How Senserva works, in detail.

Find it. Fix it. Prove it. Easy to use, with Senserva Trustworthy AI built in. A closer look at each step, from the checks Senserva runs to the fixes and reports it delivers.

read-only checks across Microsoft 365, Entra ID, Intune, Defender, Purview and Azure: 650+
Intune device checks: compliance, BitLocker, ASR, Defender and update rings: 190+
from download to first findings, with no software agents: ~20 min

Compliance mapping: CMMC Level 2 (NIST SP 800-171), Microsoft Cloud Security Benchmark and CISA SCuBA. Runs on Windows and macOS. AI optional, with your own model.

Try a Demo

Senserva detailed product overview Watch the full walkthrough

Find it. Scanning

650+ deterministic, read-only checks in one scan.

Senserva reads four kinds of input as one connected model: configuration, patching and CVEs, logs, and third-party results. It covers Microsoft 365, Intune, Defender, Entra ID, Azure, Purview and endpoints. It runs the same checks the same way every time, and it is easy to start: first findings in about 20 minutes.

Read-only through Microsoft's own APIs. No agents and no cloud service.

Turns checks on or off from the licenses it finds, and reports anything skipped with the reason

Every tenant you manage in one view

Results land in a graph of 110+ node tables and 70+ edge tables, so a user, a policy and a sign-in can be joined

Senserva Patch and Vulnerability findings grouped by check, with exploited CVEs per device across tenants

Checks by area

Area	Checks
Intune device management	190+
Authentication methods	42
Users and accounts	35
Privileged Identity Management	34
Service principals	34

Logs, read and correlated locally

Entra sign-in logs, 3 days (the Entra default retention)
Microsoft 365 unified audit log
Directory audit and provisioning logs
Security alerts

Activity is joined to the configuration it touched, so a risky sign-in and the policy that let it through show up as one finding.

Intune device analysis

190+ Intune device-management checks. Senserva reads your Intune configuration and device state through Microsoft Graph and confirms your policies actually harden the devices they target.

Compliance policies and configuration profiles: unassigned or conflicting profiles and superseded baselines
Attack surface reduction rules in audit, block or off, including LSASS credential theft, Office macros and ransomware
BitLocker on system, fixed and removable drives, plus recovery key escrow and rotation
Defender antivirus, tamper protection and the domain, private and public firewall profiles
Update rings: coverage, deferrals, deadlines and devices stuck past end of servicing

License-aware scanning

At scan start Senserva reads your subscribed SKUs and service plans from Graph.

License	Unlocks
Any Entra plan	Core identity
Entra ID P1	Conditional Access, MFA
Entra ID P2 or E5	PIM, Identity Protection
Intune	Device checks
Purview	Labels, retention
Defender	Matching workload checks

Go deeper: Security checks catalog Intune checks Log analysis Unified security model Security licensing

A Senserva finding opened in detail: about this check, risk, recommended action, entity, target, tenant and a Remediate button

Fix it. Act on these now

Ranked by what attackers are exploiting right now.

Every audit ends with a short, ranked list. Rank comes from public threat data that Senserva Watch refreshes twice a day, joined to what is actually in your tenant.

About this check, risk and recommended action, in plain language

The exact device, user or app, and the tenant it lives in

Missing patches tied to the CVEs they close

One click from the finding to its fix

How a finding is ranked

CISA KEV listing first
Known ransomware use
FIRST EPSS, 30-day probability of exploitation
CVSS as the tiebreaker
A recency boost that decays over time

A KB inherits its score from the CVEs it fixes.

Senserva CVE score, 0 to 100

Score	Meaning
80 to 100	Patch now
60 to 79	High
40 to 59	Notable
Under 40	Track

Built from public signals only, so you can check the math.

Threat data sources

Microsoft MSRC: KB-to-CVE mapping
CISA Known Exploited Vulnerabilities
FIRST EPSS
NVD or CIRCL for CVSS
Defender for Endpoint per-device vulnerability data, where licensed

Severity scale

Critical, High, Medium, Low and Informational. Critical is reserved for evidence: KEV, EPSS of 10% or more, ransomware, or a confirmed path to tenant compromise.

Go deeper: Senserva CVE Ranking CVE, patch and vulnerability management Patch tracker Senserva Watch Live

Fix it. Remediation

A validated fix for every finding. You decide when it runs.

Pick the checks to fix and Senserva generates a prompt for a PowerShell remediation script covering every affected entity. With AI connected, the fix is drafted for your tenant and validated against your current configuration before your team sees it.

Fix a whole check, or single findings, so break-glass accounts stay excluded

Every run writes a change log and a rollback script

Approve before apply, from the app or from Claude over MCP

The next scan verifies the gap is closed

Senserva Remediation view: pick the checks to fix, then generate the PowerShell script

What every script passes

Checked with PSScriptAnalyzer
Connects to Microsoft Graph and uses try/catch
No legacy commands, no placeholders
Idempotent: safe to run twice

Example: a Conditional Access fix uses the Graph module Microsoft.Graph.Identity.SignIns and creates the policy in report-only mode first.

Configuration drift

After you fix it, keep it fixed. Run Senserva again and the next scan shows whether the fix held.

The next scan confirms the gap is closed
A setting that slips back shows up as a finding again
The same checks run the same way on every scan

Without AI

No AI key saved? Senserva builds the prompt for you. Copy it into any AI, paste the reply back, and Senserva validates it the same way.

Go deeper: AI remediation

Claude reading a Senserva scan over MCP and calling out the two most important issues across tenants

Senserva Trustworthy AI

Bring your own model. Senserva never trains on your data.

Senserva is AI-native, but runs fully without AI. When you turn AI on, it works from your own scan data with deterministic checks and ranking underneath, and the AI proposes while you decide.

Automate with Senserva Claude MCP or Claude CLI with your API key

Or copy and paste into any chat AI. Use any model like ChatGPT, Copilot, or a local model like Ollama

No token markup

Nothing is applied to your environment silently

What leaves your machine

Prompts are scrubbed before they go to the model you choose: tenant aliases, anonymized users, and no object IDs or raw Graph payloads. AI calls go straight from your machine to that model.

Claude and the Senserva MCP

Ask questions of your scan from Claude Desktop or the Claude CLI. Claude asks permission before it uses a Senserva tool, and a demo mode runs against a simulated tenant.

Prompt sizes

Compact, standard or extended, so you can trade detail for cost. Set up an API model once with setup-ai.

Go deeper: Works with any AI Claude Senserva Trustworthy AI

Prove it. Reporting and compliance

Evidence an auditor accepts, not a screenshot.

Multiple report types from one scan, each a self-contained HTML file you can open anywhere. Reports work with or without AI. Every finding carries the control codes auditors ask about.

Detailed, Business, and Patch and Vulnerability reports

Native MCSB and CISA SCuBA scorecards and reports

Maps findings to CMMC Level 2 (NIST SP 800-171) practices

CMMC and NIST 800-171 readiness report by check, with an SPRS readiness estimate of 52 out of 110 across three tenants

Coverage by framework

Framework	Mapped
CMMC Level 2 (NIST SP 800-171)
Microsoft Cloud Security Benchmark
CISA SCuBA

Every check carries an MCSB code.

The evidence packet, per finding

The entity, severity and gap
Proof: policy assignments, sign-in traces, audit events, group chains
Control codes for each framework
The validated fix, its PowerShell and a re-prove pass

Compliance

6baselines scored

Entra ID

Exchange Online

SharePoint and OneDrive

Teams

Defender for Office 365

Power Platform

Open the scorecard with C and export it to HTML.

Cyber insurance and security reviews

What insurers ask about

MFA

Patching

Privileged access

Logging

Email security

BitLocker

ASR

Firewall

CMMC and federal

110NIST SP 800-171 practices

CMMC Level 2 readiness for commercial Microsoft 365 and GCC today

An SPRS estimate across all 110 practices

GCC High: coming soon

Go deeper: Framework crosswalks Microsoft Cloud Security Benchmark SCuBA compliance tools Cyber insurance readiness Federal: CMMC and GCC

# First run: a 3-step wizard
./siemserva-osx-arm64

# Share results across operators, in your own Azure subscription
siemserva setup-storage

# Install the SDK, or pipe another scanner into Senserva reports
siemserva --sdk
your-scanner | siemserva --reporter

Command line and SDK

A single binary, a keyboard-driven dashboard, and open data.

Run it with no parameters and a guided wizard gets you to your first scan. The terminal dashboard is keyboard-driven, and everything Senserva finds is yours to query.

Results in a local SQLite file by default

Or Azure Table storage in your subscription, shared by your team, for well under a dollar a month

A portable .senserva export file

Bring in Maester and Zero Trust Assessment results

Query your own data

Findings, devices and patches are tables you can read with C#, PowerShell or plain Python.

SELECT Name, Severity
FROM CurrentAudit
WHERE Severity >= 375

SDK and pipeline

SenservaWriter and SenservaClient for C#
A PowerShell module, and zero-dependency Python
Newline-delimited JSON in, every row tagged with its source

Free feeds and JSON API

No login, no key, no rate limits
RSS for Microsoft patches, exploited CVEs and Patch Tuesday
JSON for patches and the hot list
An ICS calendar of upcoming Patch Tuesdays

Go deeper: SDK and pipeline Shared cloud database Maester integration Free feeds and JSON API Quick Start

Windows and Mac.

One signed binary for Windows and one for macOS on Apple silicon. No installer, no agents, nothing to deploy to your tenant. Download it, sign in to your Microsoft tenants, and scan. Your results stay on that machine unless you choose shared storage.

Windows

Signed 64-bit executable for all Microsoft supported Windows 11 builds: siemserva-win-x64-signed.exe.

macOS

Notarized native build for Apple silicon (macOS 15 Sequoia and later): siemserva-osx-arm64.

Same everywhere

The same checks, findings, remediation and reports on both. Read-only, least-privilege access to your tenants. Remediation scripts run in PowerShell.

Go deeper: Quick Start Demo and training

See it on your own tenant.

Three free unlimited audits: one to find it, one to fix it, one to prove it.

Try a Demo Join Senserva Watch