Frequently Asked Questions

ArcScan is an enterprise security platform built around one loop: discover every asset, find every CVE and misconfiguration, and fix it under governance with proof. It audits Ansible playbooks and IaC, sweeps networks and cloud accounts (AWS and Azure; GCP in preview) into a live CMDB, scans posture against CIS/NIST benchmarks, matches installed packages against nine CVE feeds, and, the differentiator, remediates under governance: ArcScan generates the fix, computes its blast radius, and proves it in a check-mode dry run before anything is applied. Applying is gated by policy-as-code, maintenance windows, and human approval, with optional ITSM change-approval on top. Add-ons extend the loop: Quantum Arc inventories post-quantum crypto risk, Arc Tripwire plants decoy credentials, and the MCP server lets your own AI agents query posture. It also covers compliance tracking, a public Trust Center, DSPM, executive reporting, and a built-in work OS (Boards). Built by Arcus Forge LLC, an SDVOSB.

Playbooks are scored 0-100 (A-F grades). The AI analyzes for security issues, idempotency, deprecated modules, missing best practices, and more, and every finding is ranked critical / warning / info. Orgs that want a deterministic score can turn on custom scoring profiles and set their own severity weights. Cloud posture scans use the same 0-100 scale with deterministic CIS-benchmark checks.

Ansible playbooks (.yml, .yaml), inventories, role directories, and zip archives containing multiple YAML files. You can paste content directly, upload a file, or scan from connected cloud storage (Google Drive, OneDrive, Dropbox, GitHub, GitLab, Bitbucket). The Enterprise Scanner (Findings → Enterprise Scanner) also audits Kubernetes manifests, Helm charts, Dockerfiles, Terraform plans, CloudFormation, and GitHub Actions workflows.

A built-in work OS under the Work nav group. Create boards with table and kanban views, add items with custom columns, assign teammates, and group work into swimlanes. Security items pull from your live data: one click populates the board from your open vulnerability findings, filed into severity swimlanes with status and a link straight to the CVE record. Use it to run remediation sprints without exporting findings to another tool.

The Executive dashboard (Home → Insights) rolls the whole platform up to board level: risk posture score, SLA attainment, remediation velocity, industry-percentile benchmark standing once your peer group has enough opted-in organizations, a PQC deadline tile when Quantum Arc is enabled, and an AI-written posture summary narrated from your live metrics. Export it as a branded PDF, or enable the weekly AI posture briefing email (Settings → Email Delivery) for Monday-morning week-over-week deltas.

1. Open Inventory → Discovery Engine → Network Sweeps and click New sweep.
2. Enter one or more Target CIDRs (comma or newline separated; a /16 is the largest single range). Public ranges require ticking the authorization checkbox.
3. Pick a Scanner backend: tcp_connect (default, a full handshake that closes immediately), masscan, zmap, or nmap with service detection. Optionally override the port list and choose Run from an enrolled Arc Probe agent for a segmented site.
4. Submit. The sweep detail page polls progress, lists every live host with open ports, banners, and TLS certificate details, and shows the PQC readiness of the edge card for the TLS and SSH endpoints it found. Cancel is available while it runs.
5. Discovered hosts land in Inventory → Assets as CMDB rows. Put the sweep on a cadence under Discovery Engine → Schedules.

1. Store the credential first in Settings & Workspace → Vault: an SSH private key or password, a WinRM password, or an SNMP community string.
2. Open the asset in Inventory → Assets and click Deep probe, or go to Discovery Engine → Deep Probes and pick the asset there.
3. Choose the Protocol (SSH, WinRM, SNMP, SMB, or IPMI), the Auth method, the Username, and the Vault secret. Port and target host overrides are optional.
4. Submit. The probe page polls to completion and shows the parsed facts: OS and kernel, listening ports, installed packages, running services, users, neighbors, and routes. Every command is read-only.
5. Packages are matched against the CVE feeds immediately, so the asset's Vulnerabilities tab and the CVE Dashboard fill in without a second step. Recurring probes run from Discovery Engine → Schedules.

Yes. Hosts can be scanned by credentialed SSH deep probe, by agentless snapshot side-scan (Findings → Posture → Agentless Scan reads the package database straight off an AWS or Azure disk snapshot, so stopped instances and hosts with no credentials still get inventoried), or both. The org default lives under Discovery Engine → Discovery Settings and defaults to both; a per-host override on the asset page can only narrow it. A host skipped by your choice is named in the run summary and never reads as clean.

Open Inventory → Add environment → Add an environment. For a cloud account, pick or create the credential and ArcScan runs the full chain: verify, pull inventory, build the topology graph, run a posture scan, pull SSM inventory on AWS, match CVEs, reconcile assets, and set up recurring schedules. For an on-prem site, choose the agent path (ArcScan mints a one-time bootstrap token and an install one-liner for Arc Probe) or the SSH path (creates the deep-probe schedule and dispatches the first probes). The run page shows progress per step and a coverage summary when it finishes.

AWS and Microsoft Azure for full inventory and security-posture scanning. GCP credential connection and inventory are available in preview; GCP posture discovery is not yet live. You can connect multiple accounts per provider using API keys, service accounts, or IAM roles.

21 deterministic checks aligned with CIS benchmarks, no AI required: 10 for AWS, 6 for GCP (preview), and 4 for Azure, plus a generic tagging-coverage check, with more Azure coverage in progress. Checks include: open security groups/firewalls, publicly accessible databases, unencrypted storage, overly permissive IAM (AWS), missing tags/labels, stale users, public IPs, and more. Each finding includes severity, CIS reference, remediation, and Ansible module hints. A detection canary in CI proves every rule still fires on a known-bad fixture, so a rule cannot go silently dead.

Cloud Inventory pulls your live infrastructure data and uses AI to analyze it for security, cost, drift, compliance, and automation opportunities. Security Posture runs fast, deterministic CIS-benchmark checks against that same inventory, no AI call needed, instant results. You can optionally add AI-generated remediation playbooks to posture scans.

Cloud credentials are encrypted in the database and only decrypted at scan time. They are never logged, never sent to AI providers, and never leave your ArcScan instance. Enterprise customers can self-host for full control.

Discovery Engine (Inventory nav) runs network sweeps, credentialed deep probes, and lightweight agents to inventory hosts and installed packages, feeding the CVE dashboard with real per-asset vulnerability hits. Enterprise App Discovery (Findings → Enterprise Apps) is an early preview that inventories your Entra (Azure AD) enterprise applications and applies a first-pass over-privilege heuristic; treat it as a starting point, not a full SSPM inventory. DSPM (Findings → Data Security) inventories data stores across your cloud estate and flags their exposure. Content classification, sampling objects and classifying PII/PHI/PCI without retaining them, runs on AWS S3 today; Azure Blob and GCS stores are inventoried and exposure-checked but explicitly marked not yet content-sampled, so a public regulated blob is never silently passed as clean. Relational stores are classified from metadata only; ArcScan never reads your rows.

Yes. The Product Deployments wizard (Settings & Workspace → Product Deployments) provisions Arc components into your own cloud account via Terraform: the Arc Probe discovery/remediation agent, the Quantum Arc post-quantum crypto discovery appliance, and the Arc Redactor PII-sanitization container. You pick (or create and test) a cloud credential inline, review the plan, deploy, and tear it all down from the same page when finished. Availability today: Arc Probe is generally available and validated end-to-end. The Quantum Arc appliance deploys but is pre-GA pending live-apply validation. Arc Redactor requires private-registry pull credentials on AWS and GCP.

A unified asset graph with 10 edge kinds. East-west traffic observed on the hosts themselves (established TCP connections, ARP and IPv6 neighbors, LLDP and CDP peers, SNMP routes) sits alongside cloud control-plane routing read from NSG rules, VNet peering, and Front Door and load balancer configuration, plus IAM and KMS relationships. Every edge is labeled by origin, so you can always tell what actually talks to what from what is merely permitted to. Blast radius, attack-path analysis, and reachability-based CVE prioritization all run on top of that graph.

Arc Tripwire catches an intruder's first move with credentials that have no legitimate use, so any use is an alert. Open Settings & Workspace → Arc Tripwire, click the token type you want, and give it a label saying where you will plant it. Decoy kinds: an AWS access key from Arcus Forge's pool account with a deny-all policy (any call shows up in CloudTrail), an ArcScan API token in the real arcscan_ format, a web URL under /t/ that always answers 404, an Azure service principal in a pool tenant, and an LLM lure for an AGENTS.md file that catches an AI agent following planted instructions. Deploy decoy can write the credential onto a host through an enrolled Arc Probe agent (choose the Unix user, .env path, or AGENTS.md directory). Tripwire also watches real credentials: a token or agent key used from an IP outside its seven-day baseline, or a machine-regular burst of 4xx responses, raises an intrusion incident on the On-Call page and fans out to your webhooks. Detections are deterministic; decoys cannot false-positive.

Every package found by a deep probe, snapshot side-scan, SSM inventory, or image scan is matched against NVD, OSV, GHSA, RHSA, USN, DSA, Alpine, ALAS, and MSRC (enabled on request). Matching is distro-scoped, so a Debian backport is not reported as an unpatched upstream release. On top of the match, the CVE Dashboard (Findings → Vulnerabilities) shows CISA KEV status, the EPSS exploit-probability score, and a reachable flag from the exposure analyzer that asks whether the vulnerable package sits on an internet-facing path in your graph. Filter by any of them, or click Run Triage to have the AI score and cluster new hits into a plan where every step still needs your approval. Overnight rescans and KEV flips raise in-app and Slack/Teams alerts automatically.

VEX (Vulnerability Exploitability eXchange) carries ArcScan's verdict on each CVE so your other scanners stop paging on vulnerabilities already judged.

1. For one host, open the asset in Inventory → Assets and click Download VEX (OpenVEX) or VEX (CycloneDX) next to the SBOM button.
2. For the whole org, open the CVE Dashboard and use the three VEX buttons in the filter bar. The export honors the active filters but defaults to every status, so the not-affected statements are included.
3. Pick the format your consumer reads: OpenVEX for Grype, Trivy, and most open-source scanners; CycloneDX VEX when you also consume the CycloneDX SBOM (the two join by component reference); CSAF VEX for enterprise advisory pipelines and vendors that ingest CSAF 2.0.

The disposition rules are fixed: open and reachable is affected with the target version as the action; open and unreachable is not_affected citing the analyzer's reason; fixed-in-place or fixed is fixed; false positive, suppressed, and vendor-managed pins are not_affected; risk-accepted pins stay affected with a no-upgrade statement; unknown reachability is under_investigation.

Per asset: Download SBOM on the asset page. Org-wide: the SBOM button in the CVE Dashboard filter bar. Both default to CycloneDX 1.5 JSON with open vulnerabilities embedded; add ?format=spdx for SPDX 2.3. You can also upload third-party CycloneDX or SPDX SBOMs under Findings → Vulnerabilities → SBOM and ArcScan matches their components against the same feeds.

Usually because the other scanner is counting ghosts. A half-removed Python package leaves an orphaned .dist-info or .egg-info directory behind, and version-matching scanners read it as an installed vulnerable release. ArcScan records those remnants as not installed and never matches them against a CVE. It also generates a cleanup playbook that deletes the remnants, so your other scanners stop flagging them too.

Yes, on Linux. Installing a patched kernel updates the version on disk but leaves the old kernel running. Every credentialed SSH probe records the running kernel, the newest kernel installed in /boot, and the distribution's reboot-required marker; when they disagree the host is flagged patched, pending reboot instead of hiding behind a green check. From that banner an authorized user can trigger an RBAC-gated reboot action. Windows probes record the running kernel version only.

One click from a CVE row, a failed posture check, a scanner finding, or an asset page kicks off a remediation run. Nothing is applied by that click. Every run defaults to dry-run: ArcScan computes the blast radius (the reverse-dependency closure of the package mapped to the services actually running on that host, so you see what will restart), executes the play in Ansible check mode against the real host, and runs a deterministic dangerous-operations linter over the result. Only then does it ask for approval. Choose apply now or schedule inside a maintenance window when you're ready. Every run leaves a receipt on the Runs page (Remediate → Remediation → Runs) with full stdout/diff history and an HMAC-signed evidence bundle.

1. Propose. A Remediate Now click, the nightly auto-remediate sweep, an MCP agent request, or Quantum Arc creates a run in proposed state. Exclusion rules (Findings → Vulnerabilities → exclusions) drop hosts you are not allowed to patch.
2. Generate and grade. The playbook is built and graded verified, generated, or no_template. Only verified playbooks are eligible for unattended apply.
3. Dry run. Ansible check mode against the real host through AWX or an Arc Probe agent, plus the dangerous-operations linter and the update-impact restart list.
4. Policy gate. The policy-as-code guardrails (Remediate → Remediation → Pipeline, "guardrails") evaluate severity, blast score, trust tier, and approver quorum.
5. Maintenance window. Unattended runs outside a window defined in Organization Settings → Auto-Remediation are queued for the next window. Manual runs are warned, never blocked.
6. Change management. If you opted in under Settings → Change management, or a Manager enforced it org-wide from Team & Access → Team Management, ArcScan opens a ServiceNow change request and waits. An unapproved change never executes.
7. Approve and apply. A human (or quorum) approves, the apply runs, a post-apply scan verifies the CVE cleared, and the rollback playbook stays attached to the receipt.

The Remediation Reliability dashboard (Remediate → Reliability) reports it from your own runs, not from a datasheet: patch success rate, MTTR mean and median split by severity with outliers annotated rather than hidden, rollback counts, the proposed-to-applied funnel, a per-fix-class rollup, and a weekly trend. If a fix class keeps failing on your fleet, you see it there before an auditor does.

Exclude specific hosts or applications from a single run, or write a standing exclusion rule at host, package-on-host, or path-prefix granularity. Each rule carries an audit category, vendor managed, risk accepted, or false positive, so the reason travels with the finding into your evidence pack and into your VEX export. When a vendor forbids the upgrade outright, use the pin-instead flow: ArcScan issues an apt hold or dnf versionlock and reports the package honestly as pinned, never as fixed.

Every generated fix ships with a matching rollback playbook produced at the same time, so remediation is not a one-way door. After an apply, a post-apply verification scan re-checks the host to confirm the CVE actually cleared rather than trusting the exit code. Both the rollback and the verification result land in the run receipt.

No. Remediation playbooks carry a trust tier: verified playbooks (deterministic, registry- and syntax-checked, optionally sandbox-tested) can auto-apply under an explicit policy you configure; AI-generated playbooks are dry-run only and always require human review. Policy-as-code guardrails and org maintenance windows further gate unattended automation, and manual Remediate Now is never blocked, only warned.

Yes. Change management is built in and opt-in. Any user can opt themselves in from Settings → Change management, and a Manager can enforce it org-wide from Team & Access → Team Management (which locks every member's toggle on). When required, automation first opens a ServiceNow change request; the run executes only after the change is approved. It's fail-closed: an unapproved change never reaches your infrastructure. Quantum Arc live rotations follow the same mandate.

Supervised AI action plans (Remediate → Agentic Actions). The AI drafts a multi-step plan, for example autonomous CVE triage reads new vulnerability hits, scores them by severity/KEV/EPSS/exposure, clusters them by fix, and drafts a plan, but every step requires operator approval before it executes. Nothing runs automatically.

ArcScan exposes a Model Context Protocol server at /api/v1/mcp/ (MCP Streamable HTTP, stateless JSON).

1. Create a token: open Settings, scroll to the ArcScan API tokens panel, click create, and copy the arcscan_... key. It is shown once.
2. Register the server in your client. For Claude Code:
   claude mcp add --transport http arcscan https://arcusautomate.com/api/v1/mcp/ --header "Authorization: Bearer <token>"Any other MCP client works the same way: HTTP transport, Authorization: Bearer or X-API-Key header.
3. Ask the agent for your posture. Tools available: list_findings (cloud, CVE, Quantum Arc, and playbook findings under one id scheme), get_asset, search_assets, list_cves (with KEV-only, reachable-only, and minimum-EPSS filters), posture_summary, and request_remediation.

The agent sees only the token owner's organization and role. request_remediation creates a proposed run on a cloud finding and nothing more; the dry run, policy gate, and human approval still happen in ArcScan. Every tool call writes an audit-log row, rate limits match the REST API, and a token belonging to a deactivated user stops working immediately. The REST reference, including the MCP section, is under API Docs.

Home → Ask ArcScan answers plain-English questions over your security graph: "which internet-facing hosts are vulnerable to CVE-2026-1234", "what is the blast radius of db-01", "summarize our KEV exposure", or "search ServiceNow for open changes on web-tier". The LLM routes each question to a small set of read-only, tenant-scoped tools (at most four per question); write tools are unreachable by construction, and tool output, including ServiceNow record text, is treated as untrusted. A Draft a rule shortcut hands a question off to the custom-rule drafter.

1. Open Settings → Custom Rules and click Draft with AI.
2. Describe what the rule should flag, for example "flag any shell task that pipes curl into bash". Click Draft.
3. Your configured AI provider returns a rule (keyword, regex, YAML-path, or module-usage check with severity, message, and remediation) plus a canary pair: a minimal playbook that must match and one that must not.
4. Click Verify. ArcScan runs the real rule engine over both canaries on the server. Save is enabled only when the rule matches the positive canary and not the negative one, and the save endpoint re-verifies.

The canary is the proof that the rule discriminates: a regex that matches everything, or nothing, can never be saved. Drafts are sanitized at the boundary (caps, enums, unsafe-regex guard) and the saved rule records the verification date in its description. The canaries themselves are not stored.

Anthropic Claude (recommended), OpenAI, Azure OpenAI, Google Gemini, DeepSeek, and Nvidia AI, or a fully local LLM via Ollama for air-gapped deployments. Each user brings their own API key via the Settings page. Enterprise orgs can configure managed keys so members never handle keys at all.

Approximately $0.003 to $0.015 per scan depending on playbook size and provider, so 500 scans a month is roughly $1.50 to $7.50 in API costs. Cloud posture scans are free (deterministic) unless you opt for AI-generated remediation playbooks.

Only when you run an AI-powered scan. The content is sent to the provider you choose, using your API key. It is not shared with any other party. Cloud posture checks run locally without any AI calls. The executive AI summary sees a numbers-only snapshot, never free text from your database.

You cannot migrate cryptography you cannot find. Quantum Arc's agent discovers crypto assets across your estate, SSH keys, X.509 certificates, and Java keystores, then grades each one on an algorithm-aware severity scale rather than a generic CVSS score. Findings sync into ArcScan every six hours (Marketplace → Quantum Arc), with a posture page, a printable readiness report tracked against the CNSA 2.0 timeline, and a CBOM (CycloneDX 1.6 cryptographic bill of materials) alongside your SBOM. System trust anchors such as the OS CA bundle are recognized and never "remediated", so a single bundle file cannot be replaced by one generated cert. PQC remediation runs through the same governed pipeline as everything else: dry run, policy gate, human approval. Linux agents are published today; Windows, macOS, and arm64 agents are not yet available.

Every open crypto finding gets a blast score for how far a compromise would travel: a customer CA outranks an SSH host key, which outranks a TLS cert, a keystore, and a user key, and the score grows with reach, the number of hosts sharing the same key material plus the certificates a CA signed. Findings at or above the threshold are crown jewels, shown on the Crypto Posture page (Marketplace → Crypto Posture), as a pill on the findings table (sort by blast), in the readiness PDF, and as properties in the CBOM. Trust anchors and public CA chain material are never crown jewels. The Crypto Map (Marketplace → Crypto Map) draws the same relationships as a graph: hosts colored by worst severity, your CAs as stars, external issuers as hexagons, and one hub per key reused on two or more hosts, with a drawer that links each node to its findings and remediation preview. It renders from persisted findings, so it works while the appliance is down.

Every open quantum-vulnerable finding carries a must-migrate-by date, computed at read time from public transition timelines. Two regimes: NIST (default) follows the NIST IR 8547 initial public draft: 112-bit quantum-vulnerable public-key algorithms such as RSA-2048 and DH-2048 are deprecated after 2030-12-31, and all quantum-vulnerable public-key algorithms are disallowed after 2035-12-31 (P-256 counts as 128-bit, so it falls under the 2035 date). CNSA 2.0 applies the NSA's prefer-by and exclusive-by dates per use category: software and firmware signing by 2030, web, TLS, and cloud by 2033, networking equipment by 2030, operating systems by 2033, PKI by 2033, and custom or legacy by 2035. Each finding is placed in a category from its type, path, and hostname (SSH and trust anchors are OS, CA certs are PKI, VPN is networking, and so on). Hybrid and PQ-safe findings have no deadline; broken-now findings are due now; symmetric and protocol findings get no date. Surfaces: the Migration deadlines panel on Crypto Posture with a countdown and burn-down by year, a Due by column and Due before filter on the findings list, a tile on the Executive dashboard, and a Deadlines section in the readiness PDF. Switch regimes with the Regime selector on those pages.

During a tcp_connect network sweep, every TLS and SSH endpoint gets one extra connection. For TLS, ArcScan sends a TLS 1.3 ClientHello that offers only hybrid ML-KEM groups (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024, and the Kyber draft). If the server answers with a ServerHello or HelloRetryRequest selecting one of them, the endpoint is Ready; a handshake failure, a classical retry, or a TLS 1.2 fallback is Not ready. For SSH, ArcScan reads the server's KEXINIT and looks for mlkem768x25519, mlkem1024nistp384, mlkem768nistp256, or sntrup761x25519. Results appear per port on the sweep page, as a Ready / Partial / Not ready column per host, in the PQC readiness of the edge card, and in an External Edge panel on Crypto Posture. Unknown means the probe got no usable answer: a timeout, a connection reset, a closed port, or garbage back. Unknowns are excluded from the percentage rather than counted either way. Only the built-in TCP scanner probes today; masscan, zmap, nmap, and agent sweeps do not. IP targets are probed without SNI, so a virtual host that requires it may answer for its default site.

1. Open Marketplace → Rotation Rollouts and create a program: a name, the Crypto type and optional algorithm to select findings, an optional hostname list, and a Ring template (canary, then a percentage, then the fleet).
2. Set the health policy: Soak minutes between rings, Failures tolerated per ring, whether the program runs in check mode, and whether a live program requires a prior successful dry run per finding.
3. Start it. Hosts are assigned to rings by a stable hash, so a ring never changes between plan and dispatch. Each host gets its own AWX job through the normal per-finding remediation path, limited to that hostname.
4. A background task polls the ring every five minutes, waits out the soak, then advances to the next ring if healthy. Pause, resume, abort, and "advance now" (skips the soak, never the health check) are on the program page.

A ring is unhealthy, and the program halts with the reason, when failures exceed the tolerance, when a live SSH rotation has not published its new known_hosts line, or when a live X.509 rotation has not re-synced as resolved with a new fingerprint. A halt notifies the owner and creator and fires a webhook. Nothing is rolled back automatically; each run on the detail page keeps its own Roll back control. A live program is refused outright when change management is required, because one program cannot route many jobs through one ServiceNow change; use the per-finding governed path instead.

When the X.509 remediation play runs on a host that has the Quantum Arc agent installed and the certificate is not managed by ACME, the play asks the agent to issue a replacement certificate from the appliance CA over the agent's own signed channel. The private key is generated on the host and never leaves it; the appliance refuses any name outside the host's enrolled hostname; the result is a short-lived ECDSA-P384 certificate. The original material is backed up first, nothing is installed and no service reloads unless issuance succeeded, and a refused issuance fails the play with the original certificate untouched. Where there is no agent, the play falls back to the existing branches: an ACME renewal through certbot, or a self-signed interim certificate with an operator notice. The run artifact records the issuer, serial, and expiry. Known gap: the agent's renewal timer refreshes the staged files, not the installed path, so re-run the play to install a renewal.

It is designed not to. SSH host keys rotate in two phases: the first play adds the new Ed25519 key and a hybrid PQC key exchange while keeping the old key and the classical exchange, publishes the new public key so you can update your known_hosts, and only a separate Retire step (after a grace period) removes the old key. Every PQC key-exchange name is gated on the OpenSSH version that accepts that exact spelling, and the sshd drop-in is validated with sshd -t inside a block whose rescue deletes it, so an unparseable config is never left behind. Each run has a Roll back control that restores the backup.

No. The crosswalk engine (Comply & Report → Compliance → Mapping, then Crosswalk) maps controls between frameworks, so a SOC 2 CC control you have already evidenced carries over to ISO 27001, NIST CSF, and NIST 800-53 without collecting it twice. 21 control packs ship in the box, and coverage is reported per framework so you can see what adding one would actually cost you. Note: ArcScan generates SOC 2 evidence; Arcus Forge does not hold a SOC 2 attestation.

1. Open Comply & Report → Compliance → CATO. The dashboard tracks control implementation per framework with an evidence chain behind each control.
2. Click Generate to build an ATO package: an OSCAL System Security Plan, OSCAL Plan of Action and Milestones, and OSCAL Assessment Results as JSON, downloadable as a bundle.
3. Under Assessor access, click Invite Assessor with a name, email, and expiry. ArcScan mints a login-less, read-only portal link; every access and denial is audit-logged and the link can be revoked at any time.
4. From the Evidence Locker, download a framework's evidence bundle: controls, evidence chain, POA&M, a 90-day audit-log slice, the compliance PDF, and an HMAC-signed manifest the assessor can verify offline with arcscan airgap verify.

1. As an org admin or owner, open Comply & Report → Trust Center.
2. Under Publishing, choose a public slug and a contact email, and enable the page. Under Sections, toggle what it shows: posture grade, compliance framework coverage, vulnerability SLA attainment and MTTR, SBOM availability, CBOM and post-quantum readiness (when Quantum Arc is enabled), and your own plain-text security program statements.
3. Save, then copy the Share link. By default it carries a token, so only people you send it to can open it; rotate the token at any time to cut off old links, or switch the token requirement off for a fully public page.
4. Prospects can submit a Request access or documents form (SBOM, CBOM, or other). Requests land in the Requests inbox on the same page, where you track their status.

The page is fed from data ArcScan already collects, never names an asset, hostname, or IP, is cached for five minutes, is served with noindex and no-referrer headers unless you opt in to indexing, and shows "unavailable" for a section rather than failing. White-label branding applies.

Discover (pull cloud inventory) → Tag (map resources to business applications) → Scan (posture checks + AI analysis) → Build (generate Terraform HCL for tagging + infrastructure) → Provision (generate/audit Ansible playbooks) → Operate (ServiceNow/Jira/FreshService tickets, CMDB sync, Slack alerts, remediation PRs) → Monitor (scheduled scans, drift baselines, regression detection). You can enter the lifecycle at any stage.

Yes. ArcScan offers a REST API with personal API tokens (Settings → ArcScan API tokens), an MCP server for AI agents, a terraform-apply ingestion endpoint that keeps the CMDB current, and a Workflow Builder that generates configs for GitHub Actions, GitLab CI, Jenkins, Azure DevOps, and AWX/Tower with quality gate scoring.

Storage: Google Drive, OneDrive, Dropbox, GitHub, GitLab, Bitbucket. SCM: PR comments and remediation PRs for GitHub, GitLab, Bitbucket. ITSM: ServiceNow (change requests + CMDB CI push + application dependency sync + full-text search from Ask ArcScan), Jira (issues + Epic sync), FreshService (tickets/changes + asset sync). Automation: AWX/AAP, HashiCorp Vault. Alerts: Slack, Teams, Discord webhooks. SIEM & exports: streaming ArcSight CEF (Splunk, ArcSight, QRadar, Sentinel, Chronicle), SARIF 2.1 for code-scanning tools, SBOM as CycloneDX 1.5 or SPDX 2.3 JSON, VEX as OpenVEX, CycloneDX VEX, or CSAF, CBOM as CycloneDX 1.6, streaming CSV/JSON, and HMAC-signed evidence bundles that verify offline. Auth: SSO (Google, GitHub, Microsoft, GitLab) + SAML, SCIM 2.0 provisioning, TOTP/Email 2FA and WebAuthn security keys.

Yes. When you tag cloud resources to an application in the Cloud Inventory snapshot view, check the Sync to ITSM checkboxes that appear below the application selector. ServiceNow creates a Business Service CI in the CMDB and relationship records linking each resource. Jira creates an Epic for the application with sub-tasks for each resource. FreshService creates an Asset for the application with linked resource assets. Checkboxes only appear when the corresponding integration is configured and active.

Open a cloud inventory snapshot, select resources using the checkboxes, then click Tag Application. Choose an existing application or create a new one (name, owner, environment, criticality, data classification). Click Apply Tags. The mapping persists across scans and can be exported as Terraform HCL to apply arcscan:* tags to real cloud infrastructure.

1. A platform administrator enables your organization as an MSP partner. Open the Partner Console from the menu.
2. Click Add client organization to create an isolated client workspace, or add an environment to an existing client with a cloud credential and region from the same page.
3. Click Add team member to build your engineer team, then use Batch grant / revoke to give engineers access to specific clients, or to all clients at once. Grants are enforced server-side and re-checked on every scheduled send.
4. Use the Partner Overview for one row per client: score, open criticals, KEV exposure, asset count, and last scan. The SLA / MTTR page rolls up attainment and mean time to remediate per client against each client's own SLA targets.
5. Under Partner reports, schedule weekly or monthly branded executive PDFs per client, and generate a quarterly business review PDF for any client and quarter.
6. Invite read-only Client Viewers (Team & Access → Client Viewers) so client contacts see their own results under your brand without edit rights. Set your logo and colors once; client-facing PDFs, emails, and the Trust Center inherit them.

Click Sign in with Microsoft on the login page to authenticate with your Microsoft / Entra (Azure AD) account. For partner organizations, ArcScan can auto-join staff whose company email domain your org has claimed, so engineers land directly in your workspace on first sign-in. Google and GitHub single sign-on are also supported.

Beyond ArcScan (IaC + cloud security scanning), Arc is a suite of à-la-carte products: Arc Redactor (PII/PHI sanitization across 20 detection categories, with a transparent proxy and a hash-chained tamper-evident audit log, in-app or as a standalone appliance), Arc Terminal (browser-based SSH with full session recording for audit & replay), Arc Discover (network discovery, CMDB, and credentialed CVE probing), Arc Tripwire (decoy credentials and intrusion detection), and Quantum Arc (post-quantum cryptography discovery, NIST FIPS 203/204/205-aligned; Linux agents available today). Add them individually or as a bundle. Contact sales for pricing.

Most of ArcScan is agentless: credentialed probes over SSH, WinRM, SNMP, SMB, or IPMI, plus AWS SSM and snapshot side-scans. The Arc Probe agent is for the cases agentless cannot reach: segmented or air-gapped networks where the platform cannot open a connection inward, hosts where you want reverse-dependency and running-service data collected continuously rather than per scan, and planting Tripwire decoys on a host. The binary is cosign-signed, speaks mTLS, and connects outbound only. Agents are metered beyond the number included in your tier; contact sales for the current inclusion per tier.

As a Manager, open Team & Access → Team Management and switch to the SSO tab. Under SCIM 2.0 Provisioning, click Mint SCIM Token and copy it immediately; it is shown once and stored hashed. In your IdP, create a SCIM application pointing at your ArcScan SCIM base URL with that bearer token. ArcScan supports user create, read, update, and deactivate with userName filtering and pagination; a SCIM delete deactivates the user and kills their sessions and API tokens rather than hard-deleting. Push groups named after the five functional roles (Business, Engineer, Senior Engineer, Manager, Auditor) and membership maps to the role one-to-one. Every mutation is written to the audit log. The same tab holds the SSO group-to-role mapping for SAML.

Open Settings and the 2FA setup page. Choose TOTP (authenticator app), email, or SMS codes, then register a WebAuthn security key or platform authenticator (YubiKey, Touch ID, Windows Hello) as a FIDO2 factor. 2FA is enforced by middleware on every signed-in request, so there is no page that skips it. Brute-force lockout applies to the login and 2FA forms, and a login from an IP unseen for that user in 90 days is flagged by the audit-log anomaly detector.

ArcScan is licensed as an annual platform subscription sized by host and user capacity, with Trial, Small, Medium, Large, and quote-based Federal and Air-Gap tiers. Every paid tier includes cloud posture, vulnerability management, governed remediation, compliance packs, SSO/SAML, and the ITSM and SIEM integrations. Quantum Arc, Arc Redactor, Arc Tripwire, and Arc Probe agents are add-ons or metered units depending on tier. A billable host is a compute instance enrolled in scanning; cloud resources such as security groups, subnets, IAM roles, storage, and serverless functions never count as hosts. AI provider costs (your own API keys) are separate. Contact sales for a quote.

Yes. Every account starts with a free 14-day Trial you can activate from the Billing page. No credit card required. The trial covers 50 hosts and 3 users with full platform access except deployed agents, and converts to read-only when the 14 days are up.

Yes. Arcus Forge LLC is a Service-Disabled Veteran-Owned Small Business (SDVOSB), eligible for sole-source and set-aside federal contracts. ArcScan supports air-gapped Docker deployment, FedRAMP Low and Moderate control mapping with OSCAL SSP and POA&M export from the cATO dashboard, NIST 800-53 Rev 5 and NIST 800-171 Rev 2 reporting, and an AES-256-GCM (FIPS-approved algorithm) encryption mode. Quantum Arc adds CNSA 2.0 and NIST IR 8547 post-quantum migration deadlines for the NSM-10 timeline.

Yes. The Docker deployment can run fully self-hosted with no external API calls, and a self-extracting offline bundle for Linux x86-64 ships the ArcScan CLI with a local AI model preloaded. In air-gapped mode the deterministic posture engine, CVE matching against side-loaded feed data, and offline evidence-bundle verification all run locally. Live cloud posture scanning requires reachability to the provider API, so it is unavailable while air-gapped. AI features run against a local LLM endpoint (Ollama) with no outbound calls.