One Platform for Security, Exposure and Operations
Privileged Access Management (PAM)
The PAM module provides controlled, audited remote access to servers, endpoints and agentless devices. Administrators define granular policies: which users can access which machines, what commands they can run, and what actions they can perform — on agent-based and agentless targets alike.
Key Capabilities
Remote Access & Command Audit: interactive console with granular per-user, per-machine permissions. Every command and its output is fully audited.
Process & Service Management: view running processes in real-time; kill suspicious processes; start, stop and manage services remotely.
Network Connection Control: monitor current network connections on any machine; terminate a suspicious connection directly from the platform.
AI-Assisted Diagnosis: ask plain-English questions (“Why is this machine slow?”) with full process/service/network context; export answers as .md/.docx/.pdf.
File & Package Management: upload/download files; install or remove packages and software remotely.
Share & Delegate: share a device via public URL with password (+ optional TOTP) unlock; cross-organization “Shared With Me” for vendors and MSPs.
Complete Audit Trail: every PAM action logged — who accessed which machine, when, what commands ran, what output was seen.
Password Vault Monitoring & Certificates
Identity material and secrets — managed and audited from the same console.
Key Capabilities
S/MIME Certificates & CA: redesigned, purpose-built certificate lifecycle workflow to issue and manage signing certificates with a managed CA; scan history per endpoint.
Password Vault: Passbolt-style shared vault with folders and per-item access control.
Weak-Password Report: automated audit surfacing weak or reused credentials.
Password Generator: client-side generation of strong, unique passwords.
Brute-Force Protection: monitoring jobs that detect and flag credential attacks.
SIEM — Security Information & Event Management
The SIEM module collects logs from Windows and Linux endpoints and agentless collectors, normalises them with configurable decoders, correlates events with a flexible rules engine, and generates actionable alerts. SIEM alerts feed incidents, RequestHub tickets, notifications and approvals.
Key Capabilities
Log Collection: agent-side source discovery with offset-tracked tailing; custom Windows sources; dynamic endpoints fully supported; journald and rsyslog paths handled.
Rules Engine with Explanations: correlation rules with plain-English descriptions; modify priorities, suppress alerts, add custom rules; curated explanations for every decoder.
Tenant-Authored Rules: a form-based “My Rules” builder lets tenants draft their own detection rules in plain English, with an AI assist.
A complete offensive-security workspace — from target definition to signed-off reports — powered by a fleet of agent-deployed scanners.
Key Capabilities
Nine Attack-Surface Domains: network infrastructure (port recon, service enumeration, OS detection), web applications (DAST, OWASP Top 10), API security testing, source-code review (SAST), container & Kubernetes, attack-surface management (ASM), mobile applications (MAPT), identity & Active Directory, and cloud posture (CSPM) plus cloud VMs.
Multi-Tool Scanner Engine: runners and parsers for Nmap, Nessus, Nuclei, Nikto, OWASP ZAP, Semgrep, Trivy, Prowler, NetExec, BurpSuite Pro, reNgine, SonarQube and MobSF, plus a normalized-JSON importer; live detection of installed scanners.
Toolchain & Custom Tools: per-tool installers, versions and enable/disable on a dedicated vapt_scanner equipment role (never conflated with a collector node); per-org custom tool catalog.
Tactical Targeting: manual targets or the managed equipment inventory, with per-domain target types (IP/CIDR, URL, repository, container image, cloud account, mobile package).
Depth & Aggression Profiles: Stealth/Fast, Balanced/Standard, Deep/Aggressive and Custom profiles, consistent across network, Active Directory and DAST engines.
Tenable One ACR Scoring: Asset Criticality Rating (priority 1–5) with an interactive 5-diamond selector, exposure ranking and Crown Jewel alerts.
Live Scan Terminal: multi-tool parallel dispatch with collision-free batching; async orchestrator plus sweep worker; monospace queue/log output with Plain-Text / Raw-XML switcher and export.
1-Click Verify Patch: single-port re-scan that confirms a remediation actually closed the finding.
Mobile Packages: per-org private Android APK / iOS IPA upload with static assessment.
RBAC: equipment:view / dynamic:view to read; org-admin + equipment-role:manage to run scans and triage.
Cloud Security & Cloud Coverage
SecIncyte protects and monitors cloud workloads with the same agent used on-prem, and adds cloud-native posture scanning through the VAPT engine.
Key Capabilities
Cloud Workload Protection: the same single agent runs on cloud VMs across AWS, Azure, GCP and private cloud; it dials outbound over mTLS, so it works behind NAT, security groups and elastic addressing without inbound firewall holes.
Cloud Posture (CSPM): the VAPT Cloud domain runs Prowler against AWS, Azure and GCP using read-only cloud IAM credentials, evaluates CIS Cloud Benchmarks, and ranks misconfigurations by exposure (Tenable One ACR).
Cloud Log Sources: out-of-the-box decoders include Microsoft Azure platform events, AWS EKS cluster authentication, Cloudflare WAF, Docker, and ownCloud / Nextcloud file-sync audit logs.
Cloud & Object-Storage Backup: endpoint backup supports Linode / AWS S3-compatible object storage (with S3 Object Lock immutability) or a local-folder destination; server backups cover cloud VMs.
Cloud Automation: Ansible playbooks for cloud VMs (e.g. MariaDB cloud update) with network preflight and plain-English failure diagnosis.
Any Deployment Model: full SaaS, data-local hybrid or full on-prem (Edge) on Ubuntu 24.04 LTS — the same console and agent in every model.
Email Security
Email is both a monitored attack surface and the platform’s own delivery channel — SecIncyte covers both.
Key Capabilities
Email Security Log Sources: out-of-the-box decoders and rules for Barracuda email security gateways, Fortinet FortiMail, MailScanner, Postfix, Exim, Sendmail, Microsoft Exchange, Dovecot, Courier, IMAPd, Roundcube, Horde, vpopmail and Perdition — spam, phishing and relay abuse surface in the SIEM alert queue.
Email Threat Detection: curated rules with plain-English explanations for spam, attachment, relay and authentication abuse; alerts flow to incidents, tickets and notifications.
Phishing Simulation & Awareness: email-based phishing campaigns with click/report dashboards, target and template libraries, landing pages, sending profiles and assigned awareness training (user-seat licensed).
Platform Email Gateway: per-org and per-purpose SMTP gateways with a durable retry queue so no alert is lost when a gateway is down, and per-tenant Platform Branding on all outbound mail.
Deliverability & Audit: suppression list for undeliverable addresses, per-category email history (time / To / subject / content), configurable caps and a send log.
Email as a Service-Desk Channel: inbound IMAP email-to-ticket in RequestHub with auto-ack and a dedup ledger; email-OTP as a second factor for console login.
Asset Management
Full-fledged asset management with automated discovery — agent-based and agentless.
Key Capabilities
Hardware Inventory: CPU, RAM, MAC, disk, USB and PCI devices for every asset — automatically updated.
Software Inventory: all installed applications with install/remove timestamps; search across all assets.
Asset Tags & Group Filters: tag assets everywhere (inventory, SIEM investigation panel, endpoint drawer); bulk tag by group; tag hierarchy and tag-scoped rules and grants.
Equipment Geolocation: per-asset country and allowed-zone expectations scoped All / folder / tag / machine, with zone-based geofencing and map links.
Stock-Take (Scan): generate and print barcodes; scan to retrieve asset details instantly; physical audit with full audit trail.
License Key Management: Windows key capture with masked display and permission-gated reveal; compliance compares purchased vs actual usage.
CVE Correlation: vulnerability posture per asset, filterable by severity, with remediation status tracking.
Performance Monitoring
Know how every host and every reachable service is performing — live and over time.
Key Capabilities
CPU, Memory & Disk: real-time and historical metrics, per-mount disk monitoring and SMART disk-health; bird’s-eye trends over week/month/year.
Availability Monitoring: HTTP/HTTPS/SSH/SMTP/DNS reachability probes via agent or agentless route; grouped state-transition alerts; two-tier retention.
Process History: periodic process snapshots retained as history; timeline reconstruction for incident investigation.
Threshold Alerts: custom thresholds with maintenance windows; email-once and Dead-Machine policy; acknowledge/claim/reset with full audit.
Service Management: view installed services and control them remotely; correlate package/service changes with performance.
Agentless Monitoring: SNMP metrics and history graphs for firewalls and switches; BMC hardware monitoring via Redfish/IPMI.
Network Monitoring
Agent-based network visibility that works everywhere — office, home or road — because the agent reports directly, not through an office firewall.
Key Capabilities
NetFlow Visibility: per-endpoint live and historical connection data; freshness-aware display; see every SSH, RDP and data transfer.
Collector Flows: flow data arriving via offline/edge log collectors, unified in one view.
Bandwidth Analysis: per-machine LAN/WAN bandwidth; spot anomalies — a machine using 10x normal internet may be exfiltrating.
Connection Control: terminate a suspicious TCP connection directly from the console.
Live Capture & Flow Intelligence: Live Flow Intelligence and live endpoint packet capture with configurable 30-day retention; short-lived flow recovery via Linux conntrack and a conntrack-diff close-stream; capture-coverage telemetry.
Firewall & NetFlow Reporting: a unified firewall syslog + NetFlow reporting platform with live collector syslog telemetry and real dynamic GlobalProtect VPN sessions; PDF/print export and hostname resolution.
IP-Conflict Detection: duplicate-IP detection via platform analysis and agent ARP probe, corroboration-gated to reduce false alarms.
Security Investigation: connection history answers who connected to which machine, who performed RDP/SSH, and how lateral movement progressed.
Hardening & Compliance
Measure and improve security posture across servers, endpoints and the network gear between them.
Key Capabilities
CIS Hardening: benchmark scans at a chosen level plus single-control checks; posture dashboard with trends; scheduled PDF/report export.
Disk Encryption: one-click whole-disk BitLocker (Windows) and LUKS (Linux) enablement with per-volume key escrow; boot PIN chosen in the web UI, Linux TPM 2.0 pre-check, and real Windows/Linux conversion progress.
Central Approvals: users who do not hold a particular permission request it through a centralised module; administrators with higher privileges see every request in one location and approve, comment or deny to take things forward.
Granular Change Requests: request access across every module, with staged-action executors, durable review history and a top-of-page admin-request banner.
Control-to-Policy Mapping: benchmark controls mapped to platform policies with scheduling.
Backups & FIM
Full coverage inside virtual machines — and of the hypervisors and virtual fleets that run them.
Key Capabilities
Guest Coverage: the same agent protects Windows and Linux guests on VMware ESXi, Hyper-V, KVM and Proxmox VE, with Linux/Windows version parity.
Hypervisor Log Sources: out-of-the-box decoders for VMware (ESXi/vCenter) virtualization events and Proxmox VE node events, so host-level events reach the SIEM.
Containers & Workloads: Docker container events are decoded into the SIEM, and the VAPT Container / Kubernetes domain scans images with Trivy (image + SBOM audit).
Proxmox Backup Posture: role-driven, multi-cluster discovery of Proxmox VE and Proxmox Backup Server (PVE/PBS), with repo-backed “Last backup” health from snapshot history; restic source/download/local roles.
Hypervisor Hardening & Access: agentless SNMP/SSH/Redfish coverage of hypervisor hosts and BMC hardware, plus CIS hardening and PAM console access for the virtualization estate.
Disaster Recovery: VM and guest restores from endpoint/server backup, with point-in-time restore and ok-only restore windows.
Virtualization
Measure and improve security posture across servers, endpoints and the network gear between them.
Key Capabilities
CIS Hardening: benchmark scans at a chosen level plus single-control checks; posture dashboard with trends; scheduled PDF/report export.
Disk Encryption: one-click whole-disk BitLocker (Windows) and LUKS (Linux) enablement with per-volume key escrow; boot PIN chosen in the web UI, Linux TPM 2.0 pre-check, and real Windows/Linux conversion progress.
Central Approvals: users who do not hold a particular permission request it through a centralised module; administrators with higher privileges see every request in one location and approve, comment or deny to take things forward.
Granular Change Requests: request access across every module, with staged-action executors, durable review history and a top-of-page admin-request banner.
Control-to-Policy Mapping: benchmark controls mapped to platform policies with scheduling.
Ticketing & ITSM (RequestHub)
Built-in IT service management that lives where the work happens — fully integrated with SIEM alerts and incidents.
Key Capabilities
Ticketing System: inbox, kanban board, workload and dashboard; queues and tags; assign tickets to engineers; link tickets to SIEM incidents.
KB v2: global + per-org sections, versioned pages, wikilinks, dependency graph, content tables/views, orphan detection and an approval seam.
Unified Search: one search across tickets, KB articles, SIEM incidents and SIEM/EDR alerts.
Chat & Collaboration: tenant chat; client → operator chat request/accept; @-mentions and watchers on tickets.
CSAT & My Tasks: one-time-token satisfaction surveys on resolution with trend reporting; individual task lists and activity feeds.
Client Support Portal: client orgs get a dedicated Support entry that raises requests straight into the operator Client Support inbox (same data pool); Settings restored to the menu and inbox header.
Email Integration: IMAP inbound email-to-ticket with auto-ack and dedup ledger.
SLA & Escalation: SLA management, escalation rules, bulk actions, and automation hooks tied into platform alerts.
Automation
Drive fleet-wide configuration, patching and remediation from the console.
Key Capabilities
Vulnerability Scanning: CVE-based scanning against installed packages; real-time visibility into vulnerable assets; filter by severity; track remediation.
Ansible Automation: deploy and trigger playbooks per endpoint or at scale with live streamed logs; schedule runs; per-run and per-schedule extra recipients; digest emails per scheduled firing.
OS-Update Playbooks: Windows Update channel reporting with core-vs-optional severity, network preflight and plain-English diagnosis; apt-failure self-repair; SSH post-quantum readiness playbooks for Linux and Windows.
App Updates / Software Deploy: update third-party applications on Windows with winget + choco fallback and an admin-driven verified-checksum catalog; email alerts on install/remove.
CIS Remediation: one-click remedies for hardening gaps, approved via Central Approvals.
AI-Powered Fleet Automation: conversational fleet queries with a per-session Read-only or Actionable execution mode, history and export; alert-to-AI assistance for SIEM/PM/agentless alerts.
Employee Monitoring
For sensitive environments, SecIncyte provides accountable, audited visibility into endpoint activity — with privacy controls built in. Opt-in per organization; enable per endpoint or in bulk.
Key Capabilities
Screen Capture: periodic screenshots on Linux and Windows, with continuous Windows capture + offline spool and Linux change-dedup; GUI-aware targeting and configurable interval.
Keystroke Logging: key capture on Linux and Windows (compiled WH_KEYBOARD_LL helper); critical for incident analysis.
Privacy Controls: on-endpoint redaction of sensitive windows before transmission.
Dual-Auth Viewing: per-org dual-auth (AD step-up) and mandatory reason before content is viewed; every viewing event audit-logged.
EM v2 Console: Activity, Screenshots and Keystrokes tabs with dated gallery, viewer and configurable retention.
Governance & Access: org-admin EM access, a per-machine Equipment Keylog/Screenshot tab, OS chips and a Fleet OS filter, Primary Admin governance, and step-up re-authentication before viewing.
Use Cases
Compromise investigation and forensic analysis
Insider threat detection and disgruntled-employee behaviour review
Post-incident root cause analysis
Sensitive server monitoring
Security Awareness/Phishing Simulations
Train people and test resilience — one Awareness module licensed per user seat.
