Linux Identity & Access Management
The Control Plane for Linux Identity
Every path to root in the unmapped Linux identity layer, mapped.
A single, continuously updated view of every privileged identity is what separates reactive response from proactive control — and it starts with what every identity can do on every host right now — including the access nobody remembers granting. Existing tools were built for endpoints and directories, not production Linux. LinuxGuard makes every one of them known, governed, and continuously assured.
The Linux Identity Control Plane — posture, intelligence and response in one place.
Most identity security tools manage directories. LinuxGuard manages the Linux layer beneath them — continuously assuring posture, detecting threats, and surfacing intelligence across every human, non-human, and service identity on your estate. Start with what counts as a non-human identity on Linux, then what identity visibility means in practice.
ISPM
Continuous scoring across human accounts, service identities, SSH keys, sudo policies, and PAM configs — 22 weighted risk signals, continuously updated.
Response
Ranked findings, severity-scored and attributed to the identity behind them, contained rather than merely alerted — lock an account, terminate a session, revoke sudo, behind an approval gate — built for the Linux threat surface, not adapted from it.
Identity intelligence
Every identity, relationship, privilege path and configuration across your Linux estate, mapped — and fed into your broader IAM stack.
Identity Intelligence
Every Path to Root, Mapped
Production Linux is full of identity blind spots — SSH keys unrotated for years, orphaned accounts that outlive their owners, and over-privileged service accounts no one is watching.
Existing tools never map how identities relate — so one stolen low-level credential plus a forgotten sudo rule can become full root in seconds, with nothing in the way.
LinuxGuard maps your whole identity estate into one live view and cuts hidden privilege paths before attackers can exploit them — shrinking blast radius.
How it works
- Privilege Exposure Mapping — See exactly which identities can escalate to root on every server.
- Dormant and At-Risk Accounts — Surface inactive or over-privileged accounts before attackers find them.
- Per-Identity Timelines — Reconstruct exactly what any identity did — logins, sudo commands, config changes and session duration.
- Per-Node and Per-Pod Inventory — Inventory runs per node and per pod, including projected service-account tokens with their audience and expiry, and mounted secrets, so the credentials a workload can reach are known before an incident. Events carry the container they came from.
Non-Human Identity Posture
Know What Every Service Account Can Do — Including the Ones Agents Use
Service accounts, CI runners and machine credentials multiply faster than any review can track, and most have no named owner and no known credential age. AI agents authenticate as service accounts, so they are in this population whether or not anyone has listed them.
Because standard tooling never inventories this layer, an over-permissioned service account — or an agent acting through one — persists unseen, with nothing to say what it can reach on which host.
LinuxGuard inventories every non-human identity continuously — mapped to its owning team, purpose and credential age, alongside the human accounts — so the agent surface is a governed list, not a blind spot.
How it works
- NHI Classification — Every service account and machine credential identified and classified, human and non-human side by side.
- Ownership & Credential Age — Map each service account to its owning team and purpose, with the age of its credential.
- Service Accounts as the Agent Surface — Agents authenticate as service accounts. On a Linux host an agent is a service account — inventoried, scored and attributed like any other.
- Agent Runtime & MCP Server Discovery — Every agent runtime and MCP server is discovered as a first-class identity, with the credentials, privilege paths and files it can reach and a blast-radius score.
- Per-Tool Policy at the MCP Boundary — Per-tool, per-identity policy applies at the MCP boundary — which tools an agent identity may call, enforced where the call is made.
- Launcher Attribution — Each agent is tied to the systemd unit, cron job or shell that launched it.
- Exec-Confirmed Sightings — Agent sightings are confirmed from exec events; a runtime unseen for 30 days is marked stale and leaves the access graph; its record is kept.
- Per-Agent Enforcement — Exec and file denial can be scoped to a single agent, with a kill switch.
- Log-First MCP Gateway — The MCP gateway logs first and enforces only when a tenant switch is turned on, and every call is audited without its arguments.
- Gateway Bypass Finding — MCP servers that bypass the gateway are flagged.
Just-in-Time and Agentic Access
Access That Expires — Including for AI Agents
Agents and pipelines hold standing credentials around the clock, in case they need them.
A standing credential can be harvested and reused, on every host it reaches.
LinuxGuard grants access for a window, behind an approval or a policy, and cleans it up at expiry.
Product screenshot — coming soon
How it works
- AI-Agent Identity Type — An AI-agent identity type with just-in-time access forced on, and registration approved in the console.
- Approval-Gated Access Requests — Access requests are authenticated by workload-bound tokens that last 15 minutes, behind an approval-or-policy gate. The 15 minutes covers the request; the access window is set separately.
- Signed, Time-Boxed Key Windows — Signed, time-boxed key windows with cleanup at expiry, plus per-agent rate limits and anomaly alerts.
- Just-in-Time Modes, Sudo and SSH Certificates — Just-in-time modes per server or tag, time-boxed sudo grants, and short-lived SSH certificates.
Risk Scoring
Know Exactly Which Accounts Put You at Risk — and Why
Teams inherit thousands of Linux accounts with no way to tell which matter — sudo config, key hygiene, and behaviour all bear on risk, but nothing captures them together.
Without a defensible way to rank exposure, the most dangerous accounts hide in the noise — and every "why is this risky?" question restarts a manual investigation.
LinuxGuard scores every account from 0 to 100, weighing every factor together and explaining itself inline — so your team knows exactly where to focus.
How it works
- Composite Risk Scores (0–100) — Every account scored on sudo config, auth methods, key status, and access patterns.
- Inline Score Explanation — Every score shows the specific factors driving it — no unexplained numbers.
- Fleet-Wide Risk View — Rank all accounts by risk, filtered by server group, team, or environment.
SSH Key Posture
Close the Credential Gaps Other Tools Never Look At
SSH keys are the most overlooked access vector in Linux — they accumulate without ownership, outlive the people who created them, and get copied from host to host.
Because standard tooling never inventories this layer, weak keys and reused credentials persist unseen — each one a standing route in.
LinuxGuard inventories every SSH key continuously — graded for age, strength, reuse, and ownership — so hidden credentials become governed.
How it works
- SSH Key Inventory — Every authorised key on every server — age, algorithm, reuse, and ownership.
- Key Hygiene Grading — Flag weak algorithms, aged keys, and keys shared across accounts or servers.
File Security
Stop Guessing Who Touched Your Sensitive Files
Sensitive data — personal data, credentials, API keys — sits across your fleet with no consistent policy over who can open, copy, or move it, and no record tying access to an identity.
Without detection and enforcement at the file layer, one overlooked account can exfiltrate data for weeks — leaving incident response with no attribution and no audit trail.
LinuxGuard monitors sensitive files, detects personal data and secrets in the content it matches, and flips from monitor to enforce — blocking the read, write or copy and terminating the actor’s session — every event tied to the identity behind it.
How it works
- Policy-Scoped Monitoring — Target paths, subjects, and action classes by server, tag, or environment.
- Personal Data and Secret Detection — Built-in and custom detectors flag personal data and credentials in matched files — scanning runs on your own server and file content never leaves it.
- Extraction & Exfiltration Detection — Catch bulk copies and outbound transfers (scp/sftp/rsync) on suspicious volume.
- Monitor-to-Enforce in One Click — Flip any policy from detection to real-time blocking, guarded by blast-radius limits. In enforce mode a read, write or copy by an actor outside policy is blocked and that actor’s session is terminated.
- Per-Actor Egress Control — Outbound connections are filtered per actor — account or process — against URL, IP and range policy. A destination the actor has no policy for is blocked.
Findings & Risk Signals
Turn Raw Noise into Ranked, Attributable Findings
Linux emits a constant stream of raw events — config changes, drift, denials — but events are not findings. Someone still must decide what matters and who did it.
Unranked, unattributed alerts drown real exposure in noise — analysts burn hours reconstructing who did what from scattered logs while what matters sits unactioned.
LinuxGuard surfaces ranked findings, each severity-scored and attributed to the specific identity responsible — priority and context in every finding.
How it works
- Severity-Ranked Findings — Every finding carries a severity so the highest-exposure items surface first.
- Configuration Drift Detection — Track changes to sudo, SSH, PAM, and access controls against an approved baseline — sudo drift detection, continuously rather than at the next review.
- Identity Attribution — Every finding names the identity behind the change — the person or service account responsible, not just the server it happened on. On Kubernetes, escalation and lateral-movement attempts carry pod and namespace attribution.
Automated Response
Resilient, Gated Security Operations
Legacy automation is all-or-nothing — teams are asked to trust a tool to act on production identities with no defined limits, so the safe choice becomes not automating at all.
One wrong automated action on a false positive can take down a payments pipeline — so fear of breaking production leaves fast-moving identity incidents to slow, manual response.
LinuxGuard acts on the identity itself — lock an account, terminate a session, revoke sudo, disable an SSH key, or revoke and re-scope an agent’s credentials — behind mandatory approval, with quarantine and automatic rollback. Session termination on a blocked file operation or egress attempt is the one automatic action, scoped to that actor.
How it works
- Mandatory Approval Gates — Approval gates and blast-radius limits sit in front of every containment action. The exception is session termination on a blocked file operation or egress attempt, which is automatic, scoped to the actor and takes under a second. For file-security violations, a per-severity auto-contain policy decides when containment triggers.
- Account and Session Controls — Lock accounts, terminate sessions, disable SSH keys, revoke sudo, or revoke and re-scope an agent’s credentials on demand — one approval, one audit entry. Revocation takes effect on the host within 90 seconds.
- Auto-Rollback — Locking an account, revoking sudo and disabling an SSH key all reverse automatically after four hours unless confirmed. Ending a session is immediate and cannot be reversed.
- Chain-Hashed Audit Trails — Every action recorded with its trigger, approver, and outcome in a chain-hashed, tamper-evident log.
- Signed Remediation Descriptors — Every remediation action is defined by an Ed25519-signed descriptor, so what runs on a host traces back to a signature rather than to an ad-hoc script.
- Script Safety Gating — Remediation scripts are checked at the abstract-syntax-tree level before they are allowed to run — parsed and analysed, not matched against a list of banned strings.
Compliance & Audit
Continuous, Audit-Ready Operational Efficiency
Every quarter — SOC 2, DORA, NIS2 — engineering and security halt real work to log into servers, write scripts, and pull evidence by hand, all for a single point-in-time snapshot.
Weeks of effort buy only a point-in-time snapshot — the rest of the quarter goes unevidenced, and a failed audit means fines, delayed contracts, and engineering friction.
LinuxGuard makes evidence collection an automated byproduct of operations — always-on posture, immutable audit trail, ready for regulators in minutes.
How it works
- Per-Identity Compliance Views — See which accounts are out of policy and why.
- Historical Trend Tracking — Show auditors continuous improvement with posture history over time. See what a first assessment found on a payments estate.
- Exportable Audit Evidence — Structured evidence packages for SOC 2 and ISO 27001, alongside NIS2 and DORA evidence packs.
CVE & Vulnerability Management
See What Is Exposed, Where — and Who Can Fix It
Vulnerability data and identity context live in separate worlds — scanners list CVEs with no sense of who can act, while identity tools cannot see what those systems run.
Disconnected from ownership, remediation stalls in hand-off — and patches slip while the window of exposure stays open.
LinuxGuard enriches a live package inventory with CVE data — affected-server lists show what is exposed, where, and who can fix it.
How it works
- Package and Service Inventory — Continuous discovery of every installed package and running service.
- CVE Enrichment — Every package matched against current CVE data — no manual lookups.
- Affected Server Lists — For any CVE, instantly see affected servers and package versions.
- Package-Manager-Aware Fix Guidance — Fix guidance produced from the package inventory on each host, for the package managers LinuxGuard supports.
Integrations
Identity Intelligence Where Your Team Already Works
Your team already lives in a SIEM, a ticketing queue, and collaboration channels — a tool that keeps its intelligence behind yet another login just adds a tab to check.
Findings trapped in a standalone console arrive late or not at all — response slows, tickets are opened by hand, and the richest identity context never reaches where decisions are made.
LinuxGuard pushes identity-centric findings straight into your SIEM, ticketing, and collaboration tools — so identity intelligence lands where the work already happens.
How it works
- SIEM Integration — Forward findings and identity events via webhooks, syslog, or Splunk HEC. Building a product or a managed service on this? See the partner programme.
- Ticketing and Collaboration — Auto-create Jira tickets; send alerts to Slack and Teams channels.
- Identity-Centric Dashboard — Cross-filterable identity metrics, privilege drift, and posture trends.
Know every identity. Respond to every risk.
LinuxGuard gives you complete, continuous visibility across your Linux estate. Start with a Founding Pilot and see your full identity posture within a week.