CHARON

THE PROBLEM

End-of-life software is un-patchable risk hiding in the estate. No vendor fix is coming — every new CVE against it is permanent exposure. Yet EOL systems rarely announce themselves; they sit quietly in inventory, indistinguishable from healthy software until an auditor or an attacker finds them.

WHAT IT DOES

Charon tags every asset running unsupported or end-of-life software, so you can isolate or replace it deliberately instead of discovering it in an incident. It detects EOL two ways — lifecycle text in your findings, and Mimir's endoflife.date enrichment — and turns the result into gated, routable tags.

KEY CAPABILITIES

• EOL detection from lifecycle text — finds the “no longer supported” evidence already sitting in your scan findings, surfacing unpatchable software with zero new data collection.
• endoflife.date enrichment via Mimir — an independent lifecycle feed catches products whose EOL status the scanner never flags. Two detection paths, unioned, each covering the other's blind spot.
• Gated EOL tagging — the unsupportable population becomes visible, taggable, and routable — approved by a human before any write lands.
• Isolate-or-replace worklist — a bounded, evidence-backed modernization queue that turns “we should deal with legacy someday” into a prioritized plan with names on it.

HOW IT WORKS

Charon runs against the local navi.db built from your Tenable data — lifecycle signals in the findings, unioned with Mimir's endoflife.date-enriched product map. All writes are proposed, human-approved, and logged.

WHY IT'S DIFFERENT

• Two detection paths, unioned — scanner lifecycle text and an independent lifecycle feed catch what either alone misses.
• EOL as attack-path evidence — Charon's tags feed Fenrir, where unpatchable software becomes a scored foothold, not a footnote.
• Gated, reviewable writes — Charon proposes tags; a human approves.

PROOF POINTS

• In a reference environment of 268 assets, Charon works the same product map Mimir reconciled from ~28,700 software rows and ~43,700 CPE rows — every EOL hit traceable to its lifecycle evidence.

Illustrative demo-lab context — not a guarantee. EOL detection depends on inventory coverage; blind or uncredentialed hosts are called out, not hidden.

WORKS BETTER WITH

Charon is unioned with Mimir (lifecycle enrichment), feeds Fenrir (EOL software as foothold evidence in attack paths), and drives Anubis so unpatchable assets carry criticality that reflects the risk.

WHO IT'S FOR

Vulnerability management teams carrying risk they can't patch away, and IT modernization owners who need a prioritized, evidence-backed replacement queue.

CALL TO ACTION

Ask Charon what's already past saving — then choose the crossing on your terms.