Stop chasing 250,000 CVEs
Focus on the ones being exploited
Everything you need to manage vulnerabilities
Built for security teams who need to cut through the noise and focus on real threats.
CISA KEV Focus
Stop drowning in 250,000+ CVEs. Focus exclusively on the ~1,484 vulnerabilities CISA has confirmed are being actively exploited in the wild.
Only actively exploited vulnerabilities. No noise.
Zero-Day Intelligence
Instant alerts when a zero-day vulnerability affects software in your inventory. Aggregates disclosures from CISA emergency directives, vendor security advisories, and threat intelligence feeds. Dedicated tracking dashboard separates unpatched zero-day threats from regular KEV entries.
Vendor Advisory Sync
Queries OSV.dev, Red Hat, Microsoft MSRC, and Debian feeds daily. Automatically detects when vendors have patched vulnerabilities. Zero manual work.
Three-Tier Confidence
AFFECTED (red), LIKELY RESOLVED (amber), RESOLVED (green). Never silently hides a potential vulnerability. Vendor patch detection eliminates the most common source of false positives.
Software Inventory
Native agents for Windows, Linux, and macOS with distro-native version comparison (dpkg, RPM, APK). Integrates with Lansweeper, PDQ Deploy, SCCM, Intune, REST API, and CSV import.
Endpoint & Container Scanning
Native agents for Windows, Linux, and macOS scan endpoints and container images in one pass. Detect OS packages, installed applications, and container vulnerabilities across your entire infrastructure.
Windows, Linux, macOS, Docker & Podman — one agent
Code Dependency Scanning
Find known vulnerabilities in your open-source dependencies before they reach production. 11 lockfile formats across 7 ecosystems — powered by Google's OSV.dev database. Exact version matching from lockfiles means zero false positives, not CPE guessing. CI/CD native with GitHub Actions, GitLab CI, and Jenkins gate support.
Zero false positives · exact version matching from lockfiles
Intelligent Matching
Multi-method CVE matching using CPE identifiers, vendor+product combinations, and keyword analysis with confidence scoring.
Notifications & Alerting
Email alerts with daily/weekly digests, Slack/Teams/Discord webhooks with HMAC-SHA256 signing, and custom alert rules by priority, organization, or product criticality. 3-tier escalation policies for unacknowledged critical vulnerabilities.
KEV match, due date, ransomware, agent offline & more
Multi-Tenant & White-Label
Isolated organizations with role-based access control and white-label branding. Customize your app name, logo, and colors in Admin Panel — branding applies to both the web UI and exported compliance documents. Perfect for MSPs or enterprises with multiple business units.
Self-Hosted & Air-Gapped
Your data stays with you. Deploy on your own infrastructure with Docker — including fully air-gapped environments. Built-in backup/restore and TOTP two-factor authentication.
Compliance Reporting
NIS2 Article 21 and CISA BOD 22-01 compliance integrity reports with built-in cryptographic verification. One-click download delivers a complete report with audit trail, attestation, and tamper-detection hashes. White-label branding included for Pro licenses.
One-click download · white-label branding on exports
SIEM Integration
Stream vulnerability events to your SIEM via syslog in CEF, JSON, or RFC 5424 format. Native support for Splunk, Elastic/ELK, ArcSight, and QRadar.
Multi-Source Intelligence
CVSS scores from 3 independent sources (NVD, CVE.org/Vulnrichment, ENISA EUVD) with automatic fallback. Exploited vulnerability data from both CISA KEV and EUVD. Every score carries a provenance tag.
EPSS Scoring
Integrates FIRST's Exploit Prediction Scoring System to prioritize vulnerabilities most likely to be exploited.
Exploit probability in next 30 days
Background Sync
Automatic scheduled tasks keep your data current without manual intervention. CISA KEV, EUVD, and vendor advisories sync daily, EPSS scores update regularly, and NVD CPE dictionary refreshes weekly. Configurable cron schedules.
All tasks start on boot. Custom cron schedules supported.
Agent Management
Server-side agent configuration, minimum version enforcement, and heartbeat monitoring. Agents check in regularly and receive configuration updates automatically. MDM-compatible deployment for macOS (Jamf, Kandji, Mosyle).
Heartbeat monitoring, config push & version enforcement
Authentication & SSO
Enterprise authentication with Active Directory, LDAP, SAML 2.0, and TOTP two-factor authentication. Centralized user management.
System Health Checks
10 automated health checks run every 30 minutes — database, disk space, workers, CVE sync freshness, agent heartbeats, and more. Email notifications and in-app alerts surface critical issues before they escalate.
10 checks · every 30 min · email & in-app alerts
Enterprise Scale
Tested to 10,000+ agents. Concurrent worker pool, configurable database tuning, exponential backoff retry, and built-in load testing. Tune deployment size via environment variables — no code changes needed.
Tune via env vars · no code changes
Built-in Admin Tools
GUI log viewer with 7 log types, full-text search, and download. Interactive API documentation via Swagger UI. Built-in troubleshooting guide with Docker commands and common scenarios. No SSH required.
Swipe tabs or tap to explore
Most scanners tell you what's wrong.
SentriKat tells you what's actually fixed.
Traditional vulnerability scanners generate thousands of alerts with no context on which ones are already resolved by vendor patches. SentriKat automatically tracks vendor advisories so you only act on what's real.
Automatic Vendor Advisory Sync
SentriKat queries 4 vendor feeds daily and cross-references them against your inventory. When Red Hat backports a fix or Microsoft pushes a KB, SentriKat knows automatically.
Three-Tier Confidence System
Every vulnerability gets a confidence tier based on automated vendor analysis. Amber items stay visible for legal compliance. Green items are auto-acknowledged.
Distro-Native Version Comparison
SentriKat understands how your OS compares package versions. No generic string comparison -- real package manager logic for accurate results.
2.31-13+deb11u7 > 2.31-13+deb11u5 4.18.0-425.19.2.el8_7 > 4.18.0-425.3.1 1.36.1-r15 > 1.36.1-r2 Everything Included. No Add-Ons.
Windows, Linux, macOS, container scanning, SIEM integration, NIS2 compliance reports, and executive PDFs — all included in the Professional Edition. No separate modules, no hidden costs.
Typical Enterprise Scanner
$10,000+/yr
Per module add-on
SIEM + Compliance
Extra modules
Custom pricing
SentriKat
All Included
€2,499/yr Professional
From deployment to protection in minutes
SentriKat is designed to be simple. No complex setup, no steep learning curve.
Deploy SentriKat
Self-host with Docker in minutes. Single command to get started. Your data, your infrastructure.
docker compose up -d
Import Your Inventory
Deploy agents on Windows, Linux, or macOS. Integrate with Lansweeper, SCCM, Intune, or import a CSV.
# Windows Agent .\sentrikat-agent.ps1 -Install
Automatic Matching
SentriKat syncs CISA KEV + ENISA EUVD daily and enriches CVSS scores from NVD, CVE.org, and EUVD with automatic fallback. No single point of failure.
# Daily sync at 2 AM UTC [KEV] 3 exploited vulns matched [EUVD] 1 EU-flagged vulnerability [CVSS] NVD -> CVE.org -> EUVD fallback
Multi-Platform Scanning
Native agents for Windows, Linux, and macOS collect installed software. On endpoints running Docker or Podman, container images are automatically scanned too.
# Windows: 142 products detected # Linux: 87 packages (dpkg) # macOS: 63 applications # Containers: 12 images scanned [OK] 3 HIGH, 1 CRITICAL found
Act on Real Threats
Get alerted via email, Slack, or SIEM. Create Jira/GitHub issues automatically. Prioritize by severity, due dates, and ransomware indicators.
# Critical: CVE-2024-3400 # Due: 7 days | Ransomware: Yes # -> Jira SK-142 created, SIEM notified
Simple, transparent pricing
Start free, upgrade when you need more. Annual subscription with multi-year discounts.
DEMO
Evaluate the platform with limited features
- 1 User
- 1 Organization
- 50 Products
- 5 Agents (Windows, Linux, macOS)
- Container Image Scanning (Docker & Podman)
- Daily KEV Sync
- Basic Dashboard
- CSV Import
- Docker Deployment
- Multi-tenant
- Email Alerts + Webhooks
- LDAP/AD/SAML SSO
- Priority Support
PRO
Full-featured license with annual subscription
- Unlimited Users
- Unlimited Organizations
- Unlimited Products
- 10 Agents included (Windows, Linux, macOS)
- Container Image Scanning (Docker & Podman)
- Daily KEV Sync + Vendor Advisory Sync
- Background Sync (KEV, EPSS, CPE, Advisories)
- Three-Tier Confidence System
- Notifications, Digests & Escalation Policies
- Agent Heartbeat, Config Push & Auto-Update
- NIS2 Article 21 Compliance Reports
- CISA BOD 22-01 Deadline Tracking
- Executive Summary PDF + CSV/Excel Export
- SIEM/Syslog Integration (Splunk, ELK, QRadar)
- Jira, GitHub, GitLab, YouTrack Integration
- Multi-tenant + White-Label Branding
- LDAP/AD/SAML SSO + TOTP 2FA
- Air-gapped deployment + Backup/Restore
- Enterprise-scale architecture (10,000+ agents)
- Updates included for subscription duration
Multi-Year Discounts
Commit for longer, pay less. Save up to 15% with a 3-year subscription.
| Duration | Discount | Annual Price | Savings |
|---|---|---|---|
| 1 Year | Full price | €2,499/yr | — |
| 2 Years | 10% off | €2,249/yr | Save €500 |
| 3 Years Best value | 15% off | €2,124/yr | Save €1,125 |
Agent Packs
Need more agents? Add capacity to your PRO subscription. Container scanning included with every agent.
What changes with SentriKat
Stop spending hours on manual triage. Here's what your team gets on day one.
| Without SentriKat | With SentriKat | |
|---|---|---|
| CVEs to triage | 250,000+ (all known CVEs) | ~1,484 actively exploited KEVs |
| CVE triage time | 40+ hours/month manual work | Automated daily — minutes, not hours |
| False positive rate | High noise from generic scanners | Vendor patch detection filters resolved CVEs |
| Vendor patch tracking | Manual checks across 4+ sources | 4 feeds synced automatically every day |
| Container scanning | Separate product ($5,000+/yr) | Docker & Podman — included |
| SIEM integration | Paid add-on ($3,000+/yr) | Built-in (CEF/JSON/RFC 5424) |
| SSO / LDAP / 2FA | Enterprise tier only | Included in Pro |
| NIS2 / DORA reporting | Build reports manually | NIS2 Article 21 reports + Executive PDF |
| Total annual cost | $10,000 – $50,000+ | €2,499 — everything included |
Questions about licensing or need a custom solution?
Contact our sales teamFrequently asked questions
Everything you need to know before requesting a demo.
Still have questions?
Request a Demo
See SentriKat in action. Our team will walk you through the platform and answer your questions.
Get in Touch
Have questions? We'd love to hear from you. Send us a message and we'll respond as soon as possible.