Know which servers are vulnerable — and which are being exploited.
Statance checks installed software against OSV.dev, CISA’s Known Exploited Vulnerabilities catalog and endoflife.date, flags suspicious processes, and scans your websites every day. Uses the same Linux agent — nothing extra to install.
Actively exploited vulnerability or malware detected
End-of-life software or a suspicious process
Known CVEs with fixes, missing headers, or updates available
Know when your stack stops getting security fixes
The agent reports the installed versions of security-relevant software. Statance flags anything past end-of-life — using data from endoflife.date — or behind the latest patch release.
CVE matching that respects distro backports
Exact distro package versions from dpkg, rpm or apk are checked against the OSV.dev database. Because the distro’s own advisories are used, backported fixes are recognised — fewer false alarms than matching on version strings.
- Ubuntu
- Debian
- Alpine
- RHEL-family (AlmaLinux, Rocky)
Immediate alerts for vulnerabilities exploited in the wild
Statance syncs CISA’s Known Exploited Vulnerabilities (KEV) catalog daily. If any package on your servers has a CVE that is being actively exploited, you get an immediate alert — including when CISA adds a new entry, without any change on your server.
- Daily KEV catalog sync
- Alerts through your existing recipients
- Re-checked against every server automatically
Spot likely crypto-miners and malware patterns
Statance flags processes that look wrong: known miner names, binaries running from /tmp, /var/tmp or /dev/shm, and processes whose executable has been deleted. The AI assistant can help triage what it finds. If ClamAV is installed, its detections are reported too.
A daily check of your public websites
Every day, the sites behind your HTTP monitors are scanned for common, easily-exploited mistakes.
- Exposed .git or .env files
- Missing HSTS, CSP, X-Content-Type-Options and frame-protection headers
- Outdated WordPress core
Findings where you already work
See everything on the dashboard at /app/security, pull findings from the API with GET /v1/security/findings, or ask your AI agent via the MCP tool get_security_findings.
What’s included on each plan
| Security | Free | Pro | Business |
|---|---|---|---|
| Security issue counts by severity | ✓ | ✓ | ✓ |
| Outdated & end-of-life software | — | ✓ | ✓ |
| CVE monitoring (OSV.dev) | — | ✓ | ✓ |
| Actively exploited (CISA KEV) alerts | — | ✓ | ✓ |
| Suspicious process detection | — | ✓ | ✓ |
| Daily website security scan | — | ✓ | ✓ |
Honest limitations
Is this antivirus?
No. Statance does not scan files for malware signatures and does not block or remove anything. It flags suspicious process patterns (such as known miner names or binaries running from /tmp) and reports ClamAV detections if you have ClamAV installed. It will not catch all malware.
Which plans include security monitoring?
Pro and Business get full findings, alerts and website scans. On the free plan you can see how many issues were found on your servers, counted by severity.
How often are servers checked?
The agent reports package and process information every 6 hours. The CISA KEV catalog is synced daily, so a newly listed exploited vulnerability is matched against your servers without waiting for the agent. Website scans run daily.
Which operating systems are supported for CVE monitoring?
Ubuntu, Debian, Alpine and RHEL-family distributions such as AlmaLinux and Rocky Linux. All security checks — including end-of-life and outdated-version checks — currently run on Linux servers only; the Windows and macOS agents don’t send the software inventory.
Will I get false positives?
Fewer than with version-string matching, because exact distro package versions are checked against OSV.dev and distro backports are respected. Suspicious-process findings are heuristics, so treat them as leads to investigate — the AI assistant can help.
Does Statance fix vulnerabilities for me?
No. Statance tells you what is affected and how severe it is; patching is up to you. It never changes anything on your servers.
Is this a penetration test or compliance audit?
No. The website scan checks a small set of common mistakes (exposed .git/.env, missing security headers, outdated WordPress core). It is not a penetration test and does not certify compliance.
Data sources: OSV.dev, CISA Known Exploited Vulnerabilities catalog, endoflife.date.
Patch what matters first.
Security monitoring is included on Pro and Business. Start free and see how many issues your servers have today.