Built so you never have to open a port
Vertix Scanner was designed around the constraint security teams actually care about: keep the network sealed. Everything flows through an outbound-only agent.
SSRF-safe architecture
Server-side target validation, public-IP enforcement and DNS-rebinding defense on every public scan.
Abuse controls
Denylist of sensitive ranges, per-plan asset caps, and a full audit log of every public scan.
Continuous ownership re-verification
Scanning auto-disables if your ownership proof disappears.
Encrypted API credentials
API scan credentials are encrypted at rest (AES-256-GCM) and never returned by the API after save.
Outbound-only agent
The agent initiates every connection — the dashboard never calls in. No inbound firewall rules, no VPN, no exposed management ports.
Encrypted in transit
All agent↔cloud traffic is TLS 1.3. SIEM destinations support TLS too, and webhook payloads can be HMAC-signed.
One-time enrollment tokens
Agent downloads carry a single-use enrollment token — the real API and encryption keys are issued only when it redeems.
Signed agent updates
Update manifests are Ed25519-signed and verified before applying — one-click upgrades with automatic rollback.
Plan-gated AI, off by default
AI-assisted routing is opt-in. Bring-your-own model (Ollama, OpenAI, Anthropic, or any OpenAI-compatible endpoint). Disabled = deterministic rules.
False-positive reduction
AI-verified checks run only against allow-listed, non-destructive checks. Suppression keeps a full audit trail.
Multi-tenant isolation
Every finding, scan, and integration is scoped to your organization. Per-org secrets are encrypted at rest.
The connection model
Your agent reaches out; Vertix never reaches in.
Vertix Cloud
app.jaakit.com
- Dashboard, findings, reports
- Scan scheduling & SIEM export
- AI routing & EPSS/KEV enrich
- Public scans of verified assets
outbound-only
encrypted
Your network
agent runs inside
- Docker / VM / bare metal
- Scans local subnets & hosts
- Results encrypted in transit
Security questions we get asked
- Where does my data live?
- In the Vertix Scanner database (MongoDB). Findings, scan metadata, and reports are keyed by your organization ID.
- Can the agent be revoked?
- Yes — revoking an agent's API key immediately disconnects it. Single-use enrollment tokens expire if unused.
- Who can see my findings?
- Only members of your organization. Jaakit staff access is limited to support operations with audit logging.
- Can you scan domains I don't own?
- No. External scans require DNS TXT or well-known-file ownership proof, and sensitive ranges (government, cloud metadata) are denylisted.
- What if my verification record is removed?
- It is re-checked on a schedule — scanning is automatically disabled if the proof disappears.
- Will API scans hit production?
- Safe mode excludes destructive HTTP methods on production-looking endpoints by default, and you can add per-endpoint path exclusions.
- How are my API credentials stored?
- Encrypted at rest and never shown again after save.
- What data does AI receive?
- Only the finding title, host context, and scanner output — never your whole database. The AI provider is your choice.
Vulnerability disclosure
Found a security issue in Vertix Scanner or Jaakit? Email security@jaakit.com — see security.txt for details.
Back to Vertix Scanner