Architecture
The console manages. The node scans. Your data stays home.
Cyentrix Scan splits cleanly into a cloud control plane and an on-prem execution node. The console never touches your network — it creates jobs; the node pulls them, scans locally, and returns only sanitised findings.
What syncs to the cloud
- Scan jobs you create (targets you type, schedule, options)
- Sanitised findings — CVE, severity, host/port, remediation summary
- Scan status & metadata for tracking and reporting
- Account, node registry and billing
What stays on your node
- Credentials (SSH / WinRM) — stored and used locally only
- Raw scan traffic & evidence — packet-level output, banners
- PDF reports — generated on the node
- Everything not explicitly summarised as a finding
Principles
Designed so the cloud can't overreach.
The node dials out.
The node opens an outbound HTTPS connection to the console and long-polls for jobs. There are no inbound ports to expose, no VPN, and the console never initiates a connection into your network.
The console can't scan.
The console creates jobs and displays results. It has no scanning capability of its own — execution happens only on nodes you run. That separation is enforced in the software, not just the UI.
Only findings leave.
Nodes upload sanitised finding summaries for reporting. Targets, credentials and raw evidence remain local — ideal for regulated, air-gapped and client environments.
Verifiable by design.
Node updates ship as signed releases from updates.cyentrix.com and are verified before they apply. Sessions are server-side, passwords are hashed with Argon2id, and the multi-tenant database enforces row-level isolation.
Minutes to deploy
One node. Your whole network.
Drop the node on a box inside your network, enrol it with a token, and scan from the console.