Air-gapped security assessment platform

Built for estates with no route out

Isolated networks usually get assessed by hand, or not at all, because most security tools need the internet to license, update or analyse. MagenX needs none of it. It runs on one domain-joined Windows Server virtual machine inside your network, sized at 4 CPU and 16 GB for most estates and 8 CPU and 32 GB for a large one, and every scan, finding, score and report lives there with it.

From that one machine, MagenX assesses everything an attacker would use on the inside: Active Directory with 255 checks in 34 categories, the network map and the hosts past support, FortiGate policy and what it really permits, every device that answers on your subnets, and which of them your endpoint console protects. Microsoft Entra ID is the one layer that needs a route to Microsoft, so on a fully isolated estate it stays off and everything else runs as usual.

From install to first findings

Install MagenX on the server, point it at a domain controller, and add FortiManager and your endpoint consoles where they are in scope. The first scan reads the directory, maps the network, evaluates the firewall policy and, once you enable it, sweeps your subnets for every device that answers. The dashboard then shows the estate's score, the findings ranked by severity and the devices nobody recorded, and from there you can run attack simulation toward the assets you named as crown jewels. Your team assigns follow-ups, and each scheduled scan shows what changed and which fixes held.

What your team gets from the first scan

Findings ranked by severity, each with the objects behind it, the evidence and a remediation your team can act on
A score for each area of the estate, so progress shows from one scan to the next
Attack simulation from any user, computer or group to the assets you name as crown jewels, with the choke points that cut the most routes
Crown jewel analysis: who holds rights over your critical servers, and whether the firewall lets them reach those servers
An inventory of every device that answers, whether Active Directory knows it, and whether an endpoint agent protects it
Follow-ups assigned to a person or a group with a due date, tracked scan by scan until the fix is confirmed
A change history between scans: new Domain Admins, new delegation, firewall rules added or changed, and services newly published to the internet
Scans on the schedule you set, nightly, weekly or twice daily, with single sign-on and role-based access for your team

Licensed and upgraded without a connection

A licence arrives as a signed text file. Bring it in however your site allows, paste it into the console, and MagenX verifies it on the machine itself, with no licence server involved. Upgrades work the same way: run the newer installer on the same machine, and your data, licence and history carry straight over.

The assistant, if you want one

MagenX can explain any finding in plain language with a local AI model, running on the same machine or on a server you choose, with no cloud service involved. Every verdict comes from MagenX's own rules, so the assistant explains a result and never changes it. Prefer no model at all? Everything else works exactly the same.

Working with the tools you already run

MagenX hands findings and follow-ups to the systems your team already works in: Jira and ServiceNow for tickets, Microsoft Sentinel and Splunk for the security operations team, a webhook or a REST API for anything else, and email through your own mail server for follow-up assignments. Each integration is switched on only when you want it.

What it does not do

It needs no cloud tenant and no internet connection to work, and it installs nothing on the machines it assesses. It reads the systems it can reach from its own machine, so FortiManager and your endpoint consoles need to be reachable on the network for those layers to be included, and a layer it cannot read is shown as not read, never as clean.

FAQ

Where is the assessment data held?

On the machine you install MagenX on, inside your network: scan results, scores, attack paths and change history, kept for as long as you choose.

How is a licence delivered to an isolated machine?

As a signed text file. Bring it in however your site allows, paste it into the console, and MagenX verifies it on the spot.

How does the product get updated?

Run the newer installer on the same machine. Your data, licence and history carry over, and nothing an earlier version stored is lost.

Can I use AI on an isolated network?

Yes. The assistant runs on a local model on the same machine or on a server you choose, explains findings in plain language, and works only from the evidence of the finding you ask about.

Which systems can it assess on an isolated network?

Active Directory, the network and its hosts, FortiGate policy through FortiManager, and device protection through SentinelOne or CrowdStrike Falcon, all from inside the boundary. Microsoft Entra ID needs a route to Microsoft, so on a fully isolated estate it stays off.

What does an assessment need to reach?

A domain controller and DNS, plus FortiManager, SentinelOne or CrowdStrike Falcon and your DHCP servers where they are in scope, all from the MagenX machine. The discovery sweep reaches the subnets you choose. Nothing outside your network is needed.

Security assessment for an air-gapped estate