Read-only security posture assessment

Anchor Your Security
WITH CONFIDENCE

13 control areas, 21 audit modules, zero write access. We read. We never change.

13 Control Areas

Built for MSPs

Read-Only by Design

For Internal Security & IT Teams

Deploy a read-only agent across your fleet. Get a continuous ANCHOR Grade for every device without touching a single endpoint configuration. Know your posture. Prove it to auditors.

Compliance Without Complexity

21 audit modules covering firewall rules, BitLocker status, patch levels, AV health, and more. One agent. One dashboard. One source of truth.

For MSPs Managing Multi-Tenant Fleets

See every client's compliance posture from a single pane. Deliver grade reports at QBRs. Prove remediation impact with before-and-after scoring.

Revenue from Compliance

Turn posture assessment into a billable service. Client-ready PDF reports, multi-org dashboards, and the same per-endpoint pricing across every client.

13 Security Control Areas

Every area assessed and graded. Hover any block to see exactly what we audit.

1 partial

Device Inventory

Local device details (hostname, serial, hardware, OS, network adapters). Agent self-reports installed asset. Does NOT include network-wide discovery or DHCP logging.

2 full

Software Inventory

Installed programs (MSI + registry), Windows Store apps, running services, startup programs, browser versions, .NET/Java/Office versions. Supports allowlisting comparison.

3 partial

Data Protection

BitLocker encryption status (TPM, drive encryption, key protectors), NTFS permissions on shares, removable media encryption. Does NOT cover data classification, data flows, or DLP deployment.

4 full

Secure Configuration

Windows Firewall profiles & rules, risky rule detection, session lock/screen saver settings, default account status, unnecessary services, DNS configuration, UAC settings, SMBv1/LLMNR/NetBIOS status, Remote Desktop configuration.

5 full

Account Management

Local user & admin account inventory, service accounts, admin group membership, default Administrator (SID-500) status, dormant account detection, password policy (complexity, age, lockout).

6 partial

Access Control

MFA status for external apps, remote access, and admin accounts via Entra ID Conditional Access policies. Local security policy audit (user rights assignments, logon restrictions). Domain join and Group Policy application status. Does NOT cover documented access granting/revoking processes or RBAC policy definitions.

7 full

Patch and Vulnerability Management

Windows Update service status, installed/pending updates (critical, security), days since last update, auto-update settings, WSUS configuration. Application patch status for known software.

8 full

Audit Logging

Event log configuration (max sizes, retention, overwrite policy), audit policy settings, PowerShell logging status, command-line auditing, Security/System/Application log status, NTP time synchronization.

9 partial

Email and Browser Protection

Installed browser versions and currency, browser extensions inventory, email client versions. Does NOT cover DNS filtering, DMARC, URL filtering, or email server protections.

10 full

Malware Defense

Windows Defender + third-party AV detection, real-time protection, signature age/version, behavior monitoring, scan history, autorun/autoplay settings, exploit protection (ASLR/DEP), Attack Surface Reduction rules.

11 partial

Backup and Recovery

Veeam Backup services, job status/success rates, last run times, repository health. Windows Backup status, System Restore status, VSS service. Does NOT verify isolated recovery instances or test recovery.

12 partial

Network Configuration

VPN connection status, secure protocol configuration (from endpoint), network adapter driver versions. Does NOT assess network device firmware, architecture, or AAA centralization.

13 partial

Network Monitoring

Host-based IDS/IPS agent presence, Windows Firewall logging, remote access settings, connection security rules. Does NOT cover network IDS/IPS, traffic flow logs, port-level access control, or SIEM centralization.

dashboard.dataanchor.io

CONTROL AREAS

1

2

3

4

5

6

7

8

9

10

11

12

13

ANCHOR GRADE

92 / 100

30-DAY TREND

Continuous compliance in one view.

Built on 5 Principles

01

Read-Only by Design

Our agent collects data without modifying a single setting, file, or registry key on your endpoints.

02

13 Control Areas

Every audit module maps to one of 13 security control areas, so findings roll up into a posture you can act on and report.

03

Built for MSPs

Multi-tenant from day one. Manage dozens of client organizations from a single dashboard.

04

Client-Ready Reports

Generate pixel-art grade reports your clients understand — no security jargon, just clear posture scores.

05

Continuous Assessment

Agents report on a recurring schedule so you always have a current view of compliance posture.

Ready to anchor your security?

Deploy in minutes. See your first compliance grade today.

Start Free Trial Request Demo

Anchor Your Security WITH CONFIDENCE

For Internal Security & IT Teams

Compliance Without Complexity

For MSPs Managing Multi-Tenant Fleets

Revenue from Compliance

13 Security Control Areas

Built on 5 Principles

Read-Only by Design

13 Control Areas

Built for MSPs

Client-Ready Reports

Continuous Assessment

Ready to anchor your security?

Anchor Your Security
WITH CONFIDENCE