Attestrix
Audit evidence you can trace back to the exact data it came from.
Attestrix evaluates infrastructure telemetry against automated technical checks, maps each result to framework controls, and produces a summary, an HTML evidence dossier and a dashboard. Every report records the SHA-256 of the exact evidence file it read, so a finding can always be traced to its source.
Checks run against collected telemetry instead of manual captures.
Evidence that was not collected is Not Assessed, never Pass, and it counts against the score.
The same input always gives the same output.
Runs as a local service with offline license verification.
What Attestrix checks today
11 automated checks, evaluated from a telemetry file that Attestrix's read-only collectors produce or that you supply.
Encryption at rest
Volumes and disks encrypted, for example BitLocker fully on with protection enabled, or dm-crypt/LUKS on Linux.
Transport security
The lowest TLS version a service or server accepts.
Listening services
Which TCP services each machine exposes.
Firewall exposure
Internet-facing SSH, RDP, database and other non-web ports in Google Cloud firewall rules.
Backup recency
Whether backups exist and are recent enough.
MFA and audit logging
Multi-factor authentication enforced, and audit logging active (for example auditd on Linux).
Resource tagging
Owner, environment and classification tags present.
Read-only, agentless collection
Google Cloud
- Reads a project, folder or organization through Cloud Asset Inventory, using list calls only.
- Needs only the Cloud Asset Viewer role; no key files when run on a Google Cloud VM.
- Covers Compute Engine VMs and disks (labels, encryption, snapshot backups), HTTPS/SSL proxy TLS policies, project labels and Data Access audit logging.
Windows and Linux machines
- Hyper-V hosts, guest VMs and physical servers; nothing is installed on or written to them.
- Linux over your OpenSSH (key-based, host keys always verified, bastions supported); Windows over WinRM HTTPS, or PowerShell Direct through the Hyper-V host.
- Every listed machine appears in the report. One that was not reached has all its checks Not Assessed, and Hyper-V VMs missing from your list are flagged as possible scope gaps.
How it works
Collect
Run the read-only collectors or supply your own telemetry file.
Assess
The engine evaluates every check. Unknown or mistyped fields are rejected.
Map
Each result is mapped to framework controls such as SOC 2, ISO 27001:2022, HIPAA Security Rule, PCI DSS v4.0, NIST CSF 2.0 and CIS Controls v8.
Report
Get a summary, an HTML dossier and a dashboard, each carrying the hash of the evidence file.
Rules the engine follows
- Evidence that was not collected is Not Assessed, never Pass, and it counts in the score denominator. No input means no score.
- A check that cannot apply to a resource is Not Applicable, with the reason, and is excluded from the score.
- Each failed check is reported once, with all of its framework mappings.
- Results depend only on the input file, so the same input always gives the same output.
- The summary records the SHA-256 of the exact telemetry file evaluated.
Also included
Evidence ledger
Record policies and other evidence in a local hash-chained ledger, seal it, and verify it later against the files. Keep the seal somewhere else.
Questionnaire drafts
Draft answers to security questionnaires, using only your approved answer library and the latest assessment.
Readiness workspace
Track evidence and review gates on the way to a certification audit. It never makes a certification decision.
Self-hosted
Linux .deb and .rpm packages, a dashboard bound to the local machine only, and offline licence verification with Ed25519 signatures.
Not built yet
- AWS, Azure and vCenter connectors.
- Operating-system hardening checks such as password policy, patch level, SMBv1 and host firewall.
- AI answer generation, an auditor access portal, evidence packages and PDF export.
What the score means
Scores cover only the automated checks Attestrix runs. They are not an audit opinion or certification. Framework mappings have not yet been reviewed by an auditor and must be confirmed by yours.
Try Attestrix with your own data
See the sample demo first, then tell us about your environment. We agree the scope with you before anything is installed.