Platform / Tz0 Security
Module · policy enforcement
Tz0 Security
Security policy and DLP on the endpoint
Writing the security standard is the easy part. The real question is another one: how do you guarantee it is being followed on twelve thousand machines, right now, without someone checking them one by one?
Enforces the rule even with the workstation off the network · the evidence stays on your server
USB port
The rule travels with the machine.
It makes no difference whether the machine is on the company network, at an employee’s home or on the road: the removable-media policy travels with it. A USB stick that is not on the list will not mount, and the attempt is recorded with machine, user and time.
Console capture from an estate in production. Machine and person identification replaced; figures untouched.
What the module does
Seven fronts of control, a single agent.
Everything below is configured in the console and enforced by the agent on the workstation — with or without a connection to the server at the moment of the attempt.
Blocks and rules
Defines what may run, what may be installed and what may leave the machine — by group, by department or by workstation.
Hardware snapshot
Photographs the machine’s physical configuration and warns when a part is swapped, removed or appears out of nowhere.
Real-time visibility
What is happening on the estate right now — not what happened during last night’s inventory run.
Tracing for lost equipment
A laptop that went missing keeps reporting: where it surfaced, on which network, under which user.
Working-hours control
Sets the window in which each group may operate and records what was attempted outside it.
Application-layer firewall
The rule is not just port and IP: it is which program may talk, to whom and through where.
Integration with Windows policy
Lives alongside the GPO you already have instead of fighting it — and covers what the GPO cannot reach.
DLP support
Stops personal data leaving where it should not and records the attempt — the backbone of a defence in a data-protection audit.
How it works
From the written rule to the stored evidence.
The whole cycle runs inside your network. No step depends on an external service.
Evidence
Blocking is half of it. Proving is the other half.
In an audit, nobody asks whether the policy exists — they ask what happened on the 14th, who tried, what was blocked and where the record is. Every attempt becomes an event stamped with time, machine, user and the content that triggered the rule.
Console
The policy is written and enforced in the browser.
Screens from a real estate in production, not a demo environment. Folder paths that identified people, the internal domain and one public-sector folder were replaced with generic equivalents before publishing; figures, percentages and the interface itself are untouched.
Security score
One score, the minimum and where to start.
The network summed up in a score from 0 to 100, each layer measured machine by machine and the findings ranked by weight, with the period’s attacks alongside.
Action plan
It only closes when the data confirms.
Each open item becomes a task with an owner and a deadline. Marking it done is not enough: the card only reaches Done when the finding disappears from the agent’s data.
Privilege
Full power day to day, machine by machine.
Who works as local administrator, which program runs with full power and for how long, with the step each machine is on and the policy to move up to the next.
Working hours
Use outside business hours, with the estimated cost.
Hour by hour, who arrives early, leaves late or works through lunch without approval. This is the data that backs the conversation about labor risk.
Changes
Of thousands of changes, the few that count.
Hardware, software, services and startup: Tz0 discards the noise from Windows itself and puts the few changes that need attention up front.
Vulnerabilities
Open exploited flaws, and what to update first.
Each machine’s software checked every night against public security standards: the CISA catalog of exploited vulnerabilities, NIST’s affected version ranges, FIRST’s exploit probability (EPSS) and severity from CVSS 3.1 and 4.0. No network scanner and no credentials: only the inventory the agent already collects.
CISA KEV
Has it been exploited? Only flaws seen in real attacks, with CISA's remediation deadline and the ransomware flag.
NIST NVD
Is my version affected? The installed version is compared with the published ranges. When it can't be compared, the finding is marked suspect and never counts as confirmed.
FIRST EPSS
How likely is an attack now? Probability of exploitation in the next 30 days, recalculated daily, with 90 days of history. It breaks the tie on what to fix first.
CVSS 3.1 and 4.0
How severe is it? A 0–10 score and the vector in plain language: over the network, no credentials, no user action, reach into other systems.
A ready-made queue, with a rule you can explain to the auditor
First what is confirmed by version; then what is past CISA's deadline; then the highest chance of attack in the next 30 days (EPSS); finally the technical severity (CVSS, using 4.0 once NIST has published it). Ransomware use is highlighted at every level. And the action is per product: one update closes all of its CVEs at once, and the distribution module sends the update to the machines.
| Standard | Control | What Tz0 provides as evidence |
|---|---|---|
| CIS Controls v8 | 2.1, 7.1, 7.2, 7.4 and 7.7 | Software inventory per machine, an explicit priority rule, the fixing version and the daily trend that shows whether flaws are being closed. |
| ISO/IEC 27001:2022 | Annex A 8.8 · management of technical vulnerabilities | Information from recognized sources (CISA, NIST, FIRST), exposure assessment for each machine and a record of actions. |
| NIST CSF 2.0 | ID.RA-01 and ID.RA-05 | Vulnerabilities confirmed by version and recorded daily; threat (KEV), likelihood (EPSS) and impact (CVSS) in the same queue. |
| PCI DSS v4.0 | 6.3.1 and 6.3.3 | Risk ranking from industry sources, overdue deadlines and the age of each finding, per machine. |
The module produces the evidence these controls ask for; compliance also depends on the company's processes and the auditor's assessment. It ships with the Tz0 server update: the server itself downloads the updated catalog every day, with no agent update and no network scanning. No machine data leaves the network.
Network
Where the fleet connects to.
Each connection with an alert keeps the program’s hash, the destination country and the VirusTotal and Defender results. A question about an indicator of attack becomes a query.
Wi-Fi
Wi-Fi as seen by the machines themselves.
Networks in range, authentication type and congested channels, read by the agent already on the workstation, with no dedicated sensor.
Event Log
Of thousands of events, the ones that matter.
The Event Log of every machine read at once: routine hidden, critical first, program crashes explained and silent machines treated as an alert.
Database
Databases exposed, without backup or corrupted.
Attempts from the internet, databases without backup and signs of corruption, taken from the log the server already writes.
Behavior analysis
Who needs attention, and why.
A risk score per person, recalculated every night. Every point is explained by the rule and the occurrence that generated it.
Location
Where the machines are.
The outbound internet IP says where the machine is; the IP-per-location rule says whether that is the company, a branch or remote work.
What changes in practice
Eight things that stop depending on individual discipline.
In the customer’s words
The controls that were missing, inside their own environment.
We are very happy with the product, and our experience so far has been adding to the controls and security we were looking for inside our computing environment.
Translated from Portuguese
Gustavo PriuliIT Coordination · Unimed Federação Nordeste PaulistaIncluded with the module
Three tools in the same package.
A new report does not become a project. We do not build bespoke work for a single customer, but we look at every request: when the need serves everyone, the report goes into the product and reaches all customers in the next update.
Report builder
Ships with the package, not sold separately. It is for people who want to build their own reports outside the browser.
Development platform
Carries agent communication across segmented topologies and lets the product be extended.
Operations dashboard
The state of the estate on one screen, with whatever went off-target at the top. More than 600 ready-made reports, covering every module.
Who works this way
A policy built on Tz0.
We built a security policy entirely on Tz0.
Translated from Portuguese
Tz0 helps us a great deal in audits, which generally have a lot to do with security.
Translated from Portuguese
Other modules
Bring us your security standard. We will show you what can actually be enforced.
A 30-minute technical conversation: you describe the environment and the policy you have to meet, we point out what Tz0 Security enforces on its own and what still needs a process.