How it worksThe productFor MSPsPricing
Get startedSign in
The product

The reference,
in your hands.

Six surfaces, each shown as it renders rather than as an illustration of it. The port map is the one the console writes after a capture, the lint result is the real message a change set produces, and coverage is a fraction because a percentage with nothing under it is a number you cannot defend.

01

Read off the switch, not retyped.

A capture reads the ports, their VLANs, what is learned on them and the patch position each one serves. The jack label is linked to the switch port, so when a port moves VLAN the row for Room 101 moves with it.

PortsExample data
PortDescriptionVLANLinkPanelJack
Gi1/0/1uplink to core swtrunkconnectedA01
Gi1/0/2reception phone30connectedA02Reception desk
Gi1/0/320connectedA04Room 101 jack 2
Gi1/0/420free
Gi1/0/5printer back offic20connectedA07Back office
02

Checked against the live config.

The commands are generated from what you asked for, then checked against the configuration the switch actually reported. A change that would strand you is blocked; one that is merely unusual is flagged and left to you.

LintExample data
configure terminal
interface range GigabitEthernet1/0/3 - 4
 switchport mode access
 switchport access vlan 40
blockedDHCP snooping with no trusted port

Every offer on VLAN 20 would be dropped. Trust the uplink in this change.

checkGi1/0/3 shows 2 learned MACs, limit set to 1

A phone with a PC behind it needs at least 2.

okVLAN 40 exists on this switch

Created earlier in this change set.

03

Everything on the record.

Sites, assets, addressing and circuits. Every device carries an identifier, an address, a location and a support horizon, so a finding has somewhere to attach and a report has something to count.

InventoryExample data
AssetIdentifierAddressSiteStatusEnd of support
Edge firewallFW-HQ-0110.7.20.1HQup2029-06-30
Core switchSW-HQ-CORE10.7.20.10HQup2028-11-30
Access switchSW-BR-0110.7.20.11Branchup2027-03-31
Wireless controllerWLC-HQ10.7.20.12HQdegraded2027-09-30
HypervisorESX-DC-0210.7.20.13Data Centerup2030-01-31
04

A claim, and what it rests on.

Each finding carries the observation, the evidence behind it and the recommended action, in that order. Nothing asserts a state without naming where the state came from.

FindingExample data
HighARP binding changed for 10.7.20.1
ObservationThe hardware address answering for the gateway changed twice in the reporting period.
EvidenceCollector hq-desk · ARP table · 2 occurrences · first seen Aug 25
AssessmentA gateway whose hardware address changes without a planned swap is worth explaining before it is dismissed.
RecommendationConfirm whether the firewall was replaced or failed over. If neither, treat as unexplained.
05

What is watching, and from where.

A collector belongs to exactly one environment and cannot report to another. Enrol it with a code that works once, revoke it whenever you like, and see the moment it stops reporting.

CollectorsExample data
CollectorLocationStateLast reported
hq-deskHQReporting1 min ago
branch-nasBranchReporting4 min ago
dc-jumpData CenterAwaiting enrollmentnever
Enrollment code · valid 24 hours · single use
A1B2C3D4E5F6
The collector itself does not expire. It reports until you revoke it.
06

Including what nobody looked at.

Unmeasured is a first-class state. A control that could not be read is excluded from the score and reported as coverage, so a high number on thin coverage never passes for a strong posture.

CoverageExample data
92%of controls measured
Measured34 controls
Unmeasured3 controls

The three unmeasured controls are excluded from the score rather than counted as passes. A score is only defensible if the method is visible.

Know what you are standing on.

Groundplane turns infrastructure reality into a reference you can explain.

Get startedSee how it works