Getting started
This guide takes you from a fresh Horus account to your first triaged finding in about ten minutes. No security expertise required.
What you need
An account. Horus registration is not public: you either receive an invite from your organization's admin, or your organization was created when you subscribed. If you self-host, see the deployment guide. Want to look around first? Open the live demo (read-only).
Roles at a glance
Your account has one of three roles. It decides what you can do.
| Role | Can do |
|---|---|
| viewer | Read everything: findings, scans, incidents, reports. |
| analyst | Everything a viewer can, plus add assets and run scans. |
| admin | Everything, plus manage the team, integrations, API keys, and settings. |
If this is your first login with a temporary password, Horus asks you to set a real one before anything else. That is expected.
Step 1: Add your first asset
An asset is something you want Horus to watch: a domain, a URL, an IP address, or a network range.
- Open Assets and choose Add asset.
- Fill in:
- Name: a label for you, e.g. "Marketing site".
- Host: the domain, URL, or IP, e.g.
example.com. - Type:
domain,web,api, orip. - Internal: leave off for internet-facing targets; turn on for assets that live inside a private network.
- Save.
Horus validates the host before saving. Private and reserved addresses are rejected on public assets so a scan can never be pointed at internal infrastructure by mistake.
Don't know all your assets?
Use Discovery to find them for you. Give it a domain and Horus enumerates subdomains from public certificate transparency logs and DNS; give it an internal network range and it sweeps for live hosts. Discovered hosts show up in Assets tagged discovered.
Step 2: Run a scan
- From the asset (or the Scans page), choose Run scan.
- Leave the default tools selected. Horus runs port and service detection plus template-based vulnerability checks.
- Start it. The scan appears as
pending, thenrunning.
You don't have to wait on the page. Findings stream in as the scan progresses, and the scan finishes on its own. A typical single-asset scan takes a couple of minutes.
Behind the scenes an AI pipeline classifies each result, correlates detected software against known CVEs, enriches it with live threat intelligence, and debates the ambiguous ones before anything reaches your list. If you want the full picture, see how the pipeline works.
Step 3: Read your findings
Open Findings. Each finding is one issue on one asset. Two columns matter most:
- Severity: how bad the vulnerability is in the abstract (
critical→info). - Priority: what Horus thinks you should do, based on how exploited it is and how exposed you are:
| Priority | Meaning |
|---|---|
| Act | Address immediately. Actively exploited or high-impact and exposed. |
| Attend | Schedule it within your current sprint. |
| Track / Track* | Low urgency. Record it and review periodically. |
Sort by priority and start at the top. The Act items are where your time pays off.
"N hidden" banner
Horus hides low-value noise (scanner output that says "not vulnerable", failed scripts, informational chatter) so it doesn't drown the real findings. The banner tells you how many were hidden; click it to see them if you ever want to.
Open any finding to see the plain-language explanation, the CVEs involved, whether it is on CISA's known-exploited list, and the reasoning the validation step used to keep it (or the fact it was auto-confirmed).
Step 4: Act on a finding
Inside a finding you have concrete options:
- Read the suggested fix. Horus drafts step-by-step remediation, often with the exact command or config change, tailored to whether the asset is internal or external.
- Change its status. Mark it
resolvedonce fixed,false_positiveif it isn't real, oraccepted_riskif you've decided to live with it. These feed back into Horus so it gets smarter about your environment and stops re-debating the same signature. - Create an incident. For anything that needs tracked, multi-step work, promote it to an incident: assign an owner, set an SLA, link related findings, and keep an append-only trail of notes.
You can also select several findings and update their status in bulk.
Step 5: Invite your team
If you're an admin, open Team → Invite and add colleagues with the role they need (viewer, analyst, or admin). New members get a temporary password and are forced to set their own on first login.
Where to go next
- Triage findings: cut noise and prioritize like a pro.
- Set up alerts: get Slack, email, or PagerDuty notifications for what matters.
- Monitor your servers: install the Iris agent for real-time host detection.
- Board posture report: a one-click executive PDF of your security trend.