A new commercial security surface — on the Wi-Fi radio Microsoft already ships.
Enterprise buyers are asking for offline device recovery: locate, lock, and erase a Windows PC even when it is powered down or off the network. Troverlo delivers that capability on the Wi-Fi radio Microsoft already ships in every Windows PC — no cellular modem, no SIM, no agent on the endpoint, no network connectivity required. A capability Microsoft can offer through Surface, through Defender, or through both.
The Wi-Fi radio is already the most ubiquitous piece of hardware in enterprise IT. Troverlo turns it into a security surface.
Every Windows PC ships a Wi-Fi radio. Every printer, every conference camera, every access point, every mobile device in the building already hears it. Troverlo uses that existing signal as a bidirectional control channel — no cellular modem, no association, no handshake, no dedicated hardware — to let IT locate, lock, and remotely erase a Windows device even when the device is powered down, on a plane, or fully off the network.
Today, Windows-side coverage of offline device recovery is developing. Intune Lost Mode currently supports iOS/iPadOS Supervised and ChromeOS; the same is true for Defender Offline, which is a boot-time malware scanner rather than a device-recovery tool. Troverlo is a natural extension of the Intune and Defender surfaces onto Windows — using hardware Microsoft already ships.
This is a capability Microsoft can offer without new silicon, without new BOM, and without OEM segmentation. Ready today as a Windows service; roadmap-ready as an OEM-integrated feature on the Wi-Fi radio itself.
Enterprises are paying premium prices for offline device recovery today. Microsoft can make it standard.
HP Wolf Connect is the clearest public signal: "the world's first find, lock, and erase solution capable of locating, locking, and erasing a PC remotely, even when powered down or offline." HP built it on cellular because in 2023 that was the only radio that worked when a device was off. It ships on select G10+ EliteBook, ProBook 400+, and mobile workstation SKUs, at a premium.
What HP validated: enterprises will pay for offline lock-and-erase, and they'll pay at the top of the SKU stack to get it. What has changed since 2023: connectionless Wi-Fi observation now delivers the same outcome without the cellular modem, without new BOM, and without SKU segmentation.
Troverlo lets Microsoft offer that outcome across every Windows PC — Surface first, or the entire Defender-managed fleet — using the Wi-Fi radio already in the device.
Two natural paths inside Microsoft.
Surface door. Troverlo becomes a Surface security capability. Ship a Windows service through the Surface update rail; announce offline recovery as a feature the entire Surface installed base receives. Then integrate it into the Wi-Fi silicon on next-generation Surface hardware — a differentiated offline-recovery capability at the flagship level, available across the full Surface line rather than gated behind a premium SKU.
Defender door. Troverlo integrates with Defender for Endpoint as an offline-recovery capability inside the XDR narrative — MISA member, Pegasus onboarding, Security Store listing. Every Windows PC managed by Defender, regardless of OEM, gets a locate / lock / wipe answer when the device drops off the network.
Same mechanism underneath. Two go-to-market surfaces. Microsoft can pick either — or run both.
Ship as a Surface security capability. Windows service now, Wi-Fi radio on next-gen hardware.
Integrate with Defender for Endpoint. MISA + Pegasus + Security Store. Every OEM covered.
The category is forming. The right partner motion sets the standard.
Offline device recovery is on its way to becoming a table-stakes commercial security expectation. HP has been narrating Wolf Connect as their flagship story since 2023, and in 2025 they added a lower-cost Wi-Fi/Internet tier of Protect & Trace to broaden reach — a signal that the market is expanding beyond the premium cellular tier. Whoever defines the standard delivery model on Windows will set the terms.
Microsoft Security is actively building the partner surface for this kind of expansion — new EVP (Hayete Gallot, Feb 2026), Naseem Tuffaha returning as CVP, an active MISA / Pegasus / Security Store motion. Troverlo fits that motion cleanly: a well-defined capability, patented and shipping, that plugs into Defender for Endpoint and extends onto every Windows PC.
The Wi-Fi radio is Microsoft's advantage — universal, already deployed, already trusted. Troverlo is the mechanism that turns that radio into an offline-recovery surface today, and an OEM-integrated capability on future Wi-Fi silicon.
30 minutes.
A walk-through of the two paths (Surface and Defender), the connectionless Wi-Fi mechanism, and what a Phase-1 Windows-service pilot looks like on Surface hardware or inside a Defender for Endpoint integration. Happy to start with whichever path lines up with your team.
Walk, then run. A Windows service today — OEM-integrated on the Wi-Fi radio tomorrow.
Troverlo is a two-phase capability. Phase 1 runs as a Windows service — deployable through the update channel Microsoft already uses to reach the Windows fleet. Phase 2 moves that same mechanism into the Wi-Fi radio itself, OEM-integrated on new Surface (and partner-OEM) platforms. Same connectionless observation. Same Defender / Intune integration surface. Different depth in the stack.
Two modes, one radio. Scan when online. Beacon when offline. No association, no handshake.
The Wi-Fi radio behaves the way it already does when Windows looks for available networks. It records the surrounding APs it hears — BSSID, SSID, frequency, RSSI, timestamp — and forwards that snapshot to the Troverlo cloud over standard HTTPS. Every online Windows PC becomes an observer for every offline Windows PC in its vicinity.
The Wi-Fi radio emits a Troverlo-formatted identifier as a standard Wi-Fi beacon. Any nearby scanning device — an online Windows PC, a phone, a partner observation node — records the beacon and reports it to Troverlo. The offline PC is seen even though it has no network session.
Both modes ride Wi-Fi management frames — the same category of frame every Wi-Fi device transmits before it associates with a network. No user credential. No captive portal. No IP stack required in beacon mode. No association. No handshake. The Troverlo payload adds structured meaning to what the radio is already doing at Layer 2.
Two deployment phases. Same mechanism, deeper in the stack over time.
Microsoft does not have to pick between an OS-level product now and a hardware-integrated product later. The mechanism is the same in both phases. Phase 1 gets Windows an offline recovery capability quickly — on the fleet already in customers' hands. Phase 2 hardens it into the platform on new Surface (and partner-OEM) PCs, at Microsoft's own cadence.
Works on the Windows PCs already in customers' hands. No new SKU, no refresh cycle, no waiting on next-gen platforms. Covers the powered-on / offline-network case; the powered-off case is what Phase 2 delivers.
- LayerWindows service, runs in the background whenever the OS is up. Uses the standard Wi-Fi adapter for scan mode and the Wi-Fi Direct adapter for beacon mode.
- DistributionWindows Update, Intune, Autopatch, WSUS, or the same MDM rail Microsoft already uses to reach the fleet. Defender for Endpoint co-managed deployment supported.
- Microsoft hardware changeNone. No new BOM. No motherboard rework. No cellular contract. Zero OEM redesign required.
- Fleet reachEvery Wi-Fi Windows PC on a supported Windows version — Surface, HP, Dell, Lenovo, every managed endpoint. macOS, ChromeOS, Linux on the roadmap.
- Marketable asA Defender-for-Endpoint or Surface security feature roll-out to the entire installed base — not a next-gen SKU exclusive.
- Power-state coveragePC on, Windows running, offline from the network: yes. PC off / no OS loaded: no (Phase 2 delivers that).
- Time to valueWeeks, not quarters. Software product Microsoft could pilot next update cycle.
Location, telemetry, and commands all reach the PC on the Wi-Fi radio — whether it's on and connected, on and offline, or fully powered off with no OS loaded and the disk encrypted at rest. Same class of assurance HP delivers via Wolf Connect cellular, delivered on the Wi-Fi radio the mainstream Windows fleet already carries.
- LayerOEM-integrated on the Wi-Fi radio Surface (and partner OEMs) already ship. Runs below the OS — independent of Windows uptime, boot state, or disk state.
- DistributionShips on new PCs as part of the platform. Certified Windows / Surface program alignment.
- Microsoft hardware changeNo new BOM. No cellular modem, no SIM, no new antenna. A capability inside the Wi-Fi silicon Microsoft partners are already selecting cycle over cycle.
- What Microsoft can doLocate a powered-off PC on the Wi-Fi observation network. Pull telemetry back from a device with no OS loaded. Execute commands — lock, wipe, quarantine — that reach the machine on the radio, regardless of Windows state.
- Power-state coveragePC on and connected: yes. PC on and offline: yes. PC off / no OS loaded / disk encrypted at rest: yes.
- Time to valueAligned to Microsoft's next Surface platform cycle. Not a blocker for Phase 1.
Where Troverlo plugs into the Microsoft security stack.
Same mechanism underneath. Different integration surface depending on which door the pilot runs through.
Troverlo observations arrive as a new device-status signal — "last seen at location X, offline for N minutes." Defender action rail (isolate, lock, wipe) extends to reach the endpoint via the Wi-Fi radio when the machine drops off the network. Ships as a certified Defender integration partner via Microsoft's documented partner path.
The Phase 1 Windows service deploys through the same MDM rail Intune already uses. Once installed, an admin gets a Windows-shaped equivalent of Lost Mode — a locate/lock/wipe action that works even when the PC is offline. Closes the gap Microsoft's own docs describe today.
Phase 2 lands in the Wi-Fi silicon on next-gen Surface. A differentiated commercial Surface story: the only Windows PC that can be located, commanded, and wiped when powered off, on the radio it already carries. No cellular BOM, no SIM, no premium SKU wall.
Offline device events land as a new telemetry class inside the XDR narrative. "Device X last observed at Y, last-known state Z, commands pending" — routable, alertable, correlatable with the rest of the Microsoft Security telemetry stream.
Cellular is the expensive answer. Wi-Fi is the answer that ships to every PC already.
HP made the cellular bet because in 2020 that was the only way to reach a powered-off PC. The technology to do the same thing on Wi-Fi — connectionless observation, beacon mode, no association — didn't exist yet. It does now.
Cellular costs: dedicated modem BOM (~$15-40 per unit), SIM provisioning, carrier contracts, ongoing per-device data plans, time-of-purchase-only ordering, hard SKU walls between eligible and ineligible fleet. The Wi-Fi answer inherits none of that. It runs on the radio the PC already has, ships to every OEM Microsoft supports, and doesn't require a new commercial motion at Microsoft or its partners.
This is the moment where "Wi-Fi is the incumbent, cellular is the premium alternative" flips into "Wi-Fi is the answer for everyone, cellular is the legacy premium tier for HP's specific installed base." Microsoft can be the platform that makes that flip visible to the market.