Prefer to run the scanner on your own hardware? Download and install it, then click Enroll a node below and connect it from its Settings → Cloud console. On-prem nodes are still activated and licence-limited from here.
Nodes
On the node's own console: Settings → Cloud console, paste these:
Node
Version
Status
Last seen
No nodes enrolled yet. Click "Enroll a node".
Scans
Scans run on your on-prem node — never in the cloud. Start a scan from the node; it appears here to track and, once complete, to download as a PDF report.
Everything you need to set up a node, run scans, and act on findings. Scanning always runs on your own node; the console only queues work and shows results.
Cyentrix Scan has two parts. The node is a single program you run on a machine inside your network — it does all the scanning. The console (this site) is where you create scans and read results from anywhere. The node only ever makes an outbound HTTPS connection to the console, so there are no inbound ports to open and your data never leaves your network.
2. Create your account
On the console sign-in screen, choose Create an account.
Enter your work email, company (optional) and a password of at least 8 characters, then Start free trial.
You are signed straight in. New accounts start on a 7-day free trial that lets you scan up to 5 IPs — no card required.
console.cyentrix.com
Create your account
Free 7-day trial · 5 IPs · no card
Work email
you@company.com
Company (optional)
Acme Ltd
Password
••••••••
Start free trial →
The console sign-in screen, “Create an account” form.
3. Install a node
The node is one self-contained binary — no dependencies. Put it on a machine that can reach the systems you want to scan.
Windows
Run the installer (or the binary) on a Windows host, for example:
The node makes only outbound connections to the console. You do not need to expose port 8834 to the internet — it is for the local node UI.
node · inside your network
$ ./cyentrix -addr 0.0.0.0:8834
[cyentrix] node starting… v1.0.3
[cyentrix] enrolled OK · org: Acme Ltd
[cyentrix] connected to console (outbound HTTPS)
[cyentrix] status: ONLINE · waiting for scan jobs
The node running on your machine — enrolled, connected, online.
4. Connect the node to your account
1
In the console, open Nodes → Add a node to generate a one-time enrollment token.
2
Give the token to the node when prompted (or via the enrollment command the console shows). The node signs itself in over HTTPS.
3
Within a few seconds the node appears in your console under Nodes, marked online. You can rename it to something memorable.
console.cyentrix.com
Your nodes
Name
Status
Version
Last seen
HQ-scanner
online
1.0.3
just now
branch-01
online
1.0.3
2 min ago
The Nodes list with an enrolled, online node.
5. Run a scan
On your node, open New scan (the Scans tab).
Enter your targets — a single IP, a hostname, a range, or a CIDR (e.g. 10.0.0.0/24). Deduplicated and CIDR-safe.
Pick a scan mode and policy, optionally attach credentials, and set the timing (all explained below).
Start the scan. Progress streams live in both the node and the console, and you can cancel at any time.
Billing counts unique IPs assessed per month. Re-scanning the same hosts is free and does not use more of your allowance.
node · your network
New scan
Targets
10.0.0.0/24
Scan mode
Standard ▾
Timing
3 — Normal ▾
🔑 Credentialed (SSH/WinRM)☑ Compliance
Start scan →
Scan · 10.0.0.0/24 running
62% · 148/240 hosts · 17 findings so far · Cancel
The node scan form, and a scan running (cancel any time).
Scan modes
Every scan runs in one of three modes — pick the depth that matches your authorisation and risk tolerance.
Mode
What it does
Use when
Safe
Passive / non-invasive only — discovery, service & version detection, and CVE / KEV / EPSS matching. No default-credential attempts, exploit validation, or active web templates.
Production hours, sensitive or fragile systems, a first look.
Standard
Everything in Safe, plus safe active probes: web-exposure checks, non-destructive templates, and safe validation checks. Recommended default.
Most routine assessments.
Aggressive
Full depth: default-credential attempts and active exploit validation. Requires explicit written authorisation.
Authorised penetration tests only.
⚠ Aggressive mode makes credential attempts and validates exploits against live targets — only run it with written authorisation for that network.
Scan options
Targets
One or many: IP, hostname, range, or CIDR (e.g. 10.0.0.0/24).
Policy
The set of checks to run — which plugin families and benchmarks. Use a broad policy or a focused one (web, TLS, a specific framework). Some policies include default-credential / exploit checks that only run in Aggressive mode.
Credentials
Optional. Attach stored SSH (Linux) or WinRM (Windows) credentials for authenticated checks — installed packages, missing patches, local config — for far fewer false positives. Credentials are stored and used on the node only.
Timing
How fast and loud the scan is: 1 Sneaky · 2 Polite · 3 Normal (default) · 4 Aggressive. Lower is slower and quieter — less likely to trip IDS or overload fragile hosts.
Compliance
Run benchmark / hardening checks (e.g. CIS-style) alongside the vulnerability scan and see control drift in the same report.
Compliance benchmarks — hardening profiles, standalone or alongside a scan.
Advanced on-prem tools — network credential-capture and phishing simulation are available on the node for authorised engagements only, and are never run from the cloud.
6. Findings & remediation
When a scan finishes, open it to see findings ranked by real risk — exploited-in-the-wild (CISA KEV) first, then high EPSS, then the rest.
Click any finding for the drill-down: affected host, evidence, severity, CVE/KEV/EPSS, and step-by-step remediation guidance — what to patch or reconfigure, and why.
First/last seen history tells you whether a finding is new or recurring.
Fix the issue, then re-scan to confirm it is resolved and watch your risk score fall.
console.cyentrix.com
CVE-2024-3400 · GlobalProtect command injection
CRITICAL
Host
10.0.14.22
Exploit
CISA KEV · EPSS 97
First seen
today
Remediation
Upgrade PAN-OS to a fixed release (11.1.2-h3 or later) and rotate any credentials that may have been exposed. Re-scan to confirm the fix.
A finding opened — severity, KEV/EPSS, and step-by-step remediation.
7. Reports
From a completed scan, choose Report to generate a clean PDF — an executive summary plus the full findings with remediation. The PDF is produced on the node, so nothing leaves your network unless you choose to share it.
A generated PDF report — executive summary plus findings and remediation.
8. Billing & trial
Your plan and usage live in the Billing & plan card on the dashboard.
The trial gives you 5 IPs for 7 days. When you are ready, upgrade to Starter, Growth or Ultimate — you keep your node, scans and history.
Payment is handled securely via Ziina (AED). Choose monthly or annual; annual includes 2 months free and the Recon add-on.
Need more IPs mid-month? Top up any time without changing plan.
console.cyentrix.com
Billing & plan
Current: Trial · 3 of 5 IPs used · 5 days left
Starter · $29Growth · $59Professional · $149
Monthly / annual · pay securely via Ziina
The Billing & plan card — trial usage and upgrade options.
9. Two-factor authentication
Protect your login: open the Security · Two-factor authentication card, choose Enable 2FA, scan the QR/secret with an authenticator app (Google Authenticator, Authy, 1Password…), and confirm with a code. After that, sign-in asks for a 6-digit code.
console.cyentrix.com
Security · Two-factor authentication
off
Scan with your authenticator app, then confirm with a code.
6-digit code
Enable 2FA
The 2FA setup card — scan the QR with an authenticator app.
