Cyros Wants Your Fleet to Keep Its Secrets

Field notes

Cyros describes a host agent that enrolls with one token, polls for signed instructions, and forwards telemetry directly to an operator-selected destination. The homepage lists macOS, Linux, Windows, FreeBSD, and firewall or appliance modes, with Loki, S3, rsyslog, and file output among the supported sinks. It also names osquery, Sysmon, Zeek, and Winlogbeat as managed tools. The browser-held key model is presented as a way to keep command signing and destination secrets outside the control plane.