There is a gap between running a scanner on a subnet and running recon at a scale where the output needs a database, a dashboard, certificates, worker health, and regional nodes that can fail independently.
RADAR-X came from building geolocation and network intelligence tooling and hitting the ceiling of what a single box and a cron job can do. The architecture is event-driven: a central control plane coordinates discovery and scanner worker pairs across regions. MQTT carries triggers, completions, roster state, and scan events. Each worker runs assessment traffic through its own VPN namespace while management stays reachable over a separate path.
Deadknock handles port discovery. Deadscan goes deeper: nDPI, TLS fingerprinting, JA3, JA4, HASSH, service evidence, and CVE correlation against what was actually found. Writer nodes pull results through structured paths and land them in Postgres so the output is queryable infrastructure, not a folder of CSVs someone has to merge by hand.
What matters at this scale is not just the scan. It is whether the system keeps certificates, keys, workers, VPN egress, and result pipelines coherent when nodes drift or reconnect. The platform has been verified end-to-end; the real work is making that verification repeatable from the dashboard.