Start with 30 days of Fleet — no card required. Then stay on Verify for five hosts, or pay one transparent per-host price from 1 to 300 hosts.
Want to see it before you install? Explore the live demo →
Scanners are great at finding vulnerable packages. oxharden adds host-level evidence for what still needs an update, restart, reboot, or compliance review.
| Scanner-only workflow | oxharden | |
|---|---|---|
| Detects vulnerable packages on disk | ||
| Checks running-code state | Reports "fixed" once the package updates | Flags services still mapping the old library |
| Restart / reboot debt | Manual investigation | Shows restart / reboot action |
| Remediation priority | CVSS score lists | Ranks by KEV, EPSS, exposure, and affected host context |
| Compliance evidence (CIS / DISA STIG) | Separate tool or add-on | Built-in evidence from the same host context |
| Time to first result | Scanner infrastructure, consoles, tuning | One-host snapshot in minutes; fleet rollout when ready |
Comparison describes common scanner-only workflows. It is not a claim about any specific vendor product. Read the full evidence comparison.
Verify Free · 5 hosts | Fleet $9/host/mo | Enterprise Custom pricing | |
|---|---|---|---|
| Infrastructure | |||
| Monitored hosts | 5 | 1–300 self-serve | 301+ |
| Team members | 2 | Unlimited | Unlimited |
| Workspaces | 1 | Unlimited | Unlimited |
| Scanning | |||
| Scan cadence | Weekly | Daily | No limit |
| Compliance (OS) scans | |||
| Package & CVE scanning | |||
| Network port scanning | |||
| Live (applied ≠ live) tracking | |||
| Ad-hoc rescans | — | Unmetered | |
| Compliance | |||
| Benchmarks | All standard | All standard | All standard |
| Guided Remediation | |||
| Bulk compliance & audit exports | — | ||
| Data & access | |||
| Scan history | 30 days | 365 days | Extended |
| API access (PAT) | — | ||
| SSO / SAML | — | — | |
| Air-gapped / self-hosted | — | — | |
| Support | Community | Priority | |
Review a sample Patch Truth report, then start a 30-day Fleet trial to verify live fixes, restart debt, exposure, and compliance evidence on up to 300 of your own hosts.
curl -fsSL https://packages.oxharden.com/install.sh \ | sudo EXPECTED_GPG_FINGERPRINT=9B23F83E487C46C97ADE6429E7A1D1965BB4621B bash
Every new organization gets 30 days of full Fleet access for up to 300 hosts, with no credit card required. Fleet includes daily collection, API access, bulk exports, and 365-day visibility.
If you have five or fewer hosts, you move to Verify automatically. If you have more than five, you get seven days to choose Fleet or select the five hosts that should remain monitored. Unselected hosts become dormant; they are not deleted.
Monitored hosts can send new evidence and count against your plan capacity. Dormant hosts stop collection, but their existing history remains readable while it falls inside the plan's visibility window. You can change the selected hosts without a cooldown.
Yes. Fleet is available from one host. Choose it when you want daily collection, 365-day visibility, API access, bulk exports, or other Fleet capabilities even with a small estate.
Yes. Fleet capacity can be changed from 1 to 300 hosts in billing settings. Increases are available immediately. For a decrease, choose which hosts stay monitored; the rest become dormant after Stripe confirms the change, with no host or evidence deletion.
Fleets with 301 or more hosts move to Enterprise so we can scope support, retention, deployment, and contract requirements. Contact sales for pricing tailored to your deployment.
Verify shows 30 days of history. Fleet shows 365 days. Enterprise retention is scoped to the contract and can be extended when required.
Yes. Verify uses the same vulnerability and compliance detection engine. The primary differences are capacity, collection cadence, retention, collaboration, API, and export capabilities, not weaker findings.
Self-hosted and air-gapped deployment is scoped separately for Enterprise. If that is a hard requirement, contact us so we can define the update, support, and security boundaries before committing to a rollout.