A single executable that scores your Windows security configuration against CIS Benchmark controls and gives you plain-English remediation steps — no cloud, no agent, no license.
pip install apotrope
No setup, no accounts, no data leaving the machine — just an honest read on the box in front of you.
Drop apotrope.exe on a USB stick and run it on any Windows machine. No install, no Python, no dependencies.
No data leaves the machine. No telemetry, no cloud APIs, no license servers — your audit data stays yours.
Every finding is annotated with its CIS Benchmark control ID — v5.0.0 for Windows 11, v4.0.0 for Windows 10 — detected automatically at scan time.
A 0–100 security score with an A–F letter grade gives you an at-a-glance read on the system's risk posture.
Export a self-contained HTML report for stakeholders or a structured JSON report for pipeline integration.
Save a baseline and diff against it later to track remediation progress with --baseline and --compare.
An apotrope.toml profile lets you disable checks, override severities, and tune thresholds for your environment.
Every failing check ships a concrete fix command or Group Policy path — not just a description of the problem.
Fourteen categories of Windows security posture, mapped to CIS and scored by severity.
Start at 100. Each failing or warning check deducts points weighted by severity. The total maps to a letter grade.
| Severity | Fail | Warn |
|---|---|---|
| Critical | −15 | −7 |
| High | −10 | −5 |
| Medium | −5 | −2 |
| Low | −2 | −1 |
| Info | 0 | 0 |
One self-contained HTML file — gauge, prioritised findings, CIS mappings, remediation — that opens in any browser with no server and no network.
Filterable findings, copy-ready fixes, and a score you can defend. Generated entirely on the audited machine.
Open live sample report →Standalone apotrope.exe below — no Python required. Have Python 3.12+? pip install apotrope and run apotrope instead.
Grab apotrope.exe from the latest release and save it somewhere easy to find — Desktop or Downloads works fine.
Right-click PowerShell or Command Prompt → Run as administrator. Some checks (BitLocker, local accounts, services) need elevation for full results.
In Command Prompt: cd %USERPROFILE%\Downloads
The .\ prefix is required — PowerShell doesn't run programs from the current folder by bare name. It works in Command Prompt too.
Opens as a standalone file in any browser — no server required.