Device settings by group
Screensaver and screen lock, wallpaper, the message before sign-in, firewall, automatic OS updates, USB storage, remote desktop and the guest account, for each department, office or update ring.
Passkey-X Controller
Every company computer, under signed control.
The Controller is a small background service on Windows, macOS and Linux. IT sets the screensaver and lock, wallpaper, firewall, USB storage and Passkey-X settings for each group, rolls out updates, installs software and runs remote actions. Everything that changes a computer is signed with your organization's key, so not even a compromised server can push a change.
Signed with your key Report-only mode Business and Enterprise
Report only, then enforce
Start in report-only mode to see what would change on every computer. Switch to enforce and drift is put back automatically.
Staged Passkey-X updates
Early, stable, pinned or paused per group, a rollout percentage, maintenance windows, a minimum version, and an automatic stop with rollback when updates fail.
Software in the background
Install or remove apps silently with winget, Homebrew, apt and dnf, or your own installer checked by SHA-256. Mark apps required or blocked per group. (Enterprise)
Local admin passwords
Each computer sets its own random admin password, sealed to your organization's key so only your admins can open it, with a reason. It changes again after every checkout. (Enterprise)
Just-in-time admin rights
People ask for admin rights in the Passkey-X app. IT approves, and the rights end by themselves after 15 minutes to 4 hours, even if the computer is offline. (Enterprise)
Lost mode and offline lockdown
Lock a lost laptop with your message and remove the Passkey-X data on it. A computer that stays offline too long locks itself down.
Tamper-evident results
Every result is signed by the computer and chained to the one before, so a changed or missing record shows in the console.
IT roles
Give your IT team “Control company computers” without making them organization admins; local admin passwords need a separate permission.
Get started
Up and running in minutes.
- Step 1
Set up your keys
An owner creates the organization's signing and escrow keys in the browser. The private halves stay in a vault you choose.
- Step 2
Install the Agent pack
Run one command on each computer, or deploy it with Intune, Jamf or a script. Computers join the group the install code names.
- Step 3
Sign a baseline
Choose the settings, start in report-only mode, then enforce. Computers apply it within minutes.
Questions
Frequently asked
Which plan includes the Controller?
Business includes the Controller: device settings, report-only mode, Passkey-X settings and staged updates, remote actions, lost mode and offline lockdown. Enterprise adds software install and removal, local admin passwords, just-in-time admin rights, computer logins and two-person approval. Team gets the computers' security score.
Can Passkey-X push something to our computers without us?
No. Every baseline and every sensitive action must be signed with your organization's key, which only your admins hold. The Controller pins that key and refuses anything else.
Does it replace the Micro Agent?
Yes. The Controller is the Micro Agent's upgrade: the same small program and the same enrollment. Computers that run the Micro Agent update themselves.
Does it work with Intune, Jamf or Group Policy?
Yes. A setting another tool already manages is left alone and shown as managed elsewhere.
See it with your own data.
Start free in minutes, or book a walkthrough for your team.