The Problem
End-of-life software is un-patchable risk hiding in the estate. No vendor fix is coming — every new CVE against it is permanent exposure. Yet EOL systems rarely announce themselves; they sit quietly in inventory, indistinguishable from healthy software until an auditor or an attacker finds them.
What It Does
Charon tags every asset running unsupported or end-of-life software, so you can isolate or replace it deliberately instead of discovering it in an incident. It detects EOL two ways — lifecycle text in your findings, and Mimir's endoflife.date enrichment — and turns the result into gated, routable tags.
Key Capabilities
- EOL detection from lifecycle text — finds the "no longer supported" evidence already sitting in your scan findings, with zero new data collection.
- endoflife.date enrichment via Mimir — an independent lifecycle feed catches products whose EOL status the scanner never flags. Two paths, unioned, each covering the other's blind spot.
- Gated EOL tagging — the unsupportable population becomes visible, taggable, and routable — approved by a human before any write lands.
- Isolate-or-replace worklist — a bounded, evidence-backed modernization queue with names on it.
How It Works
Charon runs against the local navi.db built from your Tenable data — lifecycle signals in the findings, unioned with Mimir's endoflife.date-enriched product map. All writes are proposed, human-approved, and logged.
Who It's For
Vulnerability management teams carrying risk they can't patch away, and IT modernization owners who need a prioritized, evidence-backed replacement queue.
Proof Points
In a reference environment of 268 assets, Charon works the same product map Mimir reconciled from ~28,700 software rows and ~43,700 CPE rows — every EOL hit traceable to its lifecycle evidence. EOL detection depends on inventory coverage; blind or uncredentialed hosts are called out, not hidden.
Works Better With
Charon is unioned with Mimir (lifecycle enrichment), feeds Fenrir (EOL software as foothold evidence in attack paths), and drives Anubis so unpatchable assets carry criticality that reflects the risk.