One agent on every endpoint.
One platform on your servers.
UESP replaces the separate tools an IT team runs to protect, patch, control and account for its computers, on infrastructure you own.
At a glance
Data path
Everything goes through one program and lands in one place.
The agent is the only thing installed on a computer. It supervises the engines that do the detection, patching and scanning, applies whatever policy it was last given, and reports to the platform on a fixed interval.
Platform
Seven things you would otherwise buy separately.
Each one works against the same list of computers and writes to the same record, so a problem found by one part of the product can be fixed from the screen where it appeared.
Threat protection
Malware, ransomware, and attacks that exploit software already installed
On Windows the agent drives Microsoft Defender rather than installing a second scanner to fight it over every file open. Ransomware is caught by its behaviour, on file entropy and rename rate, and the files it encrypted can be restored from a local journal. Isolating a machine, killing a process and rolling back are actions on the device record itself.
Patching
Windows, and the applications on top of it
You approve what installs and the window it installs in. The agent applies it and reports the result on its next check-in, so a reboot never lands in the middle of somebody's afternoon.
Software distribution
The applications people are allowed to have
Publish those and staff install them unattended, with every package verified before it is allowed to run. Anything not published becomes a request with a reason attached, which arrives in the same queue as everything else.
Application and device control
What is allowed to run, and what is allowed to be plugged in
Applications are matched against your list by hash, path, publisher or parent process. Audit mode records what would have been stopped and changes nothing, which is where every rollout should start. Enforce mode terminates what is not on the list. Removable storage is dismounted or forced read-only wherever you do not permit it.
Privileged access
Administrator credentials, out of the spreadsheet
Passwords live in a vault and are checked out for a fixed window against a stated reason. The session is recorded, and the credential is rotated when the window closes. An account that cannot be rotated is shown as exactly that, rather than as a green tick over a broken login.
Compliance evidence
Control libraries, and tests that run against the machines themselves
Eight frameworks ship with the product: ISO 27001, SOC 2, PCI DSS, HIPAA, GDPR, NIST CSF, the CIS Controls and the Essential Eight. Their controls are laid out for you, and the ones that can be checked against the machines themselves are checked continuously and unattended, rather than when somebody remembers to press a button. Every result is kept per device with the date it was checked.
Endpoint inventory
Every machine, and what is installed on it
Hardware, operating system, patch level, installed software, encryption state, browser extensions and configuration drift, collected on the same 60-second report as everything else.
Deployment
It runs on your servers, and the agents talk to nothing else.
The platform is a set of services you run on a host you control: a virtual machine in your own data centre, a tenancy in your own cloud account, or a box in a cupboard. There is no tenant to sign up for.
What you provide
The boundary
Operating it
In use
Two screens. One list of computers.
For whoever runs it
Threats, missing patches, misconfigured machines and protection that has stopped working arrive in one queue, whichever part of the product noticed them. Requests for software, devices and administrator rights arrive in the same place. Approving one takes a click, and what you approve reaches the machine on its next report.
For everyone else
Most endpoint software is invisible until it blocks something, at which point it is a mystery to the person it happened to. This one puts an application on the computer: somewhere to install approved software, see what is waiting, ask for something that is blocked, and read the answer.
Security
The questions your security review will ask.
Someone else in your organisation will read this before you can buy it. These are their questions, answered here rather than three emails later.
Answered
Where does our data live?
On your infrastructure.The platform holds it in PostgreSQL and an object store on the host you run. No part of your estate is copied anywhere else, and the platform makes no outbound call to us: there is no licence check, no version check and no usage telemetry in it.
How do agents authenticate?
Mutual TLS, per-device certificate.The platform runs its own certificate authority, backed by its secrets vault, and issues each endpoint its own client certificate when it enrols. The data plane requires and verifies that certificate, and the agent refuses to send at all without it. There is no shared API key sitting in a script.
Can one endpoint report on behalf of another?
No. Checked on every agent request.A guard runs ahead of every agent route and rejects any report whose body or path names a device other than the one the presented certificate belongs to.
How are administrators authenticated?
SAML 2.0 or OIDC, against your directory.Administrator sign-in federates to the identity provider you already run, and provisioning and deprovisioning can follow it over SCIM 2.0, so an account closed in your directory closes here.
How is one organisation kept out of another's data?
An org identity on every request, enforced in every query.The organisation is resolved once, from the verified sign-in token, and carried into every database query rather than re-derived anywhere. PostgreSQL row-level security is built as a second, independent layer underneath that and can be armed per deployment.
Is there an audit trail, and can it be edited?
Hash-chained, verifiable by recomputation.Every approval, credential checkout and policy change is recorded with the actor and the time. Each entry carries a hash of the one before it, computed in the database at the moment of writing, and the whole chain can be recomputed on demand. An entry edited, deleted or reordered after the fact breaks the chain, and the recomputation says which one.
Can a change reach our estate by accident?
No. Policies are versioned and approved before publication.A policy has versions, a named approver and a simulation step. Nothing an administrator edits takes effect on a machine until it is published, and the agent verifies the signature on what it receives before applying it.
What happens to a laptop that is off the network?
It keeps enforcing.The agent holds the last policy it verified and applies it locally with no connection. Detections buffer on the machine in an encrypted, tamper-evident store whose key is sealed to the TPM, and replay when it reconnects.
Can we get our data out?
Yes, and without our help.It is in a PostgreSQL database and an object store you already control, in open formats, with no export request to raise with us. The API the console runs on is documented and open to your own scripts.
Approach
What we will not build into it.
Commitments
Nothing that reports back to us
There is no licence server to call, no version check, no usage beacon and no analytics anywhere in the platform. This is not a setting you switch off. There is nothing to switch off, which is why the answer in the section above can be stated flatly.
Nothing third-party inside our installer
The engines the agent supervises are fetched from their own official channels, on your machine, at install time. Our installer contains our own binaries and nothing else. That is a licence position as much as a technical one, and it is checked mechanically rather than trusted.
No claim we cannot show you
Every figure on this page is measured against the code, and the ones we could not measure are not here. If you want the number behind a sentence, ask for it during an evaluation and you will get the command that produced it.
Evaluate
Evaluate it on one machine, or with us on a pilot.
Two ways in
On one machine, today
Install the agent on a Windows computer, enrol it with a six-digit code from your console, and watch it appear. It takes about five minutes and changes nothing else on the machine.
Across your estate, with us
A scoped pilot against a slice of your real estate, with the deployment and hardening guides, the answers above in a form your security team can file, and someone to talk to while you run it.