Made for your console. Written for your client's QBR.
Four views from the MSP console. Everything below is sample data and labeled that way.
Accounting · 17 seats91Secure
Real estate · 22 seats74Needs work
Dental · 31 seats62Needs work
Legal · 29 seats48At risk
The one measured knockout. Registered is not the same as required.
Old mail protocols skip the second step, so password spraying goes there first.
Phone numbers can be hijacked. Authenticator apps and security keys are much harder to steal.
Two admins had never registered for MFA, and the Conditional Access policy meant to enforce it was in report-only mode. That looks fine on a screenshot and enforces nothing.
Both admins registered and the policy was switched to enforced, which clears the MFA knockout. Privileged access is still partial: eleven standing Global Admins is too many.
It was created during an onboarding four days earlier. Comparing the signed records caught it that week instead of at the next quarterly review. MFA is a knockout, so one unprotected admin puts the tenant back at risk.
The account was put under policy and standing admins were cut to four. Every step stays in the chain, so the client can see the year of maintenance.
What's in the platform.
Fleet posture
Your whole book on one screen, every tenant scored and ranked by risk.
Remediation simulator
Toggle a fix and see the score and status change, so you know which change to recommend.
White-label reports
Your company name and colors on the console and the report. Your client never sees our name. Logo upload and custom domains are planned.
Chained attestations
Each scan links to the one before it. Anyone can check the chain, and nobody can edit it without breaking it, including us.
Drift detection
Designed, not built yet. It will compare signed results to catch changes like a new admin without MFA.
Ephemeral engine
Collection, scoring and disposal happen in a single call. Raw data is never written to storage.
Delegated access
Runs on the delegated admin access you already have. Nothing to install, and your client can revoke it any time.
Verified or labeled
Each control is pass, partial, fail, or "not verified by this scan." The code has no way to make up a status.
Client-ready output
Each scan exports a report your client keeps, so your security line item has something behind it at renewal.
All nineteen controls, weight by weight.
Published in full, including the eleven we can't verify yet. A knockout caps the grade on its own. A control the scan couldn't reach counts as a coverage gap, not a failure. The catalog version is stamped on every attestation, so old results stay readable after the catalog changes.
Verification, source by source.
We add sources one at a time. Until a source is connected, its controls say "not verified".
See it on your own book.
We're working with a small group of MSPs before wider release. A founder reads every message.
Request early access