Audit journey
Everything an auditor needs from Pavois in one path: the evidence, the scoring method, the signed bundle, the trust model, the reboot proof, the OSCAL export, the benchmark and the stated limits.
1. See a real report
A real scan on a Debian 13 VM (anonymized): grade, per-severity counts, rules grouped by chapter, filters, plus the before/after campaign report with its transition matrix.
Open →2. Understand the verdict
Every control declares its evidence type (effective-runtime, persistent-config, inventory-state, filesystem-state) and whether it is reboot-survivable, so a PASS states exactly what was measured and how durable it is.
Open →3. Read the score
A published formula: failure-weighted by severity, capped per severity, a single critical caps the grade, runtime-only passes cap A to B. No black box, the grade is reproducible.
Open →4. Take the evidence bundle
The bundle command packages the before/after scans, the applied plan, the reports, the reboot proof and a manifest + checksums into a tamper-evident bundle, verified offline.
Open →5. Check the trust model
Tamper-evident vs signed: who signs, which identity is accepted, key rotation and revocation, offline verification and retention. A bundle is opposable only once signed under a policy you accept.
Open →6. Export to OSCAL
The neutral rule corpus publishes as an OSCAL catalog + profiles (the NIST machine-readable format) for your GRC tooling, so the same controls flow into your compliance stack.
Open →7. Trust the comparison
A reproducible benchmark vs OpenSCAP and Lynis on a fresh Debian 12 VM: exact versions, the drop-in scenario, an honest no-edge case, and the coverage gap with oscap’s own verdicts.
Open →What Pavois does not prove
Pavois grades an effective-configuration posture, not runtime behaviour. A green grade is a hardened configuration, not an intrusion scan: an in-memory implant, a zero-day, live network intrusion or abuse of legitimate access stay out of scope. Pair it with the shipped auditd logs and an EDR/IDS. Full limits.