Fixed means proven.
A patch report is evidence that a patch was deployed. Only a verifying scanner's rescan closes a finding, and a claim that nothing has confirmed stays visible as a claim.
About PYXA
Built by people who run remediation programs.
PYXA is an independent European software vendor, launched in 2026. It makes one product, a self-hosted platform that closes a finding only when a scanner proves it fixed, and runs PYXA Consulting, the team that tests estates, builds vulnerability programs and prepares audits.
How PYXA is built
Four rules the product keeps.
Findings stay on your hardware.
A list of findings is a map of an organisation's weak points. PYXA runs on the customer's own server, with no telemetry and no outbound connection required.
Every number explains itself.
A risk score names the contributions that made it, a percentage states its denominator, and an asset no scanner has seen is counted as unknown, never as clean.
AI proposes, people decide.
No model can close a finding, approve an exception or change a priority. Every AI task can run on a local model, and turning AI off leaves a working product.
Working with PYXA
The product and the consulting, kept apart.
The platform and PYXA Consulting have the same owner, and each is bought on its own contract. The shared ownership is disclosed in writing before PYXA is discussed with a consulting client, and PYXA is never the only remediation recommendation in a paid assessment.
Contact