A live inventory you can trust.
Every Linux host reports its kernel, packages, ports, vulnerabilities, compliance posture, and freshness. Search across the fleet, spot stale or missing systems, and open any host for the complete picture.
Inventory is not a spreadsheet. oxharden keeps a live record of every host, its software, exposure, vulnerabilities, and compliance posture, so blind spots are visible before they become incidents.
Your Linux fleet, queryable at a glance.
Hostname, primary IP, distro, agent health, CVE breakdown, package state, and compliance posture on one row per host. Online, stale, and retired are explicit states, so the inventory tells you what is known, what changed, and what needs follow-up.
Slice the fleet by any property.
Filter by OS family, agent status, installed package, CVE, kernel version, open port, tag, or cloud account, then compose conditions with AND. Answer “which RHEL hosts still have a vulnerable OpenSSL package?” and act on exactly that set.
Open any host for the full picture.
OS, kernel, cloud metadata, agent health, packages, ports, CVEs, and compliance in one place. Drill from a host into the exact findings that affect it, then see the fixes ranked by what they retire.
See what still needs a restart or reboot.
A package can be fixed on disk while vulnerable code keeps running in memory: a shared library updated while a long-lived process still maps the old copy, or a kernel update waiting for reboot. oxharden shows the host-level follow-up needed to make the fix active.
From enrolled agent to live fleet record.
Enroll
Install the read-only agent on each Linux host. It registers to your workspace, receives scan policy, and reports over an outbound connection. No inbound access or stored host credentials required.
Inventory
The agent collects the state that matters: packages, kernel, listening ports, running processes, cloud metadata, and compliance evidence. Each check-in refreshes the host record.
Assess & Rank
oxharden turns host state into ranked work: exploitable CVEs, reachable services, compliance gaps, and the fixes that retire the most risk.
Exactly what the agent records.
No black box. Here's what each host reports, how freshness is tracked, and how the fleet becomes searchable.
One agent. One fleet record. Every risk view.
Launch your first scan in minutes.
Not ready to install? Click around the live demo with real fleet data first. Then start a 14-day free trial on up to 30 of your own hosts.
curl -fsSL https://packages.executepath.dev/install.sh \ | sudo EXPECTED_GPG_FINGERPRINT=13094D5AB037E6CD79CDFA3A51687EAC6B931A09 bash
✓ inventory synced · 410 packages · 4 ports
✓ first scan complete · 12 critical · 19 vulnerable pkgs
Host inventory, answered.
OS and kernel, installed packages with full NEVRA, listening ports and their owning processes, mapped shared libraries, cloud metadata, and compliance evidence. Collection is read-only: the agent reads local state and checks in over an outbound connection.
Agents check in on schedule and refresh inventory on schedule or on demand. The fleet table shows last-seen status per host, and agents that stop reporting are flagged as stale instead of being shown as healthy.
Captured host properties such as OS family, kernel version, installed package, listening port, CVE, compliance status, agent status, cloud account, or tag. Conditions compose with AND, so you can isolate questions like \u201cRHEL hosts with a critical OpenSSL CVE\u201d in one line.
Findings are grouped by the work required: package upgrade, service restart, reboot, or compliance remediation. Where version data is available, oxharden shows the target package version and the risk retired by that fix. Findings without an available fix stay visible instead of being hidden.
No. The agent does not require inbound access, domain membership, or host credentials. It works over outbound check-in and can inventory cloud or on-prem Linux hosts.
It becomes stale. oxharden keeps the last known inventory for context, but stale hosts are called out explicitly so old data is not mistaken for current posture.
Host history and change timelines are a natural next step: packages added or removed, new ports opened, CVEs introduced or fixed, and compliance drift.
Yes. Filtered host sets can be used to focus review and decide where to run scans or apply fixes, so teams work on the exact systems affected instead of the whole fleet.