Auto Secure LoginAssessments your customer authorizes — and nobody can fake.
ASL Scan is a first-party security-assessment platform for authorized Windows and Linux business systems. A customer-run collector measures dozens of hardening controls using only read-only metadata, seals the results with hashes, and hands them to an internal portal for severity-weighted review, per-host drift, and export-ready reports. It never exploits, never touches credentials, never runs a server-supplied command, and never claims certification — every assessment is bounded by an RSA-PSS-signed scope that names the exact hosts and an expiry.
The problem
An assessment is only as trustworthy as its authorization.
MSPs and security consultancies need to show a client where they stand — without an invasive agent, without touching credentials, and without a report anyone could quietly edit after the fact. "Trust me, I scanned it" doesn't survive an audit or a dispute.
ASL Scan makes both the authorization and the evidence cryptographic. The collector refuses to measure a host outside its signed scope, and the results are hash-sealed so the report you deliver is provably the report that was collected.
What it will not do
- Exploit anything
- Touch or transmit credentials
- Run a command the server supplied
- Measure a host outside the signed scope
- Let an "unknown" control count as a pass
Capabilities
Cryptographic scope. Deterministic controls. Honest verdicts.
Signed-scope authorization
An RSA-PSS scope names exact hosts, platforms, the authorizer, and an expiry; the collector refuses to run outside it.
35 deterministic controls
Each returns pass / fail / unknown / N-A — and an unknown never becomes a pass, so gaps are visible, not hidden.
Deep Windows coverage
UAC, firewall, Defender freshness (≤7 days), RDP/NLA, SMBv1 & signing, PowerShell logging, LSA protection, Secure Boot, BitLocker, and more.
Deep Linux coverage
SSH hardening, firewall, auditd, SELinux/AppArmor, ASLR, SUID inventory, ptrace scope, and more.
Risky-listener detection
Flags exposure across 16 sensitive ports so an unexpected listener surfaces in the report.
Hash-verified evidence
Evidence bundles are hash-sealed; the portal verifies integrity before it scores, so a tampered bundle is rejected.
Signed rule packs
Custom rule packs must be signed — an unsigned pack is rejected, so nobody slips in an unvetted check.
Drift & severity
Per-host drift detection over time and severity-weighted scoring, with safe CSV export for the client deliverable.
Gated pentest workspace
A separate Business Security Audit workspace adds a signed-plan pentest engine (GET/HEAD/OPTIONS only, metadata not bodies) behind an approval gate.
Prove the posture. Prove the authorization.
Signed scope, deterministic controls, hash-sealed evidence, and reports that survive scrutiny — deliver authorized assessments without an invasive agent.