The sudo rule you forgot about is the one attackers will find first.

The €24,000 Q2 rate (€36,000 standard) covers a 28-day fixed-scope engagement delivered by Linux-native identity specialists — not generalist consultants billing hourly. You get a complete privilege map across every server, sudo rule, SSH key, PAM module, and service account; an audit-ready evidence pack mapped to SOC 2, NIS2, DORA, and CIS; and a continuous drift detection baseline. Manual reviews of an estate this size typically consume 200–400 internal hours and still miss orphaned accounts and privilege creep — at a fully-loaded cost well above the audit fee. Identity-first security for Linux pays for itself the first time it surfaces a NOPASSWD rule that should never have shipped.

Everything: 28 days of expert engagement, the full identity inventory across users, groups, sudo rules, SSH keys, PAM stacks, and service accounts; a privilege drift report identifying orphaned accounts and least-privilege violations; a compliance evidence pack mapped to SOC 2 CC6, NIS2 Art. 21, DORA, and CIS Linux benchmarks; remediation prioritisation; and a final readout with your team. There are no per-server fees, no add-on modules, and no project-management overhead — your total time commitment across all four phases is ~5 hours. We handle everything else.

No. The audit is read-only — we collect identity artefacts (sudoers files, SSH keys, PAM stacks, group memberships, service-account inventories) using lightweight, signed collection scripts that you review and run. There are no agents to deploy, no kernel modules, no changes to authentication flows during discovery. Production traffic, application performance, and authentication latency are unaffected. Continuous drift detection runs out-of-band against the same artefacts. Your total time commitment across all four phases is ~5 hours — guardrails, not gatekeepers. We handle the rest.

That's the most common starting point — and the highest-value one. First-time engagements typically surface the largest pool of orphaned accounts, NOPASSWD sudo rules, shared SSH keys, and privilege creep, because nothing has ever been mapped before. We bring a Linux-native methodology, a fixed-scope 28-day plan, and an evidence pack mapped to SOC 2 CC6, NIS2 Art. 21, DORA, and CIS Linux benchmarks. You get identity visibility and least-privilege baselines from day one — no prior audit history required, no spreadsheets to retrofit. Identity-first security for Linux starts with what you already run.

All data collected during the audit — sudo rules, group memberships, SSH key fingerprints, PAM configurations — is encrypted using TLS 1.3 in transit and AES-256 at rest. Data is processed in isolated, access-controlled environments with strict need-to-know access. We do not retain raw configuration data beyond 90 days post-engagement, and we can execute a formal data destruction certificate on request. Our process is aligned with GDPR Article 5 data minimisation and purpose limitation principles. We collect only what is necessary to map identity and privilege risk — we do not collect passwords, private keys, or application data.

The core audit scope is Linux host identity and privilege — the OS-level users, groups, sudo rules, SSH keys, and service accounts that persist regardless of what runs on top. Container runtimes (Docker, Podman) and Kubernetes node-level access are in scope where they are managed through Linux identity mechanisms. However, Kubernetes RBAC, service mesh policies, and pod-level security contexts are treated as a separate engagement scope. If your environment is heavily containerised, we recommend scoping a dedicated Kubernetes identity review as a follow-on to the Linux host audit.

The audit is led by Peter Cummings, who has over 20 years of IAM and security architecture experience at Mastercard, EY, UBS, Lonza, and UK Government agencies. Peter has designed and reviewed identity governance programmes for financial services firms subject to DORA, SOC 2, and FCA requirements, and has delivered Linux identity audits for mid-market CISOs across the UK and Europe. LinuxGuard's methodology is informed by CIS Benchmark Level 2, NIST SP 800-53, and the PTES (Penetration Testing Execution Standard) privilege escalation checks — adapted for defensive architecture rather than active exploitation.

The engagement closes with a structured handoff: all five deliverables are transferred to your team with a walk-through session, and we provide 30 days of post-delivery Q&A support at no additional charge. You own all deliverables outright — there is no lock-in. Optional follow-on services include a quarterly compliance review, a targeted re-audit of specific risk areas after remediation, or deployment of the LinuxGuard continuous monitoring platform for ongoing privilege drift detection between annual audits. None of these are required — the audit is designed to be standalone and actionable without ongoing engagement.