CIS Auditor runs on each endpoint and checks it against the CIS Benchmark — control by control. You see what passed, what failed, what value was found, what was expected, and how to fix it.
No scripting required. No cloud dependency for the scan. Results go to your dashboard.
How it works
Run the installer on any endpoint. One-liner for Windows, a shell script for Linux and macOS. The agent enrolls itself and starts reporting.
Trigger scans from the dashboard or schedule them via policy. Pick your benchmark profile (CIS L1 or L2) and optionally scope to specific control categories.
Every failing control shows the actual value found, what the benchmark requires, and a concrete remediation step. Export as JSON, CSV, or HTML for your audit trail.
What gets checked
CIS Auditor covers the full CIS Benchmark control taxonomy. Checks run directly on the endpoint using native OS APIs — not PowerShell scripts that can be bypassed.
Supported: Windows 10, 11, Server 2019/2022 · Ubuntu 22.04 · RHEL/CentOS 9 · macOS 14 Sonoma
Control
CIS-W11-L1-18.3.1 — LAPS configuration
Local Administrator Password Solution must be enabled. Prevents lateral movement via shared admin credentials.
Found
not configured
Expected
enabled + 30d rotation
Remediation
Deploy Windows LAPS via Group Policy or Intune. Set BackupDirectory = 1 (Azure AD) or 2 (on-prem AD). Set PasswordAge max to 30 days.
Products
Endpoint compliance scanning against CIS Benchmarks. Deploy the agent, run scans on demand or via schedule, get per-control pass/fail with actual vs. expected values and fix instructions.
We're building more endpoint tooling. Nothing to show yet — we don't announce things before they work.
Follow releases for updates.
What we care about
We'd rather have 180 checks that are always correct than 500 that are sometimes wrong. Every control result is verifiable. If you disagree with a result, open a ticket — we'll look at it.
Single Go binary, no installer dependencies, no agent framework. The service runs a scan and stops. It doesn't persist a connection, doesn't run scripts, and doesn't touch files outside its own directory.
The backend is open to self-host if you need scan results to stay on your infrastructure. The agent works with both. We run the SaaS instance ourselves on EU servers.
Free plan: 3 endpoints, unlimited scans, full CIS L1 results. No credit card.
Enroll takes about 2 minutes. First scan result in under a minute.