The platform
One platform for vulnerability assessment and posture management
Holistra orchestrates proven scanning engines and lightweight endpoint agents, puts every result into one prioritised list, and tracks each finding until it is fixed.
Unified scanning
Ten scan types. One finding format.
Launch any scan from the same wizard. Scans run in the background on a distributed worker pool, and every result is normalised into the same finding schema and deduplicated across runs.
Network discovery
Find live hosts, open ports and exposed services across your ranges, including private networks.
Host hardening
Benchmark-style checks on Linux and Windows servers using the credentials you provide, with no software to install.
Web applications
Dynamic application testing, web-server checks, TLS configuration and security headers, mapped to the OWASP Top 10.
Cloud posture
Misconfiguration checks for AWS, Azure and Google Cloud accounts.
Code and supply chain
Static analysis, vulnerable dependencies and leaked secrets in your Git repositories.
Compliance checks
Network and web findings mapped to PCI DSS requirements and GDPR articles.
Prioritisation
Fix what attackers are exploiting today
A list of a thousand Highs helps nobody. Holistra enriches findings with live threat intelligence so the riskiest few rise to the top.
CISA KEV
EPSS scores
Signed intel updates
Risk score
Endpoint agents
Authenticated, continuous visibility on every host
A single Go binary that runs as a service on Linux (systemd), macOS (launchd) and Windows. It only ever makes outbound HTTPS requests: no inbound ports, no SSH or WinRM to open.
- Approval gate. New agents enrol with your organisation's token and wait, receiving nothing, until an admin approves them.
- Software inventory. Packages on Debian, Ubuntu, Alpine, Rocky, AlmaLinux, RHEL and SUSE are matched against OSV data. Windows builds are checked against Microsoft's security updates. Findings close automatically after an upgrade.
- Security posture. Disk encryption, firewall, antivirus, Secure Boot, System Integrity Protection, Gatekeeper, automatic updates and pending reboots, plus operating systems past end of life.
- Attack surface and drift. Services and startup items, local and admin accounts, SSH authorised keys, sudo rules, browser extensions and trusted certificates, with optional alerts when something changes.
- Signed remediation. Scripts run only with a valid Ed25519 signature from your server, bound to that agent and organisation and valid for 24 hours.
- Safe self-updates. Agents install only releases signed with our release key, test the new version first, and roll back on their own if it cannot reach the server. Roll out by maintenance window, with canary agents first.
Remediation workflow
From finding to fixed, with a record of every step
Triage
Retest
Fix at scale
Jira
Coming soon Scheduled recurring scans, ServiceNow, Slack and Microsoft Teams notifications, and SIEM export.
Compliance and reporting
Turn scan results into audit evidence
Assign hardening baselines to groups of hosts and Holistra runs them through the agents, on a schedule you set. Scores roll up per host and per organisation, with a trend over time.
- Linux baselines from ComplianceAsCode, macOS baselines from the macOS Security Compliance Project, and hand-written Windows checks.
- Compliance reports in PDF and CSV with references to CIS, NIST 800-53, DISA STIG and PCI DSS where the check provides them.
- Vulnerability reports in PDF and CSV for management, auditors and remediation teams.
- An audit log of every change made in the platform, with who did it and when.
See Holistra on your own environment
Book a walkthrough with our team. We will show you the platform, talk through your regulatory obligations and agree a scope for a pilot.