Architecture.
Built on the ICARUS agent platform.
ResilQ is built on ICARUS — a multi-OS subagent orchestrator developed at KTU. Discovery is credential-less and short-lived; enrichment is parallel and OS-aware; scoring is deterministic.
Six stages, end to end.
Scanner discovers the estate
Parallel SSH / WinRM port discovery and live host enumeration. The scanner runs deterministically — the same inputs always produce the same graph.
Eight-worker crypto probes
TLS, SSH, DNS interrogated externally — no host install needed. Probes are deterministic, idempotent, and emit structured JSON.
Graph is built
Nodes (hosts) and edges (connections) are captured as graph.json. The graph feeds the orchestrator and is itself an exportable artefact.
OS subagents enrich each node
Linux · FreeBSD · OpenBSD · Solaris · Windows · macOS — three subagents run in parallel via the ICARUS dispatcher. Each subagent SSHes in, audits crypto, discovers further connections, and returns an EnrichedNode payload.
Crypto-DB classifies
310 cipher suites, 23 name variants, IANA + testssl.sh-derived. Every algorithm is mapped to a quantum sensitivity class and a NIST / CNSA 2.0 compliance bucket.
Callback delivers to the dashboard
The enriched graph, per-asset findings and computed QARS-NI score are POSTed to your callback URL. The dashboard renders them; your SOC ingests them.
Trigger an audit in one POST.
The orchestrator exposes a stable webhook for triggering audits. Targets, credentials, layers and a callback URL are all that's needed. Every audit run is idempotent and produces a signed evidence pack.
Cloud-hosted, sovereign-ready, or hybrid.
EU-hosted SaaS
Default deployment. EU data residency in Vilnius. Audit traffic egresses from your environment to the ResilQ orchestrator over TLS 1.3 with hybrid PQC.
On-prem ICARUS
Full ICARUS orchestrator deployed inside your infrastructure. Air-gap mode supported. Source code shipped for customer audit. The deployment is yours.
SOC integration
Run audits in your environment, ship findings to your SOC. Splunk, Sentinel, Elastic, ServiceNow connectors ship out of the box. Custom adapters on the roadmap.