Execution attempt
A remote-access tool tries to run.
IT-MANAGED WINDOWS ENDPOINT PROTECTION
Your endpoints.
Your rules.
Active endpoint protection that detects suspicious activity, blocks unauthorized remote access, and responds where threats begin.
For organizations, administered by an appointed IT lead.
Explore ProtectionMONITOR. PROTECT. PREVAIL.
Organizational use onlyHealthcare BAA
THE CONTROLLED PERIMETER
Approved support Permitted by policyUnauthorized access Stopped at the boundary
Illustrative protection model
PROTECTION STARTS
AT THE ENDPOINT.
AT THE ENDPOINT.
Define what is allowed.
Enforce what is not.
01 / REMOTE ACCESS CONTROL
ENFORCE AUTHORIZATIONRemote access is
a permission.
Not an assumption.
A legitimate support tool can still create an unauthorized path into your business.
Sentinel CS identifies remote-access software, evaluates its authorization, and blocks prohibited activity according to your endpoint policy. Approved support is permitted under defined rules—not a universal exception.
ScreenConnect / ConnectWise Control, RMM tools, TeamViewer, and AnyDesk are evaluated in the context of your policy. A tool’s legitimacy does not make every execution authorized.
Policy evaluation
Identity and context are checked against authorization.
Block & stop
Prohibited execution and associated services are stopped.
Remove persistence
Unauthorized startup mechanisms are addressed.
Security event
The decision and response are recorded for review.
Policy-driven response sequence · actions apply to identified software within the configured protection scope.
02 / ENDPOINT DETECTION & RESPONSE
From a signal
to a decision.
To a response.
EDR means understanding endpoint activity and acting on it. Sentinel CS connects evidence to policy so your team can contain identified activity and restore authorized operation.
Make activity visible.
See processes, services, execution, and relevant security changes. Give investigations a concrete starting point.
Recognize what needs action.
Evaluate software identity, behavior, and context to identify suspicious or unauthorized activity.
Reconstruct what happened.
Correlate relevant events to understand execution, associated services, and persistence—not isolated signals.
Act at the source.
Block execution, stop prohibited processes or services, and control associated persistence. Support containment and recovery within the defined product scope.
03 / DEFENSE THAT WORKS TOGETHER
ONE ENDPOINT. MULTIPLE CONTROL POINTS.A perimeter.
Five coordinated layers.
Authorization, execution, persistence, agent integrity, and response reinforce one another around the protected station.
CONTROL POINT / 01
Authorize the connection.
Protect the boundary.
Identify remote-access tools and apply your authorization policy. Approved support follows controlled rules; prohibited activity is blocked at the endpoint.
OPERATIONAL BENEFIT
Keep remote support available without treating every access path as trusted.
PROTECTION IN CONTEXT
DETECTION / DECISION / ACTION / RESULTSee the protection
workflow.
Explore how endpoint policy and your IT professional guide three different situations.
SCENARIO CONTEXT
Unauthorized remote access
An unapproved remote-support tool attempts to run on an organizational workstation.
- Station
- Example workstation
- Policy owner
- Designated IT professional
STEP 01 / 04
01 / DETECTION
Identify the access attempt.
The workflow identifies a remote-support executable and its execution context for policy evaluation.
- Observed evidence
- Remote-support executable, publisher information, and execution context.
Hypothetical scenarios illustrating the intended protection workflow
04 / OPERATION & ADMINISTRATION
LOCAL ACTION. CENTRAL VISIBILITY.Enforced on the station.
Understood across the fleet.
Protection policies act locally. The Customer Portal brings station status, security alerts, connectivity, and license administration into one view.
Sentinel CS Agent
Evaluate activity, enforce protection policies, and record the response where the activity occurs.
Customer Portal
Review enrolled stations and alerts. Track connectivity and manage licenses from a centralized account.
Open Customer PortalCONTROLLED MAINTENANCEAuthorized access.
Authorized access.
A defined window.
Maintenance Mode provides a time-limited window for authorized administrative work. Protection reactivates when the window ends.
ORGANIZATIONAL USE & IT GOVERNANCE
A DESIGNATED IT LEAD. A DEFINED ENGAGEMENT.Your organization.
Your IT lead.
Sentinel CS serves companies, clinics, and healthcare organizations through an appointed IT lead.
Offered to organizations only. Individual and personal-use subscriptions are not offered.
Managed by your appointed IT professional.
Your IT lead owns deployment, organization-specific rules, approved support workflows, report review, and Maintenance Mode.
A signed Business Associate Agreement.
For healthcare customers, Sentinel CS and your organization will sign a Business Associate Agreement (BAA) as part of the service engagement.
The signed agreement defines the parties' responsibilities for the handling and safeguarding of protected health information within the agreed service scope.
Discuss your healthcare engagementCLINICAL WORKFLOWS & CONTINUITY
Rules shaped around your clinic.
Validate the configuration against clinical, billing, laboratory, and authorized support workflows before rollout.
Validate before rollout.
Test on the intended workstation configuration before wider deployment. Compatibility is assessed for your specific environment.
Approve the right restrictions.
Approve tools and restrictions based on the clinic's software and operating requirements.
Manage legitimate-tool interruptions.
Review a legitimate-tool restriction, adjust the applicable rule or authorize maintenance, then verify the workflow and returned protection state.
05 / DEPLOYMENT & LICENSING
ONE LICENSED WINDOWS COMPUTER = ONE STATIONProtection sized
to your environment.
Your station count determines the monthly rate for each licensed Windows computer in your organization.
Contact Sales| Deployment | Per station / month |
|---|---|
| 1 station | $19.99 USD |
| 2–9 stations | $14.99 USD |
| 10+ stations | $9.99 USD |
Monthly billing. No annual contracts. Organizational use only, including single-station deployments.
INCLUDED WITH YOUR SUBSCRIPTION
Current software.
Support for your IT lead.
Active station subscriptions include ongoing version updates and unlimited technical support for your IT lead.
Ongoing version updates
Access new Sentinel CS versions as they are released throughout your active subscription. Your IT lead coordinates updates within your organization's maintenance procedures.
Unlimited support for your IT professional
Get help with Sentinel CS questions and troubleshooting through your appointed IT resource.
Support access for active customers
Support contact information and access to support chat are provided exclusively to active customer accounts. Prospective customers can contact Sales to discuss their organization's requirements.
Customer documentation
After account activation, customers receive documentation detailing subscription administration and cancellation procedures. Contact Sales with questions about the service before subscribing.
REPORTING & OPERATIONAL EVIDENCE
INVENTORY. EVIDENCE. TRACEABILITY.A dated record.
A clearer view.
Station Activation & Monitoring Report
A provider-issued snapshot of registered stations, license allocation, recorded versions, and stored heartbeat evidence.
Open Customer PortalKnow what is registered.
Review the subscription snapshot, seat allocation, and station records. Historical released stations are distinguished from current inventory.
Read the timing and limitations.
Issue time, evidence cutoff, and the report-specific freshness window provide context for recorded versions and heartbeats. Evidence exceptions are identified for review.
Keep the original record.
An authenticity reference and document status identify the record at issuance. Original bytes and their SHA-256 hash are retained in the authenticated Customer Portal. The reference is not a digital signature or a public document URL.
The report reflects registered inventory and stored evidence at issuance. It does not attest live endpoint health or continuous protection, and is not an independent audit or compliance certificate. Missing cloud evidence does not establish that local monitoring is disabled.
DIAGNOSTICS & SUPPORT
Generated locally.
Exported by your IT lead.
Diagnostic log files are generated on the workstation to investigate software behavior and technical issues.
When IT initiates an export, it is delivered to the registered customer email and made available in the Customer Portal account. The files can also be shared with support for troubleshooting.
Log exports are distinct from the heartbeats and selected security events used for operational visibility.
DOCUMENTATION
A closer look.
Product context for business and IT teams.
DEFINE YOUR BOUNDARY.
Put your policies
into action.
Bring your IT lead.
Let’s discuss your organization’s deployment and service requirements.