Harden every Windows laptop.
Keep your data in.
MavionShield audits each machine against a security baseline, remediates the gaps with one click, and keeps watching — admin-elevated, safe-by-default, and fully reversible. Built for teams whose customer data can't afford to walk out the door.
Your data leaves when people do
Open networks and unlocked endpoints make it trivial to copy customer lists to a USB stick, a personal inbox, or the cloud. Every unhardened laptop is a door left open.
Removable media
A lead list copied to a USB drive in seconds. MavionShield makes removable drives read-only, or blocks them entirely.
Disabled protections
Defender turned off, Guest re-enabled, the firewall dropped. MavionShield detects it and re-enforces the baseline.
Unencrypted disks
A lost or stolen laptop is a data breach. MavionShield checks BitLocker and guides encryption with escrowed keys.
Audit → review → remediate → monitor
A clear, safe workflow — nothing changes without your say-so, and everything can be undone.
Audit
A read-only scan scores the machine against a baseline across 7 categories — in seconds, with zero changes.
Review
See each gap in plain language with its risk and exact fix. Pick what to apply; risky items stay manual.
Remediate
A restore point and per-change backup are taken first, then the selected fixes are applied — reversibly.
Monitor
It stays resident and alerts the moment a hardened setting is switched off, offering to re-apply it.
A 30-control audit across 7 categories
MavionShield evaluates encryption, accounts, device control, Microsoft Defender, network, applications and audit policy — then scores compliance and shows exactly what's weak.
- ✓ Severity-weighted compliance score, 0–100
- ✓ Edition-aware — gracefully marks controls N/A on Home
- ✓ Runs fully offline; no data leaves the machine
One-click remediation you can always reverse
Before anything changes, MavionShield creates a System Restore point and backs up each setting. Apply fixes with per-item confirmation — and roll back a whole run with a single command.
- ✓ Guardrails never lock out the admin or disable the last account
- ✓ High-risk changes (BitLocker, admin removal) stay manual by design
- ✓ Every action lands in a tamper-evident, hash-chained audit log
A background guard that never sleeps
MavionShield runs resident in the system tray after install. If a hardened control is switched off — USB protection, Defender, Guest account — it raises a notification and offers to re-apply it immediately.
- ✓ Starts automatically at logon
- ✓ Alerts only on new violations — no noise
- ✓ Watches the security posture, complementing network DLP
Seven categories. Thirty controls.
A practical baseline mapped to CIS and the Microsoft Security Baseline — covering the settings that actually stop data loss.
Encryption
2BitLocker on the OS drive and an escrowed recovery key.
Accounts
6UAC, Guest, password & lockout policy, screen lock, surplus admins.
Device control
4USB write-protect or block, AutoRun off, removable-device install control.
Defender
6Real-time, cloud & PUA protection, CFA, ASR rules, current signatures.
Network
4Firewall on, RDP off, SMBv1 removed, LLMNR hardening.
Applications
5SmartScreen, Office-macro blocking, WSH, AppLocker, PowerShell logging.
Reports for audits, a dashboard for the fleet
Every scan can produce a self-contained HTML/PDF report with score, deltas and per-control evidence — ideal for audits and DPDP due diligence. Opt in to central reporting and every endpoint rolls up into one compliance dashboard.
- ✓ Silent deployment via Intune or ManageEngine
- ✓ Scheduled drift scans catch regressions automatically
- ✓ Optional self-hosted aggregator — your data stays yours
A hardening tool you can trust itself
It's built to never make things worse — reversible, guard-railed, and auditable from the first run.
- ✓ Every change is captured first — restore point + per-control backup — and fully reversible.
- ✓ Guardrails never demote the last admin or lock the operator out.
- ✓ BitLocker is never enabled without an escrowed recovery key.
- ✓ A tamper-evident, hash-chained audit log records every action.
- ✓ Its data is ACL-locked to Administrators and SYSTEM.
- ✓ No database, no server — works fully offline on each machine.
- ✓ Startup integrity self-check verifies the signed binary.
- ✓ Distributed as a code-signed, single-file executable.
Mapped to the standards that matter
CIS Windows
Control targets align to CIS recommendations for encryption, accounts, Defender and audit policy.
Microsoft Security Baseline
Registry and policy targets follow the published baseline wherever the edition allows.
DPDP Act 2023
Evidence of "reasonable security safeguards" — encryption, access control, auditing and exportable reports.
Ship it to the whole fleet
One signed executable, two architectures, no dependencies.
Download & run
Self-contained x64 and ARM64 builds. No Python, no installer — the x64 build even runs on ARM via emulation.
Silent deploy
Push via Intune or ManageEngine and apply a chosen baseline non-interactively, per-machine reports included.
Central reporting
Optional self-hosted aggregator rolls up every endpoint's posture into one dashboard — on your network.
Questions, answered
Will it break anything?
No change is made without your confirmation, a System Restore point and a per-control backup are created first, and any run can be rolled back with one command. High-risk changes are left manual by design.
Does it send our data anywhere?
No. The agent works fully offline with no database and no server. Central reporting is strictly opt-in and sends only a compliance summary to a server you host.
Does it replace our DLP or antivirus?
It complements them. MavionShield hardens the endpoint and watches the security posture; it relies on Microsoft Defender for AV and on your network layer for real-time content DLP.
Which Windows versions are supported?
Windows 10 (21H2+) and Windows 11, on x64 and ARM64. Some controls are edition-gated (e.g. BitLocker, AppLocker) and are marked Not-Applicable on Home.
Is it signed?
Production releases are code-signed by MavionTech. Each download publishes its SHA-256 so you can verify it before running.
Close the doors before data walks out
Download MavionShield and harden your first laptop in minutes.