Getting Started

How to use Orithos

Follow these steps to register your AI agent, run security scans, review findings, and export compliance reports. No technical expertise required.

1

Register an Agent

View docs

Go to Agents in the sidebar and click "Add Agent". Enter your LLM endpoint URL and API key. Orithos will verify the endpoint is reachable before saving it.

i

You can register agents for OpenAI, Anthropic, Groq, or any custom API endpoint.

2

Run a Security Scan

View docs

Go to Scans and click "New Scan". Select the agent you registered, choose which security probes to run, and pick a scan depth. Click "Launch Scan" to start.

i

Quick mode finishes in ~30 seconds. Standard mode runs all selected probes. Deep and Exhaustive test with multiple prompt variations to catch surface-level guardrails.

3

Review Your Findings

View docs

When the scan completes, click on any finding to expand it. You'll see a plain-English explanation of what happened, recommended actions, and technical details like CVSS scores and attack paths.

i

Each finding shows severity (critical/high/medium/low), evidence from the agent's response, and which compliance frameworks are affected.

4

Export Your Report

View docs

On the scan detail page, click HTML, PDF, or SARIF to download a report. SARIF format can be imported into GitHub Advanced Security and other CI/CD tools.

i

Use SARIF for CI/CD gates. Use HTML for stakeholder reviews. Use CSV for spreadsheet analysis.

5

Compare Across Providers

View docs

Go to Providers in the sidebar. Select one security probe and run it against multiple registered agents at the same time. Results stream in real-time so you can compare how different models handle the same attack.

i

Use this to evaluate which provider has the strongest safety guardrails for your use case.

6

Check Compliance Coverage

View docs

Go to Compliance to see how your scan findings map to industry frameworks: SOC 2, ISO 27001, HIPAA, NIST 800-53, OWASP LLM Top 10, and more.

i

Each finding is automatically mapped to relevant controls — no manual configuration needed.

7

Set Up API Keys

View docs

Go to Settings → API Keys to create API keys for automated scanning. Keys use bcrypt hashing and support role-based access (viewer, analyst, admin, owner).

i

Use API keys for CI/CD integration. Set expiration dates for temporary access.

8

Configure Data Retention

View docs

Go to Settings → Retention to choose how long scan traces are stored. Standard mode keeps traces for 30 days. Zero-Knowledge mode purges traces immediately after each scan.

i

Standard mode is required for SOC 2 evidence collection. Zero-Knowledge mode provides absolute privacy.

Need help?

Visit the detailed documentation or contact support for assistance.

Browse Documentation