Delve
AI-native compliance automation with agent-based evidence collection
Lynis
In-depth security auditing and hardening for UNIX-based systems
Lynis performs comprehensive security audits on Linux, macOS, and BSD systems, delivering actionable hardening recommendations and compliance testing for ISO27001, PCI-DSS, and HIPAA.
Overview
Overview
Lynis is a battle-tested security auditing tool designed for UNIX-based systems including Linux, macOS, and BSD. Running directly on the target system, it performs in-depth security scans to assess defenses, detect vulnerabilities, and provide actionable hardening recommendations. Trusted by thousands of organizations daily, Lynis requires no compilation or installation—simply clone and execute.
Who Uses Lynis
System administrators, auditors, security officers, and penetration testers rely on Lynis for automated security assessments. Blue teams use it to strengthen defenses, while red teams leverage it for privilege escalation reconnaissance during penetration tests.
Core Capabilities
Lynis automates security auditing, compliance testing (ISO27001, PCI-DSS, HIPAA), and vulnerability detection. It assists with configuration management, patch management, system hardening, and intrusion detection. The tool scans for general system information, outdated software packages, and configuration weaknesses, delivering a comprehensive security posture assessment.
Deployment
Install via native packages for major distributions (Debian, Ubuntu, CentOS, Fedora, RHEL) or run directly from Git with zero dependencies. Written in Shell, Lynis is lightweight, regularly updated, and built on principles of simplicity and transparency.
Highlights
Agentless architecture—no compilation or installation required, runs directly from source
Automated compliance testing for ISO27001, PCI-DSS, HIPAA, and other frameworks
In-depth security scanning with actionable hardening tips and vulnerability detection
Cross-platform support for Linux, macOS, BSD, and UNIX-based systems
Pros
- Zero dependencies and lightweight Shell-based implementation
- Regularly updated with active development and community support
- Comprehensive scanning covering configuration, vulnerabilities, and compliance
- Trusted by thousands with 14,700+ GitHub stars and proven track record
Considerations
- Command-line interface only; web dashboard requires enterprise version
- Some distribution repositories may lag behind latest releases
- Requires root or sudo access for complete system audits
- Advanced reporting and risk-based improvement plans limited to commercial offering
Managed products teams compare with
When teams consider Lynis, these hosted platforms usually appear on the same shortlist.
Looking for a hosted option? These are the services engineering teams benchmark against before choosing open source.
Fit guide
Great for
- System administrators performing routine security audits and hardening
- Organizations requiring compliance validation for PCI-DSS, HIPAA, or ISO27001
- Security teams conducting vulnerability assessments and configuration reviews
- Penetration testers gathering system information during privilege escalation
Not ideal when
- Teams requiring centralized dashboards and reporting without commercial licensing
- Organizations needing real-time continuous monitoring rather than point-in-time audits
- Windows-only environments (designed for UNIX-based systems)
- Users seeking automated remediation rather than advisory recommendations
How teams use it
PCI-DSS Compliance Validation
Auditors scan payment processing servers to identify configuration gaps and generate evidence for quarterly compliance reviews.
Linux Server Hardening
System administrators run Lynis post-deployment to receive prioritized hardening recommendations and reduce attack surface before production.
Vulnerability Assessment in CI/CD
DevOps teams integrate Lynis into build pipelines to detect security misconfigurations and outdated packages before image promotion.
Penetration Testing Reconnaissance
Red teams execute Lynis on compromised systems to enumerate security controls, identify privilege escalation paths, and map defenses.
Tech snapshot
Shell100%
Roff1%
Ruby1%
Frequently asked questions
Does Lynis require installation or compilation?
No. Lynis runs directly from source with no compilation needed. Clone the repository and execute the audit command immediately, or install via native packages for easier updates.
What compliance frameworks does Lynis support?
Lynis assists with compliance testing for ISO27001, PCI-DSS, HIPAA, and GDPR by identifying configuration gaps and security weaknesses relevant to these frameworks.
Can Lynis automatically fix security issues?
No. Lynis is an auditing tool that provides actionable recommendations and hardening tips. System administrators must manually implement suggested changes.
What is the difference between the open-source and enterprise versions?
The open-source version provides full auditing capabilities. The enterprise version adds a web interface, centralized dashboard, reporting, risk-based improvement plans, and commercial support.
Which operating systems are supported?
Lynis supports UNIX-based systems including Linux distributions (Debian, Ubuntu, CentOS, Fedora, RHEL), macOS, and BSD variants. Windows is not supported.
Project at a glance
Active- Stars
- 15,142
- Watchers
- 15,142
- Forks
- 1,571
LicenseGPL-3.0
Repo age12 years old
Last commit2 months ago
Primary languageShell
Last synced 12 hours ago