> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cystack.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment

> Deploy the VulnScan binary for Web UI, CLI, online, and offline environments

CyStack VulnScan is distributed as a binary application for **Windows**, **macOS**, and **Linux**. The same binary can run the Web UI, execute CLI scans, manage licensing, prepare offline artifacts, and export reports.

## Deployment Models

| Model                         | Best For                                               | Notes                                                                        |
| ----------------------------- | ------------------------------------------------------ | ---------------------------------------------------------------------------- |
| Single analyst workstation    | Evaluation, small assessments, local CLI usage.        | Simple to start, but not ideal for team workflow.                            |
| Shared Web UI server          | Team usage, recurring scans, centralized reports.      | Recommended for production.                                                  |
| Automation runner             | Scheduled CLI scans, CI/security pipeline integration. | Use the same workspace configuration if results should appear in the Web UI. |
| Offline or restricted network | Environments without direct Internet access.           | Requires offline activation and prepared scanner/intelligence artifacts.     |

## Recommended Production Layout

For a shared deployment:

1. Install the VulnScan binary on a stable server.
2. Create a dedicated data directory, for example `/var/lib/cystack-vulnscan`.
3. Activate the license.
4. Start the Web UI with an explicit bind address.
5. Place VulnScan behind an internal reverse proxy if HTTPS termination and access control are required.
6. Configure mail delivery.
7. Create named administrator and member accounts.
8. Add assets and validate discovery before broad scanning.

```bash theme={null}
vulnscan web --bind 0.0.0.0:8080 --data-dir /var/lib/cystack-vulnscan
```

## Data Directory

The data directory stores workspace state:

* Workspace database.
* Assets, scans, findings, and report job metadata.
* Exported reports.
* License state.
* Mail configuration.
* Runtime logs and scanner state.

Back up this directory according to your organization's recovery policy. If CLI automation must write results into the same workspace, run it with the same configuration and data location.

## Network Requirements

The VulnScan host needs:

* Access to target assets on the required ports.
* DNS resolution for domain and subdomain discovery.
* Outbound access for license activation and updates, unless the deployment is offline.
* Outbound mail provider access if email notifications are enabled.
* Inbound access from user browsers to the Web UI.

For externally hosted targets, make sure the VulnScan server's egress IP is allowed by the target owner and not blocked by staging firewalls.

## Online and Offline Activation

Online activation:

```bash theme={null}
vulnscan activate --license CYSTACK-XXXX-XXXX-XXXX-XXXX
```

Offline activation:

```bash theme={null}
vulnscan fingerprint
vulnscan activate --file activation.dat
```

Offline environments should also prepare scanner artifacts and vulnerability intelligence data before entering the restricted network:

```bash theme={null}
vulnscan prep-offline
```

## Performance and Scale

VulnScan is designed for large external attack surfaces. Default configuration uses concurrent discovery, port scanning, fingerprinting, detection, and enrichment workers. Actual throughput depends on host CPU, memory, network latency, target responsiveness, license limits, and safe scanning policy.

Recommended scale practices:

* Start with a root domain discovery pass before scanning all subdomains.
* Split very large portfolios by business owner, environment, or risk tier.
* Use schedules for recurring production scans.
* Run large PDF exports as background jobs.
* Use CSV/JSON for high-volume integration.
* Monitor scan duration and reduce scope where target systems are fragile.

## Security Hardening

For shared deployments:

* Run VulnScan under a dedicated operating-system account.
* Restrict access to the data directory.
* Put the Web UI behind HTTPS in production.
* Limit Web UI access to trusted networks or an identity-aware proxy.
* Use named user accounts.
* Rotate mail provider credentials.
* Remove inactive workspace members.
* Deactivate the license before permanently moving the instance to a new host.

## Updates

Use the update command when your deployment policy allows direct updates:

```bash theme={null}
vulnscan update
```

Restricted environments should use CyStack-provided update packages or offline preparation workflows according to the deployment notes supplied with the license.