Open-AudIT 7 finds the devices you didn't know about, audits the ones you manage, uses AI to match their software to known vulnerabilities and checks them against ISO 27001 and the DISA STIGs.
Enterprise · free for your first 30 days. The full product and unlimited devices from day one. When the trial ends, Free keeps working on up to 100 devices.
Know which CVEs affect the software you actually run, and whether each machine is configured the way your auditor expects, before the audit.
AI matches the software installed on each device to published CVEs and alerts you to the ones that affect you.
Each machine is checked against a published standard, every rule graded by severity and marked pass or fail.
Version 7 is built around discovery. Every identification comes from what the device itself said, and Open-AudIT keeps what it said. Step through how one helper reads one port.
If it is connected to the network and uses TCP/IP, something has to know it is there.
Credential-free identification tells you what a device is. A credentialed audit reads what is on it, and its switch and router tables feed ARP discovery and the network map.
| Method | Reaches |
|---|---|
| SNMP | switches, routers, printers and UPS |
| SSH | Linux, Unix and network devices |
| WinRM, winexe / psexec, WMI, SSH | Windows |
On Enterprise, what discovery found becomes the network drawn as it is, applications modelled from their real components, and your directory on one screen.
Pick a subnet and see the whole chain, router to switch to wifi to every device.
Each device on the map shows its name, address, connected port and status, with the network's DHCP, DNS, gateway and IP counts alongside.
The map is built from what discovery and your credentialed audits of the network gear learned, so the more completely your switches are audited, the truer the drawing.
Model an application as its real, discovered components.
An application is never just one server. Model each one as its components. That means the website, the API behind it, the database it reads and the cloud services it sits on. Each relationship gets a plain name, such as runs-on, uses-database or uses-certificate.
Open-AudIT only offers discovered, available servers and their related databases, so there is no free-text guesswork. A search across every component answers "which applications does this server carry?" before the change window.
Users, groups, computers, domain controllers, sites and subnets on one screen, with change history.
Point Open-AudIT at Active Directory and it reads users, groups, computers, domain controllers, sites and subnets, then keeps a history as they change. Entra is supported as well.
The summary tracks accounts not logged on for more than thirty days, passwords set never to expire, group membership changes in the last seven days, and who is in Administrators, Domain Admins and Enterprise Admins.
Enterprise
Discovery tells you what is on the network. Benchmarks tell you whether each machine is configured to a published standard, graded by severity and marked pass or fail, with the evidence kept.
Vulnerability detection, on Professional and Enterprise, carries forward from Version 6. It uses AI to match CVEs to the devices you have discovered and alert you to the ones that affect you.
Discovery finds the devices. These keep the inventory useful after that, each marked with the edition that includes it.
Credential-free discovery is in every edition, including Free on up to 100 devices. Professional adds automation, vulnerability detection and commercial support. Enterprise adds mapping, directories and benchmarking.
Enter how many devices you expect discovery to find, tick what you need, and the matching edition is marked below.
$0
After your 30-day Enterprise trial, keep going free on up to 100 devices.
Enterprise · free for your first 30 days. No device cap. When the 30 days end, buy a licence, ask us for an extension or move to Free. Activation asks for your email address. Privacy policy
From $750 USD
Everything in Free, plus automation, dashboards and vulnerability detection.
From $950 USD
Everything in Professional, plus mapping, your directory and benchmarking.
Open-AudIT tells you what is on your network, how each device is configured and when that changes. It runs on a server you control, scans your networks for devices, audits what it finds and stores the results in a database you can query, report on and export. It needs no agent on the devices it audits, though Enterprise offers one for machines you cannot reach remotely.
Version 7 is built around discovery. A new engine identifies devices without credentials, reading what each device's own protocol says back. That covers smart TVs, security cameras, PLCs, building controllers, NAS units and the management controllers inside servers. Enterprise also gains Network Dependency Mapping, the Network Routing Map, Application Relationship Mapping, a Directories view for Active Directory and Entra, Windows benchmarking against the DISA STIGs, and registers for Domains and Vendors. Every edition gets 353 device types (up from 98) and rewritten in-application documentation.
No. Open-AudIT 7 upgrades in place from any supported 6.x release, and everything customers rely on in version 6 carries forward. Upgrading also starts the 30-day Enterprise trial. Run the new installer, log in, and you will be taken to the database schema upgrade screen. Take a database backup first. The ip table is renamed to ip_address, but a view named ip is created so existing reports and integrations that read it keep working.
Not to identify them. Open-AudIT 7 reads what each device's own protocol says back, and the parsed reply is kept in the discovery log as evidence. Add credentials and it discovers even more, running a full audit over SNMP, SSH, WinRM, WMI, or the APIs of ESXi, Proxmox, Nutanix and XCP-ng hosts.
Discovery tells you what a device is. An audit reads what is on it. Open-AudIT first checks each target address for open ports, then runs a helper only where its port is open, so nothing is probed speculatively. If you hold working credentials for a computer, an audit script is copied to it and run, returning hardware, software and configuration detail. Switches, routers, printers and UPS units are queried over SNMP instead. Without credentials you still get a record of the device and whatever its open ports revealed.
The credential-free helpers cover PLCs over protocols such as S7, building management over BACnet and KNX, security cameras and recorders, including over ONVIF, server management controllers over Redfish, IPMI and Intel AMT, NAS units, printers, UPS, VoIP phones, smart TVs and media devices, game consoles, smart plugs and lights, access control terminals, fuel tank gauges, solar inverters, and specialist and unmanaged equipment. A device that answers nothing else usually presents a TLS certificate that names its vendor, and Open-AudIT reads that too.
Windows needs an account with administrator rights on the target, with a password set. On a domain, that is a member of the target's Administrators group. Off a domain, it is the built-in Administrator account, or another administrator with a registry change described in the documentation. Linux, Unix and macOS are audited over SSH and need root or sudo to retrieve every attribute. Network gear needs SNMP read access, and v1, v2c and v3 are all supported.
No. Every edition discovers and audits over the network. Enterprise adds optional agents, which are simple scripts that check in with the server each day and audit the machine locally, for Windows, macOS and Linux machines you would rather not open to remote access.
Yes. Version 7 splits large ranges into smaller subnets and scans them in parallel, reads the server's own ARP table, and queues every in-range address found in the tables of an audited switch, router or computer for its own scan. On Enterprise, Active Directory networks and locations can be used as discovery targets, and Collectors run on a remote subnet under the control of a central server, on Linux or Windows.
A 64-bit server, physical or virtual. Supported operating systems are Red Hat 9 and 10, Debian 12 and 13, Ubuntu 24.04, and Windows Server 2016 and later. Windows 10 and 11 are not supported as the server, because the desktop TCP/IP stack throttles the outbound connections discovery relies on. Open-AudIT is also included in the FirstWave VM if you would rather not install anything.
For a responsive install the documentation recommends at least an Intel i7 class CPU, 16 GB of memory, 40 GB of disk and an SSD. It will install and run on anything that can run Apache and MySQL, just more slowly. Memory and fast disk make the biggest difference, because the database does most of the work. Vulnerability detection adds load, as it runs around 20,000 SQL statements at the end of each discovery.
Under ten minutes from download to first discovery, according to the install guides. The installer handles every dependency on Linux and Windows, so there is nothing to install first. On Windows, set the Apache service to run as a regular user account so it can reach network resources. Then log in, activate your licence, add credentials, add a discovery and run it.
Only for two optional features. Vulnerability detection downloads CVE-derived definitions from FirstWave, and News delivers product updates and one-click configuration recommendations. Both send a small, documented set of non-sensitive data back (licence and application details, error logs, and counts of device types and features used, with no IP addresses, OS versions or software names). Both can be disabled, and the Help icon on the Vulnerabilities page shows exactly what is sent. Discovery and auditing run entirely inside your network.
Every edition includes discovery, credentialed auditing, change detection, software licence reporting, device management, custom fields, export to CSV, XML and JSON, and the JSON API. Professional adds scheduling of discoveries and reports, dashboards, vulnerability detection, reporting over a date range, geographical maps and commercial support. Enterprise adds network and application mapping, directories and people, benchmarking, standards reporting, baselines, file change detection, agents, collectors, cloud auditing, role-based access control, Entra and Okta sign-in, rules and custom dashboard widgets. Compare the editions on this page.
Every download of Open-AudIT 7 starts with a 30-day Enterprise licence covering unlimited devices, so you work with the full product from day one. Activation asks for your email address. When the trial ends you can buy a licence, ask FirstWave's sales team for an extension, or move to the Free edition, which covers up to 100 devices. Open-AudIT discovers over the network, so the device count is the number of devices in your inventory, not the number of users.
Free users have the community documentation and forums. Professional and Enterprise include commercial support from the people who build the product. When you open a ticket, attach the Install Support file from the Support page in the application, plus the Discovery Support export if the issue is with discovery. Those two files let support see how your server is running without a round of back-and-forth questions.
Browse to http://<your server>/open-audit/index.php/ (on Windows there are also Start Menu entries). A default administrator account is created at install, and its credentials are listed on the Open-AudIT FAQ page in the documentation. Change that password straight after your first login, then add your own users under Manage, Users.
Benchmarking checks whether a machine is configured to a published standard, graded by severity and marked pass or fail. On Enterprise, Linux servers are checked over SSH using OpenSCAP profiles, and Windows machines get DISA STIG results as part of a normal audit with nothing extra to configure. Windows coverage is Windows 10 and 11, Windows Server 2019, 2022 and 2025, and the Microsoft Windows Security Baseline. Active Directory is also benchmarked against the DISA STIGs, in the Security view on the directory's page.
Yes, on Enterprise. Standards reporting records your answer and evidence against each control and reports completion, with an Excel export for auditors. ISO 27001 ships with 93 controls. Version 7 adds four more control sets, loaded and ready: CBDDO (660 controls) and BDDK (319) for Türkiye, NCA ECC (174) for Saudi Arabia, and ASD Essentials for Australia. Together the five standards provide 1,304 controls.
Yes. Every list exports to CSV, XML or JSON, and the database structure is open and documented. A RESTful JSON API supports create, read, update and delete on every collection, including the six new ones in version 7 (directories, groups, directory security, directory changes, domains and people), which is how customers feed a CMDB. On Linux, Enterprise can also log new devices, component changes and vulnerabilities to syslog in Common Event Format for tools such as Splunk.
They serve different primary jobs. Open-AudIT is a discovery-first inventory and audit tool with built-in network scanning, change tracking, benchmarking and vulnerability detection. NetBox is an IPAM and DCIM documentation platform. Many organisations run both.
Open-AudIT records every IP address it discovers and, in version 7, draws each network with its DHCP, DNS, gateway and IP counts alongside. For dedicated IP address management, FirstWave offers opAddress, an IPAM module integrated with NMIS.
Forty-two, including English, Spanish, Portuguese, German, French, Japanese, Chinese and Arabic. Translations are machine-generated, and FirstWave corrects any you report.
Download the FirstWave VM and start a discovery. No credit card required.
Enterprise · free for your first 30 days. No device cap. When the 30 days end, buy a licence, ask us for an extension or move to Free. Activation asks for your email address. Privacy policy
