Anubis, lightweight Windows gateway for legacy XP/PLC systems (free CE)
Hi everyone,
I'm a cybersecurity dev working in IT/OT environments. I kept running into the same problem: ZeroTier and Tailscale handle the mesh just fine, but remote access to legacy systems (XP, PLCs) is still a pain, especially revocation. Rebuilding the PKI every time a contractor left was getting old.
So I built Anubis, a lightweight Windows gateway (15MB) that sits on top of the mesh and handles MFA, remote access (RDP, SSH, OPC UA,HTTP,TCP_RAW), and one-click revocation at the application layer.
No cloud, no open ports, no touching the legacy boxes.
Community Edition is free for personal use.
Would love to get feedback from anyone dealing with similar environments, especially on the revocation model.
Site: https://sgneep.com/anubis/download.php
Thanks for taking a look!
I like that you built around an existing workflow instead of asking people to replace it. For legacy systems, reducing operational friction is often more valuable than adding new features. I'm curious which part caused the most resistance in early testing: deployment, security reviews, or user adoption?
Thanks for your interest. Building the core was fairly painless. Even the security checks are excellent. The library vulnerability scan is run once a month. The prof tests are excellent. Fortunately, I used "cybersec by design" in this code from the early stages of development. The greatest resistance was in writing the client-side UX, where users expect to enter a password and log in.
The revocation angle is stronger than you might realize because it maps directly to an audit question: every SOC 2 and CMMC assessment asks how contractor access gets terminated, and most OT shops have no good answer. I run a compliance company for SMBs and that single control failure shows up constantly. Position Anubis as the answer to the offboarding finding, not as another ZTNA tool, and the buyers with budget will find you.
Your advice on positioning Anubis as 'offboarding-first' rather than just another ZTNA tool is gold, I'm definitely going to use it. Thanks again!
How long did it take you to make it?
It took me about a year, and I worked on it an average of 12 hours a day. It took a lot of effort and resources.
This is a cool niche to build for. The one-click revocation angle stood out to me since that's a pain point I don't see discussed much.
I'd also add a simple real-world example on the landing page—it'd make the value click much faster for people outside the IT/OT space.
Thanks, I'll add it as soon as possible
"Rebuilding the PKI every time a contractor left was getting old." 👍 — This is like having to rekey your house every time a plumber leaves, and the plumber still has the master key because you never trust the damn lock.
The New Yorker’s 2024 piece on "Legacy Infrastructure as a Human Condition" noted, "Security is not a feature, it’s the environment we live in." The author didn’t say "it’s a pain," they said "it’s the air you breathe."
What stood out to me is that you're treating revocation as the core problem rather than remote access itself.
A lot of tools make it easy to grant access. The harder operational challenge is removing that access quickly and confidently without disrupting legacy systems. Solving that lifecycle problem feels like a much stronger long-term position than competing on connectivity alone.
thanks for your feedback
I'm curious about one thing.
As you've been building it, has the biggest challenge turned out to be the technical side of revocation, or getting customers to recognize that revocation is the problem they actually need to solve?
Those usually lead to very different products, which is why I wondered.
The "no touching the legacy boxes" part is what caught my attention. Anyone who's had to keep old XP or PLC systems alive knows exactly why that matters.
I can imagine an OT admin hearing the name from a colleague then quietly looking it up before ever suggesting it internally. For something that sits between contractors and critical systems that first impression carries a lot more weight than the feature list.
Have you had anyone outside your own network try it in a real environment yet or are you still collecting feedback before people put it into production?
Thanks, we just launched the Community Edition, it's live and already being used by several external users. For the production-ready version, we're currently running tests and gathering feedback before the full release.
That's a good stage to be in. I'm curious have you thought about how people might discover Anubis through AI assistants? It feels like this is the kind of niche tool someone finds after asking ChatGPT something like 'how do I securely access legacy XP or PLC systems without exposing them to the internet?
no, I haven't thought about it yet
That actually makes sense. I think most technical founders naturally focus first on building, testing, and getting real users rather than thinking about discovery channels.
The reason I brought it up is because Anubis is solving a very specific problem. Those are often the kinds of problems people search for through AI assistants when they don't even know the right tool exists yet.
I'm curious are most of your current users finding Anubis through communities/referrals, or are you already seeing people discover it through search?