What is Kronyx?

Kronyx is an enterprise security platform built around three core components: Endpoint Detection & Response (EDR), Network Security, and Pentesting — the platform's core capability, and the reason the other two exist. EDR and Network give you continuous visibility into your endpoints and infrastructure; Pentesting is what turns that visibility into proof, by actively attacking your own domains and servers the way a real attacker would and telling you exactly what's exploitable.

The EDR component monitors every enrolled endpoint in real time: tracking running processes, flagging suspicious binaries, detecting persistence mechanisms, and managing the full investigation lifecycle. The Network component discovers devices on your infrastructure, analyses traffic patterns, maps topology, and detects network-level threats.

Pentesting is where that visibility gets tested, not just observed. It runs real scanning tools — vulnerability scanning, TLS/SSL auditing, port scanning, and API fuzzing — against domains and servers you own, tracks every result as a Finding with a real CVE/CVSS score where one applies, and generates a complete, presentation-ready PDF penetration test report on demand. If you only set one thing up first, make it a Pentesting target — it's the fastest way to see real, verified security posture rather than passive monitoring data.

Kronyx also includes Kronyx AI, a built-in assistant that analyses endpoint and network telemetry, summarises suspicious behaviour, and helps analysts investigate incidents in plain language.

The platform is designed around transparency. Every alert has an audit trail. Every investigation is documented. Every detection is based on observable indicators — no black boxes, no unexplained scores.

Platform Structure

Kronyx is organised into three top-level components accessible from the dashboard sidebar: EDR, Network, and Pentesting. Each contains dedicated modules grouped by function.

Devices

The central registry of all endpoints enrolled in Kronyx. Each device runs a lightweight agent that continuously reports health and security telemetry.

The device list shows every enrolled endpoint with its current status, operating system, last heartbeat timestamp, and live resource metrics (CPU, memory, disk). From the device detail view you can browse the remote file system, view running processes, and collect files for analysis.

Autoruns

Monitors persistence mechanisms on enrolled endpoints — the locations where malicious software installs itself to survive reboots.

Kronyx tracks autorun entries across Windows registry run keys, startup folders, scheduled tasks, Windows services, macOS login items, LaunchAgents/Daemons, and Linux systemd services and cron jobs. New entries are flagged automatically.

Binaries

Analyses executables discovered on managed endpoints and checks them against VirusTotal to identify malicious or suspicious files.

Each binary entry shows the file name, path, SHA256 hash, VirusTotal detection score, and the device it was found on. Unsigned binaries are flagged automatically.

Collected Files

A centralised repository of files pulled from managed endpoints for analysis or evidence preservation.

Every collected file has MD5, SHA1, and SHA256 hashes recorded at the moment of collection. Files can be linked directly to open investigations to build an evidence record.

Escalations

Define automated rules that trigger notifications or actions when specific security events occur — ensuring the right person is alerted at the right time.

Rules are configured with a trigger condition (severity level, binary verdict, new autorun, device disconnected, network threat) and an action (notify a team member, notify all admins, or automatically open an investigation).

Investigations

A structured workspace to document and track the full lifecycle of a security event from detection through containment and resolution.

Each investigation has a title, severity, assigned investigator, linked evidence (binaries, autoruns, collected files, network threats), and a full change timeline. Every update is timestamped and attributed to the user who made it.

Reports

Generate summaries of security activity for management review, compliance audits, or team retrospectives.

Select a report type, set the date range, and optionally filter by device, severity, or investigator. Reports cover security posture, threat activity, investigation summaries, and per-device health.

Teams

Manage user accounts, roles, and access within your Kronyx organisation.

Network Discovery

Scans your local network to discover all connected devices and build a live asset inventory.

Results populate in real time as devices respond. New devices are highlighted — review them to confirm they belong on your network. Any unrecognised device should be investigated immediately.

Traffic Analysis

Monitors network traffic flowing through your environment and identifies anomalous patterns at the flow level.

The dashboard shows live connection data, top talkers, protocol breakdown, and a historical bandwidth timeline. Common threat patterns detected include data exfiltration, DNS tunnelling, C2 beaconing, and lateral movement.

Network Topology

A visual map of how devices on your network are connected and related to each other.

Nodes represent devices; edges represent observed connections. Node colour indicates risk status. Kronyx tracks topology changes over time — new devices and connections are logged and can trigger escalation rules.

WiFi Security

Scans for wireless networks in range and assesses their security posture.

Each detected network is assessed for encryption strength and SSID/BSSID anomalies. Rogue access points — unauthorised APs mimicking your corporate network — are flagged automatically.

Port Services

Scans hosts on your network for open ports and identifies what services are running.

Select a scan scope (Quick / Standard / Full), enter a target IP or range, and run the scan. High-risk ports (SSH, RDP, SMB, Telnet, VNC) are flagged with remediation guidance.

Threat Detection

Analyses network traffic behaviour in real time to identify indicators of compromise and active threats.

Categories include C2 communication, data exfiltration, lateral movement, port scanning, DNS anomalies, brute force, and known malicious IPs. Each alert shows the raw traffic data that triggered it.

Bandwidth Usage

Tracks network bandwidth consumption per device and across the network, supporting both operational visibility and anomaly detection.

After 7 days of monitoring, Kronyx builds a per-device baseline. Sustained high outbound traffic from a workstation is a common early indicator of data exfiltration.

Overview

Pentesting is Kronyx's core capability — the piece that turns everything else the platform collects into an active, adversarial test of your own infrastructure. Real scanning tools, run against your domains and servers, with every result tracked as a Finding carrying severity, a real CVE/CVSS score where one applies, and remediation guidance.

Targets (Domains & Servers)

Add a domain — verified via a DNS TXT record — or a server, verified by a real SSH connection, before running active scans against it.

Domains also support passive recon (subdomain discovery, GitHub code-leak search, related domains, CIDR scan) before verification. Servers get real, encrypted credential storage and both key- and password-based auth.

Scan Types

Four active scan types map to real, industry-standard tools: Nuclei (vulnerability scanning), a port scanner, testssl.sh (TLS/SSL audit), and Schemathesis-based API fuzzing.

Full Scan & Scheduling

Run every active scan for a target in a single click, or turn on scheduled scanning to have Kronyx re-test automatically on an interval you choose.

Findings & CVSS

Every scan result lands as a unified Finding, shared with endpoint and network data, with a real CVSS score resolved — never fabricated — wherever one genuinely applies.

PDF Reports

Generate a complete, presentation-ready penetration test report — executive summary, charts, severity-grouped findings, and remediation guidance — directly from real scan results.

Exporting

Push findings into your existing tooling — SARIF export (also covers DefectDojo import) or an on-demand Slack notification.

Server Terminal

Every verified server includes a live SSH terminal built directly into Kronyx for fast manual checks, alongside the automated scans.

Quick Start

Get your organisation set up and protected in under 30 minutes. Follow these steps in order.

Research Principles

Kronyx is built as an open, research-oriented platform. The design prioritises transparency, auditability, and evidence integrity over automation and abstraction.