While custom checks aren't a self-service feature, there is a workaround. If you can write valid SQL queries compatible with OSQuery, submit them to your Secureframe support contact, who will forward them to our Automation team for review. Approved queries can be added to the Agent, extending coverage for your Linux environment.

No, the Secureframe Agent does not notify employees directly if their operating system is out of date.

Instead, the Agent collects data about the device, including the operating system version, and reports this information back to the Secureframe platform. This allows administrators and compliance teams to monitor OS versions across devices and identify which endpoints may be out of compliance. Any follow-up communication or remediation typically comes from your internal IT or security team, not the Agent itself.

You can view OS version data in the Secureframe platform under the Devices section, where flagged devices may indicate outdated operating systems depending on your configuration and compliance requirements.

You can find and access the Master Index article for the Secureframe Agent here:

Secureframe Agent: Master Index

This Master Index serves as a centralized hub that links out to all key articles related to the Secureframe Agent, such as installation instructions, supported systems, troubleshooting guides, and more. It's a great starting point if you're looking to understand or manage any aspect of the agent.

If your operating system is outdated, the Secureframe Agent may not install or run properly.

- You’ll need to upgrade your OS and then download a new Agent build from your Secureframe dashboard.
- After installation, your device should begin syncing again.

If you’ve:
- Reinstalled the Secureframe Agent,
- Verified the OS is supported,
- Uploaded Agent logs (if applicable),
- Synced successfully with the platform…

…and your device now appears in Asset Inventory, success! You’re good to go.

If your serial number is already in our internal system:
- We’ll re-sync your Secureframe Agent connection to try and restore visibility in Asset Inventory.

If your serial number is not found, we’ll walk you through additional troubleshooting steps to reinstall or rebuild your Agent package.

If your build was previously removed:

1. We’ll delete any corrupted or outdated versions.
2. You’ll be asked to re-download a new Secureframe Agent build from your dashboard.
3. Reinstall the new build and wait a few minutes for the device to sync.

Once complete, your device should begin reporting to the Asset Inventory.

The Secureframe Agent needs to be online for at least 5 minutes to properly connect and sync. Please ensure your device maintains internet connectivity for this duration.

This was caused by a temporary network issue on Secureframe's end that affected a small number of agent connections. It was not related to expired credentials, device connectivity, or an outdated operating system. Secureframe proactively reconnected the affected sessions, though in this case the customer had already reconnected on their own before the team reached it. As a general note, because the Secureframe Agent does not store customer credentials, agent connections should not be disabled under these circumstances -- this is a known gap that has been flagged internally for improvement.

Most frameworks require this, and while they don’t always specify time, PCI specifically requires it to be 15 minutes or less. The test controls provide more details for each framework.

When you open the “Employee Onboarding → Agent Installation” page, Secureframe generates a unique Agent installer package just for you. This process happens in the background and usually only takes a few minutes.

However, in rare cases, something may prevent the download from completing. This will cause the download button to appear stuck with a spinning indicator.

Why does this happen?
Each Secureframe Agent build is customized per user and device type. When your company connects the Secureframe Agent integration, two jobs are automatically triggered:

One to generate a Mac installer package for your company

Another to create unique Agent packages for each of your team members

When you visit the installation page, Secureframe checks if your personalized Agent package is ready. If not, it begins building it. The spinner indicates we’re waiting for that build to complete. If something goes wrong during the build, the spinner may never complete.

What you can try:
Wait a few minutes and refresh the page.

Try opening the Agent Installation page in an incognito or private browser window.

If the issue continues for more than 10 minutes, contact Secureframe Support. We’ll investigate and help you complete the installation.

Personnel tasks and test evidence are tracked separately. Uploading screenshots or other proof on a test does not automatically complete the Agent onboarding task for that person.

If the user should not install the Agent at all, remove the Agent requirement for their group instead of leaving the task open. Create or use a personnel group for users who need the Agent, then in Personnel → Settings → Onboarding, limit Secureframe Agent to that group only. Users outside the group will not be prompted to install the Agent.

If the user already has an incomplete Agent task and you are covering the related tests with manual evidence, use Pass with Upload on the relevant device test(s). On the test Evidence tab, open the user's row, use the three-dot menu, and choose Ignore evidence for this test with a short note that manual proof was provided.

Ignoring evidence keeps the compliance test from blocking you. It does not convert the personnel task into "completed." Prefer adjusting group assignment when the Agent should not be required going forward.

Personnel tasks and test evidence are tracked separately. Uploading screenshots or other proof on a test does not automatically complete the Agent onboarding task for that person.

If the user should not install the Agent at all, remove the Agent requirement for their group instead of leaving the task open. Create or use a personnel group for users who need the Agent, then in Personnel → Settings → Onboarding, limit Secureframe Agent to that group only. Users outside the group will not be prompted to install the Agent.

If the user already has an incomplete Agent task and you are covering the related tests with manual evidence, use Pass with Upload on the relevant device test(s). On the test Evidence tab, open the user's row, use the three-dot menu, and choose Ignore evidence for this test with a short note that manual proof was provided.

Ignoring evidence keeps the compliance test from blocking you. It does not convert the personnel task into "completed." Prefer adjusting group assignment when the Agent should not be required going forward.

Personnel tasks and test evidence are tracked separately. Uploading screenshots or other proof on a test does not automatically complete the Agent onboarding task for that person.

If the user should not install the Agent at all, remove the Agent requirement for their group instead of leaving the task open. Create or use a personnel group for users who need the Agent, then in Personnel → Settings → Onboarding, limit Secureframe Agent to that group only. Users outside the group will not be prompted to install the Agent.

If the user already has an incomplete Agent task and you are covering the related tests with manual evidence, use Pass with Upload on the relevant device test(s). On the test Evidence tab, open the user's row, use the three-dot menu, and choose Ignore evidence for this test with a short note that manual proof was provided.

Ignoring evidence keeps the compliance test from blocking you. It does not convert the personnel task into "completed." Prefer adjusting group assignment when the Agent should not be required going forward.

Personnel tasks and test evidence are tracked separately. Uploading screenshots or other proof on a test does not automatically complete the Agent onboarding task for that person.

If the user should not install the Agent at all, remove the Agent requirement for their group instead of leaving the task open. Create or use a personnel group for users who need the Agent, then in Personnel → Settings → Onboarding, limit Secureframe Agent to that group only. Users outside the group will not be prompted to install the Agent.

If the user already has an incomplete Agent task and you are covering the related tests with manual evidence, use Pass with Upload on the relevant device test(s). On the test Evidence tab, open the user's row, use the three-dot menu, and choose Ignore evidence for this test with a short note that manual proof was provided.

Ignoring evidence keeps the compliance test from blocking you. It does not convert the personnel task into "completed." Prefer adjusting group assignment when the Agent should not be required going forward.

Currently, the Secureframe Agent is not designed for mass deployment or scripted installation. Each user must download and install their unique Agent build from the Secureframe dashboard, as it’s tied to their individual profile.

Check the task manager, in the services tab, for a service named “orbit osquery” (orbit.exe). The device appears in asset inventory after its first check-in during an agent sync.

The Secureframe Agent can only be installed on one device per user account. If you attempt to install the Agent on multiple devices (for example, both a Mac and a Windows machine), this can cause inconsistencies and the Agent may not function properly.

To check which device currently has the Agent installed under your account:
Go to the Personnel tab in the Secureframe platform.

Select your user profile.

Navigate to the Devices tab.

You will see a list of all devices associated with your user account, including the operating system and device name.

If you see more than one device listed, the Agent may be installed on both. To fix this, you’ll need to remove the Agent from one of the devices.

If the Agent installation appears successful, but your device still isn’t reporting:

1. Confirm that the device is on a supported OS
2. Verify that Agent logs exist
3. Check if your Agent build was previously deleted (this sometimes happens during reassignments or resets)

If a prior build was deleted, we may need to trigger a new one.

No, the Agent can only be installed for 1 company at a time.

Our recommendation is that you pick one company to install Agent packages from.

Orbit is a runtime that manages the osquery runtime (updating, installing, etc.). Osquery is what our agent uses to pull information from the system like encryption state, screensaver, etc.

To help us investigate why the Secureframe Agent isn’t reporting your device, please provide:
- Your device’s serial number
- Your operating system version
- A copy of your Secureframe Agent logs

You can upload this information to your Secureframe support ticket.

If you see the following error when trying to install the Secureframe Agent on your Mac:

“secureframe-agent.pkg” Not Opened
Apple could not verify “secureframe-agent.pkg” is free of malware that may harm your Mac or compromise your privacy.

This typically means macOS was unable to verify the integrity of the package due to a missing or outdated signature. This can sometimes happen if the installer is partially downloaded or an older version is being used.

How to resolve:
Uninstall the current Secureframe Agent from your device.

Re-download the newest Agent package from the Employee Onboarding → Agent Installation page in your Secureframe dashboard.

Reinstall the freshly downloaded version.

If you still see this warning, try the following:

Right-click (or Control + click) the .pkg file

Choose Open from the context menu

Click Open again in the warning dialog to proceed with installation

This bypasses Apple’s Gatekeeper for one-time approved apps.

An X in the Managed Computer column usually means the employee downloaded the Secureframe Agent, but the device has not completed installation and first check-in successfully.

The Secureframe Agent column can show that the agent was downloaded, while Managed Computer confirms whether Secureframe is receiving device data from the completed installation.

Ask the employee to finish the installation, keep the device online for at least five minutes, then run a manual sync from the Secureframe Agent integration page.

Secureframe Agent installers are generated for a specific user. If a device is installed using another employee's installer, the device can reassign back to that employee during the next sync.

To fix this, uninstall the existing agent from the device, generate or download a fresh installer for the correct employee, reinstall the agent, and run a manual sync.

You can also open the affected user's profile in Personnel and review the Devices tab to confirm which user the device is currently linked to.

Deleting a device record removes it from Secureframe, but if the Secureframe Agent is still installed on the device, it can check in again and recreate the device record.

To remove a device permanently, uninstall the Secureframe Agent from that device first. After uninstalling, the device should stop checking in and should not reappear after future syncs.

If the device still appears after uninstalling, contact Support with the device serial number, affected user email, and approximate uninstall time.

On Windows, you can check whether the Secureframe Agent service is still installed by opening Command Prompt and running sc query "Fleet osquery".

If Command Prompt returns The specified service does not exist as an installed service., that indicates the agent service is no longer installed.

If the service still appears, complete the uninstall steps, restart the device if needed, and check again.

Confirm your exact macOS version (for example System Settings → General → About). Secureframe Agent support follows Apple's generally available releases. Beta or unreleased macOS versions may not be supported yet.

If you are on a new or beta macOS and see orbit / osquery segfaults at startup:

If you are on a supported macOS and still see segfaults, collect logs from /var/log/orbit and contact Support with macOS version and build number, Apple Silicon vs Intel, and whether install was from Employee Onboarding or an admin package.

Do not assume the latest public macOS beta is supported. If compliance timing allows, use a supported macOS version or contact Support for compatibility guidance before audit deadlines.

This is expected behavior and not a cause for concern. The agent is functioning correctly and reporting all expected data. However, due to Fleet limitations, it runs queries intended for Windows and Linux devices even on macOS, resulting in repeated “no such table” errors for OS-specific tables like windows_security_center or deb_packages. These errors do not impact agent performance. While they may cause logs to grow in size, the logs can be safely deleted or truncated at any time without affecting functionality.

Confirm the agent is running locally (for example orbit / osquery processes) and the employee completed the Device Management onboarding task.

Verify the Secureframe Agent integration shows Connected, then run a manual sync on the integration.

Confirm the personnel email in Secureframe matches the email used when the agent was installed.

Check Personnel for duplicate or merged user records that may prevent device assignment.

Open the user profile in Personnel and review the Devices tab to see whether the device is linked to a different user.

Allow several minutes after install for the first check-in. The agent should stay online for at least five minutes to sync successfully.

If the device still does not appear, contact [email protected] with the device serial number, OS version, and affected user email.

Installation and assignment are separate steps. The agent must check in, sync, and link to the correct personnel record before the test can pass.

Work through this checklist:

If all checks pass and the test still fails, contact [email protected] with the user email, device serial number, and OS version.

Evidence populates after the agent checks in and the Secureframe Agent integration syncs successfully.

First fix the underlying device setting (password policy, encryption, screen lock, and so on), then wait for the device to check in while online for at least five minutes, then run a manual sync on the Secureframe Agent integration.

If assets show compliant checkmarks in Asset Inventory but the test Evidence tab is still empty after a successful sync, contact Support. This can indicate a sync or evaluation delay, not necessarily a device misconfiguration.

The tray icon is a visibility indicator, not the compliance signal. If orbit / osquery is running and the device appears in Asset Inventory after a successful sync, the agent is likely reporting correctly.

If the device does not appear in Asset Inventory, treat it as not reporting and follow the troubleshooting steps in The Secureframe Agent is installed but my device does not appear in Asset Inventory above.

The agent is installed on the device, and it connects to a server that instructs the agent on what information to pull and send back to the server.

To check if a software agent (like Secureframe Agent or MDM/Endpoint applications) is implemented:

Go to Integrations Page that lists all integrations and agent-based tools currently connected to your organization’s Secureframe account.

Look for the relevant application and if the integration is listed as “Connected” or “Installed,” it means the agent is implemented.

(Optional) Verify deployment in Asset Inventory
After confirming the agent is connected, go to Asset Inventory → Devices to see which devices are reporting in, confirming actual deployment across your org.

Secureframe has three main Master Index articles that serve as central hubs for key documentation and resources.

No action is needed on your end. Once the Secureframe Agent is installed, it is automatically configured to run. This is built into how the agent works by default.

Devices should automatically be removed from your account 30 days after once the Secureframe Agent is uninstalled.

However, if a device remains listed after being inactive for an extended period, you can contact our support team for help.

Please email [email protected] with the device name and any other identifying details (e.g., last known user, operating system), and we’ll manually remove it from the backend.

Not currently, and there's no planned update to the agent/test logic at this time. That said, we don't recommend disabling Windows Hello just to pass the test, especially given it's the Microsoft-recommended approach. Customers in this situation can upload evidence manually to satisfy the check. If you'd like to see native Windows Hello support added, please submit a feature request so we can add it to our backlog.