The audit provides forensic-grade evidence to support GDPR Article 32 requirements and Cyber Essentials assessments. It identifies credential exposures, API tokens, SSH keys, developer debris, and persistence mechanisms that traditional RMM and EDR tools are not designed to surface. The audit also includes full USB device forensics, showing the storage devices recorded as connected to the endpoint, along with timestamps and usage patterns. Any USB activity outside normal working hours is highlighted — helping identify potential data exfiltration, insider-threat behaviour, and unauthorised personal devices. This gives MSPs clear, defensible evidence for GDPR compliance, HR investigations, incident response, and zero-trust endpoint reviews — all without installing agents, without cloud access, and without modifying the system.

Your security stack is blind to this — Stratum isn't.

This audit tool is built on proprietary, patent-pending methods for detecting credential exposures, persistence mechanisms, and USB device activity. Unlike open-source scripts or generic scanners, the audit uses a protected approach to identify risks that traditional RMM and EDR platforms cannot see. The patent-pending engine is fully offline, agentless, and read-only, making it suitable for GDPR, Cyber Essentials, and regulated environments where data cannot leave the endpoint. This gives MSPs a defensible audit process they can rely on for compliance reporting, incident response, and client assurance.

If a client suffers a breach, this is the forensic evidence you'll wish you had.

The audit provides a complete forensic history of the USB storage devices that have been connected to the endpoint. This includes device names, vendor IDs, serial numbers, timestamps, and repeated usage patterns. Any USB activity outside normal working hours is automatically highlighted, helping identify potential data exfiltration, insider-threat behaviour, staff misuse, and unauthorised personal devices. This gives MSPs clear, defensible evidence for GDPR compliance, HR investigations, Cyber Essentials assessments, and zero-trust endpoint reviews. The audit runs fully offline, requires no agents, and does not modify the system, making it suitable for restricted environments.

One endpoint can expose an entire organisation — audit it before someone else does.

Finds hardcoded passwords, API keys, and cloud credentials written directly into configuration files and scripts.

Find the credential leaks, SSH keys, and backdoors your RMM and EDR silently miss.

Detects orphaned scripts with hardcoded credentials, authentication bypasses, and obfuscated execution — left by contractors years ago.

Catch late-night USB activity, rogue devices, and insider-threat behaviour in seconds.

Detects ngrok, frp, chisel, and other tools that create hidden outbound tunnels bypassing firewalls.

Designed for zero-trust environments — no installation, no footprint, no network access.

Identifies TCP ports actively listening on non-standard ports that don't belong to any known legitimate service.

Turn every scan into a billable security audit — MSPs resell findings for £500–£1,500 per endpoint.

Detects unknown root CAs installed in the Windows trust store — enabling silent SSL interception of all traffic.

No other tool combines offline, read-only, agentless auditing with this depth of exposure detection.

Hunts for private keys, certificate bundles, .pfx files, .env files, and cloud credential files left on endpoints.

Your clients assume you can see everything — this proves you actually can.