Open ports are noise. Reachable services are risk.
oxharden maps every listening socket, links it to the owning process and package, and shows which services are actually exposed. Confirm internet reachability with an external probe, then jump from the port to CVEs, package context, and remediation guidance.
Open is not the same as exposed. Most tools stop at a list of listening sockets. oxharden goes further: it shows which services are reachable, what is running behind them, which package owns them, and where cleartext protocols create avoidable risk.
Turn a noisy port list into a real exposure view.
A listening socket is only risk if traffic can get to it. oxharden filters noisy listeners by bind address, host firewall, cloud security groups, and routing context, then optionally validates exposure from the outside. What remains is the smaller set of services your team should fix first.
A port is only useful when you know what owns it.
oxharden traces listening sockets back to the process, binary, and package behind them. That turns exposure into action: see who owns the service, which CVEs affect it, and what package or configuration change reduces the risk.
Some services should never be quietly exposed.
oxharden identifies cleartext protocols, admin surfaces, datastores, and control-plane services the moment they appear. If one is reachable from the internet, it becomes a priority finding, not another row in a port inventory.
Certificate risk belongs next to exposure.
oxharden checks TLS where it matters: on the live service. See expiring certificates, self-signed admin surfaces, broken chains, and weak protocol versions alongside the reachable port, owning process, package, and host.
From open port to proven exposure.
Observe
The agent enumerates listening sockets locally from /proc and socket state, then maps each one to its owning process, binary, and package where available. No network scanning, no credentials.
Infer & Probe
oxharden infers reachability from bind address, host firewall, cloud security groups, and routing context. Optional external probes confirm which services answer from outside your environment.
Classify & Prioritize
Reachable services are classified by risk, TLS posture is inspected on the live socket, and risky surfaces are prioritized when they become internet-reachable.
The technical details, up front.
No black box. Here's exactly what the agent reads, how reachability is determined, and how it runs.
One agent does more than ports.
Launch your first scan in minutes.
Not ready to install? Click around the live demo with real fleet data first. Then start a 14-day free trial on up to 30 of your own hosts.
curl -fsSL https://packages.executepath.dev/install.sh \ | sudo EXPECTED_GPG_FINGERPRINT=13094D5AB037E6CD79CDFA3A51687EAC6B931A09 bash
✓ inventory synced · 410 packages · 4 ports
✓ first scan complete · 12 critical · 19 vulnerable pkgs
Attack-surface exposure, answered.
A network scanner sees ports from one vantage point and usually cannot tell you what owns them. oxharden starts from the host: it reads listening sockets locally, maps each one to the owning process, binary, and package, then layers reachability on top. You get the inside view and, with an optional external probe, the attacker's view too.
Open means a process is listening on a port. Reachable means traffic from outside can actually get to it. A socket bound to localhost, blocked by host firewall, or denied by a security group may be open but not exposed. oxharden separates local listeners from reachable services so teams can focus on real attack surface.
No. The probe only tests services that already appear exposed. It does not change firewall rules, security groups, routes, or host configuration. It is optional and can run on demand or on a schedule.
No. The agent does not sweep subnets or brute-force ports. It observes local socket state from the host, then oxharden evaluates whether those listeners appear reachable based on firewall, routing, and cloud context. External probing is optional and targeted.
The agent maps each listening socket to its owning PID, resolves the backing binary, and attributes that binary to the package that installed it. That is why an exposed service can be tied back to the right CVEs, package owner, and remediation path.
For listening TLS services, oxharden checks certificate expiry, self-signed certificates, chain validity, and weak protocol versions such as TLS 1.0 and TLS 1.1. The finding lives next to the exposed service, not in a disconnected certificate inventory.
They are still inventoried, but they are not treated the same as internet-reachable services. oxharden keeps the full socket map for visibility while ranking unreachable listeners below confirmed or likely exposure.
oxharden combines what the host reports with cloud network context such as security groups and routing where available. If that context is incomplete, the UI should say so instead of pretending the exposure decision is certain.