Xavier now manages Linux, and shows its work
Full Linux support, plus the blast radius of every change before you save it, a time machine for every device, Why? for every outcome, and audit evidence in one click.
Xavier now manages Linux machines, right next to Macs, iPhones, iPads, Apple TVs, Android devices and Windows PCs, in the same console.
It also ships a set of tools for two of the hardest parts of the job: changing things without breaking them, and explaining what happened afterward. You can see the blast radius of a change before you save it. You can see any device as it was on any day. You can ask Why? about any outcome on any device. And you can hand your auditor a complete evidence report in one click.
Every screen below is interactive, so go ahead and click around. They’re built from the Xavier console’s own labels and wording, so what you do here is what you’d do there. The fleet is made up. The behavior isn’t.
Linux, all the way in
Macs, iPhones and Windows PCs have a management channel built into the operating system. Linux doesn’t, so on Linux the Xavier agent is the management channel. It enrolls the machine, reports on it, applies policy and runs commands. You get an install command from the console. It only works once and expires after a day. Run it as root, and it installs the right package for your distribution, checks the download and enrolls the machine.
- Distributions: Ubuntu, Debian, Fedora, Red Hat Enterprise Linux, Rocky, AlmaLinux, SUSE and the other major distributions, on x86-64 or ARM64, desktop or server.
- Policy: screen lock, firewall, updates, SSH, sudo, browsers, certificates, Wi-Fi, 802.1X and VPN. If someone changes one of those settings by hand on the machine, the agent puts it back.
- Security: disk encryption recovery keys, a managed local administrator, a hardening baseline, and the same app blocking, network filter and removable storage rules your Macs and PCs get.
- Software and commands: install apps from your catalog, schedule OS updates, run scripts, restart, lock, lost mode, erase and log collection.
- Remote shell: a terminal on any Linux machine, as root or as the signed-in user. Every keystroke is recorded to storage you own.
- Trust: each machine has its own identity certificate, kept in its TPM when it has one. The agent updates itself, and you get an alert if it’s disabled, removed or replaced.
Enrolling a lot of machines at once? There’s a reusable token for provisioning scripts and VM images, an unattended install file for Ubuntu, Fedora or RHEL that also encrypts the disk, and the option for the person at the machine to sign in with your identity provider.
Linux machines aren’t stuck in their own corner of the product, either. The first three demos below all use them.
See the blast radius before you hit Save
Every admin has a story about the change that reached a lot more devices than they expected. You edit a group, and a profile you forgot was attached to it lands on 300 laptops. You tighten a firewall, and half the build farm stops answering.
In Xavier, every profile, policy, rule and group edit opens a preview before anything is sent. It shows which devices get the change for the first time, which get the new version, and which lose it. It also shows what could go wrong, and what people will actually notice.
Below is a Linux firewall policy that covers a group of build servers and a group of engineering workstations. Change it however you like: remove a port, add a group, or apply it to every Linux machine. Then click Save policy and see what Xavier tells you.
Editing a Linux policy in the Xavier console
Inbound connections are blocked except the ports below. Outgoing traffic and replies are never blocked. Leave SSH (22/tcp) open if you reach these machines over SSH.
Here’s what to look for in that preview:
- It knows which changes can cut devices off. A wrong firewall, Wi-Fi, VPN, proxy or certificate change can leave a device unable to reach Xavier, which means Xavier can’t reach it to undo the change. The preview warns you, and if a change like that reaches more than your threshold (10 devices by default), Xavier won’t send it everywhere at once unless you roll it out in rings or explicitly accept the risk.
- Big changes make you type the number. If a change reaches more than 100 devices, or every device, you have to type the device count to save it. It’s hard to type a number without reading it first.
- It counts people, not just devices. “57 people may lose network connections the firewall now blocks” is the line that makes you think twice.
- Rings stop themselves. Your first ring gets the change right away, and each ring after it waits until the one before has it. If the devices that got it stop checking in, fail the change or fall out of compliance more often than the rest of the fleet, the rollout pauses on its own and alerts you by email, Slack, Teams, Google Chat or webhook. Rolling back is one click.
- On Linux, the firewall has a safety net. If a machine can reach Xavier before a firewall policy is applied but not after, the agent undoes the policy on its own and reports why.
Undo works across the whole fleet, too. Each device goes back to where it was before the change, including profiles the change removed. Anything undo can’t take back, like a disk that has already been encrypted, is named before you push the change and again before you undo it.
A time machine for every device
“Was this machine encrypted in August?” “When did it get the new kernel?” “Who put it in that group?” Questions like these usually mean digging through logs, if the logs still exist.
Xavier keeps every real change to every device: OS version, packages, apps, profiles, certificates, security settings and group memberships, along with what caused each change. Noise like battery level, free disk space and check-ins is never kept. Pick a day to see a device as it was then. Pick a second day to see exactly what changed in between.
Here’s a Linux build server. Drag the slider back in time, or pick a date to compare with.
Device history in the Xavier console
Pick a date to see the device as it was then, and another to compare.
The same history powers the fleet view, which turns raw changes into plain sentences like “212 Macs updated to macOS 26.1” or “Zoom removed from 14 devices.” It also shows which groups a device belonged to, and which configuration applied to it, on any date. It’s also what lets the audit report further down describe your fleet on any day in the past, and not just today.
Why?
The hardest question in device management is “why didn’t it get it?” The answer is usually spread across a scope rule, a push notification, a check-in, a vendor error code and a log you have to go request.
Next to every command, profile, policy, script and compliance result in Xavier, there’s a Why? button. It traces the outcome step by step, from scope to applied. It stops at the step that broke, explains it in one sentence, and puts the action that fixes it right there.
Here’s the firewall policy from the first demo, two hours after version 5 went out. The devices that don’t have it yet are grouped by the reason. Click a reason to filter the list, or click Why? next to any machine.
A policy’s devices, and Why?, in the Xavier console
Linux policy · version 5 · Build servers, Engineering workstations
96 of 104 devices on v5, saved 2 hours ago.
Confirmed by the Xavier agent reporting the policy applied.
Why the rest are not there yet
For a single command on a single Mac, the trace looks just as plain. The Mac was in scope because it’s a member of Engineering Macs, and its department is Engineering. Xavier queued the command, Apple accepted the push, and the Mac checked in 4 seconds later and took the command. It failed at the response step, because the certificate this Wi-Fi payload needs isn’t on the device. Apple, Windows and Android error codes are translated into plain words from the vendors’ own documentation. You can also watch a command live while it runs, with each step appearing as the device reports it.
One click. Everything your auditor asks for.
Audit season usually means a week of screenshots, CSV exports and spreadsheets stitched together by hand. Xavier turns all of that into one button. The report covers every device and its security checks, the devices you removed and what happened to them, people who don’t have a managed device, and every change to your security settings with who made it. Every check is mapped to the controls your auditor tests.
Pick your frameworks and what you want to report on, then click Generate report.
The audit evidence report in the Xavier console
SOC 2 and ISO 27001 evidence: every device, its security posture, offboarding and changes
The report can describe how your devices are right now, how they were on any past date, or everything across your audit window. That last option includes the date each failing check was first seen and the date it was fixed. It covers SOC 2, ISO 27001, CIS Controls, NIST 800-53, HIPAA, PCI DSS and UK Cyber Essentials, plus ISO/IEC 42001 for the sections on AI tools. For every device you removed, it records who removed it, when and why, and whether a wipe was sent and acknowledged.
The hashes are what make it evidence and not just a spreadsheet. Anyone can check that the files are exactly the ones Xavier produced, and the report ID and hashes stay in History after the download expires. If your auditor would rather do it themselves, give them a read-only seat and they can generate the report on their own.
Try it on a fleet that’s already there
All of this is live today. The operations page walks through each feature, and the live demo has previews, rollouts, Why? and history running on sample devices you can click through without signing up. When you’re ready to see it on your own Linux machines, Macs, PCs and phones, start a trial.