Prove every binary, library and package on your servers is the original.
From what shipped with the operating system to what you installed yesterday, Zero Door checks binaries, libraries and packages against a legitimacy database we keep current. A change is not the question. Whether the file is genuine is.
File integrity tools tell you that a file changed. Zero Door tells you whether the file on disk is the one its publisher shipped, for every binary, library and package on the host, including everything that came with the operating system.
Linux: the whole system
Installed files carry no signature the system checks at run time, and a package's own checksum list sits on the same disk as the file: whoever can rewrite one can rewrite both. Zero Door compares what is on disk with the original in a legitimacy database we keep current, from outside the host.
Windows: more than a signature
Code signing helps, and attackers have still shipped tools signed with stolen certificates. Zero Door weighs the signature, the signer and the certificate's state together with the original content in its database.
Most security products protect a server from the moment they are installed. Zero Door's first scan checks the legitimacy of every binary, library and package already on the host, so a compromise that happened before the install surfaces on day one.
Zero Door installed
system file alteredbefore the installfound in the first scan
pasttoday
3,411 → 1files changed by one Windows update, reduced to one alert per server (measured, September 2026)
13compliance frameworks built in, from ISO 27001 to national regulation
Offlineevidence an auditor can verify without an account
Built in
The capabilities behind the verdict.
01
The first question: is it the original?
Every check starts with legitimacy, not with change. Binaries, libraries and packages are weighed against the original, including what the operating system shipped, on Linux and Windows. The answer comes from a legitimacy database we keep current, read from outside the host.
Binaries, libraries and packages
What the operating system shipped, too
Read from outside the host
checked against the original
LinuxWindowsbinarieslibrariespackagesshipped with the OS
A Windows servicing run touches thousands of files. Zero Door recognises the servicing transaction and the publisher and folds the whole run into one alert per server. A malicious or suspicious verdict is never lowered.
Microsoft-signed content and TrustedInstaller transactions
One medium-severity alert per server
A suspicious file still stands on its own
Windows update3,411 changed files
1 alert · medium
03
One alert, the whole story.
A changed file arrives with the chain that changed it: the user who logged in, still known after sudo, the effective user and every process in between with its command line. When the writer runs from memory with no file on disk, the chain shows that too.
The login user, still known after sudo
Process ancestry with command lines
Deep sensor on Linux and Windows
1 alertSuspicious
event tree
userjohn.doelogged in
processsshdpid 812
process-bashpid 3310
processsudo python3 -c …john.doe → root
fileless/memfd:upd (deleted)in memory · no filefileless
file/usr/lib/libaudit.so.1changed
file/etc/ld.so.preloadchanged
04
Find exactly what runs where.
Across a large fleet, search a package by name and see which servers run it, version by version, then narrow to one exact version. Search a file by name, path or hash and get every machine that holds it, then narrow by machine tag, file type, owner or size. Vulnerabilities and end-of-life dates sit on the same inventory.
Package and exact version across the fleet
Files by name, path or hash, with CSV export
dpkg, rpm and pacman; MSI, installed programs and Store apps
opensslversion 3.0.2package
23 machines
05
Fileless attacks, caught in memory.
The image a process runs is checked, not only the file it came from. Code running from memory with no file on disk, images loaded straight into memory and injected code are flagged; for an injection, the process and user that reached in are named.
Every action lands in an HMAC-chained audit trail with signed nightly checkpoints. Reports are signed with Ed25519 and can carry an RFC 3161 timestamp, so the audit bundle can be checked without an account.
HMAC-chained audit trail
Ed25519-signed reports
RFC 3161 timestamps and OSCAL export
audit chain
RFC 3161 timestamp
audit bundle
07
Thirteen frameworks, built in.
International standards such as ISO 27001, NIST, PCI DSS, SOC 2, HIPAA and GDPR, alongside national regulation. Integrity telemetry fills in control statuses while the fleet runs.
Maker-checker approvals
Attestations pinned to control states
OSCAL assessment export
integrity evidence
ISO/IEC 27001:2022
NIST SP 800-53 Rev 5
NIST CSF 2.0
PCI DSS v4.0
SOC 2
HIPAA Security Rule
GDPR
CIS Controls v8
NATO catalogue (illustrative)
Turkish Cyber Security Law 7545
KVKK Personal Data Security Guide
BDDK banking IT regulation
Information and Communication Security Guide
And more
Everything around the verdict.
Integrations
Email, Slack, Teams, PagerDuty, Jira, signed webhooks and SIEM forwarding in CEF, LEEF, JSON or syslog.
Access and identity
SAML, OIDC and LDAP sign-in, MFA and passkeys, seven roles plus your own, classification levels with per-user clearances, two-person approval and break-glass access.
A small Rust agent
Adaptive CPU and memory throttling, an offline queue, and signed self-updates rolled out in rings with automatic rollback.
Registry and permissions
Windows registry changes and permission changes on files, owner and access lists alike, are recorded next to content changes.
File access
Who read or ran a file is recorded next to what changed in it, from the operating system's own audit trail on Linux and Windows.
Baselines and compare
Take a baseline after a planned change and compare any baseline with another or with the live state.
Incidents and workflow
Incidents, escalation, change windows, false-positive rules and standing allow or block rules for a file.
Version policies
Minimum version, allowed and blocked versions per package, with a live preview of the servers a rule would affect before you save it.
Last known location
A file that is gone or has changed can still be traced: where that hash or path was last seen across the fleet.
Who it is for
Built for the frameworks you are audited against.
Banking and finance
PCI DSS v4.0 and banking regulators ask for continuous change detection on critical files. Zero Door makes that a by-product of running the fleet, with the evidence already organised.
NIST SP 800-53 mapping and classification levels with per-user clearances are part of the product, and environments that cannot call home run it behind their own air gap.
Every detection runs here too. Activation uses an offline signed licence, updates arrive as signed bundles you carry in, and evidence is verified offline.
Runs where you need it: on your own servers, behind an air gap, or as SaaS we operate in the European Union. One codebase, the same detections and evidence.