runpath

// status: pre-launch · early access opening soon

Compliance evidence that collects itself.

runpath checks your clients' Microsoft 365 and network environments automatically, maps each result to the frameworks they answer to, and shows your team what to fix first.

Register your interest See how it works

Your systems, always running.

// risk register · acme-corp sample data
  • High
    Legacy authentication not blockedENTRA-CAP-03 · fix within 4 hoursASD EssentialsSMB1001Framework C
  • Medium
    WDAC event forwarding missingINTUNE-WDAC-02 · fix within 24 hoursASD EssentialsSMB1001
  • Low
    Unused switch ports enabledUNIFI-PORT-01 · scheduledSMB1001Framework C
findings trending down over 8 assessments

Compliance evidence shouldn't take a week of spreadsheets.

Most MSPs prove compliance by hand: tenant by tenant, console by console, then again for each framework a client answers to. The result is out of date the day it's written, and nobody can say whether a client is getting better or worse.

runpath replaces that with one repeatable assessment you can run on any client, any time, mapped to the frameworks that matter, with a register that keeps the history.

// how it works

Assess once. Evidence many frameworks.

Automated control checks

Read-only checks against Entra ID, Intune, SharePoint Online, UniFi, FortiGate and Meraki. Each control comes back pass, fail or warn.

Continuous evidence trail

Results are stored as a time series, so you can show a client's trend, how long each finding has been open, and whether it's inside its SLA.

Remediation that matches

A PowerShell library applies the same baseline the assessment checks, in a defined deployment order, so fixing and verifying use one source of truth.

Multi-framework coverage

Each control maps to the requirements it satisfies. See which are automated, where the gaps are, and how a client scores per framework. It's computed live, so it never goes stale.

// frameworks

One set of controls, mapped to the frameworks your clients answer to.

Controls are defined once and linked to the requirements they satisfy. Add a framework and existing results count towards it, with no new assessment run.

  • ASD EssentialsavailableAustralian Government
  • NIS2availableNetherlands Framework
  • NISTplannedCSF 2.0
63controls defined
6systems assessed
38requirements mapped so far
  • Microsoft Entra ID
  • Microsoft Intune
  • SharePoint Online
  • UniFi Dream Machine
  • FortiGate 60-series
  • Cisco Meraki MX/MS/MR

// early access

Register your interest.

runpath isn't open yet. Tell us who you are and we'll contact you when early access opens. No spam, and we won't share your details.

  • First access when we open to new MSPs
  • A say in which frameworks we add next
  • One email when it's ready, not a drip campaign

Protected by reCAPTCHA. The Google Privacy Policy and Terms of Service apply.

// questions

Before you register

Who is runpath for?

Managed service providers who look after Microsoft 365 and small-business network gear, and need to show clients where they stand against the compliance frameworks they answer to.

Does the assessment change anything in a client's environment?

No. Assessment skills are read-only and need only Security Reader-level access for the Microsoft 365 checks. Remediation is a separate step you choose to run.

Which frameworks does it cover?

ASD Essentials is mapped first, with SMB1001 next. Controls are defined independently of any one framework, so more can be added. Register your interest and tell us which ones you need.

When does it launch?

We haven't set a public date. Register your interest and we'll email you when early access opens.