Sample report
A real Pavois report on a Debian 13 VM (data anonymized). Below: the before/after hardening campaign report, with the transition matrix.
Transition matrix
All 621 controls in the corpus, by state before and after. The table is published whole: adding up a subset does not reproduce the total, and a reader who checks is entitled to check.
| Before | After | Count | Meaning |
|---|---|---|---|
| passing | passing | 277 | already compliant, and stayed so |
| failing | passing | 243 | fixed by the hardening |
| not applicable | not applicable | 57 | not applicable to this host, either time |
| not applicable | passing | 33 | became applicable, and passed |
| not in the corpus | passing | 4 | added to the corpus between the two scans |
| failing | failing | 4 | not closed by hardening |
| failing | not applicable | 1 | stopped applying |
| passing | not in the corpus | 1 | removed from the corpus |
| passing | not applicable | 1 | stopped applying |
| Total | 621 | controls in the corpus | |
How the totals close
Two sums are worth writing out, because they are the ones a reader redoes mentally and gets wrong: the passing count after does not follow from the passing count before.
passing after = 277 + 243 + 33 + 4 = 557
(pass>pass, fail>pass, na>pass, absent>pass)
passing before = 277 + 1 + 1 = 279
(pass>pass, pass>absent, pass>na)The term a quick check misses is pass>pass: it is 277, not 279, because two controls that passed before left the passing set (one stopped applying, one was removed from the corpus).
Key results
| Before | After (post-reboot) | |
|---|---|---|
| Grade | E | B |
| Passing | 279 / 527 | 557 / 561 |
Campaign: 243 fixed, 33 newly applicable and passing, 4 still failing, 0 regression. The hardening CONVERGED (re-scan, re-plan, re-apply to a fixpoint): a single apply is not enough, it creates gaps it cannot itself see. Re-scanned after a real reboot (boot_id changed before/after), so the passes are reboot-proven. The whole thing is packaged and verifiable with pavois bundle verify (manifest SHA-256 + checksums).
Scan report
Open full screen ↗Campaign report (before / after)
Open full screen ↗The campaign report compares two scans, before and after a hardening round. It shows the grade delta and the transition matrix: every control’s state before and after (fixed, regressed, newly applicable, still failing). You reason in transitions, not a raw pass rate, because the applicable set grows when the baseline installs components (auditd, AIDE...). Regressions are surfaced first: that is what an auditor checks before anything else.