Skip to main content
The complete assessment. It covers internal and external network scanning, installed applications, web activity and AI use, PII on devices, password analysis, the dark web, Microsoft 365 and Google Workspace, and CIS compliance. See the Risk Assessment overview.A Monitored Risk Assessment is the same assessment with continuous monitoring, risk-change alerts, and recurring scans.
Scan time varies with demand and the size of the environment. On a Risk Assessment, the PII scan usually takes longest on devices with many files.
Open the assessment’s list of domains and IP addresses and select Add Target. Add domains and IPs has the steps.
Open the assessment, select More in the top right, and choose Archive. An archived assessment no longer shows on your dashboard, but you can still find it by searching.On a Risk Assessment, archiving also sends an uninstall to every online device that still has the agent. Run the uninstall command by hand on devices that are offline. See Uninstall the Telivy agent.Delete appears in the same menu once an assessment is archived.
Rescan All refreshes:
  • Vulnerabilities
  • PII
  • Credential analysis
  • Risky applications
  • Microsoft 365
  • The external attack surface
  • Asset inventory
Agents pick up the rescan on their next hourly check-in, so allow up to an hour for devices that are switched on. Devices scanned without the agent cannot be rescanned from the portal. If no device in the assessment runs the agent, Rescan All is disabled.
It depends on the check. Devices are fully rescanned on the Risk Monitoring schedule you set for the client: weekly, monthly, or quarterly. External checks, including breached credentials and lookalike domains, refresh weekly. Microsoft 365 and Google Workspace settings are read daily. New vulnerability data arrives nightly and is compared against each client’s known software weekly. Scanning Schedule covers all of it.
Agent
  • Deploys quickly through your RMM.
  • Stays installed, so you can rescan whenever you want.
  • Collects the most complete data.
  • Supports monitoring, where Telivy rescans on a schedule, charts risk over time, and alerts you when an alert policy is triggered.
Agentless
  • Nothing to install or uninstall, which suits new clients and prospects.
  • You can email the download link, which helps when you have no RMM on the devices.
  • Runs as administrator when the user has admin rights, and as a standard user otherwise. A standard-user scan only covers files that user can open, and only that user’s browser history and passwords.
  • Gives a one-time snapshot. The device cannot be rescanned or uninstalled from the portal and gets no monitoring or alerts. It shows an Agentless Scan badge in the device list.
See Install the Telivy agent on Windows for both options.
The official CVE Program catalog (synced nightly), NVD for CVSS scores (refreshed daily), Vulners to match detected software versions to CVEs, and three exploitation signals: EPSS, CISA KEV, and ExploitDB. Vulnerabilities are ranked with the Risk Priority Score. Vulnerability Data Sources explains each source and is suitable to share with a client or auditor.
By default, yes. When the Data Security scan finds PII on a device, Telivy stores a sample of the matched value with the file path, device, PII type, and dollar risk. It is encrypted in transit from the agent and only visible to users with access to the assessment. Seeing the value is how a technician confirms a match is real and not, for example, a test card number in sample code.Passwords are handled differently: cleartext passwords never leave the device, and only hashes are stored. See Data Security.
Yes. Turn on Mask PII Data (may be required under HIPAA) in the assessment’s Configure PII Settings, or set it as your agency default in Account > Assessment Defaults > Configure default PII Settings so new assessments start with it. Matched values are then hidden in the Data Found view and in exports. Match counts, file paths, devices, and dollar risk still show.Masking only applies to data collected after the change, so run Rescan All on the assessment afterwards. Mask Dark Web Passwords is a separate toggle in the same dialog. See Mask PII Data.