The Zonitix Agent
A small agent runs on each Mac, Windows PC and Linux host and reports what it is: hardware, OS build, disk and memory, alongside a real security read (FileVault, SIP and Gatekeeper on Mac; SELinux/AppArmor, LUKS and Secure Boot on Linux; BitLocker, firewall and Defender on Windows). Every check-in is signed with a per-device key that your instance verifies. macOS, Linux and Windows are all available now.
Zonitix Agent
Ava’s MacBook Pro
This Mac
Software updates
1 update available
macOS 26.3
Fleet & enrollment
The catalog goes live
on every machine.
A small agent runs on each Mac, Windows PC and Linux host and reports its own truth: model, serial number (a machine ID on Linux), OS build, memory and disk, and a real security read (FileVault, SIP, Gatekeeper and the firewall on Mac; BitLocker, the firewall and Defender on Windows; SELinux/AppArmor, the firewall, LUKS disk encryption and Secure Boot on Linux). Each build carries a Zonitix release signature that your instance checks before hosting it. Every check-in is signed with a per-device key that your instance verifies, and the private key is never sent off the machine. It turns a hand-kept device list into an inventory the machines keep current, every 15 minutes by default.
It reports first. No hardening setting is applied and no command runs until an administrator turns one on or queues one. The agent updates itself only to a version your administrator has adopted. An admin can queue a short list of audited commands — restart, install OS updates, rename, uninstall the agent, and on Windows and Linux lock the screen. It is not an Apple MDM — it pushes no Apple configuration profiles and never wipes a device. Optional hardening enforcement and Apple MDM are separate, opt-in layers (below).
- Identity
- Per-device key
- Check-in
- 15 min default
- Posture
- Disk + firewall
macOS
macOS 13 (Ventura) or later, on Apple silicon or Intel. A menu-bar app plus a root daemon. The device key is held in the Secure Enclave where the Mac has one and the build is signed for it; otherwise it is a software key.
Linux
A headless systemd daemon: a single static 64-bit binary for distributions that use systemd. Reports machine facts plus SELinux/AppArmor, firewall, LUKS disk encryption and Secure Boot. Key held in a root-only file.
Windows
An MSI-installed service plus a system-tray app. Reports BitLocker, firewall and Defender, and escrows the BitLocker recovery key. Software key (no TPM). A 64-bit agent. Narrower than macOS.
Phased agent rollouts
Ship a new agent version to a pilot ring first, watch how many devices land on it, then widen — or hold a ring so that version stops being offered. Updates are forward-only: the agent floor blocks downgrades, so a rollout can’t walk a machine backward.
Static & smart device groups
Group devices by hand, or by rule — OS and version, model, owner, compliance state, free disk, days since last check-in, an installed app — and scope rollouts and profiles to them. A smart group is worked out again each time it is read, from what each device last reported.
Fleet-wide software inventory
See which listed application and version is installed on which device, drill into a title, and export the list as CSV. Each device lists up to 2,000 entries: the Applications folder on a Mac, the programs registered with Windows, the dpkg or rpm packages on Linux. It doesn’t install or remove software.
Report the gap.
Then close it.
Reading FileVault and firewall state is half the job. Put devices in a hardening profile and the agent enforces the settings you chose on every check-in — firewall, screen-lock, Gatekeeper, disabled guest and risky remote-access, automatic-update settings — and corrects drift when someone turns a control back off. All with native OS tooling, as root or SYSTEM: no MDM required. Several of these settings are mapped to SOC 2 and HITRUST controls, and the Profiles page shows which.
Opt-in, and only what you choose. The agent applies no hardening setting until you put a device in a hardening profile, and each control is one you picked. On a Mac that can include turning Remote Login (SSH) off; on Linux the agent never changes SSH. Switching a profile off stops the agent applying it; settings already applied stay as they are.
On Linux the enforced set is firewall (inbound traffic denied by default with SSH allowed, so other inbound services need their own rules), fail2ban, auditd, time-sync and automatic security updates. On Windows it is the firewall, Microsoft Defender real-time protection and automatic Windows Update; Gatekeeper, screen lock and the guest, auto-login and remote-access controls are macOS only. The Mac screen-lock setting is best-effort: the agent writes it for the signed-in user, and only Apple MDM can lock it. Disk encryption is reported; the agent does not switch it on.
When you need Apple’s managed controls.
The Zonitix agent needs no MDM on its own. When you need what only Apple MDM can do — push configuration profiles, or remotely lock and wipe a lost Mac — Zonitix runs a managed Apple MDM alongside it, built on the open-source NanoMDM engine. Unlike your instance, the MDM is one Zonitix-operated service shared across customers, with each customer’s devices in a separate tenant — see the Trust Center for what it holds.
Enrollment
An enrollment profile per tenant, behind a per-tenant token and enrollment challenge, with each device bound to one tenant.
Configuration profiles
Install and remove Apple configuration profiles across enrolled Macs.
Remote lock & wipe
Lock a lost Mac with a PIN, or erase it — Apple’s own managed commands, each written to an attributable, append-only audit record.
Your push certificate
Upload your Apple APNs certificate; the private key rests only in the MDM, never in the app.
Where it stands. Apple MDM is in preview — tested end-to-end on our own test Mac, with real enrollment, configuration-profile delivery, and remote lock and wipe, each written to an audit record. The Zonitix agent has its own reversible screen-lock command for Windows and Linux computers; on a Mac running current macOS that command reports failed, so a Mac is locked through Apple MDM. Today you supply your own Apple push certificate. FileVault recovery-key escrow through Apple MDM is part of this preview (stored encrypted, with an audited reveal and key rotation), but unlike the items above we do not yet list it as validated end-to-end, so don’t plan around it yet. Not yet included: zero-touch (DEP) enrollment, and Apple MDM is Mac-first. Recovery-key escrow already ships on Windows — the Zonitix agent escrows the BitLocker recovery key to your instance, stored encrypted at rest, with a separately-gated, audited reveal. We’ll say Apple MDM is generally available when it is.
Told when something changes, not when you go looking.
- Alerts by email
- With outgoing email set up, you are emailed when a device is waiting for approval, goes silent, falls out of compliance or has encryption off, and before an Apple push certificate or an enrolment token expires.
- Fleet trend
- One snapshot of the fleet a day, from the same numbers the overview shows. It gives you the line an auditor asks for: encryption coverage over the period.
- Staged settings rollout
- Roll a settings profile out to a pilot group first, then promote it. Pause, resume or roll back at any stage; every action is audited. A roll-back restores the earlier profile and leaves on what the agent already switched on.
- Enrolment approval
- A newly enrolled device waits for your approval before it is trusted. When a laptop reserved for a new hire enrols, Zonitix suggests the match for you to confirm.
- Minimum versions
- Set the oldest operating system and agent version you accept per platform. Below the OS minimum a device is out of compliance; below the agent minimum its checks read as not reported.
Devices
Inventory
Product demo · sample dataTotal devices
0
enrolled
Online
0
checked in recently
Needs attention
0
at least one open issue
Not compliant
0
posture · OS update · min OS
2 computers are reserved for new hires — they become managed devices when they enroll.
Fleet (0)
Ava’s MacBook Pro
macOS 26.2 · Apple M2 Max · C02ZX••••H7L
MacBook Air
macOS · serial FVFJ4••••Q6
OSEI-LAPTOP
Windows 11 · PF3••••7R
ops-linux-01
Linux 24.04 · 9f3a••••c2e1
Track every laptop
back to a person.
A hardware catalog assigns devices during onboarding and links each to its owner. When someone leaves, offboarding flags the equipment to reclaim — so nothing walks out the door untracked.
- Catalog
- All Hardware
- Assign
- To owner
- Return
- On Exit
See it running on a live instance.
A 30-minute walkthrough on a live Zonitix instance — no slides, no commitment.
In the walkthrough
What a device reports
Hardware, OS build, disk and memory, on Mac, Windows and Linux.
The security read
Disk encryption, firewall and the other protections on each machine.
The hardening baseline
Opt-in, for teams that want to enforce and not only report.
The device catalog
The agent fills in the list of hardware you already keep.