LinuxGuard

LinuxGuard is a Linux identity security platform. It discovers and continuously monitors the identities and privileges on Linux hosts (user accounts, groups, sudo rules, SSH keys, PAM configurations and service accounts) and maps the privilege paths that lead to root. These artefacts sit below the layer that SIEM, EDR and cloud IAM tools inspect, so privilege built up through years of deployments, migrations and emergency fixes often goes unrecorded. LinuxGuard is aimed at security, IAM and Linux infrastructure teams, with a focus on regulated sectors such as finance, critical national infrastructure, and pharma and healthcare.

Key Features

• Identity intelligence: Privilege exposure mapping shows which identities can escalate to root on each server. Dormant and over-privileged accounts are flagged, and per-identity timelines record logins, sudo commands and configuration changes.
• Non-human identity posture: Service accounts and machine credentials are classified and mapped to owning team, purpose and credential age. AI agent runtimes and MCP servers are discovered as identities, each with a blast-radius score.
• Risk scoring: Every account receives a 0–100 score based on sudo configuration, authentication methods, key status and access patterns, with the contributing factors shown alongside the score.
• SSH key posture: Authorised keys on every server are inventoried and graded for age, algorithm strength, reuse and ownership.
• Drift detection and findings: Changes to sudo, SSH, PAM and access controls are tracked against an approved baseline. Findings are severity-ranked and attributed to the responsible identity, including pod and namespace on Kubernetes.
• Just-in-time access: Time-boxed sudo grants, short-lived SSH certificates and approval-gated access for AI agents, removed at expiry.
• File security: Sensitive files are monitored, with personal data and secret detection run on the host; file content does not leave the server. Policies can be switched from monitoring to enforcement to block out-of-policy file access and outbound transfers.
• Automated response: Accounts can be locked, sudo revoked, SSH keys disabled or sessions ended behind mandatory approval gates. Lock, revoke and disable actions roll back automatically after four hours unless confirmed, and all actions are written to a chain-hashed, tamper-evident audit log.
• CVE management: A live package inventory is matched against CVE data to list affected servers and provide fix guidance.
• Integrations: Findings forward to SIEMs via webhooks, syslog or Splunk HEC; Jira tickets are created automatically; alerts go to Slack and Microsoft Teams.

Compliance
LinuxGuard provides continuous scoring against 17 frameworks, including NIS2, DORA, SOC 2, ISO 27001, PCI DSS, NIST, CIS Benchmarks, HIPAA, FedRAMP and CMMC 2.0, with exportable evidence packs for audits.

Platform Support
LinuxGuard is a Red Hat Certified Technology (RHEL, CentOS Stream, Fedora), SUSE Ready certified, and Validated with Ubuntu. It covers multiple Linux distributions across bare metal, containers, Kubernetes, devices, and on-premises, cloud and hybrid environments.

Customer Results
In a design partner deployment at a global payments firm (Q4 2025), LinuxGuard identified 247 orphaned accounts in a 412-server estate. After the first privilege map, the firm removed 83 NOPASSWD sudo rules.

Differentiators

• Built for the Linux host identity layer, not adapted from a Windows-first agent or cloud-first scanner.
• Treats AI agents as service-account identities, inventoried and scored alongside human accounts, with per-tool policy enforced at the MCP boundary.
• Containment actions are gated by approval, blast-radius limits and automatic rollback.
• Developed by practitioners with backgrounds at Mastercard, EY, UBS, Lonza and UK Government agencies.