Find and close security gaps
See where a customer's protection is missing or got weaker, such as devices without EDR, then open a ticket or ignore the gap with a reason.
On this page · 7 sections
Security gaps compares what every connected tool says about each customer and lists what is missing or got weaker: two devices without EDR while the rest have it, an admin account without MFA, a server whose backup stopped. Open it from the service desk's Security gaps tab, or press ⌘K and type security gaps.
What Current checks
| Kind | Examples |
|---|---|
| Devices | A managed device with no EDR, a server with no backup, antivirus off or unhealthy, a device your RMM does not manage, disk encryption off. |
| MFA and accounts | An account or an admin without MFA, an account not used in 90 days. Read from Duo, Microsoft 365 and your other identity tools. |
| Patching and lifecycle | Failing patches, an operating system past its end of support, a device not checked in for 30 days, a device out of warranty. |
| Got weaker | Something that was right and is not any more: EDR or backup stopped reporting, a Microsoft 365 setting that used to pass. |
A tool counts only while its connection is live and it has seen the device in the last 14 days, so a disconnected tool never raises a gap. Current checks every workspace about once an hour.
Desk and Recommendations
When the service is in the customer's agreement, a gap is work for the desk and shows under Desk with the line In their agreement. When the service is not in their agreement and most of their devices do not have it either, the gap is a recommendation for whoever plans their technology, so it shows under Recommendations instead and never counts as a desk miss. Current reads the agreement from the same service mapping Whitespace uses.
Work a gap
- 1Read the rowEach row is one check with how many devices or accounts it covers, and how many of the customer's other devices already have it. Press Why it matters and how to fix for the steps, written by AI and labelled that way.
- 2Open ticketCreates one desk ticket for that customer with the facts and the fix steps in an internal note. Nothing is created until you press it. Once a ticket exists the button shows its number and opens it.
- 3Or ignore itPress Ignore when the gap should not be fixed. You pick a reason and write a note (see below).
Ignore with a reason
| Reason | Use it when |
|---|---|
| Customer declined (risk accepted) | The customer chose not to fix it. You can name the contact who declined. |
| Another control covers it | Something else protects against it, such as a different tool or a policy. |
| Doesn't apply here | The check does not fit, such as a conference room PC with no user data. |
| False alarm | The tools are wrong about this one. |
| Fix planned for a date | A fix is booked. The gap comes back on the date you pick. |
- Every ignore needs a note of at least 10 characters. Only your team sees the note.
- An ignore lasts 30 days, 90 days, 6 months or 1 year, never longer, and then the gap comes back.
- It ends early when the gap gets worse: more devices or accounts than when you ignored it, or a higher severity.
- You can ignore one device or account, or every one at that customer, now and later.
- Any desk staff member can ignore a gap and press Stop ignoring. The Ignored view lists every ignore with who made it, why and until when.
What the AI does
- Explains why a gap matters and how to fix it, naming the tool to use.
- Ranks a customer's gaps by real risk, so a server or an admin account comes before a count.
- Spots devices the checks miss, such as one running a different antivirus from the rest, marked Spotted by AI with its evidence.
- Suggests an ignore where the evidence is clear, marked Suggested by AI. You tick that you checked it before it can be saved, and it never suggests Customer declined.
MFA checks need the customer's Microsoft 365
Account and MFA checks read each customer's own Microsoft 365. Where a customer is not connected, a tenant admin or a service manager sees Connect Microsoft 365 on that customer's card: sign in as the customer's Global Administrator and approve Current's access. When Microsoft needs a newer permission approved, the card says Approve again.
Check now
Press Check now and pick a customer to check them again right away, for example after a fix. Each customer can be checked once every 5 minutes. With a customer chosen in the filter, Check now checks that one.