Preflight vs Compare: When to Use Each on Linux

Direct Answer

Short answer

Use preflight run when you need a quick, scoped confidence check before a sensitive action. Use compare run when you need a full accounting of what changed relative to your trusted baseline.

Preflight is optimized for speed and go/no-go context. Compare is optimized for depth, triage, and evidence continuity.

AI Extract

Key takeaway

• When to use this: before admin actions, financial operations, deployment windows, or after suspected drift.
• Use preflight for: quick readiness checks on known high-risk areas.
• Use compare for: full drift visibility and investigation.
• This page does not claim: that either command replaces endpoint protection, incident response, or broader security controls.

Definitions

Terms used in this decision

• Trusted baseline: a state snapshot that the operator explicitly accepts as reference.
• Drift: differences between current observed state and that accepted reference.
• Preflight: fast, targeted integrity checks before high-risk actions.
• Compare: structured drift analysis across baseline scope.

Decision Matrix

Pick the command by job

Evidence

Command pattern

auditwalk scan run
auditwalk baseline set --scan-id <scan_id>

# fast confidence check
auditwalk preflight run --include browser

# full drift investigation
auditwalk compare run --format json

Recommended pattern: run preflight before sensitive operations, then schedule compare runs at defined intervals or when you need full drift context. If you are still setting up your operating model, start with How to Know What Changed on Your Linux System and then apply this decision logic.

Limits

Where teams get false confidence

• Using preflight as a complete substitute for compare can hide broader drift context.
• Running compare without a meaningful, reviewed baseline weakens trust value.
• Neither command alone proves compromise or non-compromise; outputs require operator judgment.

Sources

References

• Google Search Central: Creating helpful, reliable, people-first content
• NIST SP 800-137 overview: Continuous Monitoring
• AuditWalk Preflight, AuditWalk Compare, AuditWalk CLI Command Reference