Which Machine Do I Fix First? Executive Risk Triage Across a Windows Fleet

Run winsentinel --audit on one machine and you get a clear, ranked list of findings for that machine. That is the free tier, and it is genuinely complete: every audit module, the real-time monitor, scheduled scans, PDF reports — all of it, local-only, unlimited. For a single box, you are done.

Then someone hands you 60 machines and asks the only question that actually matters on a Monday morning: which one do I fix first?

The problem isn’t data — it’s aggregation

Each agent already knows its own posture. What’s missing is a way to fuse 60 independent verdicts into one comparable ranking so remediation effort goes where it buys the most security. A machine with one open critical alert outranks a machine with a dozen lows. A node that stopped reporting three days ago is a blind spot, not a clean bill of health. A box sitting at 62% CIS compliance is a slow bleed. These are different signals in different units, and eyeballing them across a spreadsheet doesn’t scale.

WinSentinel Pro’s fleet control plane fuses the three signals every admin already has — open alerts weighted by severity, CIS compliance standing, and heartbeat staleness — into a single composite risk score per node, then ranks the fleet worst-first:

winsentinel-fleet nodes at-risk

Nodes at risk (worst first)
───────────────────────────
  3 of 60 nodes need attention  ·  57 clean

  db-prod-1    risk  63.0   1 open critical alert, 62% CIS compliant
  app-2        risk  45.0   2 open high alerts, stale heartbeat
  jump-host    risk  25.0   never reported / no heartbeat

That’s the operator view: a short list you work top-down. The severity weighting is deliberately steep, so a single open critical can’t be buried under a pile of noise.

The digest leadership actually reads

Operators want the worst-first list. Leadership wants one paragraph: how exposed are we right now. So the same data rolls up into an executive risk profile — a per-tier distribution, the fleet-wide open-alert breakdown, how many nodes have gone silent, and the named top offenders:

winsentinel-fleet nodes at-risk summary

Fleet risk profile
───────────────────
  3 of 60 nodes carry risk  ·  57 clean  ·  peak risk 63.0
  By tier:    critical 1  ·  high 1  ·  moderate 1  ·  clean 57
  Open alerts: 4 total  ·  C 1  H 2  M 0  L 1
  Stale:      1 node with a stale / missing heartbeat

Compliance evidence, not screenshots

An auditor doesn’t want a screenshot of a terminal. They want a row they can drop into an evidence pack. So the executive digest exports straight to CSV — one line for the whole fleet, self-describing columns, top offenders quoted inline:

winsentinel-fleet nodes at-risk summary --csv > fleet-risk-2026-08-15.csv

total_nodes,at_risk,clean_nodes,tier_critical,tier_high,tier_moderate,tier_low,tier_clean,open_alerts_total,open_critical,open_high,open_medium,open_low,stale_nodes,max_risk,top_offenders
60,3,57,1,1,1,0,57,4,1,2,0,1,1,63,"db-prod-1 (63); app-2 (45); jump-host (25)"

Snapshot it weekly and you have a defensible trendline: “we carried three at-risk nodes on the 1st, zero by the 15th.” That’s the artifact that turns a security posture into a story you can tell a SOC 2 assessor or a board.

Free gives you the agent; Pro gives you the fleet

The mental model is simple. The free single-machine tool makes every one of your machines a powerful standalone agent — and it stays free, forever, for that job. Pro is what turns those agents into a managed fleet: a control plane that ranks them, rolls them up, and hands you the one number a room full of stakeholders can act on.

If you’re auditing more than a handful of Windows machines, the question isn’t whether you have the data. You do — every agent already has it. The question is whether you can answer “which one first?” in one command. That’s the line between the free tier and Pro.