Your audit passed Friday.
The fleet drifted by Monday.
A point-in-time assessment is stale the moment a host drifts. oxharden continuously evaluates your CIS or DISA STIG baseline across the Linux fleet — so posture means right now, not last quarter.
scan: 2026-06-14 · expected vs actualExportAudits should not be archaeology.
Keep the evidence current.
Compliant Friday. Drifted by Monday.
An assessment is stale the moment a sysadmin edits a config or a package update reverts a setting. oxharden re-evaluates the active baseline as hosts report in, so your posture is a live number — not a quarterly snapshot you hope still holds.
Expected vs actual, without the fire drill.
Stop the pre-assessment scramble for screenshots and spreadsheets. Every compliance result carries the rule, expected configuration, current configuration, evidence summary, host scope and scan timestamp — exportable as CSV/JSON, with CKL for host-level STIG review.
Unknown never counts as compliant.
Unassessed hosts, missing policy coverage and manual-review checks stay visible. oxharden does not quietly count gaps as passes, which makes the posture easier to defend when someone asks what was actually evaluated.
RHEL-09-213015RHEL-09-255045Current-state evidence, without the scramble.
No appliance and no checklist spreadsheet. Enroll a host and oxharden starts evaluating applicable controls from the same local state it uses for packages, ports and CVEs.
Built for the people who sign the report.
The frameworks you report against.
The agent collects host state once. The platform can score that evidence against the active baseline and other available profiles without asking the host to collect the same facts again.
Walk into your next audit with current evidence, not stale screenshots.
Enroll one host, choose a baseline, and see expected vs actual rule evidence start filling in. 14-day free trial for up to 30 hosts — no card.
The questions auditors ask first.
Every compliance result includes the benchmark, rule, host scope, status, expected configuration, current configuration, evidence summary and scan timestamp. It is stronger than a screenshot because it shows what was checked and what the system reported at scan time.
DISA STIG and CIS Benchmarks are the primary continuous baselines. Regulatory profiles such as PCI-DSS, HIPAA, NIST and CUI can be evaluated where the matching benchmark profile exists for the host OS.
Yes. The compliance views and exports are scoped by workspace, scan batch and host, so you can show the systems in scope without mixing them with unrelated fleet data. The agent itself is read-only during evaluation.
They stay visible. Manual-review rules are marked clearly, and unassessed hosts or missing policy coverage are treated as gaps in posture, not silently counted as passing.
The product has been designed around local collection and feed-driven evaluation so that self-hosted or offline enterprise deployments are a clean requirements path. If that is a hard requirement, it belongs in the Enterprise conversation.
CSV and JSON for current posture and scan-batch findings, plus CKL for host-level STIG checklist review where applicable. Additional auditor formats can be scoped with Enterprise reporting requirements.