Install the Cybermatic device agent

A lightweight, read-only agent for Windows, macOS, and Linux that reports device inventory and security posture hourly — findings open when problems appear and close when they're fixed.

1. 1Before you begin. The Cybermatic device agent is a lightweight program that reports a device's inventory and security posture — operating system, installed software, disk encryption, firewall, and antivirus state — to your Cybermatic workspace roughly once an hour. Findings like an unencrypted laptop or an end-of-life OS appear automatically, and close automatically when fixed. It's read-only by design: the agent never changes settings, installs software, or executes remote commands. Agent devices count toward your plan's asset limit like any other asset. From version 1.2.1 onward the agent keeps itself up to date: after reporting, it checks for a newer release, verifies the release's cryptographic signature (ed25519) and the download's SHA-256 checksum, and swaps itself in — no reinstall needed. A tampered or unsigned release is ignored, so the update channel stays safe even if the download server were compromised. To opt out (for change-controlled environments), set "autoUpdate": false in the agent's config.json and restart the service. You need: an enrollment token from Settings → Device agents (workspace admins can create one), and administrator access on the device.
2. 2Step 1 — Get your enrollment token. In Cybermatic, open Settings → Device agents. Select Create token, give it a name (e.g. Office laptops), and copy the token — it starts with cyb_. One token can enroll any number of devices; create separate tokens per site or client if you want to revoke them independently. Revoking a token stops new enrollments and reports from its devices.
3. 3Step 2 — Windows. Download cybermatic-agent-setup.exe from Settings → Device agents and run it as administrator. When the installer asks, paste your enrollment token. That's the whole setup — the agent installs as a scheduled task that reports hourly and at startup, and the device appears in Assets within a minute. Mass deployment (Intune, GPO, RMM): the installer supports silent installation: cybermatic-agent-setup.exe /S /TOKEN=cyb_your_token_here
4. 4Step 3 — macOS (13 or later; Apple Silicon and Intel). One universal package covers both chip families, signed and notarized by Apple (verified publisher: Ironhawk Group Corp). Download cybermatic-agent-1.5.0-universal.pkg from Settings → Device agents, then install and enroll from Terminal: sudo installer -pkg ~/Downloads/cybermatic-agent-1.5.0-universal.pkg -target / && sudo cybermatic-agent --enroll cyb_yourtoken Enrollment sends the first report immediately, and a launchd daemon (ai.cybermatic.agent) reports hourly from then on — including after reboots.
5. 5Step 4 — Linux (Debian/Ubuntu). Download the .deb from Settings → Device agents, then: sudo dpkg -i cybermatic-agent_1.5.0_amd64.deb sudo cybermatic-agent --enroll cyb_your_token_here The enroll command writes the config, sends the first report, and starts the systemd service. Verify with: systemctl status cybermatic-agent
6. 6Step 5 — Linux (RHEL/Fedora/Amazon Linux). Download the .rpm, then: sudo rpm -i cybermatic-agent-1.5.0-1.x86_64.rpm sudo cybermatic-agent --enroll cyb_your_token_here Same behavior as the Debian package: config written, first report sent, service enabled.
7. 7Step 6 — Verify. Open Assets in Cybermatic. The device appears with provider Agent within a minute of enrollment, showing OS, hardware, and software inventory on its detail page. If the device has issues worth knowing about — no disk encryption, firewall off, end-of-life OS — they appear under Risks or Vulnerabilities immediately, tied to the device. Fix something and it closes on the device's next hourly report. A device that goes silent for 7 days gets flagged automatically. Renamed a device? The agent reads the hostname fresh on every report, so a rename appears within the hour on all platforms — run the agent once by hand (--once on Windows/Linux, sudo /usr/local/bin/cybermatic-agent --once on macOS) to see it immediately. On Linux, use hostnamectl set-hostname — editing /etc/hostname alone doesn't change the running hostname until reboot. Verifying a download (optional, for change-controlled environments): every file's SHA-256 is in /downloads/SHA256SUMS, which is GPG-signed (SHA256SUMS.asc) by the Cybermatic release key at /downloads/cybermatic-release-key.asc. Check with: gpg --import cybermatic-release-key.asc && gpg --verify SHA256SUMS.asc SHA256SUMS && sha256sum -c SHA256SUMS --ignore-missing The .rpm additionally carries an embedded signature: rpm --import cybermatic-release-key.asc && rpm -K cybermatic-agent-1.5.0-1.x86_64.rpm reports Signatures OK.
8. 8What Cybermatic checks (v1). • End-of-life operating system — Windows 7/8/10, Server 2008/2012, macOS 13 and earlier, EOL Ubuntu/Debian/CentOS releases (High, Vulnerabilities) • Disk encryption off — BitLocker on Windows, FileVault on macOS, LUKS on Linux (High, Risks) • Host firewall disabled or partially disabled (Medium/Low, Risks) • Antivirus real-time protection off — Windows (High, Risks) • Agent silent for 7+ days — the device stopped reporting (Medium, Risks) Software inventory (name, version, publisher) is collected on every report and shown on the device page. • Outdated or end-of-life software — a curated set of widely-deployed applications (browsers, runtimes, and common tools such as Chrome, Firefox, Edge, Zoom, Slack, Python, Node.js, Go, PostgreSQL, Visual Studio Code, Docker, GitLab) is checked against live release and end-of-life data: EOL versions raise High findings, significantly outdated ones Medium/Low. Only the curated set is checked — coverage grows over time. Update the software and the finding closes on the device's next report.
9. 9Troubleshooting. "Invalid or revoked enrollment token" — the token was revoked or mistyped; create a fresh one in Settings → Device agents and re-run --enroll. "Asset limit reached" — your plan's asset cap is full; the device will enroll automatically on its next hourly attempt after you upgrade or remove unused assets. Device not appearing — Windows: check Task Scheduler for the Cybermatic Agent task and run it manually. Linux: systemctl status cybermatic-agent and journalctl -u cybermatic-agent for the last error. Behind a proxy — the agent respects the system HTTPS_PROXY environment variable. Uninstalling — Windows: Apps → Installed apps → Cybermatic Agent → Uninstall. Linux: apt remove / rpm -e cybermatic-agent. The device row stays in Assets until you delete it (it will be flagged stale after 7 days). macOS: "installer: Error - the package path specified was invalid" — check the path to the downloaded .pkg (it may be in a different folder than ~/Downloads). macOS: agent installed but the device never appears — run sudo launchctl list | grep cybermatic to confirm the daemon is loaded, check /var/log/cybermatic-agent.log for the last report result, and run sudo /usr/local/bin/cybermatic-agent --once to see the outcome directly.
10. 10One token, many devices — but separate tokens per site or client cost nothing and make revocation surgical. For fleets, the silent installer flag (/S /TOKEN=…) turns deployment into a one-line RMM job.

Tip: One token, many devices — but separate tokens per site or client cost nothing and make revocation surgical. For fleets, the silent installer flag (/S /TOKEN=…) turns deployment into a one-line RMM job.