WithSecure Atlant

What is included in WithSecure Atlant?

Multi-engine scanning service – Several scanning engines plus Security Cloud reputation for files and URLs.
REST scanning API – Scans uploaded files, SHA-1 hashes, emails and URLs over HTTPS.
ICAP scanning service – Connects ICAP-capable proxies and gateways, returns HTML block pages to users.
URL classification – Categorises URLs and blocks forbidden content categories, including embedded links.
Three management options – Atlantctl command line, REST management API, or WithSecure Policy Manager.
Important – No endpoint agent, EDR, patch management or encryption management included.

What are the main benefits of WithSecure Atlant?

WithSecure Atlant, formerly F-Secure Atlant, is a self-hosted scanning platform for Linux that your own applications, mail flows and web proxies call via REST API or ICAP to check files, URLs and emails. It runs standalone, centrally managed through WithSecure Policy Manager, or as a container configured with a single JSON file.

Safer upload portals – Scans customer uploads before they reach storage or colleagues.
Hash-only checks – Classifies files by SHA-1 without transferring full file contents.
Existing proxies reused – ICAP lets current web proxies add malware scanning without redesign.
Scale-out friendly – Policy Manager access tokens stay valid across instances behind load balancers.
Controlled product updates – Version pinning freezes the product while engines and definitions stay current.
VDI offload scanning – Replaces the Scanning and Reputation Server for WithSecure Virtual Security.

Which company size is WithSecure Atlant suitable for?

WithSecure Atlant fits organisations that run their own services where outside parties deliver content, such as customer upload portals, file transfer systems, mail flows or web proxies. The deciding factor is less the number of employees than whether someone can operate a Linux service and connect it to an application via API or ICAP.

Does WithSecure Atlant meet the requirements of Swiss cybersecurity legislation?

The revised Information Security Act obliges operators of critical infrastructure, for example in energy, healthcare, transport, telecommunications and public administration, to report cyberattacks to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery. Companies outside these sectors are usually not directly affected, but often receive comparable requirements as suppliers of such operators. WithSecure Atlant supports the detection side of this obligation: each scan returns a result with a named detection, and its logging can record the client IP address and selected request headers, which documents what was blocked, when and from which source. It does not detect attacks outside the content streams routed through it, does not reconstruct an incident timeline and does not create or submit reports to BACS. This information does not constitute legal advice; have your specific obligations checked by a qualified specialist.

Does WithSecure Atlant meet the requirements of European cybersecurity legislation?

No product makes a company compliant with the NIS 2 Directive, because the directive requires organisational risk management measures, not a specific tool. Among others, it names incident handling, business continuity, supply chain security, security in the acquisition, development and maintenance of systems, basic cyber hygiene, cryptography, access control and multi-factor authentication. WithSecure Atlant supports security in system development and operation by adding malware checks to upload and data pipelines, supports supply chain security by scanning files and emails delivered by partners, and provides detection logs as input for incident handling. Backup and business continuity, multi-factor authentication, access control, encryption, staff training and the reporting process itself are not covered and need separate measures.

Does WithSecure Atlant help with security questionnaires from large customers?

Partly, and only for the content that flows through it. Atlant answers questions such as whether uploaded or received files are scanned for malware, whether web traffic and emails are filtered for harmful content and URLs, and whether detection definitions are kept up to date automatically, including in isolated networks. It does not answer questions about malware protection on every workstation and server, endpoint detection and response with monitoring, patch management, disk encryption, multi-factor authentication, backups or a documented incident response process. Because Atlant has no higher edition that adds these functions, the practical route is to combine it with WithSecure's endpoint protection and EDR offerings and keep the other controls in your existing tools.

Which limitations should you know before buying?

WithSecure Atlant runs only on 64-bit Linux, namely RHEL, Rocky Linux, AlmaLinux, Oracle Linux, Debian, Ubuntu, SUSE Linux Enterprise Server and Amazon Linux, or as a container; there is no Windows installation. It is a building block, not a finished protection product: without an application, proxy or mail gateway that calls its REST API or ICAP interface, it protects nothing, and it provides no protection on workstations. The container variant has no management API and no Policy Manager integration, and its configuration cannot be changed once the container has started. The product needs a regular connection to WithSecure cloud services, and optional ICAP trickling passes parts of a file to the client before the scan is finished, which WithSecure itself advises balancing with additional endpoint protection. No region-limited features were identified.

Frequently asked questions about WithSecure Atlant

Does WithSecure Atlant send scanned files to the cloud?

Not by default for data files: uploading data files to Security Cloud is disabled unless you enable it, while anonymised metadata and, if advanced cloud analysis is requested, application files can be submitted. The use of online services can be switched off entirely in the configuration.

Can WithSecure Atlant be installed in an isolated network?

Yes, installation and updates on hosts without internet access are supported through content packages and update archives generated on a connected machine. Because the product still requires a regular connection to WithSecure cloud services, a permanently air-gapped operation is not a suitable use case.

Which archive formats and nesting levels does WithSecure Atlant handle?

Atlant extracts archives and scans each item individually, by default up to five nested levels. Encrypted or corrupted archives are flagged in the scan result, and the ICAP service can be set to block encrypted archives or archives that exceed the nesting limit.