Questions, answered.

On your node. Cyentrix Scan is a single binary you install on hardware inside your own network. Every scan — discovery, detection, credentialed checks — executes there. Your targets, credentials and raw evidence never leave your walls.

The console (console.cyentrix.com) is a control plane only. You use it to create scans, watch progress, cancel, and read findings from any device. It queues jobs your node pulls and runs — it cannot execute a scan itself, and that boundary is enforced in the software, not just hidden in the UI.

Windows and Linux. It is a single static binary with no dependencies — drop it on a box, point it at the console, and it dials out over HTTPS.

No. The node is outbound-only — it makes an HTTPS connection out to the console. There are no inbound ports to expose and the console never needs a route into your network.

Asset discovery and service/version detection (Nmap), matched against CVE and enriched with CISA KEV and EPSS exploit-probability, plus Nuclei template probes, TLS/certificate checks and common misconfigurations. Crucially, every finding is then graded by evidence — how strongly Cyentrix has actually demonstrated it — so a version match is never presented as a confirmed vulnerability.

They describe how strongly a finding is proven — separately from its CVSS severity. Actionable = confirmed by a live check or verified with credentials on the host (act on these). Potential = matched only by a service version or CPE, not yet proven (worth checking, not yet actionable). Validated-safe = Cyentrix found positive evidence the host is not affected (e.g. a Linux distro backported the fix). A CVSS 9.8 seen only in a banner is a Potential, not an emergency.

Because we don't count version guesses as vulnerabilities. Many scanners flag a CVE whenever a version could match, which on patched Linux fleets produces long lists a tester later dismisses as false positives. Cyentrix validates first and only marks something Actionable when there is real evidence — so the total can be lower, but what remains is worth your time.

Yes. On a credentialed Linux scan Cyentrix reads the host's own package manager (apt / dnf / yum) to see which CVEs are genuinely still pending. Distros routinely backport a security fix without changing the upstream version string, so a naive version check would flag a patched build — Cyentrix marks it validated-safe instead, with an audit trail rather than a silent drop.

Add SSH or WinRM credentials and the node performs authenticated checks — installed packages, missing patches, local configuration — for far fewer false positives. Credentials are stored and used on the node only; they never reach the cloud.

Yes — you can run compliance/benchmark profiles (e.g. CIS-style hardening checks) alongside vulnerability scans and see control drift in the same report.

Yes. Re-scanning the same hosts is unlimited and does not cost extra — you are only billed on unique assets per month (see below). Re-scan daily to watch risk fall.

Yes — every new account starts with a free 7-day trial that lets you scan up to 5 IPs, no card required. Upgrade to a paid plan any time to lift the limits; your setup and history carry over.

By unique IP addresses you assess per month — deduplicated and CIDR-safe. Starter is $25 for 20 IPs, Growth $50 for 50, Ultimate $125 for 250. The allowance resets each calendar month.

Each distinct host (IP) you actually scan in a billing month counts once, no matter how many times you re-scan it. Duplicates and overlapping CIDR ranges are collapsed so you are never double-charged.

You can top up extra IPs any time — they are added to the current month instantly, with no plan change required.

Yes — pay annually and you get 2 months free (10× the monthly price) and the Recon add-on included at no charge.

Passive OSINT and attack-surface mapping. It is available as an add-on to any plan, and included free on annual plans. Ask us for current pricing.

Payments are handled in the console via Ziina, in USD. Choose monthly or annual at checkout.

Yes. Plans are month-to-month; you keep access through the period you have paid for, with full scan lifecycle and history in the console.

Yes — the Ultimate plan supports multiple nodes and sites, so MSSPs and larger estates can scan several networks from one console.

Raw evidence, credentials and scan traffic stay on your node. The node reports finding summaries to the console so you can view and export them in the browser; you control what is uploaded, and sensitive material never leaves your network.