One host
Aftermath runs locally, no account, on the machine in front of you. This covers a real cleanup on its own.
Sweep & Fleet
Scale the same investigation across every machine that needs it.
Aftermath starts on one machine. Sweep repeats it across a few more. Fleet, a separate product, is for when it's the whole organization.
01
The progression
The progression
Sweep — a handful of hosts
Push the same triage to a host list you provide — agentless, no software pre-deployed, no standing account. Up to 5 hosts on Max.
Fleet — the organization
A separate product for unlimited hosts: an org account, role-based access, and priority support. Not self-serve — reach out directly.
02
The Sweep experience
The Sweep experience
You provide the host list. Sweep does the rest.
- How it startsEnter the host names or addresses you want checked — Sweep doesn't discover machines on the network on its own.
- How it runsAgentless push/pull triage against each host, one session, no software installed ahead of time.
- What you seeA per-host status: clean, flagged, or still running — the same Detections/Persistence/Drift findings you'd get running Aftermath directly on that machine.
- What it isn'tNot continuous monitoring, not a team dashboard, not a notification system — a one-shot triage run you control.
Host list — 5 machines
FRONTDESK-PCClean
BACKOFFICE-01Flagged
WAREHOUSE-03Running
RECEIVING-02Queued
03
When it's the whole organization
When it's the whole organization
Fleet is a separate product, built for this specifically.
Sweep covers a handful of hosts you list yourself, from a single session. Once it's dozens or hundreds of machines with real access-control needs, that's a different problem — an org account, role-based permissions, ongoing support. That's Fleet, and it isn't self-serve.