LinuxGuard is a UK Linux identity security company that maps who can do what on every Linux server. It is built for security and infrastructure teams who run large Linux estates and need to see how sudo rules, SSH keys and service accounts create paths to root that SIEM, EDR and cloud IAM tools do not see.
LinuxGuard treats every actor on a Linux host as an identity, whether it is a person, a service account or an AI agent, and gives teams the evidence auditors ask for about who holds privileged access.
At A Glance
| Vendor | LinuxGuard |
|---|---|
| Category | Linux identity security, identity visibility and least privilege enforcement |
| Identities covered | Human users, privileged and root access, service accounts, SSH keys, AI agents and MCP servers on Linux |
| Deployment | Agent on each server reporting to a cloud Platform and Console |
| Agentic AI | AI agents mapped as identities, MCP gateway, just in time access for agents |
| Certifications | Red Hat Certified Technology, SUSE Ready, validated with Ubuntu |
| Founded | 2025, London |
What LinuxGuard Does
Every Linux server carries its own identity layer: local accounts, sudo rules, SSH keys, PAM chains and service accounts that together decide who can reach root. On a large estate these settings drift and pile up, and few teams can say which accounts are dormant, which keys are shared or which service account an automation job really uses. LinuxGuard first maps that layer across every host, then scores the risk of each account, key and policy, and finally adds controls on top of the map. Compliance evidence comes from the same data, mapped to 17 frameworks including NIS2, DORA, SOC 2, ISO 27001 and PCI DSS.
Products
Identity Intelligence
Identity Intelligence answers the question most Linux audits start with: who can become root, and how? It maps privilege escalation paths on each server, surfaces dormant, inactive and over privileged accounts, and keeps a timeline per identity of logins, sudo commands, configuration changes and session length. For containerised hosts it also inventories each node and pod, including projected service account tokens and mounted secrets.
Non-Human Identity Posture
Service accounts on Linux often outlive the people who created them. This module classifies service accounts and machine credentials as non-human identities, records an owner and credential age for each, so platform teams can see which automation holds the most reach.
Just-In-Time And Agentic Access
This module is marked as coming soon. Standing sudo rights and permanent keys are replaced with access that expires. Users request access through approval gates and receive 15 minute workload bound tokens, signed and time boxed key windows that are cleaned up at expiry, time boxed sudo grants or short lived SSH certificates.
Risk Scoring And SSH Key Posture
Each account receives a score from 0 to 100 based on its sudo configuration, authentication methods, key status and access patterns, with an inline explanation of the score. The SSH key inventory lists every authorised key with its age, algorithm, reuse and owner, and hygiene grading flags weak algorithms, old keys and keys shared across accounts or servers.
File Security
File Security protects sensitive data on the servers themselves. It monitors policy scoped paths, detects personal data and secrets with scanning done on the customer’s own server, spots bulk copies and outbound scp, sftp and rsync transfers, and applies per actor egress control against URL, IP and range policies.
Findings, Automated Response And Compliance
Findings are ranked by severity and include configuration drift in sudo, SSH, PAM and access controls. Automated Response can lock accounts, end sessions, disable SSH keys, revoke sudo, or revoke and re-scope an AI agent’s credentials. Compliance and Audit scores frameworks continuously and exports evidence for auditors.
CVE And Vulnerability Management
This module keeps a package and service inventory per server, enriches it with CVE data, lists the affected servers and gives fix guidance that matches each host’s package manager.
How It Works
A small agent runs on each Linux server. It observes identity activity on the host, carries out the response actions that policy allows, and connects to the cloud Platform over outbound HTTPS only. Scanning runs on the hosts, and file content never leaves the customer’s servers.
| Component | What it does |
|---|---|
| Agent | Runs on each host, collects identity data and executes permitted response actions. |
| Platform | The cloud service that receives agent data and builds the access graph and findings. |
| Console | The central interface where teams review findings, approve access requests and register AI agents. |
| Insights API | Gives read only, programmatic access to the same data. |
| Approval gates | Containment actions need approval by default unless an administrator turns on active response. Locks, sudo revocations and key disables roll back after four hours unless someone confirms them. |
| Audit integrity | Chain hashed audit trails record the trigger, approver and outcome of each action, and remediation actions use Ed25519 signed descriptors. |
Identities And Systems Covered
| Human users | Local Linux accounts, with per identity timelines and dormant account detection. |
|---|---|
| Privileged access | Sudo rules, root access paths, NOPASSWD rules and PAM chains. |
| Service accounts | Classified as non-human identities with ownership and credential age. |
| SSH keys and certificates | Authorised keys and short lived SSH certificates. |
| AI agents and MCP servers | Agent runtimes and MCP servers discovered as identities. |
| Systems | Linux hosts on Red Hat Enterprise Linux, SUSE and Ubuntu, with Debian tested. |
Agentic AI Capabilities
AI Agents As Identities
On a Linux host an AI agent behaves like a service account, and LinuxGuard handles it that way. Each agent receives a reach score and a place in the access graph. Launcher attribution ties the agent to the systemd unit, cron job or shell that started it, and runtimes not seen executing for 30 days are marked stale.
MCP Controls
- Per tool, per identity policy at the MCP boundary.
- A log first MCP gateway that enforces only when a tenant switch is on, auditing calls without their arguments.
- A finding that flags MCP servers which bypass the gateway.
Access And Enforcement For Agents
AI agents are a distinct identity type, and each registration is approved in the Console. “AI agents get approval-gated, time-boxed access instead of standing credentials”, with per agent rate limits and anomaly alerts. Exec and file denial can be scoped to a single agent, with a kill switch.
Integrations
| Area | Integrations |
|---|---|
| SIEM | Splunk HEC, for findings and identity events |
| Ticketing and collaboration | Jira tickets, Slack and Teams alerts |
Company Background
| Founded | 2025. |
|---|---|
| Headquarters | London, United Kingdom. |
| Leadership | Peter Cummings (Founder and CTO) and John Skitt (Co-Founder and CEO). |
Note: This overview is compiled from LinuxGuard’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.