Closed by default. Open on purpose.

Portcullis blocks USB storage on every Microsoft Windows endpoint you manage, opens it for one device, one person and a set time when there is a reason, and keeps a record nobody can quietly change. One of our turnkey solutions: the gap an assessment finds, closed on your own site, installed by our DevOps engineers and supported by the tecnov8 desk.

6
profiles ready on the first day, from monitor only to nothing removable
30 days
the longest a grant lasts; the shortest is an hour
Under 1 s
from a revoke in the console to the endpoint, in the maker's tests
0
licence call-home: the licence is validated on the appliance, offline

The problem

When a stick goes missing, the first question is what was on it.

Portcullis tells you which of your machines it touched, whether anything could be written to it, and who decided. The two usual ways of handling USB storage leave you with no answer at all.

Blocked

Block every port

The work still needs sticks: the auditor's files, the engineer's firmware, the board pack for the offsite. People find a way round, and the way round is not recorded.

Open

Allow every port

Nothing stops a client list leaving in a pocket. When a stick goes, there is nothing to show where it was used, or whether anything could have been copied to it.

Portcullis

Close it, then decide

Closed by default. Opened for one device, one person and a set time when there is a reason. Every connection and every decision on the record.

51%

of the malware Honeywell found on USB media carried into industrial sites in 2024 was designed to use USB devices. In 2019 it was 9%.

It is a way in, too

A stick that carries data out can carry something in. A closed port with a recorded exception is a smaller door in both directions.

Source: Honeywell, 2024 USB Threat Report.

Working to ISO/IEC 27001?

Control 7.10, Storage media, covers removable media through its life. Portcullis gives you the use part of it: the policy, the exceptions and the record to show an auditor.

How it works

One appliance on your network. One agent on each endpoint.

Windows endpoints connect to the appliance over HTTPS on port 443, including an offline laptop that keeps enforcing its policy. Administrators use the console in a browser with a second factor. Email and a SIEM are reached only if you switch them on. Device data stays on the appliance.

The agent

A Windows service and a small desktop notifier, code signed. It enforces policy on the endpoint with or without a network, and reports what is plugged in.

The appliance

One container on a Linux server you provide. It holds the policy, the audit trail and the licence, validates the licence offline, and connects out only to the services you switch on and the hosted update service. Your device data stays on it.

The console

Where your administrators work, each with a second factor: policy, exceptions, alerts and the record, in one browser tab.

What it controls

USB sticks
Other USB storage
Phones

What it leaves alone

Keyboards and mice
Printers
Webcams
Smartcard readers
Fingerprint readers
Fixed disks

Everything is reported, controlled or not. In the maker's testing Portcullis told nine kinds of USB peripheral apart correctly, from a hub to an HDMI adaptor, and blocked nothing it should not have.

Closed by default

Six profiles, ready on the first day.

Choose the stance that fits each part of your organisation, and apply it to everyone, a group, a department or one machine. New endpoints start in Monitor, recording everything and blocking nothing, until you switch them to Enforce.

Profile	What it does	Where it fits
Baseline	Blocks nothing and records every connection.	The first weeks of a rollout: see what staff plug in before you enforce anything.
Encrypted media only	Sticks and drives work if they are BitLocker encrypted. An unencrypted one is read only, and Windows offers to encrypt it there and then.	Organisations that issue encrypted sticks.
Read only media	Staff can read from removable media but cannot copy anything onto it.	Teams that receive files from clients but should not take data out.
Standard	Blocks USB sticks and other USB storage. Keyboards, mice, printers, webcams and readers carry on.	Everyone, by default.
Kiosk	Every storage class blocked.	Reception desks, shop floor terminals, meeting room PCs.
Restricted	Nothing removable, no exceptions. Offline codes are refused; an operator allowing one named device is the only way through, and it is audited.	Machines handling regulated or classified data.

On its own clock

A policy can hold a time window, judged in the endpoint's local time wherever it is.

On or off the network

A different policy can apply when an endpoint is away from your network.

Fixed disks are never touched

No shipped profile can reach a fixed disk. The boot disk stays online and writable, whatever you choose.

Open on purpose

One device, one person, one length of time.

Closing the ports is the easy part. Portcullis is built for the exceptions. Users ask from their own desktop and an approver decides, or the service desk reads out a code when there is no network. Every exception is narrow, ends on its own, and is on the record.

08:58
A stick goes into a laptop on a train
No network. The Standard profile blocks it and the agent records the attempt.
Blocked
09:03
The user calls the service desk
The desk issues an offline code for that one stick, for eight hours, and reads it out.
09:04
The code is typed in, and that stick opens
Nothing else on the laptop changes. The code cannot be re-encoded to open more.
Allowed, one device
11:20
The laptop reconnects
The grant, the code and who issued it reach the appliance and join the audit trail.
Recorded
17:04
Eight hours are up
The stick is closed again. Nobody had to remember to do it.
Blocked

30 days

The longest a grant lasts. The shortest is an hour, and every one ends on its own.

Under 1 s

From a revoke in the console to the endpoint, measured by the maker on a test laptop.

Lockdown

Closes one endpoint's removable storage within seconds, and overrides access granted from the console. For the laptop that has just gone missing.

An example. The times and people are illustrative; every step is something Portcullis does today.

On the record

Every decision written down, where nobody can quietly change it.

The operator audit trail is hash chained, and endpoints cannot write to it: an endpoint reports an event, and the appliance stamps the time and the endpoint's own name.

row 4182
Offline code issued
hash a41f9d
row 4183
Grant reached the appliance
hash 0be377
row 4184
Changed after the fact
hash does not match
row 4185
Grant ended
hash e90a42

Illustration. Each row carries the hash of the row before it, so a change, a removal or an insertion is found at the row where it happened.

Alerts where you already look

Alert rules, each with its own switch, severity and thresholds, sent by email, to your SIEM or to Microsoft Sentinel. Eight reports, on demand or emailed on a schedule. If someone stops the agent, the agent says so.

Privacy designed in

Export everything held about one person for a subject access request, and erase it from every column that names them. Pseudonyms for what leaves the appliance are one switch, and retention purging is on from the start.

Operators held to the same standard

Sign in through Microsoft Entra ID, or a second factor for every local operator. Roles that decide who can see and change what, sign in rate limits and lockout, and stored secrets encrypted at rest.

Updates in rings, signed

Updates reach the appliance from a hosted update service, or from a bundle at an isolated site, and go out in rings. Agents install only updates carrying the trusted signature, with revocation checked.

The console fetches nothing from the internet. Not even its fonts.

Yours to run

On your network, on your terms.

Four steps from a spare server to enforced endpoints. tecnov8 does them with you, or for you.

Copy one bundle to a server

One file, about 160 MB, onto Ubuntu 22.04 or 24.04. Nothing else is downloaded.

Run the installer

Under a minute in the maker's tests, Docker included. It checks the server first and stops rather than half installing.

Send the install code

The appliance shows a code. Send it to tecnov8 and paste in the licence that comes back.

Deploy the agent

A signed MSI, installed with the one line command the console writes for each machine, or rolled out across an estate with a fleet enrolment token.

Server: Ubuntu 22.04 or 24.04 LTS, x86_64. Tested on 4 virtual processors and 8 GB, with 10 GB free disk.
Network: Inbound port 443 only. Outbound for updates and the services you enable; none at an isolated site.
Upgrades: 10 to 15 seconds in the maker's tests, keeping your data. A changed bundle or a downgrade is refused.
Backup: Built in. The restore has been drilled.
Certificates: Use your own, without cutting off agents.
SIEM: UDP, TCP, TLS or HTTPS, as RFC 5424 syslog, CEF, LEEF or JSON. Microsoft Sentinel through the Logs Ingestion API, with the setup script written for you.
Operators: Microsoft Entra ID sign in with groups mapped to roles, or a password and a second factor for every local operator.

Licensing, without the phone home

Licensed per managed endpoint, for one to three years, with 10% headroom so a few new starters never stop an enrolment.

The licence is a block of text that the appliance checks itself. It is bound to that appliance, survives upgrades and restores, and nothing is ever sent anywhere to check it.

A late renewal never leaves an endpoint unprotected or a user stuck.

Active
Everything works.
Expiring
The last 30 days. The console says so.
Grace
30 days after expiry. Nothing refused.
Step one
30 days. No new endpoints.
Step two
30 days. No policy changes either.
Step three
The console is read only.

At every stage, endpoints keep enforcing their policy, and offline codes, revokes and access decisions always work.

Try it

Start with 30 days.

Every new appliance runs a 30 day evaluation for up to 25 endpoints, with no licence and no paperwork.

Install it on a spare server

One bundle, one installer, under a minute in the maker's tests. tecnov8 can do this step with you on a call.

Start by watching

New endpoints start in Monitor: they record everything and block nothing.

Close the gate

Switch endpoints to Enforce when you are ready. The record starts on day one.

The tecnov8 ecosystem

One of our turnkey solutions, inside one ecosystem.

01 · Assess
A tecnov8 assessment finds the gap: USB sticks and phones that anyone can plug in, and no record of what touched what.
The assessment menu →
02 · Close
Portcullis closes it on your own site, with the exceptions the work needs and a record an auditor can check.
All turnkey solutions →
03 · Install
Our DevOps engineers stand up the appliance, roll the agent out in rings starting in Monitor, and connect the record to your SIEM.
How we install and run it →
04 · Support
App Guardian stands behind it. The tecnov8 desk is first line, so there is one number to call and one record of what happened.
Application support →

Your Portcullis partner

Hardened, installed and supported by tecnov8.

Portcullis is sold and supported through IT partners. tecnov8 is one. We harden it before it goes in, install it with you or for you, and the tecnov8 desk is first line support for as long as you run it. Book a demo, book a call or ask for the brochure below.

How we support it →

Microsoft, Windows, BitLocker, Entra and Sentinel are trademarks of the Microsoft group of companies. Ubuntu is a trademark of Canonical Ltd. Docker is a trademark of Docker, Inc. All other trademarks are the property of their respective owners. Facts as of Portcullis appliance 0.7.7, October 2026.

Delivered by tecnov8

Installed, rolled out and supported by one team.

01 · Prove

Proof of concept

A 30 day evaluation on up to 25 endpoints, with no licence and no paperwork.

02 · Roll out

Onboarding

Install the appliance, roll the signed agent out ring by ring starting in Monitor, agree the exception route with your service desk, and connect the record to your SIEM.

03 · Run

Support

The tecnov8 desk is first line support. You run Portcullis yourself, with the desk behind you.

See Portcullis on your own estate

Three ways to take the next step. Pick the one that suits where you are today.

Talk

Thirty minutes on your estate, where you are today and whether Portcullis fits.

See

A live walk through of Portcullis with an engineer, on a call.

Read

The Portcullis brochure sent straight to your inbox, to share with your team.

Each product links to its own dedicated vendor page. Hardened, installed and supported by tecnov8.