# PLT-004: Support Linux endpoints


- Area: Platform, Privacy & Assurance

- Verification: Live test
- OWASP adoption tier: AT0, AT4
- Formerly: ARC-003
- URL: /r/PLT-004

**Acceptance criteria:** Provide Linux visibility or document an equivalent coverage method.

**Why it matters:** Engineering teams on Linux are often the heaviest AI users.

**How to verify:** AI use on a pilot Linux endpoint is visible, or an equivalent method is shown.

**OWASP adoption context:** Linux support is relevant to shadow applications and code-agent workflows on employee endpoints; the operating system is a coverage choice, not an adoption tier itself.

**Mappings:**
- NIST CSF 2.0: DE.CM-09; ISO 27001: A.8.16 — Linux visibility or a tested network, MCP or API alternative can close an endpoint-monitoring blind spot. Platform support or a documented alternative is not itself anomaly detection or endpoint security; equivalent coverage must be demonstrated.
- SOC 2: CC7.2 — Linux visibility or an equivalent collection route can supply security-monitoring telemetry within the system boundary. Demonstrate actual, attributable security-relevant events; documenting an available method alone does not establish monitoring coverage.