Blog · 2026-10-19 · Gardience Engineering

SaltStack SecOps is gone: STIG and CIS compliance on Salt now

SaltStack SecOps (Aria Automation for Secure Hosts) stopped being sold standalone in 2024 and its replacement reached end of life. How to keep scored STIG and CIS compliance on a Salt fleet.

For years, the answer to "how do we do compliance on Salt" was SaltStack SecOps: CIS and DISA STIG content, scans, remediation and reports, sold as an add-on to the commercial Salt console. That answer has expired.

• On January 22, 2024, VMware (Broadcom) announced the end of availability of perpetual licenses and standalone add-ons across its portfolio. The list includes "VMware Aria Automation for Secure Hosts add-on (formerly SaltStack SecOps)" and the "vRealize Automation SaltStack SecOps add-on" (VMware announcement).
• The replacement named there, Tanzu Guardrails, is listed as end of life on October 31, 2024 in Broadcom's KB 413088.
• The commercial Salt console itself has an end of support date of October 2028 (same KB).

If your assessors still expect a STIG score and evidence for every machine, you need a plan for each piece SecOps used to cover.

What a replacement has to cover#

Compliance on a fleet is four jobs, and SecOps did all four:

1. A baseline: which settings each machine must have (CIS benchmark or DISA STIG controls), for Windows and Linux.
2. Scoring: a pass or fail per control per machine, and a score assessors can read.
3. Remediation: fixing failed controls without someone writing a state for each one.
4. Evidence: proof of what was checked, what changed, who approved it, and that the record was not edited afterwards.

Open-source Salt gives you the engine for all four (states can enforce any setting, and test mode reports what differs), but not the content, the scoring, the reports, or the evidence chain.

Option 1: write and maintain the content yourself#

Some teams port the controls they care about into Salt states and use state.apply test=True as the scan. It works, and it is free. The cost is ongoing: every benchmark revision, every new OS version, and a reporting layer on top. And auditors increasingly ask for evidence that the log of changes cannot be edited, which a folder of job returns does not prove.

Option 2: use community formulas#

Projects such as the Salt formulas maintained by government contractors harden machines to DISA STIG very well. They answer "get this box hardened". They are not a scoring, approval, or evidence system, so you will still need the reporting and audit side.

Option 3: a console that does compliance as a feature#

Gardience is a supported console on open-source Salt for Windows and Linux, and compliance is part of it, not an add-on:

• A scored STIG/CIS-aligned baseline on every machine, Windows and Linux, with a fleet-wide view.
• One-click fixes for failed controls, through the same permissions, change windows, and two-person approval as any other change.
• Drift detection and repair: machines are compared with their desired state on a timer, and drift can be corrected automatically.
• A tamper-evident audit log of every action and every machine's result, which forwards to your SIEM.
• A signed evidence pack for auditors, with an offline verifier they can run themselves.
• Fully offline for air-gapped enclaves, with signed releases and an SBOM per image.

It keeps your existing states, pillars, and minions, so your own hardening states keep working next to the built-in baseline.

What to tell your assessor#

Be specific about what changed: the compliance add-on you documented is no longer sold, and your plan replaces it with named controls, a named scoring method, and an evidence trail. A signed evidence pack with a verifier answers "how do we know this record was not edited" better than screenshots.

Questions#

Is SaltStack SecOps still supported if I already own it?#

It stopped being sold standalone in January 2024. Support for what you own follows your contract, and the commercial Salt console it runs on has an end of support date of October 2028.

Can open-source Salt do STIG compliance on its own?#

Salt can enforce and test any setting, so it can carry STIG controls. You still need the control content, scoring, reporting and an evidence trail, which is what a compliance product adds.

Does Gardience cover Windows as well as Linux?#

Yes. The baseline, patching, and evidence cover Windows Server 2016 to 2025, Windows 10 and 11, and the major Linux distributions in one console.