ArcScan sweeps your network, builds a live CMDB from agentless probes, matches every package against NVD, OSV, GHSA, RHSA, USN, DSA, Alpine, ALAS and MSRC feeds with KEV and EPSS enrichment, then generates Ansible remediation that is blast-radius analyzed and dry-run verified before a human approves the apply, with an HMAC-signed, offline-verifiable evidence bundle for your QSA, FedRAMP assessor, or 3PAO.
MSRC ships enabled-on-request; 8 feeds run out of the box.
ArcScan is a pre-revenue platform. The industries above are our design targets, not a customer list.
One platform in place of a discovery tool, a vulnerability scanner, a CMDB sync, a post-quantum crypto inventory, and a remediation runner, built for regulated mid-market and federal teams.
Agentless masscan/zmap sweep, then credentialed SSH/WinRM/SNMP/SMB/IPMI deep probes build a typed asset graph with packages, open ports, and software stacks. Agentless snapshot side-scans read a VM's package database straight off a disk snapshot, so stopped instances and hosts with no credentials still get inventoried. "Add environment" turns a cloud account or an on-prem site into the whole collection chain in one click.
Every discovered package is matched against nine vulnerability feeds: NVD, OSV, GHSA, RHSA, USN, DSA, Alpine, ALAS and MSRC. CISA KEV status and EPSS scores are layered on top, reachability analysis records whether the vulnerable code is exposed in your environment, and overnight delta alerts tell you when a CVE you already carry flips to known-exploited.
Export ArcScan's verdict on each CVE as OpenVEX, CycloneDX VEX, or CSAF VEX so downstream scanners stop paging on vulnerabilities already judged unreachable, fixed, or false positive. SBOMs ship as CycloneDX 1.5 or SPDX 2.3 per asset or org-wide, and Quantum Arc adds a CycloneDX 1.6 CBOM that joins to the same component references.
Before anything executes, ArcScan walks the reverse-dependency closure of the package and maps it to the services running on that host, so the approver reads a restart list, not a version bump. Every fix runs in Ansible check mode against the real host, passes a deterministic dangerous-operations linter, then waits for policy-as-code, your maintenance window, and a human approval. ServiceNow change-request gating is opt-in per user and enforceable org-wide by a Manager.
Each fix ships with its own rollback playbook, and a post-apply scan confirms the CVE actually cleared. The Remediation Reliability dashboard reports patch success rate, MTTR mean and median split by severity, rollback counts, and the proposed-to-applied funnel from your own runs. Every action lands in an HMAC-signed evidence bundle that verifies offline.
Exclude hosts or apps from a single run, or write a standing rule at host, package-on-host, or path-prefix granularity tagged vendor managed, risk accepted, or false positive. When a vendor forbids the upgrade, pin instead with apt hold or dnf versionlock, reported as pinned rather than fixed. Orphaned .dist-info remnants are recorded as not installed and never matched, with a cleanup playbook to remove them.
Agent-based discovery finds the SSH keys, X.509 certificates, and Java keystores across your estate and grades each one on an algorithm-aware severity scale. Crown-jewel ranking scores every finding by how far a compromise travels, the crypto map draws the PKI and key-sharing graph between your hosts and CAs, and the readiness report and CBOM track you against CNSA 2.0. Linux agents today.
Every quantum-vulnerable finding carries a must-migrate-by date computed from NIST IR 8547 or, when you select it, CNSA 2.0, with a burn-down by year. The external PQC readiness probe checks whether your TLS and SSH endpoints negotiate hybrid ML-KEM key exchange. Rotations roll out canary, percentage, then fleet, halt on a failed ring, and never lock anyone out.
Plant decoy credentials that alert the moment anyone uses them: an AWS access key from a deny-all pool account, an ArcScan API token, a web URL that always answers 404, an Azure service principal, or an LLM lure in an AGENTS.md file. Credential-origin monitoring flags a real token used from outside its seven-day baseline, and retry-loop detection spots machine-regular 4xx bursts. Deterministic, no new sensor.
A unified asset graph with 10 edge kinds. East-west traffic observed on the hosts themselves sits alongside cloud control-plane routing pulled from NSG rules, VNet peering, and Front Door and load balancer config, each edge labeled by origin so you can always tell what actually talks from what is merely allowed to. Blast radius and attack paths run on top.
20 current control packs loaded, including NIST 800-53 Rev 5, NIST 800-171, FedRAMP Rev5 Class B and C, CIS, HIPAA, PCI DSS v4.0.1, SOC 2, ISO 27001, NIST CSF 2.0, and GDPR, plus a crosswalk engine so SOC 2 evidence maps onto ISO and NIST without redoing the work. cATO packages export OSCAL SSP, POA&M, and assessment results. Give your assessor a read-only external portal over the tamper-evident log, and publish a token-gated Trust Center page prospects can read without an account.
Ask ArcScan answers plain-English questions over your security graph through read-only tools. Describe a custom rule in a sentence and ArcScan drafts it with a canary pair it must pass before you can save. A built-in MCP server lets Claude Code or any Model Context Protocol client query posture and open governed remediation requests with your own API token, every call audit-logged.
A self-extracting offline bundle ships the ArcScan CLI, Ollama, and a GGUF model with no outbound calls; the full platform air-gaps via Docker Compose. AES-256-GCM encryption mode (FIPS-approved algorithms) for FedRAMP and DoD environments. SDVOSB sole-source eligible.
Manage client organizations from one console: create client workspaces, grant or revoke engineer access in batch, and invite read-only client viewers. The partner overview shows score, open criticals, and KEV exposure per client, with SLA and MTTR rollups, scheduled branded client reports, and quarterly business review PDFs under your own brand.
SAML 2.0 and OAuth single sign-on for Google, GitHub, Microsoft, and GitLab, SCIM 2.0 provisioning from Okta, Entra, or OneLogin with groups mapped to the five functional roles, and TOTP or WebAuthn security-key two-factor. Deactivating a user in your IdP kills their sessions and their API tokens.
After every terraform apply, parsed tfstate upserts every compute instance it finds to ServiceNow CMDB, Jira, and FreshService. Closes the "CMDB is 60% out of date" gap regulated buyers know they have.
Three steps. No agents to deploy. Works in air-gapped networks.
Point ArcScan at a CIDR or cloud account. Agentless masscan/zmap sweep, then credentialed SSH/WinRM/SNMP probes pull packages, open ports, and software stacks.
Every package is matched against 9 live vulnerability feeds. KEV-listed and high-EPSS CVEs surface first, filtered by whether the vulnerable code is actually reachable in your environment, with blast-radius context from your asset graph.
Generate a remediation playbook, review its blast radius, watch it dry-run in check mode, then approve the apply. Or open a remediation PR or file a ServiceNow change request instead. Every action lands in an HMAC-signed evidence bundle, framework-mapped and offline-verifiable.
A complete IaC security and automation platform, not just a linter. Discover, audit, build, provision, and monitor your entire cloud estate from a single pane of glass.
Paste, upload, or zip-scan your existing Ansible, Terraform, or mixed IaC repos. Get scored findings, policy-gated remediation playbooks, and compliance mapping in the same pass.
Describe what you need in plain English and ArcScan generates security-hardened Ansible and Terraform IaC using AI. Generated code enters the review tier: dry-run verified and human-approved before it touches anything.
Connect Google Drive, OneDrive, Dropbox, GitHub, GitLab, or Bitbucket and scan playbooks directly from where your team already works.
/api/v1/mcp/ for Claude Code and other agents, plus a REST API.Purpose-built for the compliance realities of healthcare, federal agencies, and financial services, the three verticals where IaC risk and audit pressure converge.
Healthcare IaC teams typically manage hundreds of Ansible and Terraform modules across clinical, billing, and infrastructure systems, and manual pre-deployment security review competes directly with release cadence.
Federal civilian and defense agencies running air-gapped environments need consistent NIST 800-53 and FedRAMP validation across every IaC module, without sending source code to a SaaS. CNSA 2.0 adds a second clock: agencies must know where their pre-quantum cryptography lives before they can plan the migration.
Credit unions, payment processors, and regional banks face annual PCI-DSS QSA audits where evidence collection, screenshots, policy documents, and system check exports across dozens of IaC modules, is done by hand.
Target deployment profiles. ArcScan is a pre-revenue platform actively exploring design-partner relationships in each vertical.
Infrastructure as Code has transformed how teams deploy systems, but it has also moved security risk upstream. Traditional security tooling was built for running systems, not declarative configuration files. This white paper examines how automated IaC security analysis closes that gap.
Start free with your own AI key, or book a 20-minute demo and we'll walk a sweep, a CVE match, and a governed remediation on real infrastructure.