals
- 23DNS queries
- 24File drops
- Every hour
- Inventory of the datatypes above
- Daily at 03:00
- Full sweep of every datatype
- Every 5 minutes
- Heartbeat, active sessions and security scan
- Every 30 seconds
- Command poll: a response order is picked up within half a minute
- On detection
- Urgent uplink: findings that cannot wait for a cycle
- Signing
- Ed25519
- Key storage
- DPAPI
- Hashing
- SHA3-256
- Transport
- TLS 1.3
Urgent uplink
A finding that must not wait for the next cycle goes out the moment it fires, on its own channel, rather than riding the heartbeat.
Process ancestry
Process events are recorded as a chain of parents and children, not as isolated executions. That is what makes attribution possible further down the line.
Signed rule sets
Local detection rules are Ed25519-signed and verification is fail-closed. A build with no key compiled in accepts no rule set at all, because an unsigned rule path would be a remote-execution channel into every agent.
Per-tenant policy
Behaviour is distributed per client instead of compiled into the binary, so a policy change does not need a new agent release.
Report-only mode
During onboarding the agent records what it would have done without doing it, so you can see what would have been blocked before anything is.
Cross-client IOC blocks
An indicator seen at one client is blocked at every other client on the next heartbeat. Blocks lift when the campaign resolves, and a hit on most of the fleet at once is held for the partner to decide rather than lifted automatically.
Three tiers, seven roles, one query boundary
Isolation is not a filter applied to the response. It is enforced by the database itself, underneath the application's own checks: a query that forgets its tenant filter returns nothing, so a client cannot see another client's devices, risks or tickets, including under error conditions.
Platform tier, full visibility
Operates the platform itself and every client in it.
- Global Admin
- Admin
- Secuno Admin
Partner tier, scoped to its own portfolio
An MSSP managing its own book of clients, with no visibility into another partner's portfolio.
- Partner Admin
- Partner User
Client tier, own organisation only
Scoped to its own organisation data. Devices, risks and tickets belonging to other clients are never visible.
- Client Super User
- Client User
// strict database isolation on every query
How that isolation was proven before it went live, along with single sign-on, security keys, session handling, account lockout and the response security headers, is documented in full on the security page.
Read the security architectureSee the full platform live in action
We walk you through agent rollout, CVE correlation, risk scoring and board reporting, tailored to your client portfolio.