Keep completed endpoint scans moving into the validated outbox.
The server understands the completion-state field produced by current agents, validates its bounded values, and still accepts legacy manifests that predate the field.
September 2026 update
See what is running, what changed, and what deserves attention.
Completed endpoint artifacts carry their validated completion state into delivery without being rejected as an unknown manifest field. If output is quarantined, both the endpoint and Fleet now call for attention instead of letting a recent local scan time hide the unfinished delivery state.
What 0.7.21 makes possible
Turn software blind spots into answers your team can use.
See quarantined output before it looks healthy.
A quarantined artifact now overrides a recent local scan timestamp: Fleet and the Windows endpoint report Attention required with a bounded reason.
Use the same evidence logic across every collector.
Portable PE version parsing now applies on Windows, Linux, macOS, ARM, MIPS, PowerPC, and RISC-V. Platform-specific APIs add native context without becoming the only way to recover core evidence.
Start where your environment already works.
Roll out the signed Windows endpoint through Intune or install it directly. Choose all local drives or selected folders through managed scan profiles or the standalone configuration tray, without editing configuration files.
Find software conventional inventory leaves behind.
Collect evidence from endpoints, servers, storage, firmware images, embedded platforms, and inherited environments—including versions, hashes, publishers, packages, and file context.
Know what changed—and whether it matters.
Approve a known-good scan as your baseline, then see added, removed, and changed software alongside version, publisher, product, and environment drift.
Give every investigation a sharper starting point.
Begin with a plain-language brief and a ranked view of unusual patterns, then verify each signal against the evidence instead of relying on a black-box score.
Connect a finding to the risk around it.
Bring vulnerability context, malware hash intelligence, signatures, and forensic indicators together. CVSS v4.0 scores are used when published, and visible feed status helps you judge how current the supporting intelligence is.
Turn technical evidence into a defensible brief.
Turn searchable inventory and measured drift into a concise explanation of exposure and next steps. Share inventory CSV exports and NIST 800-53 POA&M worksheets with safer handling of collected evidence in spreadsheets.
Built for the blind spots
Managed endpoints are only part of the software estate.
Important software lives beyond the reach of conventional endpoint inventory: in appliances, firmware, servers, storage, isolated systems, and environments your team did not build. Portable collectors extend that reach across ARM, MIPS, PowerPC, and now RISC-V64, bringing those sources into the same evidence workflow as the managed fleet.
The result is more than a list of installed applications. Your team can establish what good looks like, measure change, connect suspicious or vulnerable software to its source, and use AI-enabled insights to decide where human attention will have the greatest impact.
Security leadersReplace assumptions about software exposure with evidence that can stand up to scrutiny.
Incident respondersMove quickly from an unusual file or changed package to its host, history, and supporting context.
Infrastructure teamsCover managed Windows fleets and systems that cannot support a conventional endpoint agent.
Mission ownersTurn inherited and hard-to-inventory environments into a prioritized, explainable risk picture.
From install to answer
Start collecting today. Build confidence with every scan.
Install the signed Windows endpoint or take a portable collector to the target. Bring the results into VersionGopher, establish a trusted baseline, and use search, risk context, drift analysis, and AI-enabled insights to turn raw software evidence into a clear next action.
See Windows and portable download options Configure Windows endpoint collection Designate and compare drift baselines Explore AI-enabled insights Check security intelligence and feed status Open Help Center01Install and collect
Deploy the Windows endpoint or run a portable collector where agents cannot go.
02Understand
Search the evidence, assess risk, and see what changed from a trusted state.
03Act
Follow the strongest signals and package the evidence into a defensible brief.
Ready to see what is really running?
Start with a laptop, server, fleet, firmware image, or inherited environment—and turn the results into an evidence-backed risk brief.