Linux Access Control Evidence for SOC 2 and ISO 27001
Deploy keys, CI runners, service accounts and the SSH keys of engineers who left last quarter have built paths to root across production Linux. Those paths live on the host, outside what SIEM, EDR and cloud IAM were designed to inspect, and automation and AI agents now use them at the speed of your pipeline. SOC 2 and ISO 27001 already ask who holds that access. LinuxGuard keeps a live map of it, human and non-human, flags changes as they land — and turns the buyer security review into a document you already have.
Sample console. Every figure shown is illustrative, not from a live estate.
How paths to root build up on a production fleet
Entitlement spread on a production fleet: eight common situations, and what LinuxGuard does about each.
Non-human identities nobody owns
Machine identities, including AI agents, outnumber human identities 109 to 1 (Palo Alto Networks, 2026 Identity Security Landscape). On a production fleet that is CI runners, deploy users and service accounts. LinuxGuard classifies every account as human or non-human and attaches the keys and sudo grants each one holds and the hosts it can reach, so the runner with root on every box shows up in the ranking rather than in the incident.
SSH keys that outlive the engineer
Offboarding removes the identity-provider account; the authorised_keys entry stays, and SSH key sprawl is what accumulates. LinuxGuard inventories every key on every host, graded for algorithm strength, reuse across hosts and accounts, and whether it still belongs to anyone — and lets you disable a key from the console, quarantined with automatic rollback if something depended on it.
The sudo grant that shipped with a hotfix
A NOPASSWD rule added to get a deploy through at midnight is now permanent. LinuxGuard tracks sudoers, SSH and PAM configuration against an approved baseline, surfaces the change in near-real-time and attributes it to the identity that made it, then pushes the finding to the channels and queues your team already lives in over webhooks, syslog or Splunk HEC.
Pipelines and AI agents that log in as service accounts
The deploy pipeline, the observability stack and, increasingly, AI agents writing and shipping code all log in as service accounts and inherit whatever reach those accounts have built up in production. LinuxGuard shows what each service account can do on each host, ranks the ones with a path to root, and flags the moment that reach changes, so the automation’s blast radius is known before something uses it. LinuxGuard also discovers the agent runtimes themselves, each tied to the unit, cron job or shell that launched it.
Agents and runners holding standing credentials
A CI runner or an AI agent that keeps a key around the clock holds standing access between jobs as well as during them. LinuxGuard replaces it with short-lived request tokens and time-boxed access that is cleaned up at expiry.
Blast radius in an incident
When a credential leaks, the identity graph shows which accounts can escalate to root on which hosts. Triage starts from the identity rather than from grepping logs, and a gated action cuts the path.
The enterprise deal blocked on the security questionnaire
When a buyer asks to see your access controls for production, you answer from a live inventory scored against SOC 2 and ISO 27001. A document you send, not a project you run before the deal can close.
Guardrails, not gatekeepers
Nothing blocks a deploy. Discovery is lightweight and read-only and changes nothing in your authentication flows, and response actions only run when an engineer approves them, with automatic rollback. Time-boxed access, just-in-time cleanup, central sudo and SSH certificates do change access, on the servers where you switch them on. It runs where your fleet runs: Ubuntu LTS, Debian, RHEL and SLES, on-premises, cloud or hybrid.
Discovery is read-only and connects outwards only, with nothing changed in your authentication flows; time-boxed access, central sudo and SSH certificates change access only where you switch them on. Otherwise, only an approved response action alters a host. Installation adds a signed package repository, a service account and a monitoring sensor; the documentation lists every change. Nothing in the installation blocks existing security patching.
How the pilot runsBy the numbers
The fleet the access review does not see
non-human to human identities
of breaches involved stolen or misused credentials
of enterprise attacks use no malware
days, fixed scope, four phases
Palo Alto Networks 2026 · Verizon DBIR 2025 · CrowdStrike 2025 Global Threat Report
Non-human identity postureWhat changes in the business
LinuxGuard is the control plane for Linux identity. On a SaaS fleet, that means:
- Deals close faster. The buyer security review answered from evidence you already have, mapped to SOC 2 CC6 and to ISO 27001:2022 A.5.15 and A.8.2.
- Offboarding you can prove. Every leaver’s residual access — keys, local accounts, sudo — surfaced and removable, with the removal recorded in a chain-hashed, tamper-evident audit log.
- Fewer standing keys and grants in production. Shared keys, root-capable runners and permanent NOPASSWD rules ranked by exposure and cut back.
- Incidents triaged from the identity, not the log. Who can reach what, right now, per host — and a reversible action, behind an approval, to contain it.
Where the evidence lands
When the SOC 2 examiner or the ISO 27001 certification auditor asks, this is where the same inventory answers them.
| Article / Requirement | What It Mandates | How the Founding Pilot Covers It |
|---|---|---|
| SOC 2 CC6.1 | Logical access security — restrict access to authorized users | Inventory of users, groups, sudo rules, SSH keys, and PAM configuration across production Linux with privilege path mapping |
| SOC 2 CC6.2 | Provisioning and de-provisioning of access | Detection of orphaned accounts and stale access from joiner/leaver churn on production systems |
| SOC 2 CC6.3 | Restrict privileged access and review it | Evidence supporting privileged-access review, including sudo grants and non-human identity classification |
| ISO 27001:2022 A.5.15 | Access control | Governance state of access control across the Linux fleet, risk-scored for remediation |
| ISO 27001:2022 A.8.2 / A.8.15 | Privileged access rights and logging | Privileged-account and SSH-key assessment with audit-trail coverage for privileged actions |
Frequently Asked Questions
Will this get us through our SOC 2 examination on its own?
We have thousands of service accounts and CI credentials. Can you handle non-human identities?
We run on Kubernetes. Does this cover our workloads?
Will this slow down our production fleet or block deploys?
Does it fit the tooling we already have?
How long does the SaaS pilot take?
Related solutions
The practitioner view — fleet-wide SSH key inventory, non-human identity classification and sudo mapping, which is what turns an access review from a manual scramble into a standing artefact.
Explore the Features
The product behind the pilot — least-privilege access control and compliance posture for Linux infrastructure, once the pilot has told you where you stand.
View Security & Compliance
For when SOC 2 and ISO 27001 stop being the only two — how one Linux identity evidence set maps across the frameworks a growing SaaS business picks up.
View Regulated Industries
Further reading: Non-human identity on Linux — the 109:1 ratio and access reviews.
Ready to see every path to root in production?
Start the pilot on your production Linux fleet: every human and non-human identity mapped, every change flagged — and the access-control evidence SOC 2 examiners and ISO 27001 auditors test produced from the same inventory.