Diese Seite gibt es auch auf Deutsch.
For the IT team · 60 min live in a Teams call
Chat with your infrastructure: InfraScout turns your question into live PowerShell, event log and Graph queries – read-only by default, every execution logged, down to the root cause with the raw output as evidence.
Get-HotFix listed September KBs – the last cumulative update dated from April 2024.
of memory went to a GPO install loop – not to the suspected EDR agent.
different host and Microsoft cloud tools were used in the reference environment.
Five real cases, anonymized. Pick a question:
List all admin accounts with their PIM status and MFA – and check what is wrong in Conditional Access.
InfraScout is working …
The evidenced finding appears here
as soon as the check is complete.
| "Admin Protection – Require MFA" | 6 Global Admin accounts explicitly excluded |
|---|---|
| Permanent Global Admins | 18 – with zero PIM eligibility in the tenant |
| Orphaned principal | 3 admin roles, object no longer exists (Graph: 404) |
Recommendation: Close the admins’ MFA exclusions first, then move the permanent assignments into PIM and remove the orphaned principal’s roles.
Looks like we are being password-sprayed. Can you go through the sign-ins – did anyone get in?
InfraScout is working …
The evidenced finding appears here
as soon as the check is complete.
| Login attempts | 887,000 in 3 days, up to 288 attacker IPs a day |
|---|---|
| Locked AD accounts | 40–60 per spray wave (event 4740) |
| Compromised accounts | 5, with successful logins via a botnet every day |
| Gap | MFA protects the gateway, not the RD Web form |
Recommendation: Revoke the 5 accounts’ sessions and reset their passwords, put the RD Web form behind MFA and block the attacker networks at the portal.
Which servers are affected by the current CVE – and are the patches really installed?
InfraScout is working …
The evidenced finding appears here
as soon as the check is complete.
| Server | Reported | Actual |
|---|---|---|
| DNS02 | up to date | CU fails: 0x800F081F, WinSxS broken |
| EXCH01 | patched | SE RTM build 07/2025, ~11 months without SU |
| DNS01 | up to date | up to date, build confirmed |
Recommendation: Repair DNS02’s component store, reinstall the CU and verify the build; apply the pending Exchange SU.
Run the SQL Server health check across all instances and compare with last week.
InfraScout is working …
The evidenced finding appears here
as soon as the check is complete.
| Database | Area | Finding |
|---|---|---|
| BitLocker recovery DB | Backup | 1 full backup, Nov 2019 |
| Endpoint management DB | Backup | 0 backups, SQL Agent disabled |
| 10 databases | Backup | no backup for 47 days |
| 11 databases | Consistency check | never run |
Recommendation: Back up the BitLocker recovery and endpoint management DBs and turn SQL Agent on first, then schedule backup and DBCC jobs for every instance – and add the newly found instance to the baseline.
Start the security assessment playbook – for all connected customers.
InfraScout is working …
The evidenced finding appears here
as soon as the check is complete.
| Parallel operation | 4 production environments, tenant-separated |
|---|---|
| Incident response customer | 57 findings from 9 conversations |
| Workflow runs | 261 findings, 23 of them critical |
| Costs | reported per run – the basis for your service prices |
Recommendation: Schedule the assessment per customer as a workflow: same sentence, different environment – more customers per engineer at the same depth.
Anonymized cases from real environments, host and account names changed. In the demo, you ask your own question – in your environment or ours.
InfraScout doesn't stop at findings – it fixes them, with your sign-off. It always reads first and changes nothing until an operator approves.
A finding, a ticket or your request
Live on the system, read-only
Exact change, target and impact
Yes, adjust or cancel
On exactly the systems named
Result read back, change logged
In chat, nothing changes on any system without an operator's explicit approval.
Each server checked read-only, plan approved, SMBv1 disabled, feature removed, servers rebooted and checked again – then the ticket was commented. Servers without an agent were reported as "not checkable", not as fixed.
On the blog: from ticket to verified change(opens in a new tab)Who may change things is set in your Entra ID. Everyone else never sees a tool that writes, and if they try a change anyway, command policy stops it before it reaches the host.
After every change, InfraScout reads the result back. A command that times out counts as failed – never as successful.
Every change is recorded with its date in the log of the affected host or environment, every execution with a named actor.
Scheduled workflows never change anything: they are always read-only. Every change needs a person who approves it.
You bring your question – or pick a reality check.
We work in the demo environment or – once clarified – in yours.
You see every tool run, the finding and the evidence live.
Together we decide whether a pilot is worth it – and where you start.
An evidenced finding for your question
Traceable down to the executed command.
An honest pilot assessment
Whether it is worth it and with which use case.
Clarity on access and security
What InfraScout reads and what never happens without approval.
Findings from real environments – and what it takes InfraScout to deliver them. As of Oct 2026.
Costs: model execution costs only, in US dollars (platform estimate), not license prices. Customer findings anonymized.
What decision-makers want to know before the first call – answered with figures from production use.
InfraScout is developed in Vienna and hosted in the EU. Every tenant has its own database; chats, memory and findings are encrypted with a key per tenant. You choose the language model – if you like, through Azure AI Foundry in your own Azure subscription and region.
Reading is the rule: more than 96% of all commands on target systems contain no write verb, and command policy stopped 129 commands before they reached a host. Before any change, InfraScout states what will change on which system and waits for your explicit approval. Every execution is logged.
Every statement is tied to a query that actually ran, and its raw output is attached to the finding as evidence. Whatever could not be reached is reported as a gap, not as an all-clear. In the incident case above, the system corrected its own MFA diagnosis after a live check – and recorded the correction as a finding of its own.
Yes. Every execution has a named actor – user or workflow – and every finding traces back to the command that produced it, including the full result.
Those tools detect. InfraScout answers the follow-up question – why, who, how bad, what to do – and connects them instead of replacing them. Best example: Defender had correctly flagged a phishing email, yet it was delivered. What turned up was the transport rule that bypassed the protection.
No. It takes the recurring work off their hands: health checks run unattended overnight, at the same depth every time and comparable from run to run. Your team still signs off on the conclusions.
Yes. Each customer's data is kept separate, a workflow can be pinned to one customer, and the same playbook runs in the next environment without changes. Costs can be shown per run – a basis for predictable service pricing.
Yes. Workflows start on a schedule, from a monitoring or ticket webhook, or at the push of a button – in production, seven of them run every Monday morning before the team arrives. Findings end up as a prioritized Jira issue or a Confluence report, not just in the chat.
No and no. We start with your question and show only what is needed to answer it, in a prepared demo environment. Your systems stay untouched.
Your tenant is connected through Entra ID in about 10 minutes; the Microsoft cloud part needs no agent. At one customer, two days passed between the first conversation and the first extensive server assessment – no rollout project.
From €1,245 per month as a subscription for 50 agents, which is also the minimum package. Support included. In the reference environment, a complete, unattended assessment costs less than $5 in model costs per run (median $2.01). The comparison is a consulting day.
Servers and clients on Windows, Linux and macOS – from domain controllers and PKI to file servers – network devices such as routers and switches, and the Microsoft cloud: Entra ID, Defender, Intune, Exchange Online and SharePoint/OneDrive. Your own tools, such as ticketing, firewall or SIEM, can be connected as well.
Didn't see your question?
Then book a free demo now.
