Deploy once and the SBCMSP Agent reports continuously — per-host scoring, public-IP exposure scanning and identity fingerprints for auto-enrollment.
Every endpoint gets its own internal score and trend.
25 port checks on the public IP each agent reports from.
Zero-touch auto-enrollment for new devices.
Force-rotate, move or revoke any agent.
The SBCMSP Agent is the product and deployment layer for internal monitoring — you ship one installer, fingerprint-driven auto-enrollment brings the host online, and every agent rolls up to the same per-host scoring, token rotation, and fleet view.
The deepest coverage — 324 internal checks across 18 core + 16 advanced modules on Windows endpoints and servers. See the Windows Internal Agent for the full module list.
The same agent ships for Linux and macOS, running cross-platform internal scanning — per-host scoring and public-IP exposure — so mixed fleets report through one console.
Identity fingerprints match new hosts to the right client automatically — no per-machine codes to distribute or manage.
Windows, Linux and macOS all run internal compliance checks — not just a per-host score — share one report shape, and every platform supports zero-touch fingerprint auto-enrollment.
The deepest coverage — workstation and server hardening, Active Directory, patch/CVE, encryption, backup, services and registry. See the Windows Internal Agent for the full module list.
SSH and access control, firewall state, sudo and SUID exposure, disk encryption, brute-force detection and patch posture — the same finding stream as every other host.
Disk encryption, firewall, software-update posture and access controls — cross-platform internal scanning so a Mac in the fleet reports through the same console as everything else.
Run the agent on a domain controller and it walks the same routes an attacker would after a single foothold — the internal identity weaknesses no outside-in scan can ever reach.
Detects enrollee-supplied-subject and permissive-EKU certificate templates — the ESC1, ESC2/ESC3 and ESC6 escalations where any authenticated user can mint a certificate for a Domain Admin and take the whole domain.
Flags service accounts carrying SPNs with non-expiring passwords, plus accounts with Kerberos pre-authentication disabled — both crackable offline into valid domain credentials.
Surfaces a stale KRBTGT password that leaves golden-ticket forgery possible even after incident response — the persistence backdoor most audits miss entirely.
The agent inventories the third-party software on every host. The platform matches each product and version against the National Vulnerability Database and raises a finding for what is actually exploitable — not a raw patch list.
Every endpoint reports the third-party software and versions it actually has installed — not just the OS build number.
Each product and version is looked up against the National Vulnerability Database, then aggregated per host — total CVEs, highest CVSS and a breakdown by severity.
Results land as SOFT-* findings in the same Findings and Assignments workflow, ordered by KEV / EPSS so you fix the software attackers are exploiting first.
Point one agent at a site and it maps the internal network — every live device on the LAN, not just the single public IP the site reports from.
Discovers live hosts across every local subnet using an ARP sweep and a targeted port probe — one agent per site, multiple internal ranges supported.
Each device is classified by its open ports and hardware vendor — servers, printers, cameras, VoIP handsets and network gear — into a Discovered Devices table.
Unmanaged and unexpected hosts on the LAN show up alongside the endpoints you already monitor — the inventory gap that lets attackers hide in plain sight.
The agent ships as a Universal Connector — one signed binary per tenant, identical on every host. Fingerprint auto-enrollment brings each machine online and the whole token lifecycle is managed from the console.
A single signed installer per tenant — the same identical binary on every machine, so there are no per-host builds to track or verify.
Identity fingerprints match each new host to the right client automatically. Nothing to type on the machine, and no per-machine enrollment codes to distribute or manage.
Tokens carry a default TTL and rotate themselves before expiry with a grace window — watch the EXPIRES pill turn amber and it is already rotating. Force-rotate, move or revoke any agent from the console at any time.
The underlying agent keeps itself current — no manual redeploys, no version drift across the fleet. New checks reach every host on the next run with no operator action required.
SBCMSP Agent is one piece of SBCMSP’s unified loop — every finding is prioritized by real-world risk, paired with AI remediation guidance, mapped to your frameworks and re-verified on the next scan.
Continuously scan every client’s internet-facing attack surface: TLS, DNS, email authentication, exp…
Learn moreSubdomain discovery, shadow-IT detection, third-party exposure mapping and a live port inventory — t…
Learn moreA lightweight Windows agent runs 324 internal checks across 18 core + 16 advanced modules: BitLocker, patching, local a…
Learn moreSee a client’s real posture in minutes — then unlock all 1,658 checks.