CompromiseLens Documentation
Everything you need to deploy, configure, and get value from CompromiseLens — the endpoint compromise assessment platform for individuals, businesses, and IT teams.
What is CompromiseLens?
CompromiseLens is a Windows endpoint security assessment tool that scans your devices for indicators of compromise, malware, misconfigurations, and suspicious activity. It delivers actionable findings with MITRE ATT&CK mappings and remediation steps to your secure cloud dashboard.
How it works
Download the agent
Get CompromiseLens.exe from your dashboard. A single portable executable — no installation required.
Run on your Windows endpoint
Double-click for the GUI, or run from command line. Requires local administrator rights for full scan coverage.
Nine modules scan in parallel
Startup items, scheduled tasks, network connections, user accounts, AV scan, browser extensions, shadow AI, and more.
View findings on your dashboard
Results post automatically to dashboard.compromiselens.com with severity scores, MITRE mappings, and remediation steps.
System requirements
| Requirement | Details |
|---|---|
| Operating System | Windows 10, Windows 11, Windows Server 2016/2019/2022 |
| Architecture | 64-bit (x64) |
| Permissions | Local administrator rights required for full scan coverage |
| Internet | Required to post findings to dashboard (offline mode saves locally) |
| Disk space | ~150MB for the agent executable |
Quick Start
Get CompromiseLens running on your first endpoint in under 5 minutes.
Step 1 — Create an account
Go to dashboard.compromiselens.com and register. Your licence key will be generated automatically.
Step 2 — Download the agent
After logging in, go to Download Agent in the sidebar. Download CompromiseLens.exe and copy it to the endpoint you want to scan.
CompromiseLens.exe is a portable executable. Copy it anywhere — USB drive, network share, or local folder — and run it directly.
Step 3 — Run a scan
Choose your preferred mode:
Personal users — double-click GUI
Double-click CompromiseLens.exe. Enter your licence key and click Start Scan.
IT professionals — command line
set COMPROMISELENS_KEY=CL-PER-XXXXXXXXXXXXXXXX
CompromiseLens.exe --mode full --server-url https://api.compromiselens.comStep 4 — View results
Once the scan completes, findings are posted to your dashboard automatically. Open dashboard.compromiselens.com to review findings, risk score, and remediation steps.
Run CompromiseLens as a local administrator for full scan coverage. Some modules (Security event log, network process mapping) require elevated privileges.
Installation
CompromiseLens requires no installation. This page covers deployment options for different scenarios.
Portable deployment (recommended)
Copy CompromiseLens.exe to any location on the target machine and run it directly:
C:\Tools\CompromiseLens.exe --mode full --server-url https://api.compromiselens.comUSB drive deployment
Copy the exe to a USB drive. Plug into any Windows endpoint and run. Useful for air-gapped or restricted environments.
Network share deployment
Copy the exe to a network share accessible from your endpoints:
\\server\tools\CompromiseLens.exe --mode full --server-url https://api.compromiselens.comGPO deployment (enterprise)
Deploy via Group Policy for automated fleet scanning. See the GPO Deployment guide for full instructions.
Setting your licence key
Set your licence key as an environment variable before running:
# CMD
set COMPROMISELENS_KEY=CL-PER-XXXXXXXXXXXXXXXX
# PowerShell
$env:COMPROMISELENS_KEY = "CL-PER-XXXXXXXXXXXXXXXX"
# Permanent (system-wide)
setx COMPROMISELENS_KEY "CL-PER-XXXXXXXXXXXXXXXX" /MYour First Scan
Run your first scan and understand what the results mean.
Running the scan
CompromiseLens.exe --mode full --server-url https://api.compromiselens.com --no-aiWhat you'll see
=================================================
COMPROMISELENS v1.0
Endpoint Security Assessment Agent
=================================================
Computer : WORKSTATION-01
OS : Microsoft Windows 11 Pro
Type : Windows Desktop
Tier : personal
Modules : user_audit, persistence, event_logs...
=================================================
[*] Running: user_audit...
[+] user_audit: 2 finding(s)
[*] Running: network...
[+] network: 5 finding(s)
...
[*] DONE. Risk score: 74/100 (Critical)Understanding the risk score
| Score | Label | Meaning |
|---|---|---|
| 0–20 | LOW | Few findings, low severity. Review and monitor. |
| 21–40 | MEDIUM | Some findings requiring attention. Schedule remediation. |
| 41–70 | HIGH | Significant findings. Remediate promptly. |
| 71–100 | CRITICAL | Critical findings detected. Act immediately. |
GUI Mode
The graphical interface for personal and family users. No command line needed.
Launching the GUI
Double-click CompromiseLens.exe — it automatically opens the GUI window. You can also force GUI mode from the command line:
CompromiseLens.exe --guiGUI overview
| Element | Description |
|---|---|
| Licence Key field | Enter your licence key here. Click Save to store it permanently. |
| Server URL | Pre-filled with the CompromiseLens API. Don't change unless using a custom server. |
| Start Scan button | Begins a full scan. All modules run in the background — the window stays responsive. |
| Scan Output | Live log showing each module as it runs, with colour-coded results. |
| Open Dashboard | Opens your browser to dashboard.compromiselens.com after the scan completes. |
| Open Reports Folder | Opens the local reports folder in Windows Explorer. |
Where results are saved
Reports are saved locally to: %APPDATA%\CompromiseLens\Reports\
Findings are also posted to your dashboard automatically if a server URL is configured.
Tray Mode
Runs silently in the Windows system tray. Scan on demand with desktop notifications.
Launching tray mode
CompromiseLens.exe --trayA CL icon appears in your system tray (bottom right, near the clock). Right-click to access the menu.
Tray menu — Personal / Family
Last scan: 2026-06-01
10 findings (1 critical) — Risk: 59/100
────────────────────────────────
🔍 Scan Now
📊 Open Dashboard
🖥️ Open GUI
────────────────────────────────
Auto-scan: OFF
────────────────────────────────
❌ ExitTray menu — Business tiers (IT managed)
Last scan: 2026-06-01
10 findings (1 critical) — Risk: 59/100
────────────────────────────────
🔍 Scan Now
ℹ️ View Last Summary
────────────────────────────────
❌ ExitFor Small Business, Business, Enterprise, MSP, and OT tiers, the tray menu only shows Scan Now and a local summary. Dashboard access and settings are managed by IT administrators.
Auto-scan (Personal / Family only)
Enable auto-scan from the tray menu. CompromiseLens will automatically scan at your configured schedule (daily, weekly, or monthly) and notify you of results.
CLI Mode
Full command-line control for IT professionals, automated scripts, and GPO deployment.
Basic usage
CompromiseLens.exe --mode full --server-url https://api.compromiselens.comAll arguments
| Argument | Values | Description |
|---|---|---|
--mode | full, targeted | Scan mode. Full runs all modules. Targeted runs one. |
--module | module name | Module to run in targeted mode. |
--server-url | URL | API endpoint to post findings to. |
--output | path | Directory to save local report files. |
--alert-type | alert type | Run modules relevant to a specific alert type. |
--no-ai | flag | Skip AI narrative generation. |
--gui | flag | Force GUI mode. |
--tray | flag | Launch system tray mode. |
Examples
# Full scan with dashboard posting
CompromiseLens.exe --mode full --server-url https://api.compromiselens.com
# Save report to specific folder
CompromiseLens.exe --mode full --output C:\SecurityReports --no-ai
# Targeted scan — network module only
CompromiseLens.exe --mode targeted --module network
# Run modules for a specific alert type
CompromiseLens.exe --alert-type brute_force --server-url https://api.compromiselens.comGPO Deployment
Deploy CompromiseLens across your fleet using Group Policy. Automate scanning on a schedule.
Step 1 — Copy the exe to a network share
\\dc01\SYSVOL\compromiselens\CompromiseLens.exeStep 2 — Create a GPO scheduled task
Open Group Policy Management
On your domain controller, open Group Policy Management Console (GPMC).
Create a new GPO
Right-click your OU → Create a GPO in this domain. Name it CompromiseLens Scan.
Add a scheduled task
Edit the GPO → Computer Configuration → Preferences → Control Panel Settings → Scheduled Tasks → New → Scheduled Task.
Configure the task
Program: \\dc01\SYSVOL\compromiselens\CompromiseLens.exe
Arguments: --mode full --server-url https://api.compromiselens.com --no-ai
Run as: SYSTEM (or a dedicated service account with local admin rights)
Trigger: Daily at 09:00, or your preferred schedule.
Set the licence key
Add a GPO environment variable: COMPROMISELENS_KEY = CL-SMB-XXXXXXXXXXXXXXXX under Computer Configuration → Preferences → Windows Settings → Environment.
Phase 6 will add a Windows service agent with remote scan triggers, heartbeat monitoring, and fleet management directly from the dashboard — eliminating the need for GPO scheduling.
Understanding Findings
Every finding CompromiseLens generates follows a consistent structure with actionable remediation steps.
Finding structure
| Field | Description |
|---|---|
| Severity | Critical, High, Medium, Low, or Info |
| Title | Short description of what was found |
| Module | Which scan module detected this finding |
| Detail | Full explanation of the finding and its risk |
| Raw Evidence | The actual data that triggered the finding |
| Remediation | Step-by-step instructions to fix the issue |
| MITRE Technique | ATT&CK technique ID (e.g. T1566) |
| MITRE Tactic | ATT&CK tactic (e.g. Initial Access) |
| Status | Open, In Progress, or Resolved |
Recurring findings
If the same finding appears across multiple scans, CompromiseLens tracks the recurrence count. Recurring findings indicate a persistent issue that has not been remediated.
Severity Levels
CompromiseLens uses five severity levels to help you prioritise remediation.
| Severity | Description | Action |
|---|---|---|
| Critical | Active compromise indicators, malware detected, security controls disabled | Act immediately — isolate if needed |
| High | Significant vulnerabilities, suspicious activity, dangerous configurations | Remediate within 24–72 hours |
| Medium | Configuration weaknesses, policy gaps, non-critical suspicious items | Remediate within 7 days |
| Low | Minor issues, informational alerts, best practice recommendations | Address in next maintenance window |
| Info | Clean scan results, successful checks, informational data points | No action required |
MITRE ATT&CK Mapping
Every finding is mapped to a MITRE ATT&CK technique and tactic for security context and threat intelligence correlation.
What is MITRE ATT&CK?
MITRE ATT&CK is a globally recognised knowledge base of adversary tactics and techniques. Each technique has a unique ID (e.g. T1566) that security teams use to understand and communicate threats.
Common techniques in CompromiseLens findings
| Technique | Name | Tactic | Module |
|---|---|---|---|
T1547.001 | Registry Run Keys / Startup Folder | Persistence | persistence |
T1053.005 | Scheduled Task/Job | Persistence | persistence |
T1110 | Brute Force | Credential Access | event_logs |
T1021.001 | Remote Desktop Protocol | Lateral Movement | event_logs |
T1070.001 | Clear Windows Event Logs | Defense Evasion | event_logs |
T1059.001 | PowerShell | Execution | event_logs |
T1046 | Network Service Discovery | Discovery | network |
T1210 | Exploitation of Remote Services | Lateral Movement | network |
T1562.001 | Disable or Modify Tools | Defense Evasion | security_config |
T1136.001 | Create Local Account | Persistence | user_audit |
Remediation Guide
Every finding includes step-by-step remediation instructions. This page covers common fixes.
Windows Defender disabled
Set-MpPreference -DisableRealtimeMonitoring $falseSMBv1 enabled
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
Restart-Service -Name ServerUAC disabled
Open Control Panel → User Accounts → Change User Account Control settings. Set to "Notify me only when apps try to make changes".
RDP exposed on all interfaces
# Block RDP at Windows Firewall for external IPs
New-NetFirewallRule -DisplayName "Block RDP External" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Block -RemoteAddress !192.168.0.0/16Suspicious scheduled task
Unregister-ScheduledTask -TaskName "SuspiciousTaskName" -Confirm:$falseUnknown admin account
net user SuspiciousUsername /active:noScan Modules
CompromiseLens runs nine specialised detection modules. Each module targets a specific attack surface.
| Module | What it checks | Tier |
|---|---|---|
user_audit | Local admin accounts, guest account, domain admin count | All |
network | Open ports, SMBv1, Windows Firewall status | All |
security_config | Windows Defender, BitLocker, UAC, audit policy, pending updates | All |
persistence | Registry run keys, scheduled tasks, startup folder items | Personal+ |
event_logs | Failed logins, RDP sessions, log clearing, PowerShell abuse, new accounts | Personal+ |
vuln_snapshot | Installed software versions, known vulnerable applications | Personal+ |
browser_audit | Sideloaded extensions, suspicious browser data (desktop only) | Personal+ |
shadow_ai | Unauthorised AI tools, data upload to external AI services (desktop only) | Personal+ |
av_scan | Windows Defender scan, third-party AV status, malware detection | Personal+ |
ot_audit | OT/ICS-specific checks, Purdue model compliance (OT tier) | OT only |
browser_audit and shadow_ai are automatically excluded on Windows Server as browsers are not typically present on server operating systems.
Dashboard Overview
The CompromiseLens dashboard at dashboard.compromiselens.com is your central hub for viewing findings, managing devices, and downloading reports.
Pages
| Page | Description |
|---|---|
| Overview | Risk score gauge, critical findings count, latest findings, enrolled devices |
| Findings | Full findings table with severity filters and MITRE mappings |
| Devices | All enrolled endpoints with last seen date and status |
| Reports | Generate and download security reports on demand or on schedule |
| Licence | View your licence key, plan, expiry, and endpoint limit |
| Download Agent | Download CompromiseLens.exe with quick start instructions |
| Settings | Profile, MFA, notification preferences, danger zone |
MFA Setup
Add two-factor authentication to your account using an authenticator app.
Enabling MFA
Go to Settings → Security & MFA
Log in to your dashboard and navigate to Settings → Security & MFA.
Click Enable MFA
A secret key will be generated and displayed on screen.
Add to your authenticator app
Open Google Authenticator, Authy, or any TOTP app. Add a new account using the secret key shown.
Enter the 6-digit code
Enter the current code from your authenticator app and click Confirm & Enable.
Store your MFA secret key in a safe place. If you lose access to your authenticator app, contact support to reset MFA on your account.
Licence Keys
Your licence key controls which modules run and how many endpoints you can scan.
Key format
CL-PER-B9AC6C23BFC61847 ← Personal
CL-FAM-A1B2C3D4E5F60001 ← Family
CL-SMB-XXXXXXXXXXXXXXXX ← Small Business
CL-BIZ-XXXXXXXXXXXXXXXX ← Business
CL-ENT-XXXXXXXXXXXXXXXX ← Enterprise
CL-MSP-XXXXXXXXXXXXXXXX ← MSP
CL-OT-XXXXXXXXXXXXXXXX ← OTSetting your licence key
# Environment variable (recommended)
set COMPROMISELENS_KEY=CL-PER-XXXXXXXXXXXXXXXX
# GUI — enter in the Licence Key field and click Save
# Permanent system-wide
setx COMPROMISELENS_KEY "CL-PER-XXXXXXXXXXXXXXXX" /MFinding your licence key
Your licence key is displayed in the Licence page of your dashboard. It is also emailed to you after purchase.
Plans & Limits
CompromiseLens plans are designed for individuals, families, businesses, and managed service providers.
| Plan | Monthly | Annual | Endpoints | Trial |
|---|---|---|---|---|
| Personal | $4.99 | $47.88/yr | 1 | 7 days |
| Family | $9.99 | $95.88/yr | 5 | 7 days |
| Small Business | $99 | $949/yr | 25 | 14 days |
| Business | $299 | $2,869/yr | 50 | 14 days |
| Enterprise | $899 | $8,629/yr | 200 | 14 days |
| MSP | $1,799 | $17,269/yr | 500 | 14 days |
All plans include a free trial period. A valid payment method is required to start the trial. You will not be charged until the trial ends.
API Reference
The CompromiseLens API is available at https://api.compromiselens.com. Interactive docs at api.compromiselens.com/docs.
Authentication
All authenticated endpoints require a Bearer token obtained from /auth/login.
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...Key endpoints
| Method | Endpoint | Description |
|---|---|---|
| POST | /auth/register | Create a new account |
| POST | /auth/login | Login and get JWT token |
| GET | /auth/me | Get current user info |
| POST | /auth/mfa/setup | Generate MFA secret |
| POST | /auth/mfa/confirm | Confirm and enable MFA |
| POST | /findings | Post scan findings (agent) |
| GET | /findings | Get findings for org |
| GET | /devices | List enrolled devices |
| GET | /licences/my-licence | Get current licence details |
| POST | /licences/validate | Validate a licence key |
| POST | /webhooks/stripe | Stripe webhook handler |
Frequently Asked Questions
Does CompromiseLens require installation?
No. CompromiseLens.exe is a single portable executable. Copy it anywhere and run it directly. No MSI installer, no Program Files entry, no registry keys on exit.
Do I need administrator rights?
Yes — local administrator rights are required for full scan coverage. Several modules (Security event log, network process mapping, Windows Defender) require elevated privileges. Run as administrator for best results.
Does it work on Windows Server?
Yes. CompromiseLens supports Windows Server 2016, 2019, and 2022. It automatically detects the OS type and adjusts module behaviour accordingly (e.g. browser modules are excluded on Server Core).
Does it work offline?
Yes. All nine scan modules run fully offline. Findings are saved locally as JSON and PDF reports. If a server URL is configured and internet is available, findings are also posted to your dashboard.
What data is sent to the server?
Only scan findings metadata — finding type, severity, hostname, MITRE technique, and remediation status. No file contents, no passwords, no personal data. All transmission is over HTTPS.
How do I reset my password?
Email support@compromiselens.com. Password reset via the dashboard is coming in a future update.
How do I get support?
Email support@compromiselens.com. Include your licence key prefix (e.g. CL-PER-...) and a description of the issue.
Managing Devices
Devices are enrolled automatically when the agent runs and posts findings to the dashboard.
How devices are enrolled
When CompromiseLens.exe runs with a --server-url, it posts the device hostname, IP address, OS version, and agent version to the API. The device appears in your dashboard automatically.
Device limit by plan
Each plan has an endpoint limit. If you exceed your limit, new devices will still scan but findings may not be posted until you upgrade. Check your current usage in the Licence page.
Reports
CompromiseLens generates several report types automatically and on demand.
Available reports
| Report | Frequency | Description |
|---|---|---|
| Weekly Security Summary | Weekly | New findings, resolved items, risk trend |
| Insider Threat Report | Weekly | Suspicious user activity, after-hours access, shadow AI |
| Monthly Executive Report | Monthly | Risk posture, findings trend, compliance summary |
| Remediation Status | Weekly | Open tickets, overdue items, SLA status |
| Full Scan Report | Per scan | All findings with MITRE mappings and remediation steps |