How the Horizon Cyber agent works.

The Horizon Cyber agent is the security-evidence sibling of the Horizon ESG agent. It runs the same lightweight installer and reports into the same portal — but the collector set is rotated. Where the ESG agent measures watts, the Cyber agent measures the things a Cyber Essentials Plus assessor and a CIS-style topology review need to see.

It is observability-only. There is no remote shell, no remote-desktop surface, no autonomous remediation. The agent reads what the host will tell it, posts the readings to the portal, and the portal does the scoring. If a reviewer needs to know "what could this agent do on the host", the answer is "read these eight collector outputs and exit" — and the surfaces that would do anything else are not started.

The agent emits readings. The artefacts a security lead or CE+ assessor reads live in the Horizon Platform, populated from those readings:

• CE+ readiness dashboard. A4–A8 evidence per agent, rolled up to the company. Pass / warning / fail / not-checked / not-applicable per control, with the underlying telemetry one click away. Multi-tenant: super-admins switch tenants from a pinned company picker.
• CE+ readiness export. A branded PDF in IASME question-order (A1 organisation details, A2 scope inventory, A3 insurance, A4–A8 controls), shaped to match the way an operator fills the IASME portal. Hostname and IP appear in the Controls breakdown so each evidence line is traceable to a specific endpoint.
• CIS topology view. Two-axis scoring: a device's local CIS check posture, weighted by its internet exposure. SSH password authentication is critical on a public-facing gateway and low-risk on a LAN box; the topology view reflects that rather than scoring every host the same.
• Software EOL flags. CE+ A6.6 is auto-answered by joining your installed-package inventory to the endoflife.date community database. Versions past their support window are flagged with the EOL date and the package name; the auto-answer is offered as a suggestion the operator confirms.
• Asset / scope inventory. CE+ A2 pre-populated from agent telemetry — operating system, role, location, network exposure — rather than re-typed into a spreadsheet.
• CSV export. Per-endpoint evidence rows with timestamps and method labels, for the cases where an assessor wants the underlying data alongside the PDF.

• Hosting. UK-hosted Postgres, single-tenant logical separation per company. Telemetry does not leave the UK.
• Direction of traffic. Outbound-only HTTPS from the host to the portal. The host is never reachable from the portal side — there is no inbound shell, no listening port opened by the agent, no return channel.
• Retention. 90-day rolling window by default. Fixed-period retention is configurable on request and is enforced by automated deletion.
• Update channel. The agent pulls signed tarballs and checks a recorded SHA-256 before applying. A failed update rolls back automatically; a tampered tarball never installs.
• Uninstall. One-line removal that leaves no residual state on the host beyond the install-log entry. After uninstall the agent goes offline in the portal within five minutes and is auto-archived after thirty days.

An honest list. We'd rather name the gap than pretend it's solved.

• CE+ evidence, not CE+ certification. The agent and the portal produce the evidence in the shape an assessor expects. The certificate itself comes from IASME or one of their certification bodies; that step belongs to the operator, not the tool.
• CIS-aligned, not CIS-certified. The check suite is built against the CIS controls but is not a CIS Benchmark assessor and is not assured by the Center for Internet Security.
• EOL data is community-sourced. The A6.6 auto-answer joins your inventory to endoflife.date, a community-maintained database. It is accurate enough to flag the obvious cases (e.g. an OpenSSL release past its OpenSSL Project support window) — it is not the only source we'd expect an assessor to consult for a borderline call.
• Auto-answers are suggestions, not sign-offs. Where the agent can populate a control answer from telemetry, it does — and presents it as a draft for the responsible operator to confirm. The CE+ submission is the operator's, not ours.
• Scope: the hosts running the agent. The CE+ scope inventory reflects what the agent sees. Out-of-scope endpoints (BYOD, contractor laptops, isolated lab kit) still need to be enumerated through the normal CE+ process.