Quick Start Guide

This guide takes you from a fresh account to your first completed security scan in about 15 minutes. You'll tour the dashboard, meet Bobby, register an asset, run a scan (from the UI or the API), and review your findings.

Before you begin

You'll need:

• ✅ An active Cert-IX account with access to the dashboard.
• ✅ Something to scan that you own or are authorized to test — a domain, host, or IP.
• ✅ (Optional, for the API) a terminal with curl and jq.

Only scan what you're allowed to

Run scans and simulations exclusively against assets you own or have explicit written permission to test. Unauthorized scanning may be illegal in your jurisdiction.

Don't have access yet?

Cert-IX is rolling out through early access. Request an invitation at cert-ix.com/early-access.

Step 1 — Sign in and tour your dashboard

Sign in at app.cert-ix.com. You'll land on your Security Dashboard — your command center. Take a moment to find:

• Security Score — a 0–100 measure of your overall posture (higher is better).
• Threat Overview — active threats, blocked attacks, and items pending review.
• Recent Alerts — the latest security events, most critical first.
• Quick Actions — one-click access to run a scan, generate a report, or review vulnerabilities.

Your score starts low simply because Cert-IX doesn't know about your environment yet — the next steps fix that.

→ Full reference: Dashboard Overview

Step 2 — Meet Bobby, your AI assistant

Bobby is available on every page from the icon in the bottom-right corner. Ask questions in plain language and get answers with links to the right place in the product.

Try asking:

• "What should I do first to improve my security score?"
• "Which of my assets are most at risk?"
• "Explain this vulnerability in simple terms."

→ Full reference: Bobby AI Assistant

Step 3 — Register your first asset

Everything in Cert-IX starts with knowing what you have. Open Asset Management and add an asset — a device, a domain, a cloud resource, or any other type Cert-IX supports. Registered assets become the targets for scanning, the basis of your security score, and the inventory behind compliance and incident response.

→ Full reference: Asset Management Overview

Step 4 — Run your first scan

You can scan from the dashboard or the API. Both use the same 10 professional engines behind the scenes.

Option A — From the dashboard

1. Open the asset you registered in Step 3.
2. Choose Run Security Scan and pick an engine (start with Nmap for a network scan, or OWASP ZAP for a web application).
3. Cert-IX queues the scan and shows progress in real time. Scans run asynchronously, so you can keep working while it completes.

Option B — With the Scan API

Prefer automation or want to wire scanning into CI/CD? Submit the same scan over the Scan API.

First, create an API key in the dashboard under Settings → API Keys (grant the scans:create, scans:read, and results:read scopes), then set it in your shell:

export CERTIX_API_KEY="cix_sk_your_api_key_here"

Submit an Nmap scan:

curl -X POST https://api.cert-ix.com/scan-api/api/v1/scans \
  -H "X-API-Key: $CERTIX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "target": "example.com",
    "scanType": "nmap",
    "name": "My first scan",
    "options": { "ports": "1-1024", "timing": "T3", "serviceDetection": true }
  }'

The response returns a scan id:

{
  "success": true,
  "data": {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "scanType": "nmap",
    "status": "queued",
    "progress": 0
  }
}

Poll its status until it's completed:

export SCAN_ID="a1b2c3d4-e5f6-7890-abcd-ef1234567890"

curl -s "https://api.cert-ix.com/scan-api/api/v1/scans/$SCAN_ID?scanType=nmap" \
  -H "X-API-Key: $CERTIX_API_KEY" | jq '.data | {status, progress}'

Store your key safely

The raw API key is shown only once at creation and is stored only as a hash — Cert-IX can't recover it. Keep it in a password manager or secrets vault, and never put it in a URL.

→ Full API walkthrough (results, webhooks, all 10 engines): Scan API — Getting Started

Step 5 — Review your findings

When the scan completes, review the results:

• From the API: GET /scans/:id/results returns the structured findings.
• In the dashboard: open Analytics → Vulnerability Management to see findings grouped by severity (Critical, High, Medium, Low), with risk-based prioritization and remediation guidance.

Not sure what a finding means or how to fix it? Ask Bobby — it can explain any result in plain language.

→ Full reference: Analytics Overview

Step 6 — Get notified automatically

Rather than checking back manually, let Cert-IX tell you when something matters:

• Alerts — configure notification rules in the dashboard so critical events reach you by your preferred channel.
• Webhooks (for the API) — register an HTTPS endpoint to receive real-time scan completions, verified with HMAC-SHA256 signatures. Webhooks consume zero API quota and are the recommended pattern for production integrations.

→ Full reference: Scan API — Webhooks

Step 7 — Track your compliance

Head to Compliance to map your posture to the frameworks you care about — NIST CSF, ISO 27001, SOC 2, CIS Controls, or a custom framework — manage policies, and start collecting audit evidence.

→ Full reference: Compliance Overview

Recommended next steps

You've completed the essentials. To get the most out of Cert-IX:

• Register the rest of your assets so your security score reflects your whole environment.
• Schedule recurring scans or save a scan template for one-click reruns.
• Map your posture to a framework in Compliance.
• Switch API integrations from polling to webhooks.
• Add DepCheck MCP to your AI coding agent to block vulnerable dependencies.

Get help

• Bobby AI — ask anytime from the bottom-right corner of the platform.
• Documentation — browse the full feature guides.
• Support — email [email protected].

---

Next steps:

• Dashboard Overview
• Scan API Overview
• Asset Management