Scan your servers
from the inside.
Openness reads the software installed on your Linux and Windows servers, matches it against vendor advisories and explains every finding. An open source alternative to Nessus.
$ curl -fsSL https://raw.githubusercontent.com/s4e-io/openness/development/install.sh | shSHA256SUMS and installs to ~/.local/bin. Run the collector as root for fuller evidence.The collector and resolver repositories are public on GitHub, under the Apache License 2.0. Openness is in beta: commands and file formats may still change between releases.
Collector, evidence, resolver.
Findings you can check.
Collection and matching are separate steps. You can read the evidence before anything leaves the host, and every finding says why it is there.
1. Collector
2. Evidence
.openness JSON file. Check it with openness validate and openness inspect before it goes anywhere.3. Resolver
4. Explainable findings
unknowns[], never reported as clean.# On the host: collect evidence$ openness collect --output ./host.openness # With the resolver: fetch only the advisories this host needs, then resolve$ openness feed sync --for host.openness$ openness resolve --input host.openness --output findings.json
What it never does.
The collector looks, it does not touch. It does run the host's own read-only OS tools, such as dpkg-query, rpm -qa and powershell.exe with CIM, registry and WUA queries.
Tested, and not tested yet.
Native collection runs on Linux and Windows. This is exactly where Openness has been tested so far.
| Component | Platform | Status |
|---|---|---|
| Collector | Ubuntu 22.04 arm64 | Tested (primary Linux lab) |
| Collector | Ubuntu 22.04 amd64, Docker arm64 | Smoke tested |
| Collector | Windows Server 2022 amd64 | Tested (primary Windows lab, also end to end in S4E) |
| Collector | macOS arm64 | Build and CLI helpers only, no native full collect (use Docker) |
| Resolver | Linux amd64 (Docker) | Tested, end to end in S4E |
| Resolver | macOS arm64 | Tested manually (feed sync + resolve of Windows Server 2022 evidence) |
| Resolver | Linux arm64 | Built, not separately tested |
| Resolver | Windows amd64 | Built, not separately tested |
Not tested at all
Coverage today
Windows is checked at OS build level (cumulative update). Not covered yet: .NET, Office, Edge, SQL Server, Exchange, Windows 8.1 / 7 ESU and Hotpatch baselines.
Red Hat family (CSAF / RPM) and macOS hosts are on the roadmap, not supported yet.
Outside and inside,
in one Full Scan.
Credentialed scanning in the S4E app runs the collector and the resolver for you. Scanning inside the server is available on paid plans.
1. Add a server login
2. Run a Full Scan
3. Read the findings
Upload evidence from the command line.
Store a token from the API Token page with openness login, then let the collector upload its evidence to S4E.
$ openness login$ openness collect --upload --api-url https://api.s4e.io/api/openness/ingest
Today S4E stores the uploaded evidence for the beta programme. It does not yet resolve it or return findings through the API. Returning results through the API is planned, not shipped.
To get findings now, run the resolver yourself, or use credentialed scanning in the S4E app (Asset, Server login, then Full Scan with From the internet + inside the server).
Open source.
Apache License 2.0.
Apache License 2.0
Openness (collector and resolver) is licensed under the Apache License 2.0, a permissive open source license. Developed and maintained by S4E.
Read the license →Use it for anything
Personal, research, education and commercial use are all allowed. Modify it, redistribute it, build it into your own products or services. The license includes an express patent grant from the contributors.
What it asks of you
Keep the LICENSE and NOTICE files and their attribution when you redistribute, and state any changes you made. The software is provided as is, without warranty.
View the repositories →This is a plain-language summary, not legal advice. The license text in each repository is what counts. Third-party components keep their own licenses, listed in the NOTICE file of each repository.
Openness is in beta
The collector and resolver are public repositories on GitHub under the Apache License 2.0. Beta means the CLI, the .openness schema, the findings contract and the API may still change between releases, and platform coverage is partial and stated exactly.
In the S4E app, everything built on Openness is labelled beta: server login, From the internet + inside the server, and the Inside the server results.
Or let S4E
run it for you.
External Scanning
Manual scans of your internet-facing assets, from the outside, like an attacker.
AI-based CTEM
S4E keeps watching: continuous scanning, prioritised actions and AI fix guidance.
Credentialed Scanning
Add a server login and S4E also looks inside the server for outdated, vulnerable software.