Stop guessing which Linux risk matters first.
oxharden collects host state once, then ranks CVEs, exposed services, compliance gaps, stale running code, and package fixes in one place. No scanner pileup. No spreadsheet triage. Just the hosts and fixes that move risk down.
Four ways to find the same truth.
One agent collects the state. Every surface reads from it: scans, inventory, exposure, and compliance all point back to the same hosts, packages, ports, CVEs, and fixes.
Scans
Ad-hoc and scheduled assessments · last run 6 min ago
| Scan | Trigger | Hosts | Took | Result |
|---|---|---|---|---|
| Vulnerability scan | scheduled | 347 | 2m 11s | 12 crit |
| STIG · RHEL 9 V2R3 | ad-hoc | 142 | 4m 03s | 38 fail |
| Exposure scan | scheduled | 336 | 1m 47s | 47 exposed |
| Re-scan · ip-10-20-2-107 | ad-hoc | 1 | 0m 08s | clean |
| CIS Benchmark · L2 | scheduled | 118 | 3m 22s | 21 fail |
What each surface actually does.
Scan on a schedule — or the moment you need to.
Set daily vulnerability sweeps, weekly STIG/CIS runs, and frequent exposure checks, each scoped to the hosts that matter. When something changes, re-scan one host, one system, or the whole workspace on demand.
“Patched” by version. Still running the vulnerable code.
A package upgraded on disk is not fixed until the services using it restart. A kernel update is not fixed until the host reboots. oxharden tracks applied-vs-live state, so a finding only closes when the vulnerable code is no longer running.
Ask the fleet a question. Drill into the answer.
Filter across hosts, packages, ports, CVEs, and compliance results with stacked conditions: distro, severity, exploit status, internet exposure, package name, kernel version, or benchmark. Every result opens into the exact detail page behind it.
Open is not the same as exposed.
A listener on localhost is not your attack surface. A datastore reachable from the internet is. oxharden maps every socket to its service, TLS posture, certificate state, and real reachability so exposed services rise to the top.
Every benchmark, every host — continuously evaluated.
Stop treating hardening as a quarterly audit. oxharden evaluates every host against CIS, DISA STIG, and PCI on schedule, scores results by severity, and shows expected vs actual evidence for every rule.
A live posture score, not a stale PDF.
Each rule is evaluated per host, so you know what is passing, what is failing, and exactly which systems need attention first. Severity-weighted scoring surfaces CAT I failures ahead of cosmetic gaps, with remediation guidance attached to the finding.
Built for enterprise Linux fleets.
Full enterprise-distro coverage across major versions, matched against per-distro vendor advisories instead of guessed from CPE strings.
Everything the agent makes possible.
One read-only agent collects the host state behind inventory, vulnerabilities, exposure, compliance, and remediation guidance.
Run an assessment when you need an answer, or schedule recurring vulnerability, compliance, and exposure scans. Every run records trigger, duration, status, and scope.
Find patched packages that are still running vulnerable code: stale shared libraries, kernels awaiting reboot, and exposed services backed by outdated processes.
Launch your first scan in minutes.
Not ready to install? Click around the live demo with real fleet data first. Then start a 14-day free trial on up to 30 of your own hosts.
curl -fsSL https://packages.executepath.dev/install.sh \ | sudo EXPECTED_GPG_FINGERPRINT=13094D5AB037E6CD79CDFA3A51687EAC6B931A09 bash
✓ inventory synced · 410 packages · 4 ports
✓ first scan complete · 12 critical · 19 vulnerable pkgs