skAegisYour continuous shield. Every CVE seen, every gap closed.
skAegis watches every machine you run, Linux servers, Windows laptops and Macs. The moment a new CVE is published against something you have installed, it tells you, ranks it by how exploitable and how exposed it is, and hands the fix to your patch pipeline. On your own infrastructure.
Status: in design and early build. Tiers and scope below describe the plan, not a shipped release.
What it is
Continuous vulnerability intelligence for your whole fleet, from one self-hosted service. Detection to remediation as a closed loop, with no SaaS in the middle and no inventory leaving your network.
Whole-fleet visibility
One detection fabric across Linux, Windows and macOS, so a CVE on a laptop is not a blind spot next to the server rack.
Continuous, not scheduled
New advisories are matched against what is actually installed on each host as they land, instead of waiting for the next quarterly scan.
Ranked, not just listed
Findings are ordered by exploitability and exposure, so the short list at the top is the one worth your morning.
Yours to host
Runs on your infrastructure behind your own single sign-on. Findings and host inventory stay inside your walls.
Defend. Detect. Remediate.
Three products, one story. skAegis is the Detect pillar: it sees the gap. The other two keep attackers out and close the gap once it is seen.
sksec
Runtime defense at the edge and on the network: intrusion prevention and blocking of hostile traffic.
skAegis
Vulnerability detection and CVE intelligence across every host, ranked by exploitability and exposure.
skpatch
Patching and remediation: turns a finding into an applied fix and verifies it landed.
The three share one loop. sksec reduces what can reach you, skAegis finds what is weak on your side, skpatch fixes it. You can adopt skAegis on its own.
The closed loop
A finding is not done when it is reported. It is done when a re-scan shows it gone.
Detect
Agents report installed software on every host. New CVE data is matched against it continuously.
Triage
Findings are ranked by exploitability and exposure, using a model that runs locally, so context stays in-house.
Remediate
The fix goes into your patch pipeline: package updates for hosts, pull requests for dependencies and images.
Verify
skAegis re-scans. When the CVE no longer appears, the change is closed. If it does, it stays open.
What you get
Built on a mature open-source security platform that we run and support as a single product.
CVE detection per host
Matches installed packages against public vulnerability sources, with severity and whether a fix is available.
Configuration checks
Posture checks against hardening benchmarks, to catch misconfiguration as well as vulnerable software.
File integrity monitoring
Watch the paths that matter and see when they change.
Dashboard with SSO
A web dashboard behind your own identity provider, with the fleet's open findings in one place.
Pipeline hand-off
Findings flow into your existing patch, ticketing and notification tools instead of a separate inbox.
Cross-OS agents
Agents for Linux, Windows and macOS, rolled out with the tooling you already use.
Three tiers
Start by watching. Add closed-loop fixes when you trust the findings. Add active defense and compliance when you need them. Each tier includes the one before it.
Watch
- Continuous CVE detection, Linux, Windows, macOS
- Ranking by exploitability and exposure
- Configuration posture checks
- File integrity monitoring
- Dashboard behind your SSO
Guard
- Everything in Watch
- Automatic fix pull requests for dependencies and images
- Host patch hand-off to skpatch
- Re-scan verification before a finding closes
- Alerts into your chat and ticketing
Fortress
- Everything in Guard
- Runtime threat detection
- Active response rules
- CIS and compliance reporting
- Audit export
Pricing and availability are not final. Tier contents describe the current plan and may change before release.
FAQ
Does any data leave my network?
No. skAegis is self-hosted. Host inventory, findings and triage stay on your infrastructure. It pulls public vulnerability feeds in, and sends nothing of yours out.
Which operating systems are covered?
Linux, Windows and macOS, using a lightweight agent on each host.
Will it fix things automatically?
Only at the Guard tier and above, and through your own patch pipeline, so your review and change process still applies. Watch only detects and reports.
Does it find every vulnerability?
No tool does. It detects known, published CVEs against software it can see on enrolled hosts. It does not find unknown flaws, and a host without an agent is not covered. It reduces exposure, it does not make a system impossible to breach.
Is it built on open source?
Yes. The detection engine is an established open-source platform, run unmodified from pinned images and packaged with SSO, ingress and backups as one product.
Do I need sksec and skpatch too?
No. skAegis stands alone. Together the three cover defend, detect and remediate.
When can I use it?
It is in design and early build. Watch this site and the repository for updates.