WithSecure Server Security for Linux Corporate

What is included in WithSecure Server Security for Linux Corporate?

Real-time malware scanning – Checks files in defined paths on open, close and execution.
Manual and scheduled scans – Weekly full-system scans from Policy Manager or the fsanalyze command.
Integrity checking (HIPS) – Cryptographically signed baseline blocks or reports tampering with protected files.
Cloud reputation lookups – WithSecure Security Cloud (ORSP) adds file reputation to local detection.
Command-line administration – lsctl utility configures standalone hosts without Policy Manager connection.
Important – No EDR, firewall, patch management or Windows server coverage included.

What are the main benefits of WithSecure Server Security for Linux Corporate?

WithSecure Server Security for Linux Corporate is the Linux server component of WithSecure Business Suite, technically delivered as Linux Security 64 and sold as F-Secure Linux Security before the corporate business of F-Secure was renamed WithSecure in 2022. It is managed on premises through WithSecure Policy Manager, or locally from the command line on hosts without a console connection.

On-premises control – Policies, alerts and updates run through your own Policy Manager Server.
Rootkit and tamper detection – Modified system utilities or account files trigger administrator alerts.
Package-aware baseline – Baseline updates automatically during apt or dnf package upgrades, avoiding false alarms.
Air-gapped deployment – Content packages install and update hosts without internet access.
Syslog-ready alerting – Alerts carry syslog priorities, from informational up to security alert.
Path to Elements – Built-in migrator moves hosts to WithSecure Elements when requirements grow.

Which company size is WithSecure Server Security for Linux Corporate suitable for?

The product fits organisations that operate their own Linux web, file or application servers and administer them centrally with WithSecure Policy Manager, often alongside other Business Suite components for Windows. Small businesses with one or two Linux hosts can run it standalone via the lsctl command line, but then carry the configuration work themselves, because real-time scanning covers no files until an administrator defines the paths to protect.

Does WithSecure Server Security for Linux Corporate meet the requirements of Swiss cybersecurity legislation?

Since 1 April 2025, the revised Information Security Act obliges operators of critical infrastructure in Switzerland to report cyberattacks to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery; most other companies are not directly subject to this obligation. The product supports the documentation side of such a report: detections from real-time scanning are recorded in access.log, and all product services write events to syslog, so the time and type of a malware finding on a Linux server can be traced. Integrity checking alerts additionally show when a protected system file was modified, which helps establish when an intrusion was noticed. The product does not detect attacks that use no malicious files, does not correlate events across several hosts, and neither handles the incident nor submits the report to BACS. This information does not constitute legal advice; whether and how your organisation is affected should be assessed by a qualified specialist.

Does WithSecure Server Security for Linux Corporate meet the requirements of European cybersecurity legislation?

No security product creates NIS 2 compliance on its own, because the directive requires risk management measures that the management body of an organisation must approve and oversee. The NIS 2 Directive lists measure categories such as incident handling, business continuity, supply chain security, vulnerability handling, basic cyber hygiene, cryptography, and access control. WithSecure Server Security for Linux Corporate contributes to cyber hygiene through malware protection on Linux servers and to incident handling through detection alerts and syslog records. Its integrity checking helps detect unauthorised changes to system files on protected hosts. It does not cover vulnerability and patch management, backup and continuity, multi-factor authentication, encryption, or endpoint detection and response, so these measures need other tools and processes.

Does WithSecure Server Security for Linux Corporate help with security questionnaires from large customers?

Partly: it answers the questions on malware protection and file integrity for Linux servers, but not those on detection and response, patching, or Windows systems. Questions it can answer with a clear yes are whether anti-malware runs on the Linux servers with automatically updated definitions, whether protection is centrally managed with settings users cannot override, whether critical system files are monitored for unauthorised changes, and whether security events are logged. Questions it cannot answer are those about EDR or continuous monitoring, vulnerability and patch management, host firewalling, protection of Windows servers and workstations, backup, and multi-factor authentication. Where a customer demands EDR, the more economical route is usually to stay with the same vendor and move the Linux hosts to WithSecure Elements with the built-in migrator, rather than running a second vendor's agent on the same servers. Windows endpoints can be covered by other Business Suite products managed from the same Policy Manager.

Which limitations should you know before buying?

WithSecure's documentation lists no country- or region-limited features for this product. With default settings, real-time scanning does not scan any files: only the files and folders an administrator enters in Policy Manager or via lsctl are protected, so an untuned installation offers far less protection than it appears to. Only 64-bit distributions that are still supported by their vendor are covered, and SELinux is supported only on the listed distributions, while other distributions require SELinux to be disabled. The current version has no web interface, so administration runs through Policy Manager Console or the command line. The follow-up purchases most often needed are EDR, protection for Windows servers, and a patch management tool.

Frequently asked questions about WithSecure Server Security for Linux Corporate

Does WithSecure Server Security for Linux Corporate need an internet connection?

Cloud-based detection requires internet access, and the hosts must be able to reach all addresses under *.fsapi.com. Managed hosts normally receive updates from Policy Manager Server and fall back to WithSecure update servers directly if Policy Manager cannot be reached.

Does it detect Windows malware on Linux file servers?

Yes, WithSecure states that the product protects mixed environments against both Windows and Linux malware, and real-time scanning also covers files on network drives. This matters for Samba or NFS file servers that store files later opened on Windows workstations.

Can scanning be offloaded from busy servers?

Yes, the product supports offload scanning, sending scan requests to one or more ICAP servers with a configurable response timeout. This reduces the scanning load on servers that handle large numbers of file accesses.