The free WinSentinel agent already audits, monitors, and fixes each machine on its own. Pro is the brain that turns those standalone agents into a managed fleet — remote scans, policy push, drift alerts, and org-wide compliance, all from one place.
$29/mo for 25 nodes · $79/mo for 100 nodes · Enterprise custom · 14-day trial when available.
Local scans on a schedule. Heartbeat every 5 min. Authenticated by license key + machine fingerprint.
Runs on Cloudflare — no servers for you to host.
The mental model: Free gives you a powerful standalone agent. Pro gives those agents a control plane.
Everything below is fleet-level. Single-machine auditing, monitoring, fixing, and reporting stay free forever.
Every node's score, severity counts, and last-seen time on one screen. Drill into any machine for its full finding list.
Trigger a scan, apply a fix, or push a policy across the fleet — or a subset of nodes — without touching each box. Agents poll and execute.
"All nodes must pass CIS L1 by Friday." Define a baseline once, push it everywhere, and watch nodes converge.
Get pinged the moment a node regresses — BitLocker turned off, a firewall rule weakened, a new admin appeared. Webhook delivery to Slack, Teams, or your own endpoint.
Aggregate findings across the fleet into org-level CIS L1, SOC2, and HIPAA reports. Export PDF or CSV for auditors.
Admin, viewer, and auditor roles. Per-member API tokens, shown once and revocable instantly. Every mutation lands in an immutable audit log.
Everything the dashboard does is an API call. Wire fleet posture into your SIEM, your CMDB, or a cron job.
25 nodes, 100 nodes, or unlimited. SSO (SAML / OIDC) and priority support on the larger tiers.
Admins can drive the whole fleet from any terminal — no web UI required when you'd rather script it.
# activate Pro once, on the admin's machine
winsentinel pro activate WSP-7Q2K-9F3M-X8AB
# see the whole fleet at a glance
winsentinel fleet status
# scan every node — or just a couple
winsentinel fleet scan-all
winsentinel fleet scan-all --nodes db-prod-1,db-prod-2 --modules defender,firewall
# push a hardening baseline to the fleet
winsentinel fleet push-policy --file cis-l1.json
# list registered nodes (JSON for scripting)
winsentinel fleet nodes --jsonFleet commands require a Pro license. Without one they print a friendly upgrade note and exit — the free single-machine commands are unaffected.
winsentinel agent daemon itselfStart free on one machine today. Add Pro the day a second machine becomes someone's problem.