Your device posture.

The Cloudflare app on your device has to be switched on and connected.

What it is. Prioticket uses an app from Cloudflare that acts like a private, secure road for your work traffic. It is usually called Cloudflare One, or WARP on older versions.

Why it matters. It keeps your work traffic private on any network, including hotel and cafe wifi. It is also how your device proves it is really yours and really safe, which is what lets you into the apps you need. If it is off, nothing else here can even be checked.

How to fix it. Find the orange Cloudflare cloud in the small icons near your clock, bottom right. Click it and turn the switch on. Click the little arrow first if the icons are hidden.

How to fix it. Find the orange Cloudflare cloud in the menu bar at the top right of your screen. Click it and turn the switch on.

How to fix it. Open the Cloudflare One app and turn the switch on. If it is not installed, ask in the Access Hotline.

How to fix it. If your desktop has a system tray, the Cloudflare One client sits there · click it and turn the switch on. Otherwise use a terminal: warp-cli connect, then warp-cli status to confirm it reads Connected. If it is not installed, ask in the Access Hotline.

If the switch will not stay on, or it asks you to sign in somewhere you do not recognise, stop and ask rather than guessing.

Your traffic passes through Cloudflare's filter, which blocks known bad sites.

What it is

The same Cloudflare app checks the sites you visit against a list of known scam, malware and phishing sites, and stops the page loading.

Why it matters

Most attacks on a company start with someone clicking a link. This catches many of them before the page opens, which means it protects you on the day you are tired and click without thinking. That happens to everyone eventually.

Installed is not the same as signed in

This is the part that catches almost everyone. The Cloudflare app can be running, and say it is connected, while not being signed in to Prioticket at all. It may be signed in to a personal Cloudflare account, or to nothing. In that state you get no Prioticket filtering, this card stays red, and the app gives you no hint that anything is wrong.

So if the app looks connected and this is still red, do not reinstall it. Check which organisation it is signed in to.

How to sign in to Prioticket

1. Open the Cloudflare One Client from the system tray, near the clock.
2. In the list down the left, choose Profile.
3. Scroll to the bottom, to the section headed Cloudflare One team login.
4. In the box that says "Connect to a Cloudflare One team", press the Login button on the right. This is the step everyone misses, and nothing else on this page will go green until it is done.
5. When it asks for a team name, type prio. Just that: not an email address, not a web address.
6. Sign in with your Prioticket Google account when the browser opens.
7. Come back here and press Re-measure my device.

How to sign in to Prioticket

1. Open the Cloudflare One Client from the menu bar at the top of the screen.
2. Go to Profile, and scroll to Cloudflare One team login.
3. In the box that says "Connect to a Cloudflare One team", press Login. This is the step everyone misses, and nothing else here will go green until it is done.
4. Type the team name prio, then sign in with your Prioticket Google account.
5. Come back here and press Re-measure my device.

How to sign in to Prioticket

1. Open the Cloudflare One app.
2. Find the account or team login section in its settings.
3. Choose to connect to a Cloudflare One team, and enter the team name prio.
4. Sign in with your Prioticket Google account.

The phone app is laid out differently from the desktop one and changes between versions, so the wording above is approximate. If you cannot find it, ask in the Access Hotline rather than guessing.

Signed in to Prioticket, connected, and still red? Then it is a policy setting rather than anything on your device. Say so in the Access Hotline and it gets looked at.

If your device is lost or stolen, nobody can read what is on it.

What it is

Everything stored on the device is scrambled. Without your password the contents are unreadable, even to someone who takes the drive out and plugs it into another computer.

That last part is the point. Your login password protects the machine while it is running and protects nothing at all against someone who unscrews the drive. Encryption makes the data itself useless to them.

Why it matters

This is the most valuable control on the list. It is the difference between a lost laptop being an annoying expense and a company wide incident involving customer data.

On Windows: BitLocker

Windows calls this BitLocker. Turn it on under Settings, Privacy and security, Device encryption. Leave the laptop plugged in and awake until it finishes: it is not protecting you until it has finished, not merely started.

No such setting? You are on Windows Home

This is the most common reason this card is red on Windows, and it is not something you did wrong. Microsoft does not put BitLocker in every edition of Windows:

• Windows Pro or Enterprise. Full BitLocker. You can switch it on yourself · this is the edition every work machine needs.
• Windows Home. No full BitLocker, so it cannot be made compliant. Home does not mean a personal device · a company-bought laptop can be on Home simply because it has not been upgraded yet.

Every work machine must be Pro or Enterprise · company-owned or your own. Everyone is entitled to a licence, so this is an upgrade, not a purchase.

The fix is a licence, not a setting. Ask the Access Hotline for a Windows Pro key. It is an in-place upgrade: Settings, System, Activation, Change product key. Nothing is wiped, nothing is reinstalled, the machine restarts, and BitLocker appears.

To check your edition: Settings, System, About, and read the line marked Edition.

On a Mac: FileVault

macOS calls this FileVault, and unlike Windows there is no edition problem: every Mac has it, on every model, and it is simply off until someone turns it on. Recent Macs encrypt the drive at rest anyway, but only FileVault ties that to your password, which is what makes a stolen Mac unreadable rather than merely locked.

System Settings, then Privacy and Security, then FileVault, and turn it on. You will be offered a recovery key. Keep it somewhere that is not this machine: a recovery key stored on the drive it unlocks is not a recovery key.

On a phone or tablet

Nothing to switch on. iPhones, iPads and modern Android devices encrypt themselves as soon as a passcode is set, and unlock with it. If this card is red, the reason is almost always that no passcode, PIN or biometric is set at all.

On Linux: LUKS

Linux uses LUKS for full-disk encryption, and unlike Windows and macOS it is normally chosen when the system is installed, not switched on afterwards. Enabling it on an existing install usually means backing up and reinstalling, so if this card is red, talk to the Access Hotline first: on a work machine we would rather reprovision it encrypted than have you attempt an in-place conversion. To check your current state: lsblk (a crypt layer means LUKS is active), or sudo cryptsetup status on the root device.

If the option is missing or greyed out on a work laptop, only IT can change that. Ask rather than forcing it.

Stops other devices on the same network reaching into yours.

What it is. A firewall is a door policy for your device. It decides which incoming connections are allowed and refuses the rest.

Why it matters. On a shared network, an airport, hotel or co-working space, other machines can try to reach yours. With the firewall on they cannot. It is also the control people switch off to make a printer work and then forget about for a year.

How to fix it. Settings, then Privacy and security, then Windows Security, then Firewall and network protection. Turn it on for all three network types.

How to fix it. System Settings, then Network, then Firewall, and turn it on.

How to fix it. Phones and tablets have no firewall you manage. If this shows for you, the rule is aimed at laptops and you can ignore it.

You are running a version that still gets security fixes.

What it is. A check that your Windows, macOS, iOS, Android or Linux version is recent enough to still receive security updates. On Linux it reads the kernel version rather than the distribution, because distribution numbering is not comparable across distributions.

Why it matters. Once a version stops being supported, newly found holes in it are never fixed. They stay open forever and get published, so they become easy to use. An old system is not slightly riskier, it is permanently and increasingly vulnerable.

What counts as recent enough. These are the actual minimums the check uses, so if this card is red you can see exactly how far behind you are rather than guessing.

Minimum version, by platform

Platform	Minimum	Which release that is
Windows	10.0.19045	Windows 10 22H2. Any Windows 11 passes.
macOS	13.0.0	Ventura
iOS and iPadOS	16.0.0	iOS 16
Android	11.0.0	Android 11
Linux	5.10.0	Kernel version, not the distribution. Debian 11 and 12, Ubuntu 20.04.5 and later, RHEL 9.

On Windows, the edition matters too. A recent version is necessary but not sufficient · the machine must also be Windows Pro or Enterprise. Windows Home has no BitLocker, so a fully up-to-date Home laptop still cannot be compliant. Everyone is entitled to a free Pro upgrade · the drive-encryption card explains how.

Older than the minimum does not mean your device is unsafe today. It means it has stopped receiving the fixes that keep it that way.

The thing that catches people. This reads the version you are running, not the one you downloaded. Installed updates but not restarted still counts as out of date. Restart.

How to fix it. Settings, then Windows Update, Check for updates, install everything, restart.

How to fix it. System Settings, then General, then Software Update. Install, then restart.

How to fix it. On iPhone or iPad, Settings, General, Software Update. On Android, Settings, System, System update. Plug in and leave it to finish.

How to fix it. Update through your distribution's package manager · sudo apt update && sudo apt full-upgrade on Debian or Ubuntu, sudo dnf upgrade on RHEL or Fedora · then reboot if the kernel was updated. The check reads the running kernel, not the installed one, so the reboot is what actually clears this.

Security software is active and watching for anything malicious.

What it is. Software that watches for malicious programs and stops them. Whatever your device already uses counts, as long as it is running and current.

On Windows this is usually Microsoft Defender, built into the system, which is perfectly good and needs nothing bought.

Why it matters. It is the safety net for whatever gets past everything else. This check wants it running and up to date, not merely installed: a paused or expired product counts as none at all, which is exactly the state people drift into without noticing.

How to fix it. Open Windows Security and check virus and threat protection is on and not paused. If you have another antivirus, check its subscription has not run out.

How to fix it. Open the security software Prioticket gave you and check it is running. On a Mac it often needs an approval under System Settings, Privacy and Security.

How to fix it. Phones and tablets handle this themselves. If this shows for you, the rule is aimed at laptops.

If it is off and will not turn back on, that needs IT.

You sign in to this Windows machine with your Prioticket Google account rather than with a separate local password.

What it is. Google Credential Provider for Windows. It replaces the Windows login box with your Google Workspace sign-in, so the password that unlocks your laptop is the same one that protects your email, and it carries the same two-factor protection.

Why it matters. Without it a laptop has its own local password that nobody else can see, cannot reset, and cannot switch off when someone leaves. With it, disabling one Google account closes every door at once, which is the entire point of having a single account.

If this shows amber

Amber means the check came back negative and we do not trust it enough to call that a failure. This one is found by looking for the software on your machine, and that lookup misses working installs often enough that a red cross here would be wrong more than it was right.

To confirm it yourself: sign out of Windows and look at the login screen. If it asks for your Google account, or shows a Google button, it is working and you can ignore the amber. If it asks only for a local Windows password, it is genuinely not set up.

If it is genuinely missing. This one is installed for you rather than by you, so there is nothing for you to do. Ask in the Access Hotline: it usually means the machine was set up before we started doing this, not that anything is wrong with your device.

You do not have to type your Google password every morning. Worth knowing, because this is the part people assume is worse than it is. After the first sign-in you can set a Windows Hello PIN and use that from then on, exactly as before. The PIN never leaves the machine and is not your Google password: it unlocks this laptop only, so it is useless to anyone who does not physically have it. Set one under Settings, Accounts, Sign-in options, PIN.

On a Mac. Not applicable. This is a Windows-only tool, and a Mac signs in through Apple Business Manager instead.

On a phone or tablet. Not applicable. This one is about laptop and desktop sign-in.

Your phone or tablet is registered with Cloudflare One under an identity that belongs to this device alone.

What it is. When you enrol a mobile device it is issued its own client identity. This check confirms that identity is still unique to your device and has not been copied onto another one.

Why it matters. A shared or cloned registration would let a second device pass as yours, so a copied profile could reach Prioticket in your name. A unique identity keeps each device separately accountable and lets a single one be revoked without affecting anyone else.

How to fix it. A red result here almost always means the Cloudflare One app needs re-registering. Sign out of the Cloudflare One app and sign back in to the Prioticket organisation. If it is still red after that, ask in the Access Hotline: they can reset this device's registration, which is not something you can do from the phone yourself.

On Windows. Not applicable. This check covers phones and tablets only.

On a Mac. Not applicable. This check covers phones and tablets only.

Your machine is kept up to date with security fixes for Windows and for the applications on it, deployed centrally rather than by you.

Why it matters

Most successful attacks use a flaw that was fixed months earlier. The patch existed, it just was not installed. This is the control that closes that gap, and it is the one where being a few weeks behind genuinely changes your risk.

Windows Update says I am up to date, so why does this say otherwise?

Because they are counting different things, and both are telling the truth.

Windows Update only covers Microsoft's own operating system components. It has never heard of Chrome, Git, node, Google Drive, Zoom, the Cloudflare client, or any of the other software on your machine.

This page counts those too. Most outstanding updates on a typical laptop are applications rather than Windows itself, which is why the number here is usually higher and why the panel above splits it into "Windows updates" and "application updates" rather than giving you one total. If the Windows number is zero and the application number is not, Windows Update saying "you are up to date" is correct and so is this.

The other reason they can differ: when patching is managed centrally, Windows Update is usually told to stand down so deployments happen on a controlled schedule instead of whenever Microsoft chooses. An idle Windows Update is the system working as intended, not a sign nothing is happening.

Who fixes it

IT does, automatically. ManageEngine deploys patches on a schedule, so the normal answer is that nothing is required from you and the count clears on its own within a few days.

On Windows

The one thing you can do: restart. Windows patches finish installing only after a reboot, and until then they still count as missing. If this card is red and your machine has been on for weeks, restart before doing anything else · the panel higher up the page tells you how long it has been up. Applications are patched the same way, so Chrome, Git and the rest are also handled centrally.

On a Mac

Also managed, with one difference. The same agent patches macOS and the applications on it. Apple requires you to approve major macOS upgrades yourself, so those wait for you rather than being installed silently. If macOS prompts you to update and you keep postponing it, this is the card that will go red.

On a phone or tablet

Not covered here, and it is still your job. Phones are not under patch management, so nothing installs updates for you and this card will not report on them. Install OS updates yourself when your phone offers them: Settings, then System, then software update on Android, or Settings, General, Software Update on iPhone. An out-of-date phone is the one device on this page nobody else is watching.

If it stays red

Say so in the Access Hotline. A machine that stays behind after a couple of deployment windows usually means the agent cannot reach the patch source, not that anyone forgot.

Firmware and drivers are separate

These are listed apart from security patches on purpose. They are rolled out far more cautiously, because a failed firmware update can leave a laptop unusable, so outstanding firmware is usually a deliberate decision rather than an oversight. Nothing for you to do there.

Set up a device for work

Setting your device up for work is the requirement everything else on this page builds on. It takes a few minutes, and the link above walks you through the one route that fits your device.

What it is. Our device management, ManageEngine. On a company machine it runs a small agent; on a device you own it adds a separate work area and leaves your personal side alone. It is what lets us keep machines patched and know a lost laptop is not a breach.

What we can and cannot see. Patching, disk encryption status, inventory and the software we deploy. Never your location, browsing, personal files, keystrokes, camera or microphone. Turning any of that on would need the oversight group, not just IT, and the full detail is on the setup page.

Screen lock, worth doing now. It is enforced here rather than by Cloudflare, so this page cannot read it. It is also the cheapest protection there is and defeats anyone who walks past your desk: set a password on wake and a short auto-lock, whether or not the agent is on yet.

Updates are downloaded and waiting for a restart to finish installing.

What it is. Some updates download in full but only take effect once the machine restarts. Until then they still count as outstanding and the device keeps running the old, unpatched version.

Why it matters. A laptop left on for weeks holds those updates in limbo. The fix is already on the disk · it just needs the restart to apply.

How to fix it. Save your work, then Start, Power, Restart · use Restart rather than Shut down, which on Windows can skip the update step. Give it a few minutes to finish on the way back up.

How to fix it. Save your work and choose Apple menu, Restart. Let it finish installing before you sign back in.

How to fix it. Phones apply their updates on their own restart, so if this shows for you the item is aimed at laptops.

How to fix it. Reboot · a kernel or shared-library update only takes effect on the running system after a restart.

Nothing is broken. This is the one device-management item you can clear yourself, in about a minute.

The ManageEngine agent on this device is checking in with our systems.

What it is. A small background service that reports the device's patch state, encryption and inventory back to IT, and lets a lost machine be locked or wiped. It is the precondition for every other device-management signal here · if it goes silent, those readings stop being trustworthy.

Why it matters. A device whose agent has stopped reporting looks compliant only because nothing is measuring it any more.

How to fix it. This one is IT's, not yours. It usually just needs the machine left on and connected long enough to check in. If it stays silent, say so in the Access Hotline · it typically means the agent needs a nudge or a reinstall, not anything you did.

How recently we last checked this device for missing updates.

What it is. The patch counts on this page are only as fresh as the last scan. This says whether that scan is recent enough to trust · a scan from three weeks ago tells you about a device as it was three weeks ago.

Why it matters. A stale scan is why "0 updates outstanding" can sit on a machine that is actually behind: nobody has looked recently.

How to fix it. The scan runs on its own when the device checks in, so a stale scan almost always means the machine has been asleep or off the network. Leave it on and connected for a while. If it stays stale, raise it in the Access Hotline · nothing for you to configure.

Low-level updates to the device's firmware, BIOS and hardware drivers.

What it is. Updates to the code that runs below the operating system. They are rolled out far more cautiously than ordinary patches, because a failed firmware update can leave a laptop unusable.

Why it matters. Outstanding firmware is usually a deliberate hold rather than a lapse · IT stages these carefully. That is why this never counts as a failure even when something is outstanding.

How to fix it. Nothing for you to do. These are deployed and timed by IT. If one is genuinely overdue it will be picked up centrally; you do not need to chase it.

This machine runs Windows Pro or Enterprise, not Home.

What it is. A check on the Windows edition. Microsoft leaves full BitLocker out of Windows Home, so a Home machine cannot encrypt its drive to our standard and cannot be made compliant · however up to date it is.

Why it matters. Home is not the same as "personal": a company laptop can be on Home simply because nobody upgraded it. The gate is on the edition, never on who owns the device.

How to fix it. The fix is a licence, not a setting. Everyone is entitled to a free Pro key · ask the Access Hotline. It is an in-place upgrade under Settings, System, Activation, Change product key: nothing is wiped, the machine restarts, and BitLocker appears. Check your edition under Settings, System, About.

On a Mac. Not applicable · this is a Windows-only requirement.

On a phone or tablet. Not applicable.

On Linux. Not applicable.

This machine runs a Linux distribution ManageEngine Endpoint Central supports.

What it is. A check on whether this device's Linux distribution is on Endpoint Central's supported list. The agent installs on almost anything, but only the supported families are guaranteed to upgrade the agent and report reliably.

Why it matters. On an unsupported distro central management is not guaranteed · the agent may fail to upgrade or report, so the device can drift out of view without anyone noticing. It is not a fault with your machine, and nothing here blocks you.

How to fix it. There is nothing to toggle on the device · ask the Access Hotline before relying on this for a managed device. Supported families include Ubuntu, Debian, RHEL, Fedora, Rocky and AlmaLinux, openSUSE and SUSE, Linux Mint, and Amazon and Oracle Linux.

On Windows. Not applicable · Windows is a supported Endpoint Central platform.

On a Mac. Not applicable · macOS is a supported Endpoint Central platform.

On a phone or tablet. Not applicable.