You can’t protect what you don’t know is vulnerable.
A vulnerability scanner shows you, today, what an attacker can exploit in your systems.
To defend yourself, you first have to know what vulnerabilities your applications and infrastructure have — and how exposed you are right now. Atlas gives you immediate results you can run as often as you like, inside your own network. It doesn’t replace a pentest or an audit; it’s the day-to-day tool that keeps your exposure under control between them.
What it actually does for you
A vulnerability scanner doesn’t replace a security programme, a pentest or an audit. But without one you work blind: you don’t know what you have exposed today, nor whether your updates really land where they should. Atlas fills exactly that gap.
See what you have exposed, now
What vulnerabilities your systems have in real time and what your exposure to an attack is — that is, what an attacker working toward your data would exploit first.
Check that patches land
Run it as often as you like, without limits, and see whether your patching programme actually works — not just that it runs.
Catch what has no CVE
Most breaches don’t start from a CVE but from a configuration: a default password, an unauthenticated service, an anonymously accessible share. Atlas looks for exactly these.
Complement the pentest and audit
Scanning is a complementary activity: it keeps exposure under control between penetration tests and audits, continuously, not once a year.
We don’t just report what’s vulnerable. We show what can be exploited.
Most scanners detect by version: they read a banner, compare it to an affected range and emit a finding. Fast, but it produces backport false positives and prioritisation by a score that ignores context. Atlas confirms actively, through a safe, non-destructive query, and assigns each finding an exploitability band. The prioritisation is already done by the time the report reaches your team.
An active probe confirmed the vulnerability on this target. It’s not an inference.
The version matches and there is partial evidence. The ceiling of version detection — without confirmation, nothing rises higher.
The version is in the affected range, without probe confirmation.
The product was detected, the version could not be established.
On top of the band, each finding carries EPSS, VPR and the CISA KEV marker — so the ordering doesn’t depend on a single indicator.
A console that turns scanning into a repeatable process
From the dashboard to the attack graph, bilingual reports and export — all inside your own infrastructure.
Dashboard
Assets, scans, findings by severity and the count of targets that are actually exploitable — not just a raw CVE list.
Beyond the CVE catalogue
Coverage is oriented toward what we meet at clients in real infrastructures — not toward what fills a marketing list.
01Default and weak credentials
On products, network equipment and exposed services. The class of problems an attacker actually gets in through — which has no CVE and appears in no catalogue.
02Unauthenticated services
Databases, message queues, orchestration APIs and admin panels left open; anonymously accessible shares and directories; null sessions.
03Unenforced SMB and LDAP signing
Missing channel binding — the premise of NTLM relay attacks. Confirmed by definitive evidence, not by an ambiguous response.
04Active Directory, without credentials
Domain controllers, AD CS ESC8 and ESC11, ZeroLogon via a safe check, the PetitPotam / DFSCoerce / PrinterBug coercion surface — without ever firing the callback.
05Hardening and TLS
Outdated protocols and ciphers, expired certificates, permissive CORS, directory listing, missing security headers, secrets exposed in config files and code repositories.
06Unsupported systems and backdoors
End-of-life operating systems, active backdoors and honeypots marked as such, so you don’t waste time on them.
07Discovery that doesn’t hit the network
Ports first, then service identification only on what proved open, via real protocol handshake. The rate adapts automatically over NAT or VPN.
08OT-safe mode
Generic identification probes can crash PLCs; they can be turned off per profile before an industrial segment. Requirement ID.RA-01.5, applied in practice.
09Continuous management
Scheduled scans, delta between runs (new / fixed / unchanged), SLA deadlines by severity and risk exceptions with an owner and an expiry date.
10Bilingual reports
Full report, remediation plan, scan comparison and Attacker’s View — RO/EN, in HTML, DOCX and PDF, with full explanatory text on each finding.
11Export and integration
JSON, CSV, Markdown, NDJSON, SARIF (GitHub / Azure DevOps) and DefectDojo. REST API with scoped keys, webhooks and an MCP server for agents.
12Security and operation
Linux or Windows, your database, native HTTPS. Four roles with fail-closed authorisation, MFA, an SHA-256 chained audit log and cryptographically signed updates.
Dedicated checks on the products we meet
On top of the misconfiguration class come dedicated checks for products and known vulnerabilities. An excerpt:
From site to report
Define the site
IPs, CIDR, hostnames. Or import an existing nmap result and Atlas takes over the open ports.
Choose the profile
From a quick check to full coverage, including UDP — or build your own profile.
Run it
Discovery, checks and enumeration, with a rate adapted to the link and OT-safe mode where needed.
Triage by proof
Findings ordered by exploitability band and by proof, not by a theoretical score.
Deliver and track
A bilingual report ready to send and remediation tracking on SLA deadlines.
Scanning has become a compliance requirement
The NIS2 directive (EU 2022/2555), transposed in Romania through GEO 155/2024 and detailed in DNSC Order no. 1/2026, requires a vulnerability management plan (ID.RA-08), continuous identification and monitoring (ID.RA-01) and scans that don’t affect system functions (ID.RA-01.5). The same requirement appears, in other words, in ISO/IEC 27001, PCI DSS and DORA. Atlas produces the evidence, not the statement — and it integrates with SafeNIS2, our NIS2 compliance platform, which it can feed automatically.
Built by people who deliver penetration tests
From the field, not a catalogue. What we find by hand in a pentest becomes an automated check in Atlas. A new repeatable way to exploit a vulnerability becomes a new detection module.
Updated with what matters. When a new exploit appears, the team analyses it in the lab and builds a module that reaches you through the update channel — including in airgap.
On-premises, by conviction. It runs in your network, including fully disconnected. The data, the evidence and the reports stay with you.
An ecosystem, not an isolated product. Atlas feeds SafeNIS2 with live evidence for the vulnerability controls; the tester’s judgement stays with the tester.
A simple on-premises model, with no confusing tiers
An annual licence with full functionality, sized by the number of scanned assets. Contact us for pricing — tell us how many assets you have in scope and how you want to use Atlas. office@safebyte.io.
- Annual licence, tied to your installation, with a preset asset (IP) cap.
- Full functionality while the licence is active; no per-user cost and no scan limit.
- Signed content and engine updates included for the licence term — including for airgap installs.
- Install on Linux or Windows, with your own database and no cloud dependency.
Tell us how many assets you have in scope and we’ll send you a clear, no-commitment quote.
Want to run it on your network?
Tell us the scope and we’ll reply within two business days. No marketing list — your data is only used to reply to you.
Atlas, briefly
Does it replace a pentest or an audit?
No, and it doesn’t try to. Scanning is a complementary activity: it gives you immediate, continuous visibility over your exposure, between penetration tests and audits. A tester’s judgement is still needed — Atlas cuts the dead time, it doesn’t replace it.
What does “on-premises” mean and why does it matter?
Atlas runs inside your infrastructure, not in our cloud. It can run fully disconnected from the Internet (airgap). The data, the evidence and the reports never leave your network.
Does scanning affect my systems?
Probes are non-destructive by design rule; dangerous checks stop before the destructive action, and the rate drops automatically on fragile links. OT-safe mode turns off aggressive probes before an industrial segment.
How do you stay current with new vulnerabilities?
Detections come from our offensive testing work and from analysing new exploits in the lab. Content and engine updates are cryptographically signed and apply online or via manual upload in airgap.
How much does it cost?
An annual licence with full functionality, sized by the number of scanned assets, with no per-user cost and no pay-per-finding. Ask us and we’ll send you a clear quote.