How It Fits Together

One Platform, plus independent standalone tools.

The AuditToolkit Platform is a single-licence, fleet-wide compliance suite of five core products covering asset discovery, audit execution, controlled remediation, and tamper-evident evidence packaging across your entire estate.

Further products are licensed independently — they are not part of the Platform, and each runs on its own with no Platform subscription required: AuditToolkit Lite (single-host auditing for Linux, Windows, and macOS — one licence covers all three host tools), the Hordian (distributed storage inventory), Meldian (agentless audit and remediation), and Taldian (infrastructure data ingestion). Each is its own product. The first three are priced and supplied separately; Taldian is governed by its own Business Source Licence terms and is not included in a Platform subscription.

AuditToolkit v1.1.8 Aldian v1.2.3 Ladian v1.2.5 Findian v1.2.7 Sothian Cunnian Borian Kithian Hordian Meldian v2026.3 Taldian v1.2.5

Complete Architecture

Producers feed a central platform

Each specialised tool operates independently as a satellite producer, can be deployed where it has the best access to its target infrastructure. The central AuditToolkit sees everything — and correlates, remediates, and packages evidence for the entire estate. The diagram below shows how the tools interoperate, not what a Platform licence covers: Taldian appears as a producer because it can feed the platform, but it is an independent product licensed separately.

Toolkit Structure

Main toolkit, sub-tools, and agent layers

The AuditToolkit is the core platform, with distinct sub-tools and agent models that support different deployment patterns across five products.

Layer	What it includes	Why it matters
Core platform	Web application, central workflow engine, and REST API (390+ endpoints)	Single control plane for findings, evidence, scheduling, and reporting
Audit script libraries	Linux scripts, Windows PowerShell scripts, and hypervisor audit scripts	Covers server, endpoint, and virtualisation audit scenarios in one platform
Agent execution layer	Standalone Agent, Fleet Agent, Hypervisor agent, plus Fleet Agent coordinator service	Supports single-host, fleet-scale, and hypervisor-native collection modes
Platform products	Aldian, Ladian, Findian, Sothian	Linux audit and reporting depth, asset governance context, switch exposure intelligence, and distributed execution — each covered by the same Platform subscription
Remediation and evidence	SuperAdmin-gated direct host remediation over SSH and WinRM. Secondary auth token required. Atomic rollback by execution ID. SHA-256 signed evidence packages with MANIFEST.json for auditor delivery.	Controlled change execution with full audit trail, rollback safety, and tamper-evident compliance evidence output.

Naming note: older references to Managed Agent and Lightweight Agent map to Fleet Agent and Standalone Agent in current docs.

Tool Map

What each tool does

Each product is purpose-built, but designed to interoperate in one governance and operations model.

Taldian

Ingestion and normalisation layer

✓40+ integrations across cloud, network, identity, and enterprise systems.
✓Agents for Windows (.NET 8), Linux (Go), macOS, BSD, and containers.
✓Dual-mode operation: standalone CMDB or integrated feeder to core platform.
✓Canonical payload contract (schema_version 2026.05.1) for normalised asset and vulnerability records.
✓Dead-letter queue with retry and backoff for reliable delivery.

View Taldian

AuditToolkit

Audit operations and evidence layer

✓Audit coverage across Windows, Linux, macOS and hypervisors, detailed in the coverage matrix.
✓Automated remediation across Linux, Windows, and hypervisors, with approval gating and rollback.
✓Integrated asset discovery with CVE and KEV correlation per asset.
✓SuperAdmin-gated remediation with secondary auth, dry-run preview, execution history, and rollback by execution ID.
✓Seven SIEM integrations and ticketing integrations for operational workflows.
✓SHA-256 signed auditor-ready evidence packages.

View AuditToolkit

Aldian

Linux audit and reporting platform

✓Linux audit coverage across 12 control domains: platform, apps, advanced-controls, security, data, network, cloud, storage, automation, web, virtualization and Alpine.
✓Versioned control catalogue with stable ID lock and CI guard enforcement.
✓Control plane contract v1 for result ingest and export operations.
✓Idempotent outbound queue with dead-letter and replay support.
✓SIEM webhook push and GitHub issue creation from audit findings.
✓RHEL, Debian, Ubuntu, SLES, Alpine, Arch, and openSUSE support.

View Aldian

Ladian

Asset intelligence and enrichment layer

✓Auto-discovery across hypervisor and cloud environments.
✓CVE and KEV vulnerability context per asset.
✓Offline MSI for air-gapped and restricted environment deployment.
✓CMDB-aligned data normalisation and enrichment.
✓Windows and Linux agent-based collection.

View Ladian

Findian

Network switch exposure operations layer

✓Cisco IOS-XE/NX-OS, Juniper JunOS, Arista EOS, Aruba AOS-CX, and Dell OS10 live API-backed collection.
✓SAN connector scaffolding for Brocade and Cisco MDS.
✓CVSS, KEV, and remediation state per device and firmware version.
✓Advisory automation with external scheduler model.
✓Customer-provided vendor feed credentials for gated advisory access.

View Findian

Execution Layer

Sothian

The distributed execution backbone of the platform. The Sothian runs audit scripts across large host inventories in parallel — local or remote — and delivers cryptographically signed evidence bundles to the central platform. It is the execution layer that makes fleet-scale auditing reliable and tamper-evident.

Distributed & Parallel Execution

✓Executes PowerShell and shell scripts across hundreds of hosts simultaneously with configurable concurrency
✓JSON-based host inventory for structured, repeatable execution across named host groups
✓Separate dev, test, and production environment profiles — one node, multiple configuration contexts
✓Standalone web UI for execution control, schedule management, and report viewing

Remote Execution & Signed Evidence

✓Remote execution via SSH (Linux) and WinRM (Windows) with full credential management — no persistent agent required
✓Every evidence bundle is HMAC-signed with SHA-256 checksums on every artifact before leaving the host
✓Bundle verification — any bundle can be independently verified against its manifest at any time
✓Historical run tracking preserves every audit execution for trend comparison and audit defence

AuditToolkit Lite

Standalone Host Auditing — No Platform Required

A separate product family for single-host security auditing. Each tool is self-contained, requires no central server, and produces structured findings, a Hardening Index, and a human-readable HTML report entirely on-device. Designed for consultants, small teams, pre-deployment host checks, and air-gapped environments.

🐧

Cunnian

DEB / RPM · Python 3.9+ · CLI

✓Debian 11+, Ubuntu 20.04+, Rocky 9, AlmaLinux 9, Oracle Linux 9.
✓Read-only checks — no system changes during audit.
✓JSON + CSV + HTML output. OS python3-cryptography only — no pip install, no network at run time.
✓Online activation or signed offline licence import.

View Documentation

💻

Borian

MSI · PowerShell 7 · CLI + GUI

✓Windows 10 (1903+), Windows 11, Server 2019+.
✓MSI installer with optional WinForms GUI launcher.
✓JSON + CSV + HTML output per run.
✓Online activation or signed offline licence import.

View Documentation



Kithian

DMG / PKG · Python 3.10 · CLI + Web viewer

✓macOS Catalina (10.15) or later. DMG or PKG install.
✓Local web viewer on port 8766 for browser-based report review.
✓JSON + HTML output. Online or offline licence activation.
✓Gatekeeper approval required for pre-release builds.

View Documentation

When to use Lite vs Enterprise Suite: Use the Lite Toolkit for individual host posture checks, consultant engagements, or environments where deploying a full platform is not warranted. Use the Enterprise Suite when you need fleet-wide audit coverage, a central findings platform, remediation workflows, and tamper-evident evidence packaging. Full Lite Toolkit overview →

Licensing: AuditToolkit Lite is a separate add-on, sold independently of the Platform licence. One annual licence (£4,999/year) activates all three host tools.

View Pricing Product Overview View Documentation

Hordian

Distributed Storage Inventory — Sold Separately

A standalone product, licensed and priced independently of the AuditToolkit suite. Lightweight agents run on each storage node and publish results to a self-hosted control plane — distributed file inventory, classification, and change-tracking across RHEL, Ubuntu, Lustre, GPFS, ZFS, and Windows Server, with no cloud dependency.

Incremental by design

The first scan establishes a baseline; every subsequent scan only processes new, modified, or deleted files. Large NAS, Lustre, and ZFS filesystems complete in minutes with no measurable I/O impact on production workloads.

Agents survive server outages

Agents always initiate the connection and never block on server availability. If the control plane is unreachable, scan jobs complete locally and results are held until the connection resumes — no lost data, no missed scan windows.

Air-gap and offline ready

Docker images for the server and agent ship as loadable tarballs. The agent auto-update mechanism serves packages from a local path with SHA-256 verification — no external package repository required at run time.

Licensing: BSL 1.1 — free up to 10 nodes with no expiry. Paid tiers extend to 50, 200, or unlimited nodes (£995–£8,500/year) via key activation.

View Pricing View Documentation Product Overview Release Notes

Meldian

Agentless Audit & Remediation — Sold Separately

A standalone product, licensed and priced independently of the AuditToolkit Platform. Meldian audits and remediates assets agentlessly over SSH, WinRM, SNMP, and API — attach a connection profile to each node, run scheduled audits, and review findings, drift, and trends, with approval-gated remediation and rollback. Nothing to install on the target hosts.

Agentless by design

Reach Linux, Windows, network, and API targets over their native protocols — no agent to deploy, package, or maintain on the assets under audit. A node becomes managed the moment a connection profile is attached.

Audit, drift, and remediation

Scheduled audits feed a dashboard of findings, trends, and configuration drift. Remediation is approval-gated with atomic rollback, so changes stay controlled and fully auditable.

Per-node-band licensing

Licensed by connected-node band — a flat annual price up to the node count in your tier. SSO, scheduled audits, and reporting are included from the free tier; air-gapped offline licensing is available on higher tiers.

Licensing: BSL 1.1 — free Starter tier up to 5 connected nodes, no key required. Paid tiers extend to 25, 100, 500, or 2,500 nodes (£349–£11,900/year) via key activation.

View Pricing Release Notes

Use-Case Matrix

Which tool to use for what

Primary indicates the main owning tool. Supporting indicates where companion tooling adds value.

Use Case	Primary Tool	Supporting Tool(s)	Typical Output
Infrastructure data intake and connector polling	Taldian	Ladian	Normalised inventory + vulnerability-linked records
Audit finding lifecycle and remediation tracking	AuditToolkit	Aldian	Findings queue, evidence reports, closure records
Direct host remediation with atomic rollback	AuditToolkit	SuperAdmin remediation APIs	Execution history, rollback records, change evidence
Asset discovery with CVE and KEV correlation	AuditToolkit (native asset discovery)	Taldian	Normalised asset records with CVE and KEV risk context
Linux hardening and compliance control verification	Aldian	AuditToolkit	Control-level pass/fail evidence and reports
Asset governance and command-centre views	Ladian	Taldian	Asset context dashboards and enrichment state
Compliance evidence packaging for review	AuditToolkit	Aldian, Taldian	Evidence exports for internal/external assurance
Switch firmware advisory and network exposure tracking	Findian	Taldian, Ladian	Switch-centered exposure reports with CVE and advisory context
Storage inventory and classification for RHEL / Ubuntu / Lustre / GPFS	Hordian	AuditToolkit	Timestamped file inventory, classification breakdown, migration delta reports
Single-host Linux posture check — no platform deployment	Cunnian	—	Local JSON + CSV + HTML with Hardening Index
Single-host Windows posture check — no platform deployment	Borian	—	Local JSON + CSV + HTML with Hardening Index
Single-host macOS posture check — no platform deployment	Kithian	—	Local JSON + HTML with Hardening Index and web viewer

Operational Flow

How they fit in one lifecycle

The tools are designed as an operational chain, not isolated silos.

1. Discover and collect

Taldian and asset discovery gather host, software, and network inventory. CVE and KEV context are applied per asset.

2. Enrich and contextualise

Ladian layers governance context, ownership, and lifecycle visibility. Findian adds network infrastructure posture.

3. Audit and validate

AuditToolkit runs audit workflows and Aldian adds deeper Linux control verification.

4. Remediate

SuperAdmin-gated direct host remediation over SSH and WinRM with secondary auth and dry-run preview before every execution.

5. Validate and roll back

Post-remediation validation with automatic or manual rollback by execution ID when outcomes are not compliant.

6. Evidence and improve

SHA-256 signed evidence packages, SIEM export, trend analysis, and compliance trajectory reporting for continual improvement.

Start Paths

Start by role

Quick entry points for teams that need an immediate operating path.

Security Operations

✓Start with AuditToolkit for findings and evidence workflows.
✓Add Aldian for deeper Linux control verification.

IT Operations / CMDB Teams

✓Start with Taldian for connector-based intake.
✓Add Ladian for enriched command-centre operations.

Governance / Compliance

✓Use AuditToolkit as the evidence and reporting control point.
✓Pull supporting control outputs from Aldian and CMDB data sources.

Network Security Operations

✓Start with Findian for switch-focused advisory and CVE workflows.
✓Integrate with Taldian and Ladian for broader estate context.

Standalone / Consultant

✓No platform needed — install Cunnian, Borian, or Kithian directly on the target host.
✓Activate with a licence key, run an audit, review the HTML report. Air-gap and offline licence supported.

Deployment Models

How to deploy by operating pattern

Mode	Description	Best for
Single-host (Standalone Agent)	Core platform plus Standalone Agent on one machine. Local dashboard, local findings, and no coordinator required.	Small environments, evaluation, developer workstations
Fleet (Fleet Agent + Coordinator)	Fleet Agent deployed to target hosts with a coordinator service for centralised collection and reporting.	Multi-server environments and recurring scheduled audits
Hypervisor-native	Hypervisor agent for ESXi, KVM, Nutanix, Proxmox, and Xen with audit scripts run against hypervisor layers directly.	Virtualisation estate audit and compliance
Air-gapped / offline	Offline MSI installers with no outbound internet requirement and agent deployment without external connectivity.	Financial services, healthcare, government, and defence supply chain
CI/CD integration	Aldian with AUDIT_SKIP_LICENSE_CHECK for pipeline use, stable control IDs, and JSON/CSV outputs with GitHub issue creation.	DevSecOps, developer workstations, and pipeline gates

One Platform, plus independent standalone tools.

Producers feed a central platform

Main toolkit, sub-tools, and agent layers

What each tool does

Taldian

AuditToolkit

Aldian

Ladian

Findian

Sothian

Distributed & Parallel Execution

Remote Execution & Signed Evidence

Standalone Host Auditing — No Platform Required

Cunnian

Borian

Kithian

Distributed Storage Inventory — Sold Separately

Incremental by design

Agents survive server outages

Air-gap and offline ready

Agentless Audit & Remediation — Sold Separately

Agentless by design

Audit, drift, and remediation

Per-node-band licensing

Which tool to use for what

How they fit in one lifecycle

1. Discover and collect

2. Enrich and contextualise

3. Audit and validate

4. Remediate

5. Validate and roll back

6. Evidence and improve

Start by role

Security Operations

IT Operations / CMDB Teams

Governance / Compliance

Network Security Operations

Standalone / Consultant

How to deploy by operating pattern

Need help designing your rollout path?