Frequently Asked Questions

Everything you need to know about ArcScan.

General
What is ArcScan?
ArcScan is an AI-powered enterprise security platform. It audits Ansible playbooks and IaC, discovers and inventories your cloud estate (AWS, Azure, GCP), scans security posture against CIS/NIST benchmarks, tracks CVEs against your real assets, and — the differentiator — remediates: one-click Remediate Now with dry-run previews, blast-radius scoring, and optional ITSM change-approval gating. It also covers compliance tracking, DSPM, executive reporting, and a built-in work OS (Boards). Built by Arcus Forge LLC, an SDVOSB.
How does the scoring work?
Playbooks are scored 0-100 (A-F grades). The AI analyzes for security issues, idempotency, deprecated modules, missing best practices, and more. Each finding carries a severity-weighted deduction. Cloud posture scans use the same 0-100 scale with deterministic CIS-benchmark checks.
What file formats are supported?
Ansible playbooks (.yml, .yaml), inventories, role directories, and zip archives containing multiple YAML files. You can paste content directly, upload a file, or scan from connected cloud storage (Google Drive, OneDrive, Dropbox, GitHub, GitLab, Bitbucket).
What is ArcScan Boards?
A built-in work OS under the Work nav group. Create boards with table and kanban views, add items with custom columns, assign teammates, and group work into swimlanes. Security items pull from your live data — add a CVE and the row auto-populates severity, affected assets, and remediation context. Use it to run remediation sprints without exporting findings to another tool.
How do I report security posture to executives?
The Executive dashboard (Home → Insights) rolls the whole platform up to board level: risk posture score, industry-percentile benchmark standing, SLA attainment, remediation velocity, and an AI-written posture summary narrated from your live metrics. Export it as a branded PDF, or enable the weekly AI posture briefing email (Settings → Email Delivery) for Monday-morning week-over-week deltas.
Cloud & Security Posture
What cloud providers are supported?
AWS, Microsoft Azure, and Google Cloud Platform (GCP). You can connect multiple accounts per provider using API keys, service accounts, or IAM roles.
What does the security posture scanner check?
20+ deterministic checks aligned with CIS benchmarks — no AI required. Checks include: open security groups/firewalls, publicly accessible databases, unencrypted storage, overly permissive IAM, missing tags/labels, stale users, public IPs, and more. Each finding includes severity, CIS reference, remediation, and Ansible module hints.
What's the difference between Cloud Inventory and Security Posture?
Cloud Inventory pulls your live infrastructure data and uses AI to analyze it for security, cost, drift, compliance, and automation opportunities. Security Posture runs fast, deterministic CIS-benchmark checks against that same inventory — no AI call needed, instant results. You can optionally add AI-generated remediation playbooks to posture scans.
Are my cloud credentials safe?
Cloud credentials are encrypted in the database and only decrypted at scan time. They are never logged, never sent to AI providers, and never leave your ArcScan instance. Enterprise customers can self-host for full control.
Beyond cloud accounts, what else can ArcScan discover?
Discovery Engine (Inventory nav) runs network sweeps, credentialed deep probes, and lightweight agents to inventory hosts and installed packages — feeding the CVE dashboard with real per-asset vulnerability hits. Enterprise App Discovery (Findings → Enterprise Apps) inventories your Entra (Azure AD) enterprise applications and scores automation-account risk. DSPM (Findings → Data Security) finds and classifies sensitive data stores across your cloud estate.
Can ArcScan deploy its own agents into my cloud?
Yes. The Product Deployments wizard (Settings & Workspace → Product Deployments) provisions Arc components into your own cloud account via Terraform: the Arc Probe discovery/remediation agent, the Quantum Arc post-quantum crypto discovery appliance, and the Arc Redactor PII-sanitization container. You pick (or create and test) a cloud credential inline, review the plan, deploy — and tear it all down from the same page when finished.
Remediation & Automation
How does Remediate Now work?
One click from a CVE row, a failed posture check, a scanner finding, or an asset page kicks off a remediation run. Every run defaults to dry-run — you see the planned changes and a blast-radius score before anything is applied. Choose apply now or schedule when you're ready. Every run leaves a receipt on the Runs page (Remediate → Remediation → Runs) with full stdout/diff history.
Are AI-generated fixes applied automatically?
No. Remediation playbooks carry a trust tier: verified playbooks (deterministic, registry- and syntax-checked, optionally sandbox-tested) can auto-apply under an explicit policy you configure; AI-generated playbooks are dry-run only and always require human review. Policy-as-code guardrails (Remediate → guardrails) and org maintenance windows further gate unattended automation — and manual Remediate Now is never blocked, only warned.
Can automation be gated behind an ITSM change ticket?
Yes — change management is built in and opt-in. Any user can opt themselves in from Settings, and a Manager can enforce it org-wide (which locks every member's toggle on). When required, automation first opens a ServiceNow change request; the run executes only after the change is approved. It's fail-closed: an unapproved change never reaches your infrastructure.
What are agentic actions?
Supervised AI action plans (Remediate → Agentic Actions). The AI drafts a multi-step plan — for example, autonomous CVE triage reads new vulnerability hits, scores them by severity/KEV/EPSS/exposure, clusters them by fix, and drafts a plan — but every step requires operator approval before it executes. Nothing runs automatically.
AI Providers
What AI providers can I use?
Anthropic Claude (recommended), OpenAI, Azure OpenAI, Google Gemini, DeepSeek, and Nvidia AI — or a fully local LLM via Ollama for air-gapped deployments. Each user brings their own API key via the Settings page. Enterprise orgs can configure managed keys so members never handle keys at all.
How much do AI API calls cost?
Approximately $0.003–$0.015 per scan depending on playbook size and provider. 500 scans/month is roughly $5–$7 in API costs. Cloud posture scans are free (deterministic) unless you opt for AI-generated remediation playbooks.
Is my playbook content sent to AI providers?
Only when you run an AI-powered scan. The content is sent to the provider you choose, using your API key. It is not shared with any other party. Cloud posture checks run locally without any AI calls.
Integrations & Lifecycle
How does the full infrastructure lifecycle work?
Discover (pull cloud inventory) → Tag (map resources to business applications) → Scan (posture checks + AI analysis) → Build (generate Terraform HCL for tagging + infrastructure) → Provision (generate/audit Ansible playbooks) → Operate (ServiceNow/Jira/FreshService tickets, CMDB sync, Slack alerts, remediation PRs) → Monitor (scheduled scans, drift baselines, regression detection). You can enter the lifecycle at any stage.
Can I integrate with CI/CD pipelines?
Yes. ArcScan offers a REST API with webhook tokens, plus a Workflow Builder that generates configs for GitHub Actions, GitLab CI, Jenkins, Azure DevOps, and AWX/Tower — with quality gate scoring.
What other integrations are available?
Storage: Google Drive, OneDrive, Dropbox, GitHub, GitLab, Bitbucket. SCM: PR comments and remediation PRs for GitHub, GitLab, Bitbucket. ITSM: ServiceNow (change requests + CMDB CI push + application dependency sync), Jira (issues + Epic sync), FreshService (tickets/changes + asset sync). Automation: AWX/AAP, HashiCorp Vault. Alerts: Slack, Teams, Discord webhooks. SIEM: streaming CEF export (Splunk, ArcSight, QRadar, Sentinel, Chronicle) plus SBOM export as CycloneDX/SPDX JSON. Auth: SSO (Google, GitHub, Microsoft, GitLab) + SAML, SCIM 2.0 provisioning, TOTP/Email 2FA and WebAuthn security keys.
Can I push application-resource mappings to ServiceNow, Jira, or FreshService?
Yes. When you tag cloud resources to an application in the Cloud Inventory snapshot view, check the Sync to ITSM checkboxes that appear below the application selector. ServiceNow creates a Business Service CI in the CMDB and relationship records linking each resource. Jira creates an Epic for the application with sub-tasks for each resource. FreshService creates an Asset for the application with linked resource assets. Checkboxes only appear when the corresponding integration is configured and active.
How do I tag cloud resources to a business application?
Open a cloud inventory snapshot, select resources using the checkboxes, then click Tag Application. Choose an existing application or create a new one (name, owner, environment, criticality, data classification). Click Apply Tags. The mapping persists across scans and can be exported as Terraform HCL to apply arcscan:* tags to real cloud infrastructure.
MSP, Partners & Arc Suite
Does ArcScan support MSPs and managing multiple clients?
Yes. The MSP partner console lets a partner organization manage multiple client organizations from one place — create client workspaces, build your engineer team, and grant or revoke each engineer's access to specific clients (individually or in batch). A partner security overview shows per-client score, open criticals, and last-scan status. Apply your own branding (logo, colors) so client-facing reports, emails, and the portal appear under your brand, and invite read-only client viewers who can see their organization's results without edit access.
How do I sign in with Microsoft (Azure AD)?
Click Sign in with Microsoft on the login page to authenticate with your Microsoft / Entra (Azure AD) account. For partner organizations, ArcScan can auto-join staff whose company email domain your org has claimed, so engineers land directly in your workspace on first sign-in. Google and GitHub single sign-on are also supported.
What is the Arc product suite?
Beyond ArcScan (IaC + cloud security scanning), Arc is a suite of à-la-carte products: Arc Redactor (PII/PHI sanitization with a transparent proxy and tamper-evident audit), Arc Watch (AI/ML infrastructure observability — GPU fleet, inference endpoints, and LLM cost), Arc Terminal (browser-based SSH with full session recording for audit & replay), and Quantum Arc (post-quantum cryptography discovery, NIST FIPS 203/204/205-aligned). Add them individually or as a bundle — contact sales for pricing.
Billing & Plans
How much does ArcScan cost?
ArcScan is licensed as an annual platform subscription: Trial (free, 14-day), Small ($95K/yr), Medium ($275K/yr), Large ($525K/yr), and quote-based Federal and Air-Gap tiers. All paid tiers include the full platform — cloud posture, vulnerability management, remediation, compliance, and integrations. AI provider costs (your own API keys) are separate. Contact sales for a quote.
Can I try ArcScan for free?
Yes — every account starts with a free 14-day Trial you can activate from the Billing page. No credit card required, full feature access during the trial.
Government & Defense
Is ArcScan suitable for federal/defense use?
Yes. Arcus Forge LLC is SDVOSB-certified, eligible for sole-source and set-aside federal contracts. ArcScan supports air-gapped Docker deployment, FedRAMP-aligned security controls, and DISA STIG compliance reporting.
Can it run in an air-gapped environment?
Yes. The Docker deployment can run fully self-hosted with no external API calls. In air-gapped mode, cloud posture scans still work (deterministic checks against manually imported inventory). AI features require network access to the chosen provider's API endpoint, or you can configure a local LLM endpoint.