A single canonical device
A device seen in several platforms is reconciled into one record, so counts and coverage reflect reality rather than double-counting. One finding per device, however many records the products keep for it.
AthonisOne module 03 of 08
Endpoint Compliance
One device picture, however many agents you run.
Endpoint tooling is rarely uniform, and it changes. This module reads every platform you run, reconciles the same machine across all of them into one record, and shows onboarding, protection health and coverage against what the directory says you own.
What it answers
The questions this module exists for.
- 01 How many managed devices do we actually have, once duplicates are reconciled?
- 02 Which devices aren't onboarded or aren't healthy?
- 03 Are there machines the directory knows about that endpoint protection doesn't?
- 04 How is our endpoint compliance trending?
What it checks
In detail.
Onboarding, protection health and coverage
Assessed across every connected platform, on the same recent check-in window for every vendor — so a laptop that was simply offline at sync time is not reported as unprotected.
Cross-domain gap detection
The machine the directory knows about and no protection platform reports. This is the check that only exists because the modules share one dataset.
End-of-life operating systems
Windows 10 and Windows 11 releases past their end of servicing are reported as end-of-life; supported long-term-servicing editions are not.
Typed findings
Each with the evidence behind it, not just a severity label.
Finding Wiki
A built-in explainer on every finding — what it is, why it matters, what to do.
A posture score
Rolled up from the findings and trended over time.
Compliance evidence
Findings mapped to the framework controls they evidence.
How it judges
Where it refuses to over-claim.
A check that guesses produces false findings, and false findings teach a team to ignore the real ones. These are the places this module holds back.
- Built around what a platform can report, not around a vendor's name. Each platform declares the capabilities it can actually provide, and checks bind to those — so running two platforms side by side, migrating between them, or not running a category at all needs no reconfiguration and never distorts the score.
- Where no connected platform can report on something, it reads not measured. The estate is never scored as clean on a fact nobody collected.
- Cluster names, availability-group listeners, managed service accounts and appliance accounts are not treated as machines missing protection — no agent can run on them.
- Local-administrator findings come only from hosts whose collector reported recently; when none has, the check reads not measured rather than restating old results.
What it reads
Connected to what you already run.
- Microsoft Defender for EndpointManaged devices, onboarding state and health
- Microsoft IntuneManaged-device inventory and compliance state
- Kaspersky Security CenterManaged endpoints, protection status and health
- CrowdStrike FalconEndpoints, sensor state and device risk signals
- Trend Micro Vision OneManaged endpoints and agent health
What it never does
The boundary, stated plainly.
- Never installs anything on a device. There is no AthonisOne agent — it reads the platforms that already have one.
Findings from this module evidence the endpoint-protection, asset-management and coverage control areas of every activated framework.
Works with
One dataset, so the modules answer each other.
See what Endpoint Compliance would say about your estate.
Licensed on its own, and on the same platform as every other module. We'll show you the answer — and what it would say it couldn't measure.