ArcherySec

Overview

ArcherySec is an open-source tool for vulnerability assessment and management, aimed at developers, penetration testers, and DevOps teams. It gathers findings from web and network scans performed by supported security tools, then presents those results together for review and management. Finding deduplication, severity prioritization, and false-positive tracking help organize the resulting work.

ArcherySec is self-hosted and distributed under the GPL-3.0 license. The project dates to 2017 and credits Anand Tiwari as maintainer. It depends on external scanners rather than replacing them: users need to run supported scanners and provide their endpoints to ArcherySec. It belongs to the broader Application Security Orchestration Platforms category.

Key features

Scanning and findings management

The tool supports web and network vulnerability scans, authenticated web scanning, and web application scanning with Selenium. It correlates raw scan data into a consolidated view, with rules-based risk prioritization and false-positive tracking. Finding deduplication is supported, and remediation workflows help manage findings beyond initial review.

Integrations and automation

The product site describes more than 80 integrations spanning commercial and open-source tools. Documented connectors include OWASP ZAP, Burp, Arachni, and OpenVAS for scanning, along with Jira and email. ArcherySec can synchronize tickets through its Jira connector.

Periodic and concurrent scans support ongoing vulnerability management. Its CLI can join CI/CD pipelines and return pass or fail exit codes according to configured scan policy criteria, allowing policy gates in an automated workflow. REST APIs are documented for scanning and vulnerability management.

Pricing

ArcherySec is free. The listed Open source plan costs 0.00 USD per free. It is GPL-3.0 licensed and uses self-hosted deployment; there is no paid plan listed in the provided pricing details.

Platforms

ArcherySec lists API, Linux, macOS, self-hosted, web, and Windows support. Deployment documentation covers Linux, Docker, and Vagrant with Ansible options, while the project README provides Windows setup and run scripts. Because ArcherySec relies on external scanners, users need to configure and run supported scanners separately and provide their endpoints.

The README cautions against exposing ArcherySec publicly and recommends restricting the signup page in production. It describes the default setup as intended for internal use only, an important deployment consideration for teams operating a self-hosted instance.

Who it's for

ArcherySec is suited to development, security testing, and DevOps teams that already use supported scanners and want a consolidated place to review vulnerabilities. Its scanner integrations and finding-management tools address the challenge of bringing multiple scan results together, while its CLI policy gates and APIs support teams incorporating vulnerability checks into automation.

It is less appropriate for users seeking a standalone scanner that works without external tools: scanner setup and endpoint configuration are prerequisites. Teams also need to account for the production security guidance when deploying it.

Pros and cons

• Pros: Open-source GPL-3.0 licensing, self-hosted deployment, and no listed charge.
• Pros: Consolidated findings, deduplication, severity-based prioritization, and false-positive tracking.
• Pros: Documented scanner, ticketing, and email connectors, plus REST APIs and CI/CD policy gates.
• Cons: Requires users to run supported scanners and provide their endpoints.
• Cons: The README advises against public exposure and calls for signup restrictions in production.

Alternatives

Other options to consider include OWASP DefectDojo, ScanDog, Conviso Platform, Strobes ASPM, OX Security, PointGuard AI, Safeguard DAST, and Mend.io.

Verdict

ArcherySec brings scan results and vulnerability-management tasks into one self-hosted workflow, with integrations, APIs, and CI/CD policy checks for teams that want to automate parts of review. Its free, open-source model may suit teams prepared to operate the service and its scanners themselves. The key trade-off is operational responsibility: users must configure supported scanners and follow the project's guidance for restricting access in production.