Security
Account for every file on your Linux hosts before you decide what stays
A read-only software provenance assessment of your Linux hosts: a verdict for every file and a prioritised keep, remove or review list.
For CISOs and IT directors who inherited servers nobody can fully account for—after a takeover, before decommissioning, or due to an audit finding—the question is what on those hosts can be vouched for. If you cannot answer this, you cannot meet the supply-chain security measures of Directive (EU) 2022/2555 (NIS2), Article 21(2)(d). This page explains the assessment that answers this question and concludes with a scoping call for one host.
Every file receives exactly one verdict
A vulnerability scan identifies known issues within known packages; it is silent regarding files not claimed by a package. The provenance assessment walks every file on a Linux host and assigns each exactly one verdict from a closed set—there is no “other” bucket.
Coverage includes:
- System packages
- every file owned by a package manager, verified against its package.
- Snap and flatpak
- complete inventories.
- Python packages
- verified hash by hash; mismatches are flagged as tampered.
- Compiled binaries
- the libraries they depend on.
- Generated and orphaned files
- trees that no package or process vouches for.
If a vulnerability scan is missing, the report states UNASSESSED, never clean. Without live evidence of a server’s purpose, it states “no role” rather than guessing.
Read-only, and nothing leaves the host but evidence
The assessment runs as a dedicated unprivileged user: no root access, no installation, and no trace left behind. File contents and secrets never leave the host, and key material is refused. An offline mode covers air-gapped hosts and disk images.
Analysis occurs on our self-hosted EU infrastructure; no third-party AI service sees your data. The report is rendered without AI, ensuring identical inputs produce identical outputs.
A report the sponsor and the engineer both act on
You receive a self-contained HTML report that opens offline, alongside the raw evidence bundle used to build it. The report contains four layers:
- Verdict
- the decision for the sponsor.
- Action cards
- instructions to keep, remove, or review, including the reasoning.
- Package inventory
- includes CVSS context for known vulnerabilities.
- Evidence
- the files supporting every statement.
In a live run, 60,494 files were walked and reduced to 141 decisions. A typical run takes minutes per host. Repeat assessments retain all previous escalations; nothing is forgotten.
The assessment provides evidence for NIS2 Article 21(2) and, for manufacturers, the Cyber Resilience Act (Regulation (EU) 2024/2847) requirements regarding the product’s operating environment—it is not a certification. Host reliability is a separate matter, addressed by the SRE audit.