Argus24 runs on this box.
A Shuttle XPC slim DS50U7. Fanless, approved for continuous 24/7 operation, and sitting in your network.
Form factor
- FanlessPassive cooling · 0 to 40 °C
- 200 × 165 × 39.5 mm1.3 l · 1.6 kg · steel chassis
Front
- 2× USB 3.2 Gen 210 Gbit/s
- 4× USB 3.2 Gen 15 Gbit/s
- Microphone and headphones3.5 mm jack
Back
- DisplayPort 1.4, HDMI 2.0b, VGAup to 3 displays · UHD at 60 Hz
- 2 antenna connectorsfor optional Wi-Fi
- Serial portRS232 · RS422 · RS485
- 2× Intel LAN2.5 Gbit/s + 1 Gbit/s
Performance
- Intel Core i7-1355U10 cores · 12 threads · up to 5.0 GHz
- Memoryup to 64 GB DDR5-5200
- StorageM.2 NVMe (PCIe 4.0 x4) · M.2 SATA · 2.5 inch
- Intel UHD Graphics96 execution units
A pentest is a snapshot.
Networks change every day: a new printer here, a forgotten test server there, an update left pending for months. An annual pentest sees exactly one day of that. Everything after it goes unnoticed.
Each box represents one week of the year.
Argus24 checks every day,
all on its own.
Four steps, every single day. Nobody has to maintain lists or start scans by hand.
Discover
Finds every device on the network, from servers to refrigeration controllers. You do not have to maintain IP addresses.
Assess
Detects what is running on a device and automatically selects the right testing tools.
Compare
Compares each run with the previous one: What is new, what was fixed, what remains?
Report
Raises the alarm by email as soon as things get serious, and delivers reports for your documentation.
Proven tools,
one clear result.
Argus24 does not reinvent testing. It uses the security industry's established tools in a targeted way and presents their results in one consistent, readable format.
Inventory
naabu and nmap find devices and open services.
Known vulnerabilities
OpenVAS looks for known security gaps and misconfigurations.
Emerging vulnerabilities
Nuclei checks for newly disclosed vulnerabilities, with detection rules updated daily.
Web applications
OWASP ZAP and Nikto test the security of web applications and web servers.
Systems & controllers
Building technology (OT) such as refrigeration, heating, air conditioning and controllers, tested with particular care.
Accounts & permissions
The AD posture module checks your Active Directory, read-only.
The auto-pilot picks the checks to match each device. Web servers get web checks, domain controllers an identity check.
OT stands for Operational Technology, meaning technology that controls physical equipment: refrigeration, heating, ventilation, building automation, production. Such devices are often sensitive and stay in service for years without updates. That is why Argus24 tests them with particular care.
You see at once what has changed.
Every finding is also mapped to the OWASP Top 10:2025, the international reference list for web risks.
The network map shows where things are on fire.
Risk per device
Every device is color-coded by risk and shown with its device type, sorted by network and subnet.
Who talks to whom?
The map shows scans, decoy hits and alerts. Anything reachable from the internet is marked in red.
What happened?
Rewind the last hours or days and jump straight to the next anomaly.
Decoys that give attackers away.
Scanners find vulnerabilities, a honeypot catches the attacker. Argus24 sets out decoys that nobody needs in day-to-day operations. Anyone who touches them has no business there. That is why every contact triggers an instant alarm, with practically no false alarms.
If the access comes from your own network, Argus24 points directly to the affected device. That is a typical sign of an attacker who is already moving through the network.
The decoys run on a dedicated deception appliance. The device is fully isolated and separated from the production network.
Fake servers
Service decoys that convincingly imitate real services such as SSH, SMB, RDP or admin interfaces.
Tempting documents
File decoys and canary tokens that raise an alarm the moment they are opened.
Seemingly old accounts
A honey account in AD as an access decoy. It looks attractive but has no real permissions at all.
Even the refrigerated display case is a computer.
In the fall of 2026, refrigeration systems in hundreds of supermarkets were heated up remotely. Access went through controllers whose user interface was reachable from the internet. Argus24 now specifically keeps an eye on such devices.
Recommendation: remove the port forwarding on the router; remote maintenance via VPN only.
What kind of device is it?
Argus24 identifies refrigeration, heating, air conditioning, building automation, controllers, printers and cameras, each with manufacturer and model.
Where is it vulnerable?
Argus24 tests specifically for known vulnerabilities of exactly these devices. On request, it also checks whether the factory default password still works. Password tests only with your authorization.
Is it reachable from the internet?
The SinCera hub checks this daily from the outside. If the device is reachable, you get an immediate alarm. No findings leave your network in the process. The hub only sees what anyone on the internet can see anyway.
A new vulnerability is out? Are we affected?
When a critical vulnerability becomes known, Argus24 immediately matches it against its inventory: operating system, software, versions and devices. No new scan is needed, and every result comes with a reason.
Actively exploited vulnerabilities (CISA KEV), vendor advisories and SinCera's own notes arrive daily and digitally signed. The box does not query any databases on the internet for this.
Argus24 reads every TLS certificate on the network. It reports expired, revoked or weak certificates before services fail.
Confirmed
Product and version are within the affected range. If the vulnerability is already being actively exploited, you get an immediate alarm. On request, Argus24 runs a targeted check.
Likely
The product matches. The version cannot be determined reliably from the outside.
Candidate
Device type or operating system matches, for example on Linux-based devices. Then the advice is: ask the manufacturer for an update.
Argus24 checks the identities as well as the network.
Pure network scanners find open ports and CVEs, but not the class of error behind the most serious incidents: forgotten but still enabled, over-privileged domain accounts. A read-only AD module checks the identity hygiene of your Active Directory. It cross-checks which accounts are allowed to log on to DMZ-exposed hosts. It reports, but changes nothing.
Argus24 at work.
Illustrative preview of the interface. Findings, history, identity posture and deception appear in a single view.
For larger screens
The interactive preview (findings dashboard, history, identity posture and the forensic CVR replay) is designed for larger screens. Please view it on a tablet or desktop (900 px wide or more).
Open on tablet or desktop| 10.0.12.18 | Default creds web login | Critical | new |
| 10.0.30.14 | Outdated OpenSSH | High | new |
| 172.16.8.9 | Anonymous FTP | High | recurring |
| 192.168.40.7 | TLS 1.0 enabled | Medium | recurring |
- svc-idx-backupno login for 183 daysStale + Enabled
- adm-legacy01Domain AdminsOver-privileged
- websvc-appSPN setKerberoastable
- test-tempDMZ logon allowedDMZ-exposed
- SERVICESSH login attempt · decoy-dmz-012 min ago
- ACCOUNTHoney-Account svc-idx-backup14 min ago
- FILEDecoy file Passwords_2024.xlsx1 hr ago
- SERVICEMSSQL connection · decoy-dmz-023 hrs ago
The forensic replay (CVR) plays back the communication between components with exact timing and jumps to the next anomaly.
Illustrative mockups · final interface may differ
We only test
what you authorize.
Written authorization
Every network segment needs a signed engagement, otherwise it is not tested. Once the engagement expires, no scan runs.
Clear boundaries
You define IP ranges, time windows and testing depth yourself.
No attacks
Argus24 finds vulnerabilities but never exploits them. Password tests only with your authorization.
Emergency stop
One click immediately stops all running and scheduled tests.
Relocation guard
On an unknown network, the box pauses until you confirm the network.
Logging and roles
Every action is recorded in a tamper-proof log. Permissions depend on the role.
Under the hood, every target is checked against the allowlist and global denylist before every run. The audit log is append-only. Argus24 is self-hosted, so your data stays with you.
Up and running in three steps.
Define the scope
Specify authorized target ranges and bind them to an authorization record.
Choose policy & schedule
Configure engines, intensity and scan windows. After that, it runs on its own.
Monitor & respond
The platform scans automatically, shows changes and raises alerts on critical findings.
Who Argus24 is for.
IT security service providers
Monitor your clients between the major audits, with auditable reports.
Internal security & IT teams
A permanent view of your own attack surface instead of annual spot checks.
Compliance environments
A traceable, documented vulnerability history over time.
What Argus24
does today.
✓ Platform & core
- Scope & authorization management
- Guardrail layer & tamper-proof audit log
- Discovery (naabu / nmap) & auto-pilot
- Normalization & diffing
- Mapping to OWASP Top 10:2025
- Network map with timeline & replay
- Relocation guard on network change
✓ Engines, modules & integration
- Greenbone / OpenVAS · Nuclei
- Web scans (ZAP / Nikto)
- 24/7 scheduling
- Reporting (PDF/CSV/JSON) & multi-channel alerting
- API & Dashboard · Login/SSO (Keycloak)
- AD / identity posture analysis
- Honeypot / deception detection
- Building technology / IoT detection & OT checks
- Factory default password check (only with authorization)
- Daily outside-in check via the SinCera hub
- Certificate watch (expiry, revocation, weak keys)
- Vulnerability matching with a signed advisory feed
Argus24 as a turnkey
appliance.
Argus24 is available as a ready-made appliance operated by SinCera. You plug it in, the rest runs on its own. Optionally, a separate, fully isolated deception appliance can be added.
One box on the network
As a small appliance or virtual machine. Nothing is installed on your devices.
New detection rules every day
Test templates for newly disclosed vulnerabilities update themselves every day.
Reports & alerts
Reports as PDF, CSV and JSON. Instant email alerts for critical findings and decoy hits.
Turnkey
Plug it in and it runs. No installation on your side, no waiting for spare capacity in your IT team.
Managed by SinCera
We handle setup, configuration, updates and monitoring. You have nothing to administer.
Hardware built for 24/7 operation
Designed for continuous operation around the clock, quiet and compact.
Signed, automatic updates
Updates arrive verified and signed. If problems occur, the device rolls back automatically, without downtime and without any action from you.
Encrypted & sealed
Disk encryption and a tamper-proof seal protect the device against unnoticed tampering.
Full data sovereignty
Self-hosted on your premises. Findings and data never leave your network.
Proactive monitoring
We monitor the device's health, license and update status and get in touch before anything gets stuck.
Fast commissioning
Our technicians install the device. At handover you get acceptance testing and complete documentation.
Predictable costs
A fixed monthly or annual flat fee, license included.
Replacement when needed
If a device fails, we take care of a fast replacement so your protection keeps running.
Argus24 Appliance
The complete platform as a ready-to-run device. SinCera sets it up, keeps it up to date and monitors it.
Deception appliance (optional)
A separate, fully isolated decoy sensor, separated from the production network. It provides deceptively real services. Every interaction triggers an instant alarm.
No SOC? Argus Cloud.
Honeypot Air is a compact deception sensor (“canary”) for small and micro businesses, such as the shop around the corner, the medical practice, the law firm or the trades business.
- ▸Decoys on the network. Every touch triggers an alarm, with hardly any false alarms and no configuration.
- ▸No local Argus24 box. Control & alerting run entirely through the Argus Cloud.
Let's look at your network
together.
In a short meeting, we show you Argus24 live, directly on your network if you wish.
Book a meetingArgus24 · A product of SinCera Tech GmbH · Continuous security testing