Apotrope — Windows Security Posture Auditor

// Features

A fast, honest read on the box in front of you.

No setup, no accounts, no data leaving the machine. Run one executable and get a prioritised, fixable list.

Single Executable

Drop apotrope.exe on a USB stick and run it on any Windows machine. No install, no Python, no dependencies.

Fully Offline

No data leaves the machine. No telemetry, no cloud APIs, no license servers — your audit data stays yours.

CIS Benchmark Mapping

Every finding is annotated with its CIS Benchmark control ID — v5.0.0 for Windows 11, v4.0.0 for Windows 10 — detected automatically at scan time.

Scored & Graded

A 0–100 security score with an A–F letter grade gives you an at-a-glance read on the system's risk posture.

HTML, Executive & JSON Reports

Export a self-contained technical HTML report, a plain-English executive Security Posture Assessment for decision-makers, or structured JSON for pipeline integration.

Comparative Scanning

Save a baseline and diff against it later to track remediation progress with --baseline and --compare.

Custom Profiles

An apotrope.toml profile lets you disable checks, override severities, and tune thresholds for your environment.

Actionable Remediation

Every failing check ships a concrete fix command or Group Policy path — not just a description of the problem.

// Checks

One scan, the controls that actually move risk.

Fourteen categories of Windows security posture, mapped to CIS and scored by severity.

50+Checks

14Categories

~22sPer scan

Access Control4 checks

UAC enabled, admin & standard consent prompts, secure desktop.

Accounts6 checks

Built-in admin & guest state, local-admin count, password complexity, length & lockout.

Antivirus4 checks

Defender real-time, signature age, tamper protection, registered AV.

Encryptionper drive

BitLocker drive-encryption status, per fixed drive.

File Sharing3 checks

SMB signing, SMB encryption, legacy SMBv1 disabled.

Firewall6 checks

Domain, private & public profile state and default inbound action.

Hardening5 checks

Audit policy, AutoPlay, screen-lock timeout, Spectre/Meltdown, WinRM.

Network5 checks

LLMNR & NetBIOS, IPv6, listening & risky ports.

Patching3 checks

Update-service health, pending updates, time since last update.

Persistence2 checks

Startup programs and non-Microsoft scheduled tasks.

PowerShell5 checks

Script-block & module logging, execution policy, Constrained Language Mode, PSv2.

Remote Access3 checks

RDP exposure, Network Level Authentication, RDP port.

Services2 checks

Risky services and unquoted service paths.

System6 checks

OS version & end-of-support, Secure Boot, TPM, uptime, domain membership.

// Scoring

A transparent score you can reason about.

Start at 100. Each failing or warning check deducts points weighted by severity. The total maps to a letter grade.

Point deductions

Severity	Fail	Warn
Critical	−15	−7
High	−10	−5
Medium	−5	−2
Low	−2	−1
Info	0	0

A90 – 100Excellent

B80 – 89Good

C70 – 79Fair

D60 – 69Poor

F0 – 59Critical

// Report

A report you can email to someone who wasn't in the room.

One self-contained HTML file — gauge, prioritised findings, CIS mappings, remediation — that opens in any browser with no server and no network.

See the full sample report.

Filterable findings, copy-ready fixes, and a score you can defend. Generated entirely on the audited machine.

Open live sample report →

Result mix

✓ 34 pass ✗ 3 fail ! 3 warn i 13 info

Need it for the boardroom? The Security Posture Assessment is a plain-English executive report — grade, verdict, business impact, and a prioritised remediation roadmap. Open the executive sample →

// Get Started

Up and running in under a minute.

Standalone apotrope.exe below — no Python required. Have Python 3.12+? pip install apotrope and run apotrope instead.

Download the executable

Grab apotrope.exe from the latest release and save it somewhere easy to find — Desktop or Downloads works fine.

Want to verify it first? See Verify Your Download — SHA-256 plus CI build provenance. Installing with pip instead? There's no exe to hash; your integrity comes from PyPI (PEP 740 attestations).

Open an Administrator terminal

Right-click PowerShell or Command Prompt → Run as administrator. Some checks (BitLocker, local accounts, services) need elevation for full results.

Go to the folder you saved it in

cd $env:USERPROFILE\Downloads

In Command Prompt: cd %USERPROFILE%\Downloads

Run a scan

.\apotrope.exe

The .\ prefix is required — PowerShell doesn't run programs from the current folder by bare name. It works in Command Prompt too.

Generate an HTML report

.\apotrope.exe --html report.html --verbose

Opens as a standalone file in any browser — no server required.

Track changes over time

.\apotrope.exe --baseline before.json # ... remediate findings ... .\apotrope.exe --compare before.json

// FAQ

Questions, answered straight.

The things people ask before running an unknown binary on a machine they care about.

Does Apotrope send any data off the machine?

No. Apotrope is fully offline and read-only. It makes no network connections and has no telemetry.

Does Apotrope change my system?

No. It is read-only. It reads configuration to evaluate it and does not change your settings, the registry, or files. One check exports the current security policy to a temporary file that it reads and deletes immediately; nothing on your system is modified.

Which CIS Benchmark versions does it use?

CIS Microsoft Windows 11 Enterprise Benchmark v5.0.0 and Windows 10 v4.0.0, selected automatically from the OS build.

Is Apotrope free?

Yes. Free and open source under the MIT license. No account or key.

Do I need Python?

No. The standalone apotrope.exe needs no Python. You can also install via pip on Python 3.12+.

How it compares: Is there a Lynis for Windows? · Apotrope vs CIS-CAT Lite · Apotrope vs Harden Windows Security