Acceptance criteria
Provide Linux visibility or document an equivalent coverage method.
Why it matters
Engineering teams on Linux are often the heaviest AI users.
How to verify
AI use on a pilot Linux endpoint is visible, or an equivalent method is shown.
OWASP adoption context
Linux support is relevant to shadow applications and code-agent workflows on employee endpoints; the operating system is a coverage choice, not an adoption tier itself.
Framework mappings
Linux visibility or a tested network, MCP or API alternative can close an endpoint-monitoring blind spot. Platform support or a documented alternative is not itself anomaly detection or endpoint security; equivalent coverage must be demonstrated.
Linux visibility or an equivalent collection route can supply security-monitoring telemetry within the system boundary. Demonstrate actual, attributable security-relevant events; documenting an available method alone does not establish monitoring coverage.