PYXA
ServicesConsulting
GitHub Request a demo Get started free
Self-hosted vulnerability remediation · AGPL-3.0

A patch report is a claim.
A rescan is proof.

PYXA merges every scanner, penetration test and bug bounty finding into one queue, ranks it with the reasons shown, puts the work with an owner, and closes a finding only when your own scanner proves it fixed.

Get started free Request a demo

Community edition free under AGPL-3.0. Runs on one server inside your network.

pyxa / Command Center · all regions · 1,784 open findingsCaptured from PYXA
Qualys VMTenableRapid7 InsightVMOpenVAS / GreenboneMicrosoft DefenderCrowdStrike SpotlightAmazon InspectorWizGitHub Advanced SecurityGitLabSnykSARIFAWS Security HubPatrowlwatchTowrBloodHoundMicrosoft IntuneWSUS · SCCM · AnsibleHackerOne · BugcrowdSecurityScorecardServiceNowCISA KEVEPSSVulnCheck
CVE-2026-3390 · srv-pay-04.eu-west.corp

A patch report is not a fix.

Microsoft Intune reported srv-pay-04 patched. Tenable Nessus rescanned it and still found SMB signing not required. A workflow that closes on the deployment report would have closed this ticket the moment Intune reported it. PYXA kept it as a claim, and the rescan decided.

  1. Detected

    First seen by a scanner

    Tenable Nessus · QID-2026-3390 · CVSS 8.1

  2. Claimed

    Microsoft Intune reported fixed · KB5065219

    Marked fixed by automation, not a person

    Claimed · not proof
  3. Rescanned

    Tenable Nessus still found it after a reported fix

    Same failure on srv-pay-05, -06 and -07

    Verification failed · 4 of 4 hosts
The claim and the observation disagree about this host, and the observation decides. PYXA · finding detail, srv-pay-04
pyxa / Findings / CVE-2026-3390 / srv-pay-04Captured from PYXA
What was claimed sits beside what was observed. Nobody asserted this by hand; a patch-deployment connector reported success, which PYXA treats as evidence of deployment, never as evidence of remediation.
What makes PYXA different

Six rules that change vulnerability management.

Collecting findings and scoring them is where remediation tools start. These six are where PYXA goes further, each enforced by the product rather than left to a setting.

01 · Proof of fix

Fixed means proven.

Only a verifying connector can set a finding to verified. On CVE-2026-21445, 9 of 34 hosts are proven fixed and the vulnerability cannot close while 25 remain unproven, regardless of patch reports.

02 · Coverage

Unknown is never counted as clean.

An unscanned asset produces no findings, which looks identical to a clean one. 154 of 4,322 assets have never been scanned. They read "unknown", sit hatched, and are left out of every percentage, with the exclusion stated.

03 · Compliance

Five answers, never a blended score.

Every control gets one of five answers: pass, fail, evidence incomplete, needs a person, or not applicable. Never a blended percentage. PCI-DSS 6.3.3 fails because 1,134 high and critical vulnerabilities have been open longer than 30 days.

04 · Deployment

Your findings never leave your network.

PYXA runs on one server inside your network, air-gapped if needed. No PYXA cloud, no phone-home, and every outbound call is recorded.

Security and architecture → 05 · Pricing

One published price, no asset meter.

Professional is €9,000 per instance per year, in the open. Nothing is charged per asset, per finding or per seat, or twice when two sources report the same host.

Pricing → 06 · Free edition

Every source merged, even for free.

Deduplication across scanners, penetration tests, bug bounty, code and attack-surface findings is part of the free Community edition, not a paid upgrade.

Get started free →
Aggregate · Prioritise · Share · Verify

From finding to verified fix.

01 · Aggregate

Every finding, one record.

Each vulnerability is one row, whichever sources reported it. The demo estate carries 1,784 open vulnerabilities on 4,322 assets, ranked by risk.

Needs action today · 53Beyond SLA · 284KEV backlog · 35Uncovered · 157
02 · Prioritise

A priority you can explain.

Not "P0" but the contributions that made it P0. The score reads CISA KEV, EPSS, exploitation in the wild and your own asset context, and names every source it read, so the engineer asked to patch on a Friday can see why.

+40 EPSS 71%+40 criticality 5/5+35 internet-facing+28 CISA KEV
03 · Share the work

Everyone gets their part.

Selam Haile signs in to 13 host tasks, worst first: 4 failed verification, 9 inside their dates. Not a four-hundred-row export of the estate, and Jira, GLPI, TheHive or ServiceNow tickets follow the same lifecycle.

04 · Verify

Closed only when proven.

A patch report shows deployment. Only a verifying rescan closes the remediation. The emergency plan for CVE-2026-21445 holds 34 host tasks: 9 proven, 25 unproven, and it cannot complete until a scanner observes the rest.

Community edition · free

Running in four commands.

One host with Docker is all it needs. PYXA prepares the rest itself on first start, and the first sign-in opens a guided Setup.

  • No repository to clone
  • No configuration file to write
  • HTTPS from the first start
  • Encryption keys generated for you
  • Scanners added from a form
  1. 1

    Download

    The compose file and the web server's files, in one archive. No clone, no Git.

    mkdir pyxa && cd pyxa
curl -sSL https://github.com/PYXA-Security/pyxa/archive/refs/heads/main.tar.gz \
  | tar -xz --strip-components=1 pyxa-main/docker-compose.yml pyxa-main/nginx
  2. 2

    Start

    PYXA generates its own keys and a certificate, and serves HTTPS straight away.

    docker compose up -d
  3. 3

    Create the first account

    Then open https://localhost/ and sign in.

    docker compose exec django python manage.py createsuperuser
  4. 4

    Setup takes it from there

    The first sign-in opens Setup: required steps first, most with a one-click default. Connect a scanner from a form, or load the demo data shown on this site to look around first.

    PYXA Setup: seven required steps, six recommended and five optional, each marked done, partly or to do.
Full install guideBook a guided install

The browser warns once about the certificate PYXA signs for itself; the install guide shows how to replace it. Professional and Enterprise include a two-day install with your team, remote or on site.

Three ways in

Start where your team is.

The same product in three editions. No edition caps assets, findings or seats, and every price is published.

Community

For security engineers and small teams who self-host.

Free

The whole loop, scanner to rescan-proven fix, under AGPL-3.0: scanners and imports, the risk score, action plans, Jira and 3 auto-triage rules.

Get started free Explore GitHub
Professional

For vulnerability managers running remediation across teams.

€9,000per instance per year

Less time on triage and reporting: unlimited auto-triage, every AI proposal, single sign-on, the board report and one framework of NIS2, TISAX or PCI DSS. Installed with your team in 2 days.

Get Professional Compare plans
Enterprise

For CISOs and regulated organisations.

from €18,000per instance per year

Governance at scale: all seven frameworks, access scope per person, ServiceNow, AI routed per task, a long-term support release and source-code escrow.

Request a demo Review the security architecture
PYXA Consulting

The team behind PYXA, on your estate.

The people who built the platform also test, audit and run vulnerability programs, with PYXA or with whatever you already run. Fixed scope, a written deliverable, practitioners only.

See the consulting services →
Offensive

Penetration testing

External, internal, web application and Active Directory, with retests until the findings are closed.

 Operate

Vulnerability management

Exposure assessment, then the program: ownership, priority policy, SLAs, campaigns and verified closure.

 Comply

Compliance audit

Gap assessments and readiness for NIS2, TISAX, the Cyber Resilience Act and PCI DSS.

 Lead

CISO advisory

Fractional support for the roadmap, the board narrative and the budget case.

Frequently asked questions

Still have a question?

A first call is 30 minutes with a practitioner, not a sales script.

Book a call
Who in the organisation uses PYXA?
Everyone who owns or fixes something. Business owners, engineers, managers and leadership sign in through your directory and see their own part. The security team prioritises, advises and verifies.
Is there a cloud version?
No, deliberately. Your findings describe exactly where you are weakest. PYXA runs on your own Docker Compose stack, one instance per company, with no multi-tenant SaaS and no phone-home.
What does the free edition include?
The whole remediation loop: the Qualys, Tenable, Rapid7 and OpenVAS connectors and every file import, the risk score with its sources, action plans, Jira, closure on a verifying scan and remediation guidance drafts. Single sign-on, compliance frameworks, the agent, cloud, code and attack-surface connectors and most AI proposals are in Professional or Enterprise. Compare editions
Do we need consulting to use it?
No. Setup walks an empty install to a working one. PYXA Consulting is a separate service: penetration tests, vulnerability management programs and compliance audits, with or without the platform.
What does the AI see, and can we turn it off?
The AI page states, task by task, what each would send. Point PYXA at a local model on your Compose network and nothing leaves; Enterprise can also route each task to its own model. Turn every provider off and every feature still works; AI only drafts and proposes.
Which compliance frameworks does PYXA cover?
Professional includes one of NIS2, TISAX or PCI DSS v4.0. Enterprise covers all seven: those three, OWASP ASVS, the EU Cyber Resilience Act, SOC 2 and HIPAA. PYXA assesses the vulnerability-management controls its data can speak to, 27 across the seven, and marks what it cannot answer instead of passing it. See them on the Platform page
Does PYXA make an organisation compliant?
No. It evidences the vulnerability-management controls from the day it is installed and cannot back-date evidence. Its assessment is a self-assessment, not an audit.
Who handles upgrades and backups?
The organisation running it. PYXA ships versioned releases with upgrade notes, and a backup is a scheduled Postgres dump stored off the host. Enterprise adds upgrade assistance and a long-term support release.
Can PYXA run in an isolated network?
Yes. No egress is required. CISA KEV, EPSS, exploit catalogues and CERT advisories each have their own switch, schedule and a mirror-or-file option for air-gapped installs.

Make security everyone's job, starting this week.

Run the free edition on your own server today, or see PYXA on your own scanner data in a 30-minute demo.

Get started free Request a demo