Validates SSH configurations against eight compliance frameworks. Fixture-driven. pytest-powered. Reports your auditors will accept.
SSH Compliance Testing is an agent harness - a kernel-governed runtime that connects to your hosts, runs every compliance check, and produces auditor-ready evidence without manual intervention.
The Problem
Most teams treat SSH auditing as a quarterly fire drill. Engineers SSH into boxes, grep sshd_config, and paste output into spreadsheets. Drift happens silently between audits. By the time anyone checks, the environment has already failed.
Auditors want structured proof. They get terminal screenshots, copy-pasted config snippets, and spreadsheets that are out of date the day they are created. No repeatability, no chain of custody.
You pass an audit in January and drift by March. An admin hotfixes a cipher suite, another disables a setting for troubleshooting, nobody reverts it. Drift persists for weeks or months before anyone notices.
STIG, CIS, NIST, PCI, HIPAA, SOC 2, ISO 27001 all have overlapping but different SSH requirements. Teams maintain separate scripts, checklists, or spreadsheets for each one. Nothing is unified.
Large enterprises accumulate thousands of SSH keys with no centralized inventory. Keys from former employees and decommissioned services persist indefinitely. Auditors find no trail of who provisioned what.
Frameworks
Each framework targets a different compliance need. The harness validates all eight from a single pytest run.
Defense Information Systems Agency Security Technical Implementation Guides. Required for DoD networks.
Center for Internet Security consensus-based configuration guidelines. The baseline for hardening.
Protecting Controlled Unclassified Information in nonfederal systems. CMMC requirement.
Federal cryptographic module validation. Ciphers, key exchange, MACs - all validated.
Payment Card Industry Data Security Standard. SSH hardening for cardholder data environments.
Health Insurance Portability and Accountability Act. Technical safeguards for PHI access controls.
Service Organization Control. Trust service criteria for security, availability, and confidentiality.
International information security management standard. Annex A control validation.
How It Works
Define your targets in JSON. The AI agent reads your host fixture, selects the right validators for your image variant, connects via SSH, and runs every check. You get the report.
Define Your Targets
Add a JSON fixture per host. Hostname, SSH credentials, image variant, expected packages and services. Adding a new target is config, not code.
Agent Plans the Run
The AI agent reads your host fixture, identifies the image variant, and selects the right validators. Kernel enforcement prevents architectural drift.
Agent Connects and Validates
The agent SSHs into your hosts, executes validation commands through the 5-layer framework, and captures evidence for every check. Retry, timeout, fail-fast built in.
Structured Results
Pass/fail per rule, per framework, per host. Command output captured as evidence. Run it in CI/CD or schedule it nightly. Auditor-ready.
Architecture
Live Scan
Results
Who This Is For
Maintaining SSH hardening across a fleet of hosts. Run compliance checks in CI/CD. Catch drift before it reaches production.
STIG compliance is not optional when your systems sit on a DoD network. Continuous validation replaces the scramble before an audit.
Structured reports with rule IDs, severity levels, and evidence. Designed to hand directly to an auditor.
Each customer gets their own fixture file with their compliance requirements. Scale without writing new code.
Why Isagawa
Every check captures command output as evidence. Hand the report to an auditor - no manual screenshots needed.
When a check fails or a rule changes, the system updates its own protocol. Lessons compound across every run.
STIG, CIS, NIST, FIPS, PCI, HIPAA, SOC 2, ISO 27001 - validated from a single pytest run.
The AI agent can't skip checks or drift from architecture. Hooks block non-compliant operations before they execute.
Interested in compliance automation for your infrastructure?
View verified build history - every change signed with Sigstore