Core concepts at a glance

Everything in Argus follows one pipeline. Read this page once and the rest of the product, and these docs, should read as variations on it.

The pipeline

Cloud account            you connect it, Argus never holds your credentials
      |
      v
Agent                    runs in YOUR cloud; data never leaves
      |
      +--> Discovery     what datastores and identities EXIST
      |
      +--> Scanning      what is INSIDE them
                |
                v
        Classification   ~70 sensitive data types across 7 categories
                |
                v
        Risk scoring     content + exposure + reachability -> 0-100 and a band
                |
                +--> Compliance    does this meet GDPR, HIPAA, PCI DSS, ...
                +--> Policies      does this meet YOUR rules
                +--> Alerts        what needs attention now
                          |
                          v
                  Recommendations  what to do about it
                          |
                          v
                  Remediation      Argus does it, with approval and rollback

The ideas that matter most

Discovery and scanning are different. Discovery finds which datastores exist. Scanning looks inside them. A datastore is always discovered first and scanned second, which is why a new account shows an inventory almost immediately but no findings until the first scan finishes. Discovery & scanning

Argus samples, then extrapolates honestly. It does not read every object. It samples intelligently and reports an interval, so a finding says “an estimated 12,000 records, 95% confident between 10,400 and 13,600” rather than a made-up exact number. Sampling & extrapolation

Two different confidences. Detection confidence is how sure Argus is that a match is real, backed by checksums. Statistical confidence is how sure it is that a sample represents the whole store. A confirmed card number in a thin sample is high on the first and low on the second. Confidence scoring

Risk is blast radius, not just sensitivity. A public unencrypted bucket of card numbers and a private encrypted one are the same data and very different problems. Exposure is weighted heaviest. Risk engine

A blind spot is never scored as safe. If the agent cannot verify something, Argus assumes the worse case and flags it as unverified rather than quietly passing it. The fix is usually granting a read permission, not changing your data. IAM permissions

Identity risk is scored separately from datastore risk. One says who could reach your data, the other says what is at the end of the path. Together they tell you which exposure actually matters. Identity & access risk

Compliance is derived, not declared. You never fill in a questionnaire. Controls are evaluated from real scan results, and every score traces back to a datastore or identity you can open. Compliance mapping & scoring

Four findings, one condition

One problem can surface in four places at once. They are not duplicates, and the distinction decides who acts:

Surface	Question it answers	Who defined it
Alert	What needs attention now?	Argus
Policy violation	Does this meet our standard?	You
Compliance control	Does this meet an external obligation?	A framework
Recommendation	What should I actually do?	Argus

They cross-link, so you can pivot between them from any one.

Vocabulary that trips people up

These sound alike	But
Suppress vs Waive	Suppress hides an alert; Waive accepts a violation. Not interchangeable
Resolve vs Dismiss	Resolve means the condition is gone; Dismiss means the resource is gone
Remediation vs Mitigation	Remediation fixes the root cause; mitigation only contains it
Hidden vs Not Found	Hidden is your decision; Not Found is the resource disappearing
Idle vs Stalled agent	Idle is healthy with no work; Stalled looks online but has stopped working

Full list in the Glossary, and every state machine in Statuses & lifecycles.

Things Argus deliberately will not let you do

These are design decisions, not gaps, and knowing them up front saves hunting for buttons that do not exist:

You cannot resolve an alert by hand. Resolution is system-owned: a scan verifies the condition is gone. Otherwise “resolved” would mean “someone said so”.
You cannot close a recommendation. Same reason. Its status is fully system-controlled.
You cannot cancel a remediation run. The window is about a second and a running change has no abort channel, so the recovery path is rollback, which is a verifiable reversal.
You cannot promote someone to tenant owner. There is exactly one, set at tenant creation.

Where things live

Section	What it is for
Getting Started	Zero to a first scan
Deploy the Agent	Every way to run the agent in your cloud
How Argus Works	The engines, and why numbers are what they are
Using Argus	Page-by-page walkthroughs and what each action does
Administration	Tenancy, roles, users, audit
Reference	Statuses, glossary, permissions, API