Skip to content
Labs
Sign inRequest a demo

QUME · Endpoint security

Hardened, encrypted and controlled endpoints

QUME applies hardening baselines, controls device ports and privileges, keeps disk encryption recovery keys and firmware credentials, and works with endpoint protection, all from the same agent and console as device management.

Book an architecture briefingQUME overview
A hardening baseline evaluated on one device, control by controlSix controls from a hardening baseline are listed with their verdicts: four pass, one fails and one is unknown because the device stopped reporting it. The device’s overall verdict is non-compliant, with the failing control named.Finance baseline · FIN-LT-0142disk encryption on, recovery key escrowedUSB mass storage blockedlocal administrator removedfirmware password set and held by QUMESSH root login disabledscreen lock after 5 minutesNON-COMPLIANT — 1 control failedremediation ladder: notify
  1. A baseline is a set of controls, each evaluated and read back on the device.
  2. A failed control is named, and the device moves onto the remediation ladder you set.
  3. An unknown verdict is kept apart from a pass, because a control that stopped reporting is not evidence of health.

Capabilities

What QUME does for endpoint security

  • Hardening baselines and cyber audit

    Apply hardening baselines by group, audit configuration against them, and see each device’s drift control by control.

  • Device control

    Allow, block or read-only USB and other device ports by policy, per group and per ownership.

  • Data loss prevention

    Rules that keep sensitive data on managed devices and record the attempts that were stopped.

  • Privilege management

    Remove standing local administrator rights and grant elevation per task, with a reason and an expiry.

  • Disk encryption and key escrow

    BitLocker and FileVault recovery keys escrowed in QUME, released under audit, with two-person release where you require it.

  • Firmware and BIOS credentials

    Firmware passwords set and rotated by QUME and held in its vault rather than on a spreadsheet.

  • Endpoint protection, integrated

    Telemetry for detection is built into QUME; prevention integrates with the endpoint protection you run.

  • Prohibited software

    Name what may not run, find it in inventory, and remove it through the same signed commands.

Questions

What buyers ask

Does QUME replace our antivirus?

QUME collects endpoint telemetry for detection and response, and integrates prevention with the endpoint protection product you already run.

Who can see a recovery key?

Only roles with that capability, after a reason is recorded, and with a second approver if your policy requires it. Every release is in the audit trail.

Explore QUME

Other capabilities

← Patch and vulnerabilityDetection and SIEM →

See endpoint security in QUME

On your own devices, with your team.

Book an architecture briefingHow licensing works