Devices
Every managed endpoint as one record: hardware and software inventory, groups and enrolment. Windows, macOS, Linux and servers; phones and tablets through mobile device management.
Unified endpoint security platform
Five products.
One platform.
Endpoint management, privileged access, application control, compliance and EDR. Self-hosted, behind one console, one agent and one audit log.
What it replaces
Five vendors, five agents,
five sets of credentials.
UESP covers the same ground as the five products below, at the feature level, from one deployment. Each row is a module, not an integration.
Endpoint CentralManageEngine, Security Plus
Inventory, patching, software delivery, device control, disk encryption and configuration baselines, against the same device records everything else uses.
16 of 16
PAM360ManageEngine
A credential vault, just-in-time elevation, recorded sessions, SSH keys and certificates, and discovery of the privileged accounts nobody wrote down.
16 of 16
ThreatLockerApplication control
Allowlisting with a learning mode, ringfencing, storage and network control, all as versioned policies in the same library as everything else.
13 of 13
VantaCompliance automation
Continuous control monitoring, evidence collected from the platform itself rather than uploaded, audits, risk register and a trust centre.
15 of 15
Intercept XSophos, EDR and XDR
Detections correlated into cases, threat hunting, your own detection rules, ransomware rollback and file-integrity monitoring on servers.
20 of 21
One of the twenty-one is closed as blocked: it needs mobile hardware to prove, and we do not mark a feature done on a claim. Application security and data resilience are building now, as modules on the same spine rather than as another product to buy.
Twelve areas of the console.
Three records they all share.
Every module writes to the same device records, the same stream of findings and the same approvals queue. The list below is the console's own navigation, and every name is a page in it.
Shared by every module
Findings
One stream for threats, vulnerabilities, misconfigurations and broken protection, from every module, against the same device and user records. One place to triage, whichever module raised it.
Approvals
One queue for blocked applications, USB devices, elevation, privileged access and patches. Approve, deny or grant for a limited time, with the reason and the decision recorded.
The modules
Threats
Detections from the agent, correlated into cases, with threat hunting and your own detection rules. Ransomware rollback, email quarantine, file-integrity monitoring and account health are the same module.
Patches and vulnerabilities
Missing OS and third-party updates and known-vulnerable software on every device, approved in the console and installed on a schedule. Code and cloud scanning covers the other side.
Software
Deploy to groups or publish to a self-service catalog people install themselves. Inventory, usage metering, prohibited software, licences, warranties and OS deployment sit here too.
Endpoint control
Allowlisting with a learning mode, ringfencing, network and web control, USB and device control, disk encryption with recovery keys, browser control and data loss prevention.
Privileged access
A credential vault, just-in-time elevation and recorded sessions, with discovery of the accounts nobody wrote down. SSH keys, certificates, break-glass and application-to-application credentials.
Compliance
Benchmark results per device and evidence collected from the platform itself. Audits, a risk register, vendor risk, access reviews, attestations and a trust centre. An assistant drafts questionnaire answers; a person approves before anything is sent.
Backup and recovery
Repositories, backups and restore points for the devices you already manage, with replicas and failover, disaster-recovery runbooks and a ransomware recovery path that starts from the same device record as the detection.
Reports and audit
Reports and dashboards across every module, and one tamper-evident audit log of every state change, access, credential reveal, session and approval.
Administration
Users and roles, single sign-on and multi-factor authentication, log forwarding to your SIEM, and separation between organisations so a managed service provider can run many customers from one deployment.
One binary per computer.
It keeps enforcing offline.
One Rust binary per operating system carries every module's endpoint work, so there is one thing to install, one process to trust and one check-in to watch.
Protect
- Anti-malware
- Anti-exploit
- Anti-ransomware
- EDR telemetry
Control
- Application control
- Ringfencing
- Data loss prevention
- Device control
- Web control
- Privileged-session broker
Operate
- Compliance sensor
- Patching
- Software delivery
- Backup agent
Offline, it still enforces
The last approved policy is held in a tamper-evident local store and enforced with no connectivity at all. Events queue on the device and are delivered when the network returns.
Checks in every 60 seconds
Policy changes, approvals and commands reach the endpoint on its next check-in, so an approval made in the console lands on the computer within a minute.
Identified by its own certificate
Each agent authenticates with its own mTLS client certificate, so the platform knows exactly which device is talking and there is no shared secret to leak.
A service, from boot
On Windows the installer registers the agent as a LocalSystem service that starts at boot and restarts if it stops. On Linux it installs with one command.
Self-hosted and policy-driven,
with nothing that is UI-only.
The platform runs on your own infrastructure, and six rules hold across every module. They are the architecture's own, not marketing.
Self-hosted
UESP runs on your own infrastructure, with your own Postgres, ClickHouse, OpenSearch and object storage. Your device records, session recordings and evidence stay in those stores; there is no vendor cloud holding them.
Policy before action
Every enforcement action on an endpoint comes from a versioned, approved policy in the policy library. A change is reviewed, approved and versioned before any agent sees it.
One audit log
Every state change, access, credential reveal, recorded session and approval is written to one tamper-evident audit log, whichever module it came from.
Every action is an API call
Every console action is also a REST API call. Nothing is UI-only, so whatever an administrator can do by hand can be scripted and automated.
Separated per organisation
Each organisation's data is separated in the database itself, not only in the interface. It is the same separation a managed service provider relies on to run many customers from one deployment.
Secrets in a vault
Credentials, keys and certificates live in a vault, never in configuration files. Reveals are brokered, audited and, where possible, avoided by injecting the secret into the session instead.
The app you download here
is the one you use daily.
The desktop app is not just the agent. It is where you install approved software, see what needs a restart, ask for something that was blocked, and reach IT, and where their answer comes back.
Software Center
Install software your IT team has published, or request titles that need approval.
Updates
See what is pending, install approved updates, and choose when to restart.
Requests
Ask for a blocked app, a USB device or a short elevation, with a reason, and track the answer.
Get help
Raise a ticket with IT from the app; replies show up as notifications.
Troubleshoot
Named checks with plain explanations, safe one-click fixes, and a send-to-IT button.
Get the app.
Pair it with a code from your IT team.
One installer for the desktop app and the agent. Administrators can also install the agent alone from a shell, on Windows or Linux.
UESP for Windows
Windows 10 and 11, 64-bit. Installs the desktop app and registers the agent as a Windows service that reports to your console.
- The desktop app: Software Center, Updates, Requests, Get help and Troubleshoot.
- The agent, as a LocalSystem service that starts at boot and restarts if it stops.
- No account to create. The pairing code comes from your IT team.
For administrators
Install the agent on its own from a shell. Run as an administrator or with sudo.
Windows (PowerShell)
iwr -UseBasicParsing https://api.allcyber.org/install.ps1 -OutFile $env:TEMP/uesp-install.ps1; powershell -ExecutionPolicy Bypass -File $env:TEMP/uesp-install.ps1
Linux
curl -fsSL https://api.allcyber.org/install.sh | sudo sh