Cyber Defence Center
A confirmed vulnerability arrives as a record with an owner and a due date, and discovered hosts arrive in the CMDB. A risk accepted in the hub is accepted in the scanner.
Cyber Defence CenterAdvanced Vulnerability Scanner
A network vulnerability scanner for one or many networks, with its own scanning engine and a finding you can defend in front of the system owner. It assesses, and never exploits.
What it does
Every finding, with the evidence attached
A scan report nobody believes is worse than none. Eagle ScanV says how sure it is, shows why, and remembers what happened next.
- Discovery that finds the quiet ones. Eight discovery methods, IPv6, the vendor and kind of device from its address, and an asset identity that survives a change of address.
- Ports and services. Three profiles, from discovery to all 65,535 ports, at a rate set for each network, with services fingerprinted to product and version.
- Authenticated scanning. Linux over SSH against distribution advisories, Windows over WinRM against Microsoft's fixed builds, and network devices over SSH and SNMP.
- Every finding graded. Confirmed, likely or possible, each with its evidence and one sentence of reasoning, so the report is not a list of maybes.
- Priorities from the real world. CVSS, EPSS and the CISA list of known exploited vulnerabilities order the plan, with what is being exploited first.
- A plan, not a list. Findings are grouped by the action that closes them: one update that closes many findings is one line.
- Safe by rule. Printers, controllers, medical devices, cameras and power supplies get discovery only, and no probe is intrusive.
- Configuration audits. CIS Level 1 controls for Windows and Linux, where a failed control is a confirmed finding.
- It remembers. Every scan reconciles: fixed, reopened, accepted until a date, or a recorded false positive.
- Every CVE, answered. A catalogue of every known vulnerability, searched by number or in plain words, with a plain answer on whether any of your hosts can be affected.
- Certificates, schedules and alerts. A register of every certificate found, scan windows that pause and resume, exports, and alerts by mail and signed webhook.
- Knowledge that arrives signed. The vulnerability data comes as one signed package, so the scanner works on a network with no internet connection.
In the suite
Findings that become work
Eagle SOC
The SOC reads findings, hosts and the remediation plan for each customer's report, and asks every scanner at once when a vulnerability makes the news.
Eagle SOCEagle Agents
For laptops off the network and machines in a cloud: fixed questions, no command channel, and findings as confirmed as a credentialed scan.
Eagle Agents
How it is secured
A scanner that cannot be turned on you
A vulnerability scanner holds credentials to everything and a map of every weakness. It is built on the assumption that somebody will try to take it.
- Credentials bound to a scope. A credential belongs to one network scope and is never offered outside it, and it is stored encrypted with AES-256-GCM.
- It knows who it is talking to. The SSH host key or the WinRM certificate of every target is pinned.
- A fixed list of commands. The scanner never writes to a host and never raises its own privileges.
- Authenticator codes and roles. Sign-in with a second factor, rights by role, and API keys scoped to read, scan or triage.
- A Security Log that leaves the building. Shipped as syslog or CEF, with the database encrypted at rest.
Good to know
Before you ask
On your premises
Runs on your own Windows Server with IIS and MariaDB, installed from an offline package, with a production and a test instance side by side.
An open door
A documented API with an OpenAPI description and a cursor for changes since the last call.
No borrowed engine
The scanning engine is its own. There is no third-party scanner underneath, and no licence of somebody else's to inherit.
Eagle SecOps Suite
One part of one system
Eagle ScanV is part of the Eagle SecOps Suite: governance, detection, monitoring, vulnerability scanning and secure DNS, built by one team to work as one.
See Eagle ScanV running
An hour with the people who built it, on a real system, with your questions. No slideware.