—The platform

The platform behind every assessment.

Arturus is the system we built to run our own work, and to show it to you while it runs. It is not a product you buy. It is how a Hashfort assessment is delivered.

[ video placeholder · intro to arturus ]

A short walkthrough of the portal is coming here.

Why we didn’t just buy a scanner.

Off-the-shelf scanners are black boxes. You get a verdict without the working: what ran, in what order, why a finding was included, why it was rated the way it was. When a client asks "how do you know?", "the tool said so" is not an answer.

So we built the layer above the tooling. Arturus runs the checks, collects what they produce, and keeps every finding attached to the scan that produced it. When we tell you something is critical, you can follow that claim all the way down to the evidence behind it.

—What it does

From raw scan to a decision.

(a)
Assesses the machines you actually run
A lightweight agent covers workstations and servers on Windows and Linux: listening services, missing patches, operating system hardening, encryption and remote access settings, and the software installed on the host. macOS is in development.
(b)
Looks from the outside too
A separate perimeter scan looks at your estate the way the internet does, so internet-facing exposure is assessed as exposure rather than inferred from the inside.
(c)
Ranks by real-world risk
Findings from every kind of check are scored into a single risk picture and sorted into priority tiers, P0 through P3, weighted by whether a weakness is known to be exploited in the wild rather than by severity label alone.
(d)
Writes for two audiences
One assessment produces a technical report for remediation and an executive summary for decisions, both generated from the same evidence, so they cannot disagree.
(e)
Estimates the work
The remediation plan is consolidated into a short ordered list of steps, each with the findings it closes and an estimate of the effort involved, so a fix can be planned rather than just filed.
(f)
Says what it did not check
Where a check could not run on a host, the report says so plainly. A partial scan should never read like a clean one.
—The portal

Visible while it runs, not just after.

Your team gets a live view while it runs: assets as they are discovered, findings as they are confirmed, and reports as they are produced. No waiting three weeks for a PDF to land in an inbox.

↳ every finding traceable to its source scan
↳ reports downloadable as PDF, and readable in the browser
↳ scan to scan comparison between reports
Start your first scan→
arturus / findings · acme-corp · aug 2026
OpenSSH regreSSHion RCE
CVE-2024-6387 · vpn-gateway
p094
Database port open, no credentials
CWE-306 · db-primary
p091
Missing OS security updates
14 packages · app-server-02
p168
TLS 1.0 still accepted
encryption · prod-web-01
p241
risk reduction
28% addressed

Arturus comes with the engagement.

There is no separate licence and nothing to buy on top. You register, pick a package, and the portal is available straight away.

Start your first scan→Already have access? Sign in to the portal→