Argus – Open-Source Agentic Security Platform – MIT

Argus is a self-hosted, MIT-licensed security operations platform designed to monitor infrastructure, detect threats, investigate incidents with AI agents, and carry out controlled responses. It brings together signals from cloud services, identity systems, GitHub, Kubernetes, endpoints, and networks. Its investigations use read-only specialist agents, while responses are kept separate and subject to policy checks, approval, dry runs, and limits. Autonomy is disabled by default; actions are intended to be reversible and recorded in a signed audit trail.

The platform lists seven AI investigation specialists, 27 typed response actions, 13 built-in detection rules, and eight sandbox attack scenarios. Beyond threat detection and response, it offers AI governance features for model access, spending limits, data-loss prevention, and shadow AI discovery, as well as authorized penetration testing and agent canaries for ongoing validation. Audit features include encrypted backups and control mappings. Argus can be deployed with Docker Compose, Kubernetes, AWS, or Azure, and supports OpenAI, Anthropic, Ollama, or operation without a model. Its emphasis is on combining broad security coverage with human oversight, reversible actions, and control over where data and infrastructure reside.