5Rs rationalisation engine
Every product in your estate gets a per-app, per-version recommendation: Retain, Reduce, Replace, Remove or Replatform. Driven by real usage telemetry, vulnerability exposure and category. Manual override at any level.
Unified ITAM, MDM and agent inventory. KEV-aware risk register. 5Rs rationalisation. Everything you need to run continuous CE+ instead of an annual scramble.
Every product in your estate gets a per-app, per-version recommendation: Retain, Reduce, Replace, Remove or Replatform. Driven by real usage telemetry, vulnerability exposure and category. Manual override at any level.
NIST NVD plus CISA Known Exploited Vulnerabilities catalogues overlaid on your live estate. SLA clock starts the moment a KEV match is found. Automated alerts on breaches.
Sam360 ITAM, Microsoft Intune MDM and our lightweight Windows agent feeding the same normalised view. AppNameAliases regex resolver handles the messy real-world product names from each source.
One-click PDF export of executive summary, top-20 risk register and rationalisation plan. Mapped to CE+ Annex A controls. Send to auditors and board members without rebuilding the deck.
Four pieces. One data model. Designed so each layer can be swapped without rebuilding the others.
Three feeds keep the estate view live:
An AppNameAliases regex resolver maps each raw product name from each source to a canonical AppId. So "Microsoft Edge", "Microsoft Edge Update" and "Edge GameAssist" don't all get treated as the same product. Categorisation maps to a 42-class canonical taxonomy (browsers, runtimes, BIM tools, antivirus, etc.).
Every 4 hours the platform pulls the latest CVE records from NIST NVD and CISA's KEV catalogue, matches them against your estate's CPE strings, and computes exposures. A high-confidence filter excludes major-only version matches by default so the risk register only shows actionable rows.
The 5Rs engine ranks every catalogued product by usage and exposure. Your IT team sees per-app and per-version action plans. Manual overrides are recorded with reviewer, date and notes. Decisions flow back into the rationalisation reports.
Pre-built connectors. Add a credential, accept the consent, see your estate populate within hours.
OAuth app registration in your tenant. Pulls device inventory, compliance state and published-app catalogue.
Tenant credentials. Nightly device + installed-app snapshot. Brings your historical ITAM dataset along.
MSI-deployed via your existing SCCM, Intune or GPO. HMAC-signed reporting on a configurable interval.
For asset registers and licence schedules. Validated against the same normalisation pipeline.
Authoritative vulnerability sources. Refreshed every 4 hours. No work for you.
Programmatic access to the risk register, applications and exposures. JSON, HMAC-authenticated.
Free 30-day pilot · UK-based onboarding · No procurement friction