Enterprise Cybersecurity Platform

Active Directory, Entra ID, Exchange Online, Tenant Management, File Server, Endpoint Security, CIS Benchmark, SSL Certificate Monitoring and Network Discovery — all in one platform, with real-time visibility.

CyLook Enterprise is a Security Visibility & Risk Intelligence platform that analyzes data from your existing IT and security infrastructure — Firewall, EDR, Active Directory, Microsoft Entra ID, Microsoft 365 and file servers — to make cybersecurity risks visible, measurable and manageable from a single security cockpit. It does not replace your existing SIEM, Firewall or EDR investment; it adds a visibility and risk-analysis layer on top of it.

Where Do Security Vulnerabilities Begin?

The majority of organizations already harbor unknown security vulnerabilities before a cyberattack occurs. The fundamental problem is a lack of visibility.

Password Management Issues

Passwords that never expire, accounts with empty passwords and credentials older than 365 days remain blind spots.

Over-Privileged Accounts

Unnecessary members in Domain Admin, Enterprise Admin and Schema Admin groups expand the attack surface.

File Server Permission Chaos

Orphan SIDs, stale shares and uncontrolled full-access permissions across hundreds of thousands of folders.

Unpatched Software

Critical CVEs lurking on hundreds of computers with no way to prioritize remediation efforts.

Expired SSL Certificates

No visibility into which server's certificate expires when; service outages cannot be prevented in advance.

Lack of Network Visibility

Unmanaged devices, open dangerous ports and newly joined assets go unnoticed.

Your Entire Security Environment in One View

CyLook's main dashboard presents all modules, the overall security score and 30-day per-module trend charts in one place.

Main Dashboard — Active modules and overall security score

Overview Dashboard

When you log in to the platform, you see the status of all modules, active alert counts and the overall security score at a glance.

Each module card is clickable; reach the relevant module with a single click.

Active Directory Entra ID Exchange File Server CIS Benchmark Endpoint Security

Security Score History — 30-day per-module trend chart

Active Directory

CyLook's Active Directory security audit tool scans your on-premises AD environment for vulnerabilities — Kerberoastable accounts, excessive Domain Admin privileges, weak password policies — and delivers real-time log alerts.

AD Dashboard — Targets and critical/high/medium/low finding summary

AD Inventory — 40+ security checks per Domain Controller

Control Categories — Account Management, Privileged Access, Kerberos, Domain Config, Credential Exposure, GPO Audit and more

Log Alerts — Real-time security alerts for suspicious activities; filter by severity level

Log Alert Rules — Customizable alert rules based on Event IDs

Kerberoastable Account Detection Empty / Non-Expiring Password Domain Admin Excess Real-Time Log Alerts Syslog Integration Security Score & Trend GPO Security Audit Excel / PDF Export

Entra ID (Azure AD)

Run a continuous Entra ID (Azure AD) security assessment of your Microsoft 365 and Azure environment — identity risks, conditional access gaps, privileged role anomalies — with real-time anomaly log monitoring.

Entra Dashboard — Tenant summary, critical/high/medium findings

Entra Inventory — Comprehensive identity security analysis covering Authentication, Conditional Access, Privileged Roles and more

Issue List — Permanent Privileged Role Assignments, Legacy Auth detection

Log Alerts — Real-time alerts for MFA manipulation, script/automation attempts and other suspicious identity events

Multi-Tenant Support Conditional Access Audit Privileged Role Tracking Auto-Refresh (15s / 30s / 1min) Identity Risk & Governance Excel / PDF Export

Exchange Online — Email Security

Audit your Microsoft 365 Exchange Online infrastructure for email security; keep mail flow, anti-spam, anti-phishing policies and mailbox security under control.

Security Scan — Audit & Compliance, Mail Flow Security, Anti-Spam / Anti-Phishing, Anti-Malware, Defender for Office 365, Transport Rules, Mailbox Security categories

Mailbox Audit Logging Check SPF / DMARC / DKIM Record Audit Anti-Phishing & Anti-Spam Policy Analysis Anti-Malware Protection Check Defender for Office 365 Check Transport Rules Security Analysis Mailbox Security — 7 Checks Log Collection & Log Alerts

Tenant Management — Microsoft 365

Inventory your Microsoft 365 tenant assets (users, mailboxes, groups); monitor SPF, DMARC, DKIM, MX and expiry dates for all domains in a single screen.

Tenant Information — Complete inventory of active users, mailboxes, shared mailboxes, distribution and security groups; mail activity summary

Domain Health — SPF, DMARC, DKIM, MX, MTA-STS, TLS-RPT, CAA record status and domain expiry date tracking for each domain

Tenant User & Mailbox Inventory M365 / Distribution / Security Group Tracking Domain Health Monitoring SPF / DMARC / DKIM / MX Status Check Domain Expiry Date Alert MTA-STS / TLS-RPT / CAA Record Tracking

File Server — NTFS & Share Permissions

Audit permissions across hundreds of thousands of folders, track changes and detect stale assets.

File Server Dashboard — Monitored servers, shares and folders; risk distribution by severity level

Inventory — Orphan SID Detected: Residual permissions belonging to deleted accounts

Permission Browser — Folder tree; NTFS Permissions, Share Permissions, Effective Access view

Stale Folders — Detection of folders not accessed for a long time; 30-day / 1-year / 2-year / 3-year threshold filtering

Permission Changes — NTFS permission change history and real-time comparison

Security Log Viewer — Filterable view of file access and security logs

Log Alert Rules — Customizable Event ID-based alerts for critical events like deletion, permission changes and file/folder access

Orphan SID Detection Stale Folder Detection Permission Change Tracking NTFS / Share / Effective Access User or Folder-Based Query Windows Event ID Log Alerts

CIS Benchmark

CyLook's CIS Benchmark compliance software audits Windows, SQL, Linux, MySQL and Apache servers against CIS standards; manage compliance scores, CVE vulnerabilities and patch prioritization in a single screen.

CIS Dashboard — Overall compliance score of active systems and platform-based distribution chart

CIS Inventory — Number of controls applied per system and compliance score; Account Policies, Windows Firewall, Audit Policy categories

Target Detail — Remote Monitoring: Processes, Services, Event Viewer, Hardware, Software, Users, Groups, PowerShell, CMD, Task Scheduler

CVE Vulnerabilities — Affected targets and CVE-based findings; detailed listing with CVE ID, CVSS score and description

Patch Prioritization — Ordered update plan starting from the software affecting the most systems

Windows Server / SQL / Linux / MySQL / Apache / PostgreSQL Detailed compliance score per system CVE Database (209K+ NVD) Patch Prioritization Remote Monitoring & Tools Exception Management with Exclusions

Endpoint Security

Monitor your computers for CVE vulnerabilities, compliance status and privileged session tracking.

Endpoint Security Dashboard — Compliance rate, coverage status and active local administrator session alerts for monitored computers

Computer Inventory — Connection status, OS, compliance score and last scan information

Patch Prioritization — Ordered software list by number of affected devices; priority update plan

Compliance Policies — Define mandatory software for your organization (Must Have)

Software Selection — Define mandatory software policies for any desired service or application

Active Local Admin Session Detection CVE Scanning Mandatory Software Policy Patch Prioritization Windows & macOS Support Compliance Tracking

SSL / Certificate Monitor

CyLook's SSL certificate monitoring platform tracks certificates across your entire network and alerts you before they expire, preventing unplanned outages caused by expired TLS/SSL certificates.

SSL Dashboard — Certificate statuses: expired, expiring soon and weak TLS configurations

Remote Certificate Renewal — Renewal via Nginx SSH/Apache SSH; before/after comparison and "Apply Certificate"

Expired / Expiring Soon / Weak TLS Detection Remote Certificate Renewal (IIS, Nginx, Apache) Before/After Comparison View Network and Endpoint-Based Scanning Email Notification on Certificate Change

Network Discovery

Discover all assets in your network; detect unknown devices and open dangerous ports.

Dashboard — Summary of managed, unmanaged and newly discovered assets; device type distribution

Asset List — IP, hostname, type, status and last scan information

Port Alert Rules — Automatic alerts when risky ports such as SSH, SNMP, FTP, SMB, MSSQL, MySQL, RDP, VNC, Telnet are open

Unmanaged Device Detection Newly Discovered Device Alert Dangerous Open Port Alert (SMB, RDP, Telnet...) Server, Printer, Network Device, Workstation Classification Customizable Alert Rules

Platform Management — Global Settings

Notifications, security, system health and CVE feed management from a single center.

Email Notifications (AD) — Log Alert Triggered, Scan Completed, Score Dropped, Target Connection Error, Syslog Connected/Disconnected

Email Notifications (Global) — Login Failed, User Created/Deleted, Role Changed, Backup Result, License Expiring (16/17 active)

Security Settings — MFA (Optional/Required), Session Timeout, Password Policy

System Health — Real-time CPU, Disk and RAM usage; platform uptime and module status

CVE Feed — Daily automatic updates via NVD API; CVSS threshold-based notification configuration

60+ Notification Types (Module-Based) Global Master Recipients TOTP MFA Support Session Timeout Password Policy 209K+ CVE Database (NVD) Daily Automatic CVE Update System Health Monitoring

What Does It Monitor & Detect?

Summary of each module's core detection capabilities

Module	Monitored Environment	Critical Detections
Active Directory	On-premises AD / Domain Controller	Kerberoastable account, empty password, domain admin excess, GPO vulnerability, credential exposure
Entra ID	Microsoft 365 / Azure AD	Post-breach MFA change, script/automation login, conditional access gap, permanent privileged role
Exchange Online	Microsoft 365 / Exchange Online	Mailbox Audit gap, Anti-Phishing/Anti-Spam policy vulnerabilities, Defender for Office 365, Transport Rules security configuration
Tenant Management	Microsoft 365 Tenant	User, mailbox and group inventory; domain expiry, SPF/DMARC/DKIM/MX record status, mail activity summary
File Server	NTFS & Share Permissions	Orphan SID, Full Control privileged accounts, stale folders, permission changes
CIS Benchmark	Windows, SQL, Linux, MySQL, Apache	CIS non-compliance, firewall gap, audit policy error, weak password policy
Endpoint Security	Client & Server Computers	CVE vulnerabilities, missing mandatory software, active local admin session, non-compliant system
SSL Monitor	Certificates (Web, Internal Network)	Expired certificate, approaching expiry, weak TLS configuration
Network Discovery	Network infrastructure	Unmanaged device, open risky port (RDP, Telnet, SMB, FTP, MySQL, MSSQL)
Remote Tools	All managed targets	Bulk command execution, real-time system query, job history

Frequently Asked Questions

Common questions about CyLook Enterprise.

What is CyLook Enterprise?

CyLook Enterprise is a Security Visibility & Risk Intelligence platform that analyzes data from Active Directory, Entra ID, Exchange Online, Microsoft 365, file servers, endpoints and network infrastructure to make cybersecurity risks visible and prioritized in a single cockpit.

Is CyLook a SIEM?

No. CyLook is not a SIEM alternative — it is a visibility and risk-analysis layer that works on top of your existing security infrastructure, including your SIEM if you have one. It works equally well with or without a SIEM in place.

What systems does CyLook support?

Active Directory, Microsoft Entra ID (Azure AD), Exchange Online, Microsoft 365 Tenant, file servers (NTFS/share permissions), endpoint systems, network devices and SSL certificates are the core data sources CyLook supports.

How does CyLook help with CIS Benchmark compliance?

CyLook automatically audits Windows, SQL, Linux, MySQL and Apache systems against CIS Benchmark standards, detecting non-compliant configurations, missing firewall settings and weak password policies, and delivers a prioritized compliance report.

Which companies is CyLook best suited for?

CyLook is designed for mid-size and large organizations — typically 250+ employees, operating across multiple locations, running Active Directory/Entra ID, Microsoft 365, Firewall and EDR infrastructure.

How do I get started with CyLook?

Without touching your existing infrastructure, a Cyber Security Visibility assessment can be run against a limited period of your data. Request a demo to learn how the process works.