Frequently Asked Questions

ArcScan is an AI-powered enterprise security platform. It audits Ansible playbooks and IaC, discovers and inventories your cloud estate (AWS and Azure; GCP in preview), scans security posture against CIS/NIST benchmarks, tracks CVEs against your real assets, and, the differentiator, remediates under governance: ArcScan generates the fix, computes its blast radius, and proves it in a check-mode dry run before anything is applied. Applying is gated by policy-as-code, maintenance windows, and human approval, with optional ITSM change-approval on top. It also covers compliance tracking, DSPM, executive reporting, and a built-in work OS (Boards). Built by Arcus Forge LLC, an SDVOSB.

Playbooks are scored 0-100 (A-F grades). The AI analyzes for security issues, idempotency, deprecated modules, missing best practices, and more, and every finding is ranked critical / warning / info. Orgs that want a deterministic score can turn on custom scoring profiles and set their own severity weights. Cloud posture scans use the same 0-100 scale with deterministic CIS-benchmark checks.

Ansible playbooks (.yml, .yaml), inventories, role directories, and zip archives containing multiple YAML files. You can paste content directly, upload a file, or scan from connected cloud storage (Google Drive, OneDrive, Dropbox, GitHub, GitLab, Bitbucket).

A built-in work OS under the Work nav group. Create boards with table and kanban views, add items with custom columns, assign teammates, and group work into swimlanes. Security items pull from your live data: one click populates the board from your open vulnerability findings, filed into severity swimlanes with status and a link straight to the CVE record. Use it to run remediation sprints without exporting findings to another tool.

The Executive dashboard (Home → Insights) rolls the whole platform up to board level: risk posture score, SLA attainment, remediation velocity, industry-percentile benchmark standing once your peer group has enough opted-in organizations, and an AI-written posture summary narrated from your live metrics. Export it as a branded PDF, or enable the weekly AI posture briefing email (Settings → Email Delivery) for Monday-morning week-over-week deltas.

AWS and Microsoft Azure for full inventory and security-posture scanning. GCP credential connection and inventory are available in preview; GCP posture discovery is not yet live. You can connect multiple accounts per provider using API keys, service accounts, or IAM roles.

21 deterministic checks aligned with CIS benchmarks, no AI required: 10 for AWS, 6 for GCP (preview), and 4 for Azure, plus a generic tagging-coverage check, with more Azure coverage in progress. Checks include: open security groups/firewalls, publicly accessible databases, unencrypted storage, overly permissive IAM (AWS), missing tags/labels, stale users, public IPs, and more. Each finding includes severity, CIS reference, remediation, and Ansible module hints.

Cloud Inventory pulls your live infrastructure data and uses AI to analyze it for security, cost, drift, compliance, and automation opportunities. Security Posture runs fast, deterministic CIS-benchmark checks against that same inventory — no AI call needed, instant results. You can optionally add AI-generated remediation playbooks to posture scans.

Cloud credentials are encrypted in the database and only decrypted at scan time. They are never logged, never sent to AI providers, and never leave your ArcScan instance. Enterprise customers can self-host for full control.

Discovery Engine (Inventory nav) runs network sweeps, credentialed deep probes, and lightweight agents to inventory hosts and installed packages, feeding the CVE dashboard with real per-asset vulnerability hits. Enterprise App Discovery (Findings → Enterprise Apps) is an early preview that inventories your Entra (Azure AD) enterprise applications and applies a first-pass over-privilege heuristic; treat it as a starting point, not a full SSPM inventory. DSPM (Findings → Data Security) inventories data stores across your cloud estate and flags their exposure. Content classification, sampling objects and classifying PII/PHI/PCI without retaining them, runs on AWS S3 today; Azure Blob and GCS stores are inventoried and exposure-checked but explicitly marked not yet content-sampled, so a public regulated blob is never silently passed as clean. Relational stores are classified from metadata only; ArcScan never reads your rows.

Yes. The Product Deployments wizard (Settings & Workspace → Product Deployments) provisions Arc components into your own cloud account via Terraform: the Arc Probe discovery/remediation agent, the Quantum Arc post-quantum crypto discovery appliance, and the Arc Redactor PII-sanitization container. You pick (or create and test) a cloud credential inline, review the plan, deploy, and tear it all down from the same page when finished. Availability today: Arc Probe is generally available and validated end-to-end. The Quantum Arc appliance deploys but is pre-GA pending live-apply validation. Arc Redactor requires private-registry pull credentials on AWS and GCP.

A unified asset graph with 10 edge kinds. East-west traffic observed on the hosts themselves (established TCP connections, ARP and IPv6 neighbors, LLDP and CDP peers, SNMP routes) sits alongside cloud control-plane routing read from NSG rules, VNet peering, and Front Door and load balancer configuration, plus IAM and KMS relationships. Every edge is labeled by origin, so you can always tell what actually talks to what from what is merely permitted to. Blast radius, attack-path analysis, and reachability-based CVE prioritization all run on top of that graph.

No. The crosswalk engine maps controls between frameworks, so a SOC 2 CC control you have already evidenced carries over to ISO 27001, NIST CSF, and NIST 800-53 without collecting it twice. 21 control packs ship in the box, and coverage is reported per framework so you can see what adding one would actually cost you. At audit time an external auditor portal gives your assessor read-only access to the evidence, and the hash-chained audit log with anomaly detection lets them verify the record has not been altered. Note: ArcScan generates SOC 2 evidence; Arcus Forge does not hold a SOC 2 attestation.

One click from a CVE row, a failed posture check, a scanner finding, or an asset page kicks off a remediation run. Nothing is applied by that click. Every run defaults to dry-run: ArcScan computes the blast radius (the reverse-dependency closure of the package mapped to the services actually running on that host, so you see what will restart), executes the play in Ansible check mode against the real host, and runs a deterministic dangerous-operations linter over the result. Only then does it ask for approval. Choose apply now or schedule inside a maintenance window when you're ready. Every run leaves a receipt on the Runs page (Remediate → Remediation → Runs) with full stdout/diff history and an HMAC-signed evidence bundle.

The Remediation Reliability dashboard (Remediate → Reliability) reports it from your own runs, not from a datasheet: patch success rate, MTTR mean and median split by severity with outliers annotated rather than hidden, rollback counts, the proposed-to-applied funnel, a per-fix-class rollup, and a weekly trend. If a fix class keeps failing on your fleet, you see it there before an auditor does.

Exclude specific hosts or applications from a single run, or write a standing exclusion rule at host, package-on-host, or path-prefix granularity. Each rule carries an audit category, vendor managed, risk accepted, or false positive, so the reason travels with the finding into your evidence pack. When a vendor forbids the upgrade outright, use the pin-instead flow: ArcScan issues an apt hold or dnf versionlock and reports the package honestly as pinned, never as fixed.

Usually because the other scanner is counting ghosts. A half-removed Python package leaves an orphaned .dist-info or .egg-info directory behind, and version-matching scanners read it as an installed vulnerable release. ArcScan records those remnants as not installed and never matches them against a CVE. It also generates a cleanup playbook that deletes the remnants, so your other scanners stop flagging them too.

Yes, on Linux. Installing a patched kernel updates the version on disk but leaves the old kernel running. Every credentialed SSH probe records the running kernel, the newest kernel installed in /boot, and the distribution's reboot-required marker; when they disagree the host is flagged patched, pending reboot instead of hiding behind a green check. From that banner an authorized user can trigger an RBAC-gated reboot action. Windows probes record the running kernel version only.

Every generated fix ships with a matching rollback playbook produced at the same time, so remediation is not a one-way door. After an apply, a post-apply verification scan re-checks the host to confirm the CVE actually cleared rather than trusting the exit code. Both the rollback and the verification result land in the run receipt.

No. Remediation playbooks carry a trust tier: verified playbooks (deterministic, registry- and syntax-checked, optionally sandbox-tested) can auto-apply under an explicit policy you configure; AI-generated playbooks are dry-run only and always require human review. Policy-as-code guardrails (Remediate → guardrails) and org maintenance windows further gate unattended automation — and manual Remediate Now is never blocked, only warned.

Yes — change management is built in and opt-in. Any user can opt themselves in from Settings, and a Manager can enforce it org-wide (which locks every member's toggle on). When required, automation first opens a ServiceNow change request; the run executes only after the change is approved. It's fail-closed: an unapproved change never reaches your infrastructure.

Supervised AI action plans (Remediate → Agentic Actions). The AI drafts a multi-step plan — for example, autonomous CVE triage reads new vulnerability hits, scores them by severity/KEV/EPSS/exposure, clusters them by fix, and drafts a plan — but every step requires operator approval before it executes. Nothing runs automatically.

Anthropic Claude (recommended), OpenAI, Azure OpenAI, Google Gemini, DeepSeek, and Nvidia AI — or a fully local LLM via Ollama for air-gapped deployments. Each user brings their own API key via the Settings page. Enterprise orgs can configure managed keys so members never handle keys at all.

Approximately $0.003 to $0.015 per scan depending on playbook size and provider, so 500 scans a month is roughly $1.50 to $7.50 in API costs. Cloud posture scans are free (deterministic) unless you opt for AI-generated remediation playbooks.

Only when you run an AI-powered scan. The content is sent to the provider you choose, using your API key. It is not shared with any other party. Cloud posture checks run locally without any AI calls.

Discover (pull cloud inventory) → Tag (map resources to business applications) → Scan (posture checks + AI analysis) → Build (generate Terraform HCL for tagging + infrastructure) → Provision (generate/audit Ansible playbooks) → Operate (ServiceNow/Jira/FreshService tickets, CMDB sync, Slack alerts, remediation PRs) → Monitor (scheduled scans, drift baselines, regression detection). You can enter the lifecycle at any stage.

Yes. ArcScan offers a REST API with webhook tokens, plus a Workflow Builder that generates configs for GitHub Actions, GitLab CI, Jenkins, Azure DevOps, and AWX/Tower — with quality gate scoring.

Storage: Google Drive, OneDrive, Dropbox, GitHub, GitLab, Bitbucket. SCM: PR comments and remediation PRs for GitHub, GitLab, Bitbucket. ITSM: ServiceNow (change requests + CMDB CI push + application dependency sync), Jira (issues + Epic sync), FreshService (tickets/changes + asset sync). Automation: AWX/AAP, HashiCorp Vault. Alerts: Slack, Teams, Discord webhooks. SIEM & exports: streaming ArcSight CEF (Splunk, ArcSight, QRadar, Sentinel, Chronicle), SARIF 2.1 for code-scanning tools, SBOM as CycloneDX 1.5 or SPDX 2.3 JSON, CBOM as CycloneDX 1.6, streaming CSV/JSON, and HMAC-signed evidence bundles that verify offline. Auth: SSO (Google, GitHub, Microsoft, GitLab) + SAML, SCIM 2.0 provisioning, TOTP/Email 2FA and WebAuthn security keys.

Yes. When you tag cloud resources to an application in the Cloud Inventory snapshot view, check the Sync to ITSM checkboxes that appear below the application selector. ServiceNow creates a Business Service CI in the CMDB and relationship records linking each resource. Jira creates an Epic for the application with sub-tasks for each resource. FreshService creates an Asset for the application with linked resource assets. Checkboxes only appear when the corresponding integration is configured and active.

Open a cloud inventory snapshot, select resources using the checkboxes, then click Tag Application. Choose an existing application or create a new one (name, owner, environment, criticality, data classification). Click Apply Tags. The mapping persists across scans and can be exported as Terraform HCL to apply arcscan:* tags to real cloud infrastructure.

Yes. The MSP partner console lets a partner organization manage multiple client organizations from one place — create client workspaces, build your engineer team, and grant or revoke each engineer's access to specific clients (individually or in batch). A partner security overview shows per-client score, open criticals, and last-scan status. Apply your own branding (logo, colors) so client-facing reports, emails, and the portal appear under your brand, and invite read-only client viewers who can see their organization's results without edit access.

Click Sign in with Microsoft on the login page to authenticate with your Microsoft / Entra (Azure AD) account. For partner organizations, ArcScan can auto-join staff whose company email domain your org has claimed, so engineers land directly in your workspace on first sign-in. Google and GitHub single sign-on are also supported.

Beyond ArcScan (IaC + cloud security scanning), Arc is a suite of à-la-carte products: Arc Redactor (PII/PHI sanitization across 20 detection categories, with a transparent proxy and a hash-chained tamper-evident audit log, in-app or as a standalone appliance), Arc Terminal (browser-based SSH with full session recording for audit & replay), Arc Discover (network discovery, CMDB, and credentialed CVE probing), and Quantum Arc (post-quantum cryptography discovery, NIST FIPS 203/204/205-aligned; Linux agents available today). Add them individually or as a bundle. Contact sales for pricing.

You cannot migrate cryptography you cannot find. Quantum Arc's agent discovers crypto assets across your estate, SSH keys, X.509 certificates, and Java keystores, then grades each one on an algorithm-aware severity scale rather than a generic CVSS score. It exports a CBOM (CycloneDX 1.6 cryptographic bill of materials) alongside your SBOM, and produces an executive readiness report tracked against the CNSA 2.0 milestone timeline. PQC remediation runs through the same governed pipeline as everything else: dry run, policy gate, human approval. Linux agents are published today; Windows, macOS, and arm64 agents are not yet available.

Most of ArcScan is agentless: credentialed probes over SSH, WinRM, SNMP, SMB, or IPMI, plus AWS SSM. The Arc Probe agent is for the cases agentless cannot reach: segmented or air-gapped networks where the platform cannot open a connection inward, and hosts where you want reverse-dependency and running-service data collected continuously rather than per scan. The binary is cosign-signed, speaks mTLS, and connects outbound only. Agents are a metered unit ($15K/agent/yr beyond your tier's inclusion), which is why the pricing cards count them: Medium includes 1, Large includes 5, Federal and Air-Gap are unlimited.

ArcScan is licensed as an annual platform subscription: Trial (free, 14-day), Small ($95K/yr), Medium ($275K/yr), Large ($525K/yr), and quote-based Federal and Air-Gap tiers. Every paid tier includes cloud posture, vulnerability management, governed remediation, compliance packs, SSO/SAML, and the ITSM and SIEM integrations. Quantum Arc and Arc Probe agents start at Medium. Multi-year commitments discount list price by 8% (2 years), 15% (3 years), or 25% (5 years). AI provider costs (your own API keys) are separate. Contact sales for a quote.

Yes. Every account starts with a free 14-day Trial you can activate from the Billing page. No credit card required. The trial covers 50 hosts and 3 users with full platform access except deployed agents, and converts to read-only when the 14 days are up.

Yes. Arcus Forge LLC is a Service-Disabled Veteran-Owned Small Business (SDVOSB), eligible for sole-source and set-aside federal contracts. ArcScan supports air-gapped Docker deployment, FedRAMP Low and Moderate control mapping with SSP and POA&M export, NIST 800-53 Rev 5 and NIST 800-171 Rev 2 reporting, and an AES-256-GCM (FIPS-approved algorithm) encryption mode. Quantum Arc adds CNSA 2.0 post-quantum readiness reporting for the NSM-10 timeline.

Yes. The Docker deployment can run fully self-hosted with no external API calls, and a self-extracting offline bundle for Linux x86-64 ships the ArcScan CLI with a local AI model preloaded. In air-gapped mode the deterministic posture engine, CVE matching against side-loaded feed data, and offline evidence-bundle verification all run locally. Live cloud posture scanning requires reachability to the provider API, so it is unavailable while air-gapped. AI features run against a local LLM endpoint (Ollama) with no outbound calls.