Home/ Toolkit Overview

How It Fits Together

One Platform, plus independent standalone tools.

The AuditToolkit Platform is a single-licence, fleet-wide compliance suite of six core products covering asset discovery, audit execution, controlled remediation, and tamper-evident evidence packaging across your entire estate.

Three further products are sold and licensed independently — they are not part of the Platform, and each runs on its own with no Platform subscription required: AuditToolkit Lite (single-host auditing for Linux, Windows, and macOS — one licence covers all three host tools), the Storage Intelligence Platform (distributed storage inventory), and Litmus (agentless audit and remediation). Each is its own product, priced and supplied separately.

Audit Admin Toolkit v6.4.8 Linux Security Lite v1.1.4 CMDB API v0.2.11 Asset Command Centre v1.1.0 Switch Exposure Centre v1.0.3 Audit Assurance Node Linux Host Lite Windows Security Lite macOS Security Lite Storage Intelligence Platform Litmus v0.3.0

Complete Architecture

Producers feed a central platform

Each specialised tool operates independently as a satellite producer, can be deployed where it has the best access to its target infrastructure. The central Audit Admin Toolkit sees everything — and correlates, remediates, and packages evidence for the entire estate.

flowchart TB subgraph ControlPlane["Control Plane"] CC["Web Console"] API["API Layer"] end subgraph Tools["Audit Tools"] T1["Audit-Tool"] T2["Switch Exposure Centre"] T3["CMDB Data Collector"] T4["Linux Security Lite"] T5["Audit Assurance Node"] end subgraph Execution["Execution Methods"] AG["Fleet Agent"] SSH["SSH"] WINRM["WinRM"] SNMP["SNMP"] end subgraph Targets["Target Systems"] LINUX["Linux Hosts"] WINDOWS["Windows Hosts"] NETWORK["Network Devices"] end CC --> API API --> T1 API --> T2 API --> T3 API --> T4 API --> T5 T1 --> AG T2 --> AG T3 --> AG T1 --> SSH T1 --> WINRM T2 --> SNMP AG --> LINUX AG --> WINDOWS SSH --> LINUX WINRM --> WINDOWS SNMP --> NETWORK

Toolkit Structure

Main toolkit, sub-tools, and agent layers

The Audit Admin Toolkit is the core platform, with distinct sub-tools and agent models that support different deployment patterns across six products.

Layer What it includes Why it matters
Core platform Web application, central workflow engine, and REST API (390+ endpoints) Single control plane for findings, evidence, scheduling, and reporting
Audit script libraries Linux scripts, Windows PowerShell scripts, and hypervisor audit scripts Covers server, endpoint, and virtualisation audit scenarios in one platform
Agent execution layer Standalone Agent, Fleet Agent, Hypervisor agent, plus Fleet Agent coordinator service Supports single-host, fleet-scale, and hypervisor-native collection modes
Extension and companion tools Linux Security Lite, CMDB API Data Collection Tool, Asset Command Centre, Switch Exposure Centre Adds deeper Linux controls, ingestion/normalisation, and asset governance context
Remediation and evidence SuperAdmin-gated direct host remediation over SSH and WinRM. Secondary auth token required. Atomic rollback by execution ID. SHA-256 signed evidence packages with MANIFEST.json for auditor delivery. Controlled change execution with full audit trail, rollback safety, and tamper-evident compliance evidence output.
Naming note: older references to Managed Agent and Lightweight Agent map to Fleet Agent and Standalone Agent in current docs.

Tool Map

What each tool does

Each product is purpose-built, but designed to interoperate in one governance and operations model.

CMDB API icon

CMDB API Data Collection Tool

Ingestion and normalisation layer

  • ✓40+ integrations across cloud, network, identity, and enterprise systems.
  • ✓Agents for Windows (.NET 8), Linux (Go), macOS, BSD, and containers.
  • ✓Dual-mode operation: standalone CMDB or integrated feeder to core platform.
  • ✓Canonical payload contract (schema_version 2026.05.1) for normalised asset and vulnerability records.
  • ✓Dead-letter queue with retry and backoff for reliable delivery.
View CMDB API Tool
Audit Admin Toolkit icon

Audit Admin Toolkit

Audit operations and evidence layer

  • ✓1,019 audit scripts across Linux (500), Windows (503), and hypervisors (16).
  • ✓712 fix scripts: Linux (348 runnable), Windows (353), and hypervisors (11).
  • ✓Integrated asset discovery with CVE and KEV correlation per asset.
  • ✓SuperAdmin-gated remediation with secondary auth, dry-run preview, execution history, and rollback by execution ID.
  • ✓Seven SIEM integrations and ticketing integrations for operational workflows.
  • ✓SHA-256 signed auditor-ready evidence packages.
View Audit Admin Toolkit
Linux Security Lite icon

Linux Security Lite

Linux control depth extension

  • ✓500 Linux audit scripts across 11 domains: platform (140), apps (67), cloud (57), security (56), network (44), data (36), advanced-controls (24), automation (22), storage (23), web (25), Alpine (6).
  • ✓Versioned control catalogue with stable ID lock and CI guard enforcement.
  • ✓Control plane contract v1 for result ingest and export operations.
  • ✓Idempotent outbound queue with dead-letter and replay support.
  • ✓SIEM webhook push and GitHub issue creation from audit findings.
  • ✓RHEL, Debian, Ubuntu, SLES, Alpine, Arch, and openSUSE support.
View Linux Security Lite
Asset Command Centre icon

Asset Command Centre

Asset intelligence and enrichment layer

  • ✓Auto-discovery across hypervisor and cloud environments.
  • ✓CVE and KEV vulnerability context per asset.
  • ✓Offline MSI for air-gapped and restricted environment deployment.
  • ✓CMDB-aligned data normalisation and enrichment.
  • ✓Windows and Linux agent-based collection.
View Asset Command Centre
Switch Exposure Centre icon

Switch Exposure Centre

Network switch exposure operations layer

  • ✓Cisco IOS-XE/NX-OS, Juniper JunOS, Arista EOS, Aruba AOS-CX, and Dell OS10 live API-backed collection.
  • ✓SAN connector scaffolding for Brocade and Cisco MDS.
  • ✓CVSS, KEV, and remediation state per device and firmware version.
  • ✓Advisory automation with external scheduler model.
  • ✓Customer-provided vendor feed credentials for gated advisory access.
View Switch Exposure Centre

Execution Layer

Audit Assurance Node

The distributed execution backbone of the platform. The Audit Assurance Node runs audit scripts across large host inventories in parallel — local or remote — and delivers cryptographically signed evidence bundles to the central platform. It is the execution layer that makes fleet-scale auditing reliable and tamper-evident.

Distributed & Parallel Execution

  • ✓Executes PowerShell and shell scripts across hundreds of hosts simultaneously with configurable concurrency
  • ✓JSON-based host inventory for structured, repeatable execution across named host groups
  • ✓Separate dev, test, and production environment profiles — one node, multiple configuration contexts
  • ✓Standalone web UI for execution control, schedule management, and report viewing

Remote Execution & Signed Evidence

  • ✓Remote execution via SSH (Linux) and WinRM (Windows) with full credential management — no persistent agent required
  • ✓Every evidence bundle is HMAC-signed with SHA-256 checksums on every artifact before leaving the host
  • ✓Bundle verification — any bundle can be independently verified against its manifest at any time
  • ✓Historical run tracking preserves every audit execution for trend comparison and audit defence

AuditToolkit Lite

Standalone Host Auditing — No Platform Required

A separate product family for single-host security auditing. Each tool is self-contained, requires no central server, and produces structured findings, a Hardening Index, and a human-readable HTML report entirely on-device. Designed for consultants, small teams, pre-deployment host checks, and air-gapped environments.

🐧

Linux Host Lite

DEB / RPM · Python 3.10 · CLI

  • ✓Debian 11+, Ubuntu 20.04+, RHEL 8+, Rocky, AlmaLinux.
  • ✓Read-only checks — no system changes during audit.
  • ✓JSON + CSV + HTML output. No pip packages, no network at run time.
  • ✓Online activation or signed offline licence import.
View Documentation
💻

Windows Security Lite

MSI · PowerShell 7 · CLI + GUI

  • ✓Windows 10 (1903+), Windows 11, Server 2019+.
  • ✓MSI installer with optional WinForms GUI launcher.
  • ✓JSON + CSV + HTML output per run.
  • ✓Online activation or signed offline licence import.
View Documentation

macOS Security Lite

DMG / PKG · Python 3.10 · CLI + Web viewer

  • ✓macOS Catalina (10.15) or later. DMG or PKG install.
  • ✓Local web viewer on port 8766 for browser-based report review.
  • ✓JSON + HTML output. Online or offline licence activation.
  • ✓Gatekeeper approval required for pre-release builds.
View Documentation
When to use Lite vs Enterprise Suite: Use the Lite Toolkit for individual host posture checks, consultant engagements, or environments where deploying a full platform is not warranted. Use the Enterprise Suite when you need fleet-wide audit coverage, a central findings platform, remediation workflows, and tamper-evident evidence packaging. Full Lite Toolkit overview →
Licensing: AuditToolkit Lite is a separate add-on, sold independently of the Platform licence. One annual licence (£4,999/year) activates all three host tools.
View Pricing Product Overview View Documentation

Storage Intelligence Platform

Distributed Storage Inventory — Sold Separately

A standalone product, licensed and priced independently of the AuditToolkit suite. Lightweight agents run on each storage node and publish results to a self-hosted control plane — distributed file inventory, classification, and change-tracking across RHEL, Ubuntu, Lustre, GPFS, ZFS, and Windows Server, with no cloud dependency.

Incremental by design

The first scan establishes a baseline; every subsequent scan only processes new, modified, or deleted files. Large NAS, Lustre, and ZFS filesystems complete in minutes with no measurable I/O impact on production workloads.

Agents survive server outages

Agents always initiate the connection and never block on server availability. If the control plane is unreachable, scan jobs complete locally and results are held until the connection resumes — no lost data, no missed scan windows.

Air-gap and offline ready

Docker images for the server and agent ship as loadable tarballs. The agent auto-update mechanism serves packages from a local path with SHA-256 verification — no external package repository required at run time.

Licensing: BSL 1.1 — free up to 10 nodes with no expiry. Paid tiers extend to 50, 200, or unlimited nodes (£995–£8,500/year) via key activation.
View Pricing View Documentation Product Overview Release Notes

Litmus

Agentless Audit & Remediation — Sold Separately

A standalone product, licensed and priced independently of the AuditToolkit Platform. Litmus audits and remediates assets agentlessly over SSH, WinRM, SNMP, and API — attach a connection profile to each node, run scheduled audits, and review findings, drift, and trends, with approval-gated remediation and rollback. Nothing to install on the target hosts.

Agentless by design

Reach Linux, Windows, network, and API targets over their native protocols — no agent to deploy, package, or maintain on the assets under audit. A node becomes managed the moment a connection profile is attached.

Audit, drift, and remediation

Scheduled audits feed a dashboard of findings, trends, and configuration drift. Remediation is approval-gated with atomic rollback, so changes stay controlled and fully auditable.

Per-node-band licensing

Licensed by connected-node band — a flat annual price up to the node count in your tier. SSO, scheduled audits, and reporting are included from the free tier; air-gapped offline licensing is available on higher tiers.

Licensing: BSL 1.1 — free Starter tier up to 5 connected nodes, no key required. Paid tiers extend to 25, 100, 500, or 2,500 nodes (£349–£11,900/year) via key activation.
View Pricing Release Notes

Use-Case Matrix

Which tool to use for what

Primary indicates the main owning tool. Supporting indicates where companion tooling adds value.

Use Case Primary Tool Supporting Tool(s) Typical Output
Infrastructure data intake and connector polling CMDB API Data Collection Tool Asset Command Centre Normalised inventory + vulnerability-linked records
Audit finding lifecycle and remediation tracking Audit Admin Toolkit Linux Security Lite Findings queue, evidence reports, closure records
Direct host remediation with atomic rollback Audit Admin Toolkit SuperAdmin remediation APIs Execution history, rollback records, change evidence
Asset discovery with CVE and KEV correlation Audit Admin Toolkit (native asset discovery) CMDB API Data Collection Tool Normalised asset records with CVE and KEV risk context
Linux hardening and compliance control verification Linux Security Lite Audit Admin Toolkit Control-level pass/fail evidence and reports
Asset governance and command-centre views Asset Command Centre CMDB API Data Collection Tool Asset context dashboards and enrichment state
Compliance evidence packaging for review Audit Admin Toolkit Linux Security Lite, CMDB API Data Collection Tool Evidence exports for internal/external assurance
Switch firmware advisory and network exposure tracking Switch Exposure Centre CMDB API Data Collection Tool, Asset Command Centre Switch-centered exposure reports with CVE and advisory context
Storage inventory and classification for RHEL / Ubuntu / Lustre / GPFS Storage Intelligence Platform Audit Admin Toolkit Timestamped file inventory, classification breakdown, migration delta reports
Single-host Linux posture check — no platform deployment Linux Host Lite — Local JSON + CSV + HTML with Hardening Index
Single-host Windows posture check — no platform deployment Windows Security Lite — Local JSON + CSV + HTML with Hardening Index
Single-host macOS posture check — no platform deployment macOS Security Lite — Local JSON + HTML with Hardening Index and web viewer

Operational Flow

How they fit in one lifecycle

The tools are designed as an operational chain, not isolated silos.

1. Discover and collect

CMDB API and asset discovery gather host, software, and network inventory. CVE and KEV context are applied per asset.

2. Enrich and contextualise

Asset Command Centre layers governance context, ownership, and lifecycle visibility. Switch Exposure Centre adds network infrastructure posture.

3. Audit and validate

Audit Admin Toolkit runs audit workflows and Linux Security Lite adds deeper Linux control verification.

4. Remediate

SuperAdmin-gated direct host remediation over SSH and WinRM with secondary auth and dry-run preview before every execution.

5. Validate and roll back

Post-remediation validation with automatic or manual rollback by execution ID when outcomes are not compliant.

6. Evidence and improve

SHA-256 signed evidence packages, SIEM export, trend analysis, and compliance trajectory reporting for continual improvement.

Start Paths

Start by role

Quick entry points for teams that need an immediate operating path.

Security Operations

  • ✓Start with Audit Admin Toolkit for findings and evidence workflows.
  • ✓Add Linux Security Lite for deeper Linux control verification.

IT Operations / CMDB Teams

  • ✓Start with CMDB API Data Collection Tool for connector-based intake.
  • ✓Add Asset Command Centre for enriched command-centre operations.

Governance / Compliance

  • ✓Use Audit Admin Toolkit as the evidence and reporting control point.
  • ✓Pull supporting control outputs from Linux Security Lite and CMDB data sources.

Network Security Operations

  • ✓Start with Switch Exposure Centre for switch-focused advisory and CVE workflows.
  • ✓Integrate with CMDB API Data Collection Tool and Asset Command Centre for broader estate context.

Standalone / Consultant

  • ✓No platform needed — install Linux Host Lite, Windows Security Lite, or macOS Security Lite directly on the target host.
  • ✓Activate with a licence key, run an audit, review the HTML report. Air-gap and offline licence supported.

Deployment Models

How to deploy by operating pattern

Mode Description Best for
Single-host (Standalone Agent) Core platform plus Standalone Agent on one machine. Local dashboard, local findings, and no coordinator required. Small environments, evaluation, developer workstations
Fleet (Fleet Agent + Coordinator) Fleet Agent deployed to target hosts with a coordinator service for centralised collection and reporting. Multi-server environments and recurring scheduled audits
Hypervisor-native Hypervisor agent for ESXi, KVM, Nutanix, Proxmox, and Xen with audit scripts run against hypervisor layers directly. Virtualisation estate audit and compliance
Air-gapped / offline Offline MSI installers with no outbound internet requirement and agent deployment without external connectivity. Financial services, healthcare, government, and defence supply chain
CI/CD integration Linux Security Lite with AUDIT_SKIP_LICENSE_CHECK for pipeline use, stable control IDs, and JSON/CSV outputs with GitHub issue creation. DevSecOps, developer workstations, and pipeline gates

Need help designing your rollout path?

Tell us your environment goals and we will map the right starting sequence across the four tools.

Contact Us Browse Documentation