Insights
Problems RevoSecure explains by joining data from two or more modules, the rules behind them, and how the customer's ideal state applies.
Updated
An insight is a problem that only becomes clear when you put two modules side by side: a breached mailbox whose account is also showing risky sign-ins, or updates that fail because ThreatLocker blocks the installer. Insights appear on Home (Top insights, across customers) and on each customer's Overview (Insights), most severe first.
Each insight has a severity, a plain explanation, evidence rows that link to the records involved, and a next step with a link to where you act. Insights are worked out fresh from the data every time you open the page.
The rules
| Insight | Modules | When it appears |
|---|---|---|
| Mail authentication gaps on a Microsoft 365 domain | External assessments + Microsoft 365 | Open SPF, DKIM or DMARC findings on a domain verified in the customer's tenant. With mailboxes on the domain, the next step is the Exchange Online fix; with none, locking down a parked domain |
| Exposed account showing signs of misuse | Dark web + Microsoft 365 | A mailbox in breach data whose account is also risky or confirmed compromised in Entra ID, or forwards mail outside the organisation |
| Exposed administrator without phishing-resistant MFA | Dark web + Microsoft 365 | A Microsoft 365 admin in breach data without phishing-resistant MFA |
| Known-exploited vulnerability on an unprotected device | Devices (+ ThreatLocker) | A device with known-exploited or threat-watch exposures whose antivirus isn't protecting it, or (with ThreatLocker) that isn't in an enforcing mode |
| Updates blocked by ThreatLocker | Devices + ThreatLocker | Updates that failed in the last 30 days with an access-denied or blocked-by-policy error on a computer ThreatLocker is enforcing |
| Updates failing because of the device's state | Devices + patching | Updates that failed in the last 30 days because of a pending restart or low disk space |
| Internet-exposed service at a customer site | External assessments + devices | An internet-exposed service on a public IP address that enrolled devices connect from |
| Agent silent on a device that's still on | Devices + ThreatLocker | RevoAgent stopped reporting while ThreatLocker saw the same computer recently (often an agent update blocked by ThreatLocker) |
| Retired devices still holding seats | Devices + ThreatLocker | Devices silent for 30 days in both Revo and ThreatLocker |
A rule only runs for customers whose modules it needs are all active. A customer without ThreatLocker never gets a ThreatLocker insight.
The ideal state applies
Insights respect the customer's ideal state: findings outside it, Microsoft 365 issues marked outside the baseline and checks whose control isn't required never produce an insight. Accepted and false-positive findings aren't open, so they never count either.
Insights on a record
The same insights show on the record they're about, in its Related context panel: open a device, a finding, a Microsoft 365 user or a vulnerability to see the insights that name it. See Related context.
The AI analyst can read insights too: ask it why something is wrong and it checks them.