Audit journey

Everything an auditor needs from Pavois in one path: the evidence, the scoring method, the signed bundle, the trust model, the reboot proof, the OSCAL export, the benchmark and the stated limits.

1. See a real report

A real scan on a Debian 13 VM (anonymized): grade, per-severity counts, rules grouped by chapter, filters, plus the before/after campaign report with its transition matrix.

Open →

2. Understand the verdict

Every control declares its evidence type (effective-runtime, persistent-config, inventory-state, filesystem-state) and whether it is reboot-survivable, so a PASS states exactly what was measured and how durable it is.

Open →

3. Read the score

A published formula: failure-weighted by severity, capped per severity, a single critical caps the grade, runtime-only passes cap A to B. No black box, the grade is reproducible.

Open →

4. Take the evidence bundle

The bundle command packages the before/after scans, the applied plan, the reports, the reboot proof and a manifest + checksums into a tamper-evident bundle, verified offline.

Open →

5. Check the trust model

Tamper-evident vs signed: who signs, which identity is accepted, key rotation and revocation, offline verification and retention. A bundle is opposable only once signed under a policy you accept.

Open →

6. Export to OSCAL

The neutral rule corpus publishes as an OSCAL catalog + profiles (the NIST machine-readable format) for your GRC tooling, so the same controls flow into your compliance stack.

Open →

7. Trust the comparison

A reproducible benchmark vs OpenSCAP and Lynis on a fresh Debian 12 VM: exact versions, the drop-in scenario, an honest no-edge case, and the coverage gap with oscap’s own verdicts.

Open →

What Pavois does not prove

Pavois grades an effective-configuration posture, not runtime behaviour. A green grade is a hardened configuration, not an intrusion scan: an in-memory implant, a zero-day, live network intrusion or abuse of legitimate access stay out of scope. Pair it with the shipped auditd logs and an EDR/IDS. Full limits.