Argus- open source security platform to protect against agentic attacks
A new open-source security operations platform called Argus has been released, using AI agents to detect and respond to cyber threats in real-time while maintaining human oversight.
The platform, developed by Thomas Unise, offers autonomous response capabilities that activate immediately upon threat detection. It can block attackers at Cloudflare, isolate compromised devices through CrowdStrike or SentinelOne, and perform 27 different typed actions. All responses begin in shadow mode to allow review before execution, with built-in safety measures including hourly caps and blast-radius limits.
AI Investigation Without Compromise
Argus employs seven specialist AI agents that triage and investigate threats using read-only tools. These agents can propose fixes but never execute them, ensuring human control remains paramount. The platform treats all AI-input data as untrusted, converting potential prompt injections into detectable signals rather than allowing system hijacks.
Everything they read is treated as untrusted data, so a prompt injection hidden in a log becomes a signal instead of a hijack.
Comprehensive Security Controls
The platform includes an AI gateway that brings OpenAI and Anthropic traffic behind organizational controls, including model allowlists and data-loss prevention. It also features shadow-AI discovery to identify unapproved services being used within the organization through network and cloud telemetry.
For testing, Argus offers an agentic attack simulator that replays 8 AI-driven attack scenarios in an isolated environment, helping organizations validate their detection capabilities before real attacks occur. The system also provides continuous pentesting through an autopilot feature that runs red-team operations within authorized scopes.
Enterprise-Ready Features
Argus maintains audit-ready records with a hash-linked, signed audit chain that mirrors to external immutable storage like S3 Object Lock or Azure blob storage. It includes control mappings for common compliance frameworks including SOC 2, NIST 800-171, and ISO 27001.
The platform automatically enriches findings with CISA's Known Exploited Vulnerabilities list and EPSS exploit-probability scores, raising severity for actively exploited issues. It can operate offline for air-gapped installations and is designed to run anywhere through Docker Compose, Helm for Kubernetes, or Terraform for cloud deployments.
Architecture and Deployment
Argus uses a multi-tenant architecture with role-based access control (viewer < analyst < operator < admin < owner) and maintains strict trust boundaries between components. The platform core is tested end-to-end on both SQLite and PostgreSQL in CI environments.
For production deployments, Argus requires PostgreSQL, Redis, HTTPS configuration, encryption keys, and external audit storage. It can be deployed via Docker Compose for pilots, Helm for Kubernetes, or Terraform for AWS and Azure environments, with all autonomous features disabled by default to allow gradual adoption.
Related
