Argus – a free, open-source agentic security operations platform – MIT

Argus, a free open-source security operations platform released under the MIT license, watches cloud services, logins, code and devices and uses AI agents to detect and respond to machine-speed attacks, with autonomous response and autonomous pentesting shipped switched off by default. Every action passes through a single broker with approvals, dry runs, automatic rollback, hourly per-tenant and per-playbook caps, and a kill switch, and the platform also brokers staff access to OpenAI and Anthropic models so provider keys stay inside Argus. Argus additionally inventories AI services found in network traffic, cloud accounts and SSO grants, and ships eight realistic agent attacks replayed in a sealed sandbox for drills.

Attackers have AI agents now. So do you. Argus is a free, open-source security operations platform that watches your cloud, logins, code and devices around the clock, catches machine-speed attacks the moment they start, and shuts them down in seconds. AI does the legwork. Guardrails you control decide what it's allowed to touch. A stolen key handed to an AI agent can fire sixty probing calls across twenty of your cloud services in less time than it takes to read this sentence. Swarms of fake identities can spray passwords at your admin accounts from a hundred places at once. By the time a person reads the first alert, the attacker has already moved on to the next system. Most security tools were built for attackers who sleep. Argus was built for the ones that don't. It watches at machine speed, investigates at machine speed, and when you let it, responds at machine speed. It does all of that through one broker with approvals, dry runs, automatic rollback and a kill switch, so speed never turns into a new risk. Fast enough to stop an AI attacker. Disciplined enough to trust with your production systems. What Argus does for you. 2:14 a.m. Nobody's awake. Argus is. 1. 02:14:07 Attacker An attacker's AI agent finds what looks like an LLM API key in your code and tries to use it.The key is a canary that Argus planted. Nothing real was exposed. Tripwire 2. 02:14:08 Detect Argus raises a high-severity detection with the attacker's source address and the full evidence trail. Caught 3. 02:14:09 Respond Your playbook blocks the source at your Cloudflare firewall, within the hourly cap you set.Policy, deny-lists and the kill switch are checked first, every time. Blocked 4. 02:14:10 Notify Slack lights up with what happened, why, and a one-tap Roll back button. Slack 5. 07:30:00 Review Your team starts the day with a closed incident, a signed audit record and a choice: keep the block, or let it expire.If nobody keeps it, Argus rolls the block back automatically when its timer runs out. Done Letting software act on its own in production is a big decision, so Argus makes it a small, reversible one. The AI agents never touch your systems directly. They investigate with read-only access and can only propose. Every change, whether a person asks for it, an agent suggests it or a playbook fires, passes through the same broker. - Off until you say so - Autonomous response and autonomous pentesting ship switched off, and each needs both a deployment switch and a per-tenant opt-in. - Shadow mode first - Playbooks start by logging what they would have done, so you see their judgment before you give them the keys. - Reversible only - Autonomous playbooks run reversible actions, and each one rolls back automatically unless someone decides to keep it. - Capped - Hourly limits per tenant and per playbook, a blast-radius limit, and two human approvals for high-risk actions. - One switch - The kill switch stops every action in a tenant or across the whole deployment instantly. - Hard to fool - Everything the AI reads is treated as untrusted, and the agents are tested against prompt-injection attacks. New: built for the AI era. Threats handled while you sleep Playbooks turn a detection into a fix with no human in the loop, then undo it on a timer unless you keep it. Approve, deny and roll back from Slack buttons. One front door for every AI call Your team uses OpenAI and Anthropic with company-held keys, approved models, data-loss rules, budgets and prompt-injection flags. Staff get Argus keys; your real provider keys stay locked inside Argus. See which AI tools your staff really use Argus spots AI services in your network traffic, cloud accounts and SSO grants, keeps an inventory, and raises an alert for anything unreviewed or blocked. A fire drill for AI-driven attacks Eight realistic agent attacks, from credential-spray swarms to a rogue Kubernetes agent, replayed in a sealed sandbox. Add "slow and low" evasion variants to find the gaps attackers would exploit. A red team that never clocks out An AI planner picks the tests, Argus runs them through scanners like Nuclei, ZAP and Trivy, then plans the next round from what it found. It stays inside your authorized scope, re-checked before every step. Fix what's actually being exploited Every vulnerability is checked against the CISA Known Exploited list and scored for exploit likelihood. Anything attackers are actively using jumps to the top of your queue. Traps built for AI attackers Fake LLM keys, fake MCP servers, decoy agent rules files and planted prompt injections. An agent that bites gives itself away instantly. Isolate a compromised laptop in one step New CrowdStrike and SentinelOne actions contain a device straight from Argus, with the same approvals, dry run and rollback as everything else. One screen for your whole security picture. Running on your laptop in five commands. Open 127.0.0.1:8080 and sign in with the admin login from .env. Run python scripts/seed demo.py for synthetic demo data. Going to production? There's Docker Compose for a pilot, a Helm chart for Kubernetes, and Terraform for AWS and Azure. Argus refuses to start in production mode without encryption keys, HTTPS, a write-once audit sink and SSO or two-factor, so an unsafe install can't happen by accident. The full checklist is in docs/DEPLOYMENT.md https://github.com/thomasunise/argus/blob/main/docs/DEPLOYMENT.md . Do it yourself, or have it running this month. Free, forever Clone it, deploy it, make it yours. Best for teams with security engineers who want to own every line. - MIT license: no seats, no usage fees, no vendor lock-in - Architecture, threat model, runbooks and a step-by-step go-live guide - Issues and contributions welcome on GitHub Get it on GitHub https://github.com/thomasunise/argus I install it and hand it over running For business owners and lean IT teams who want enterprise-grade protection without hiring a security team to run it. You get the outcome, not the project. - Deployed in your own AWS, Azure or Kubernetes account. You own everything - Connected to your cloud, logins, code and devices, with alerts in Slack - An attack-simulator report showing what you catch today and the gaps we close - Rules tuned to your business, and autonomous response proven in shadow mode before it goes live - AI gateway and shadow-AI discovery set up so your team's AI use is safe and visible - Your team trained on alerts, approvals and the kill switch Book an install call https://thomasunise.com/contact?topic=Argus%20Installation Argus questions, answered. What is Argus? Argus is a free, open-source security operations platform you host yourself. It maps your cloud, identity, code, device, network and Kubernetes assets into one evidence graph, detects attacks including fast, AI-driven ones, uses AI agents to triage and investigate, and fixes problems through an action broker with approvals, dry runs, automatic rollback and a kill switch. It also governs your own company's AI use with an AI gateway and shadow-AI discovery. Can Argus act on its own? Is that safe? Only if you turn it on. Autonomous response and autonomous pentesting are off by default and need both a deployment setting and a per-tenant opt-in. Playbooks start in shadow mode, run only reversible actions, are capped per hour, and roll back automatically unless someone keeps the change. The AI agents themselves never execute anything: they investigate with read-only access and can only propose actions. Every change goes through the same broker, and the kill switch stops everything instantly. Can an attacker trick the AI? Argus is designed on the assumption that someone will try. Everything an agent reads is wrapped and labelled as untrusted data, and the agent is told that instructions found inside evidence are a sign of an attack. The agents are tested against prompt-injection evaluation suites, and because they cannot execute anything themselves, a tricked agent can at most file a request that still has to pass policy and approval. What does the attack simulator do to my systems? Nothing. It replays synthetic attack data in a hidden, isolated sandbox that copies your detection settings. It sends no traffic, runs no tools and touches no real system. Simulated detections can't trigger autonomous response, alerts or findings. You get a coverage report showing which attacks your rules would catch and which would get through. What is shadow AI, and how does Argus help? Shadow AI is staff using AI tools the business hasn't approved, often by pasting in customer or company data. Argus finds AI services in your network, cloud and SSO data and keeps an inventory you review. Its AI gateway gives your team approved access to OpenAI and Anthropic models with company-held keys, data-loss rules, budgets, prompt-injection flags and a usage log. Does it replace my SIEM or EDR? It works with them. Argus takes events in from thirteen sources, including CrowdStrike, SentinelOne, GuardDuty, Wazuh and CloudTrail, can contain devices through CrowdStrike and SentinelOne, and sends alerts to Slack, Jira, ServiceNow, PagerDuty, email and webhooks. Many teams run it alongside existing tools as the layer that connects the evidence, investigates it and governs the response. Which AI models does it work with? Anthropic Claude, OpenAI, local models through Ollama, or none at all. With no model configured, the specialists fall back to deterministic logic, so detection and triage still work. Budgets cap every agent run by steps, tokens, time and cost. Does my data leave my network? Argus is self-hosted, so the platform and its data stay in your infrastructure. The only outside calls are the ones you set up: the cloud and identity APIs it collects from, the channels you send alerts to, the public threat-intel feeds, and a model provider if you choose a hosted one. With a local model and offline threat-intel files, no AI or intel traffic leaves your network at all. Is it ready for production? The platform core tenancy, sign-in, roles, the audit trail, the job queue, policy and approvals is tested end to end on SQLite and PostgreSQL in CI. Like any security platform, it should be tuned to your environment: connect the collectors you use, tune the detection rules, and run in monitoring-only mode before enabling any action. That tuning is exactly what the install service covers. Argus is not a certified product. Does Argus make us SOC 2 or ISO 27001 compliant? No software does that alone. Argus ships a control mapping for SOC 2, NIST 800-171 and ISO 27001 that shows which controls it can provide evidence for, such as the signed audit trail, role-based access and approval records. That makes the audit faster, but your auditor still assesses your program as a whole. What does it cost? The software is free under the MIT license. You pay only for the infrastructure you run it on and any AI model you choose. If you want it installed for you, the install is scoped and priced after a short call about your environment, and you keep everything: the code, the configuration and the credentials. I'm a business owner, not a security engineer. Is this for me? If you have cloud accounts, staff logins, customer data or code worth protecting, the protection is for you. You don't need to run it yourself. Book a call, tell me what you use, and I'll tell you plainly whether Argus is the right fit or whether something simpler would serve you better. Get AI-speed protection without hiring a security team. Thirty minutes. We look at what you run, where you're exposed, and what an install takes. You leave with a plan, a timeline and a fixed price, or a straight answer that you don't need it yet. Book an install call https://thomasunise.com/contact?topic=Argus%20Installation