● NO LIVE BACKEND — strict mode: offline connectors return no data. Connect the backend for real findings.
ATLAS — Sign in
Log in to run scans, save engagements, and view the audit trail. All API calls require a login.
First run? If no account exists yet, this form creates the first admin account. Sessions last 12 hours. Activity is written to the audit log.
TARGET CONFIGURATION — type any business / domain
🛡️ Dashboard
—
Exposure — awaiting live scan
0 / 40
Live Sources (real backend)
0
Real Findings
NOT SET
Active-Scan Authorization
Type a Target Domain above, then run a passive audit (public OSINT — safe on any domain, no authorization needed). The backend must be running (Backend URL, top-right) for real results; with no backend, connectors return no data.
No findings yet — run checks from Dashboard or Connectors.
🗺️ Asset Inventory (subdomains/hosts from certificate transparency + DNS — passive, keyless)
Loads from GET /api/inventory?domain=. Lists only hosts that actually appear in CT logs or resolve in DNS — nothing is invented. Legal on any domain.
🎯 Prioritized Remediation Plan
Findings ordered by urgency, with a suggested remediation window. Suggested timeframes are standard SLA bands — confirm against your own risk policy.
Priority
Finding
Suggested window
Recommended action
Activity Log
[SYSTEM] ATLAS V22 ready — strict mode (no live backend; offline connectors return no data). Type a target and run checks.
✦ AI Analysis
The AI only writes up findings that already exist in your scan results. It does not scan, and it will not invent findings, CVEs, or risk scores. Every summary needs human review before it reaches a client.
⚠ AI-suggested fix code. NOT reviewed, NOT tested, NEVER auto-applied. A qualified engineer must review and test every snippet in a non-production environment before it touches any system.
[AI] No output yet. Run scans, then generate a summary or fix code — the AI only works from findings that already exist.
Connectors0 live0 sample
Tags:PUBLIC DATA queries third-party databases, never contacts the target — safe on any domain.
TOUCHES TARGET actively probes — needs written authorization.
CUSTOMER INFRA reads the customer\'s own systems (SIEM/EDR/cloud) — ATLAS reads, doesn\'t control or host.
OUTBOUND notifications only.
FREE — passive OSINT + active
ENTERPRISE — API key + authorization required
🏢 Internal Exposure Assessment
Internal assessment requires the customer to grant scoped, temporary access inside their network (a read-only scanner on the LAN, or authorized credentials) for a defined engagement. It is active by definition, so it is gated behind written authorization. No standing agent, no permanent credentials — access ends when the engagement ends.
Checks: patch/CVE gaps on internal hosts, open internal services, network segmentation, weak access control, logging coverage — mapped to the same compliance controls.
Internal Findings — 0
Area
Host
Severity
Evidence · Controls · Fix
Remediation
No internal assessment run yet. Authorize an engagement first.
🧪 Manual / Pentest Findings
Record findings you verified or exploited by hand during an authorized engagement. ATLAS documents them — it does not perform exploitation. Each is tagged Detected / Verified / Exploited so the report is honest about the level of proof. These flow into the Exposure Inventory and the PDF report.
Added findings appear in the Exposure Inventory and the PDF report, tagged MANUAL with their proof level. ATLAS records your hands-on work; it does not run exploits.
🛰 Coverage, cross-check & unified risk
Country-aware mapping shows which frameworks apply where. Control counts are framework totals. Pass/fail stays dashed until a completed, authorized assessment produces real results — it is never guessed.
➕ Additional framework
Evaluate one more framework of your choice, on top of the country set. Evidence comes from the same findings, never guessed.
📈 Risk trend (per scan run + engagement jobs — executable)
Loads from GET /api/engagements/:id/risk-trend. Points are cumulative findings at each run; the sparkline plots the weighted score (critical×25 + high×15 + medium×8, capped at 100 — matches the dashboard and PDF risk score).
No trend loaded yet — run/re-scan an engagement, then load it here.
Governance self-assessment — the 5 BCEAO pillars a scan cannot see. Answers are self-attested by the bank, never verified by ATLAS scan. Editing any pillar voids its attestation until re-attested.
Attestation
Attesting confirms the answers reflect the bank's actual posture to the best of your knowledge. This is a self-attestation, not a scan verification.
📄 Report Generator
Reports are built from your typed business details and the findings actually collected. In sample mode they are watermarked SAMPLE and contain no real-institution claims. A qualified analyst signs off before anything is sent.
Without a backend, reports live only in this session. Open an engagement to save them (client-scoped, survives refresh).
📥 Server exports (from the open engagement)
Generated by the backend from the stored findings of the open engagement: the remediation plan for the IT department (PDF + Excel tracking file) and the conformity plan (Excel).
📥 Ingest client tool results
With the engagement authorization recorded, ATLAS reads the results of the client tools (vulnerability scanners and SIEMs) into this engagement as ordinary findings. ATLAS reads results only; it never launches scans inside those tools.
🤝 Partners (v6.11 — a partner sees only the clients an admin granted it; grants and revokes are written to the hash-chained audit log)
Log in to load.
🤖 Autopilot & Sentinel (acts on the currently loaded engagement — Autopilot prepares drafts, it never sends and never scans; Sentinel fingerprints what ATLAS checks with)
📥 Domain claims (admin — public claims from /check; approving creates a client and an OSINT engagement and grants NO scan authorization)
Public pages: /check (check your public surface) and /sector-index (aggregate, anonymised; statistics only at 5+ organisations).
🏛️ Estates — policy vs edge (a group of domains measured against its headquarters policy)
Log in, then refresh.
👤 Users (admin only — viewer accounts are read-only)
Log in as admin to manage users.
🔐 Two-factor authentication (TOTP)
Protects your own account. Use any authenticator app (the setup shows a secret + otpauth URL).
💾 Data backup (admin — copies the data file to backups/)
Load a saved engagement to restore its findings and reports from the backend (they now persist).
🏢 Portfolio & third-party roll-up (every engagement / vendor at a glance — real findings only)
One row per engagement (your own entities or assessed vendors): target, severity posture, open items. Assess a vendor = create a client for them + an engagement on their domain + run passive OSINT.
Jobs reuse the same connector code as single checks and diff against the previous completed job for the domain (incomplete connectors count as unverified, never gone). Schedules re-fire every interval; a schedule never runs twice while its last job is still running.
Log in, then refresh schedules.
📋 Security program (acts on the currently loaded engagement — open one under “Saved clients” above)
No engagement loaded — open one in “Saved clients & engagements” to enable these.