Cyentrix, from zero to your first fixed finding.

Overview

Cyentrix is a threat-informed vulnerability platform. You run lightweight nodes inside your own network; they discover assets, test exposure and read exploitability, and stream evidence-graded findings up to a central console. The console correlates everything against live threat intelligence — CISA KEV, EPSS and CVSS — and surfaces the handful of actions that actually change your risk.

The design principle throughout: severity is not certainty. Every finding is graded by the evidence behind it, and anything proven safe is set aside instead of padding your count.

Install a node

A node is a single self-contained binary. Run it on any machine inside the network you want to assess.

Linux (recommended — the full engine)

chmod +x cyx-linux-amd64
./cyx-linux-amd64 -addr 0.0.0.0:8835

Windows (Beta)

A Windows node build is available and marked Beta. The full assessment engine — including Metasploit-backed verification — runs on Linux; run Windows nodes for reach into Windows-only segments and expect a narrower toolset.

Enrol the node

Your first scan

From the console, choose New Scan, enter a target (an IP, range, hostname or URL), pick a policy and a mode, and start. Results stream in as the node works — no need to wait for the whole scan to finish to see the first decisions.

For the highest-confidence results, supply a credential (see Credentialed scans) so the node can read the target directly instead of inferring from banners.

Scan policies

A policy is a purpose-built bundle of scan modules. Pick the one that matches your intent — policies never quietly pull in unrelated heavy testing.

• Asset Discovery — live hosts, ports, services and identity, with no vulnerability testing.
• Basic Vulnerability Scan — fast, low-impact network assessment.
• Web & API Assessment — web exposure, hygiene, secrets and API surface for HTTP services.
• Credentialed Patch Audit — authenticated installed-software inventory matched to CVEs. Highest confidence, lowest false positives.
• Security Configuration Audit — insecure OS/software configuration, without a formal framework.
• Compliance Audit — formal pass/fail control testing against a chosen benchmark.
• External Attack Surface — internet-facing recon, DNS/email, web exposure and remote-access checks.
• Compromise Assessment — credentialed hunt for indicators an attacker is already inside (see below).

Scan modes

Mode is a single safety dial applied on top of the policy. Each module's individual checks are filtered to the mode's ceiling.

• Safe — read-only requests only. Nothing beyond what discovery already sent.
• Standard — active probing and template sweeps at a controlled rate. The recommended default.
• Aggressive — adds authentication attempts, default-credential tests and non-destructive exploit verification. Requires explicit confirmation, and never runs disruptive checks.

Credentialed scans

Supply an SSH or WinRM credential and the node reads the target from the inside — the exact installed build, its configuration, its running services. This is the highest-confidence, lowest-false-positive path, because a finding is confirmed against ground truth rather than guessed from a version banner.

Credentials are held in an encrypted vault, used only for the scan you attach them to, and never sent to the console.

WordPress Guardian

A read-only compromise & vulnerability scanner for WordPress. Install the Guardian plugin (or point a node at the site) and it inspects the site file-by-file, live, for web-shells, hard-coded secrets, exposed source and config, world-writable PHP, dangerous user/registration state, XML-RPC abuse and pending updates.

On any paid plan, high-confidence findings get a one-click Fix — for example blocking the XML-RPC endpoint or correcting file permissions — applied safely and re-verified so the button clears once the issue is gone.

Compromise Assessment

Answers a different question from "what could be exploited?" — it asks "is a threat actor already on this host?" Over the same authenticated SSH session as a credentialed audit, and strictly read-only, it hunts for indicators of active presence:

• A second UID-0 (root-equivalent) account, or an SSH key installed on a service account.
• Cron jobs and systemd services that pull-and-execute or open a reverse shell.
• Processes running from a temporary filesystem, and backdoor-style bind-shell listeners.
• Shell-history redirection and cleared authentication logs.

Every indicator maps to a MITRE ATT&CK tactic. Unambiguous backdoors are reported Confirmed; strong indicators that need an analyst's judgement are Highly-likely — never a bare "potential", so it doesn't cry wolf.

Select the Compromise Assessment policy on a scan with credentials, and intrusion.* findings appear alongside your other results.

Continuous scanning

Schedule any policy to run on a recurring basis. Cyentrix tracks drift across runs — first-seen, last-seen and confirmed-fixed — so you see what changed, not just a fresh wall of findings each time.

Evidence grading

Every finding carries a state derived from the evidence behind it, kept separate from severity. A version-only match to a CVSS-9.8 CVE is a Potential, not an action item.

Findings & triage

The console ranks by what moves your risk: findings that are both exploitable in the wild (KEV / high EPSS) and confirmed on your assets rise to the top. Filter by state, severity, host or module; open any finding for its evidence, the affected asset, and the remediation.

Remediation

Remediation happens from the finding itself — there's no separate section to hunt through. Open a finding, choose Remediate, and Cyentrix asks for the credential it needs and applies the fix over the node, then re-checks it.

Reports

Generate a board-ready report for any scan: cover, executive summary, evidence-graded findings and remediation. Export as PDF, Word, HTML, CSV or JSON.

Compliance mapping

Findings map to CIS, NIST and ISO controls, turning a scan into an audit-ready program. Run a formal benchmark with the Compliance Audit policy; only implemented benchmarks are ever presented as implemented — roadmap frameworks are labelled as such.

Console & nodes

The console manages. The node scans. The console is where you enrol nodes, launch scans, read findings and generate reports. Nodes do the work inside your network and report outward. One console can run many nodes across many segments and sites — each streaming its signals back to one place.

Updates

Nodes update themselves over a cryptographically signed channel. Each release is Ed25519-signed and verified against a key baked into the node; a node fails closed on any signature or version problem, so it will never apply an unsigned or downgraded build. Check for updates any time under Settings → Updates.

Plans

• Community — free forever. One site or subnet, evidence-graded findings, KEV/EPSS prioritisation, remediation preview.
• Core — the operating baseline for a team that patches: credentialed patch audit, one-click remediation, PDF/Word/CSV reports.
• Pro — depth beyond one box: external recon & attack surface, continuous scanning & drift, compliance mapping.
• Enterprise — MSSP multi-tenant, unlimited scale, SSO/SAML and audit log.

Security & privacy

Scanning and credentials stay inside your network on the node. Credentials are stored in an encrypted vault and used only for the scan they're attached to. The console receives findings and metadata, not your raw traffic or secrets.

Troubleshooting

The node won't come online

Confirm the node can make outbound HTTPS to the console, and that the enrolment token hasn't expired. Re-issue a token from Nodes → Add a node if needed.

A finding looks like a false positive

Check its state. A Potential is a version-only match by design — attach a credential and re-scan to confirm or suppress it against ground truth.

"Update available" won't clear

Trigger it manually under Settings → Updates → Check → Update now; the node verifies the signed manifest and applies it.

FAQ

Does Cyentrix send my data to the cloud?

No. The node scans locally; only findings leave your network. Credentials never do.

Do I need to open firewall ports?

No. Nodes connect outbound to the console.

What's the difference from a classic scanner?

Classic scanners flood you with CVEs. Cyentrix grades every finding by evidence and ranks by live exploitability, so you get a short list of what to actually fix.

Is the Windows node the full engine?

The full engine — including exploit verification — runs on Linux. Windows nodes are Beta and cover Windows-only reach.