Version 7 is all about discovery.
A new engine identifies most equipment from the protocols it already speaks, with no credential needed. Version 7 also draws your network, maps each application to the servers it runs on, and benchmarks Windows and Active Directory against the DISA STIGs.
Enterprise 路 free for your first 30 days. The full product and unlimited devices from day one. When the trial ends, Free keeps working on up to 100 devices.
Edition
All 20 changes.
| Feature | Edition | Collection | Section |
|---|---|---|---|
| Credential-free discovery engine | Every edition | Discoveries | Discovery without credentials |
| Parallel subnet scanning | Every edition | Discoveries | Discovery without credentials |
| ARP discovery | Every edition | Discoveries | Discovery without credentials |
| OT discovery | Every edition | Discoveries | Discovery without credentials |
| SSDP, NAS and service processors | Every edition | Discoveries | Discovery without credentials |
| 353 device types | Every edition | Devices | Discovery without credentials |
| Active Directory as a discovery target | Enterprise | Discoveries | Discovery without credentials |
| Network Dependency Mapping | Enterprise | Networks | Mapping and the directory |
| Network Routing Map | Enterprise | Networks | Mapping and the directory |
| Application Relationship Mapping | Enterprise | Applications | Mapping and the directory |
| Directories | Enterprise | Directories | Mapping and the directory |
| People | Enterprise | People | Mapping and the directory |
| Windows benchmarking with DISA STIGs | Enterprise | Benchmarks | Is it configured the way it should be? |
| Active Directory security | Enterprise | Directories | Is it configured the way it should be? |
| Four new standards control sets | Enterprise | Standards | Is it configured the way it should be? |
| Domains | Enterprise | Domains | Domains, vendors and certificates |
| Vendors | Enterprise | Vendors | Domains, vendors and certificates |
| Certificates matched to web servers | Enterprise | Certificates | Domains, vendors and certificates |
| OpenStreetMap-based maps | Professional and Enterprise | Maps | Maps and in-app help |
| In-application documentation | Every edition | GUI | Maps and in-app help |
The new engine identifies equipment from the protocols it already speaks. Most of it needs no credential, and credentialed auditing is all still here.
Open-AudIT scans the target. Every probe is gated on an open port, so helpers are never called speculatively and a network of Windows machines is never bothered with PLC probes.
The matching helper identifies the device from the protocol's own reply, and the full parsed response is kept in the discovery log as JSON. The evidence for every identification is one click away.
SSDP discovery now retrieves the device's own webpage, and NAS devices and server service processors are identified too.
A baseboard management controller now identifies itself without credentials. Redfish, IPMI and Intel AMT are all probed.
Even a device that says nothing at all usually ships a self-signed TLS certificate that names its vendor. Open-AudIT reads that too.
Open-AudIT identifies PLCs and SCADA devices over their own industrial protocols, including BACnet, Modbus, S7 and EtherNet/IP.
Open-AudIT splits a large range into smaller subnets and scans them in parallel. The TCP and UDP port lists are longer too.
ARP discovery uses the server's own table. When a credentialed audit reads a switch, router or computer, every in-range address in its tables is queued for a scan of its own.
Active Directory networks and locations can now be used as discovery targets, and Collectors now run on Windows.
Open-AudIT 6 knew 98 device types. Version 7 knows 353, so PLCs, access control systems and NVRs get a type of their own, and so does the stray game console. You can filter on any of them.
Everything here is drawn from data Open-AudIT already holds, from discovery, your credentialed audits and your directory.
Each device on the map shows its name, address, connected port and status, with the network's DHCP, DNS, gateway and IP counts alongside.
The map is built from what discovery and your credentialed audits of the network gear learned, so the more completely your switches are audited, the truer the drawing.
Where Network Dependency Mapping shows what each device connects to, the Network Routing Map shows how your networks connect to each other.
An application is never just one server. Model each one as its components. That means the website, the API behind it, the database it reads and the cloud services it sits on. Each relationship gets a plain name, such as runs-on, uses-database or uses-certificate.
Open-AudIT only offers discovered, available servers and their related databases, so there is no free-text guesswork. A search across every component answers "which applications does this server carry?" before the change window.
Point Open-AudIT at Active Directory and it reads users, groups, computers, domain controllers, sites and subnets, then keeps a history as they change. Entra is supported as well.
The summary tracks accounts not logged on for more than thirty days, passwords set never to expire, group membership changes in the last seven days, and who is in Administrators, Domain Admins and Enterprise Admins.
Directory users populate the new People collection, each with their details from the directory and the devices they use.
Discovery tells you what is on your network. The Linux benchmarks from Version 6 carry forward, using OpenSCAP profiles including CIS Benchmarks, DISA STIG, NIST 800-171 and ACSC Essential Eight.
Windows machines are benchmarked as a side effect of being audited, with nothing extra to configure. Results are graded by severity and marked pass or fail.
Active Directory is benchmarked against the DISA STIGs, alongside Windows. Results are in the Security view on the directory's page.
ISO 27001 ships with 93 controls. Version 7 adds four more control sets. CBDDO (660 controls) and BDDK (319) cover T眉rkiye, NCA ECC (174) covers Saudi Arabia, and ASD Essentials covers Australia. That makes 1,304 controls across five standards.
Open-AudIT now tracks the domains you renew, the companies you buy from and the certificates your web servers use.
Each domain records who it is registered through, the certificate securing it, when it expires and when renewal work should start, with a status of Active, Due For Renewal or Expired.
Vendors used to be a list of software vendors for filtering vulnerability retrieval. It is now a register of contact, legal and payment details, linked to the things each vendor supplies, and domains link to their registrar.
Certificates record issuer and fingerprint. Open-AudIT matches them to the web servers using them, by serial from the device audit, and marks a certificate active while any device still uses it.
The geographic map uses OpenStreetMap based tiles instead of Google Maps. Give your locations coordinates and the map works. The maps_api_key configuration item has been removed.
Every feature has a Learn About page in plain English: what it is, what it does, why you would use it and how. The FAQ pages have been revised to match, and the documentation describes the shipping code.
For the full story on the discovery engine, see Learn About Credentialless Discovery in the application help.
Credential-free discovery is in every edition, including Free on up to 100 devices.
Enterprise 路 free for your first 30 days. The full product and unlimited devices from day one. When the trial ends, Free keeps working on up to 100 devices.