PowerSC: Your One-Stop Shop For Security On IBM i – And Beyond
September 21, 2026 Alex Woodie
Keeping on top of changing security threats is difficult, to say the least. It is even harder to map changing threats to changing configurations on your IBM i server. When your IT network also includes AIX and Linux systems, the difficulty gets multiplied. For these types of environments, IBM provides a tool called PowerSC.
When IBM launched PowerSC (which stands for security and compliance) as an IBM Lab Services product way back in 2010, it was primarily designed for setting up security configurations and running audits on AIX. That is not the case today, as the tool provides a plethora of security capabilities specifically for IBM i environments as well as AIX on Power and Linux on both Power and X86 systems.
IBM recently hosted a Guided Tour that provided a peek into what this powerful tool can do. It turns out IBM has been keeping up with evolving security threats as well as IBM i-specific capabilities with the product, such as support for multi-factor authentication (MFA), which is barely a year old.
Our guides for this September 3 tour, titled What’s New in IBM PowerSC for IBM i: Strengthening Security, Compliance, and Audit Readiness, were Anima Varshney, the PowerSC product manager based out of IBM’s India Systems and Development Lab (ISDL), and Bhargavi Reddy, the product’s lead architect.
According to Varshney, the easiest way to understand PowerSC is to think of it as a collection of complementary security and compliance capabilities managed through a unified platform.
“A key advantage of PowerSC is that it supports the major operating environments running on IBM Power: AIX, IBM i, and Linux,” she said. “This is important because many enterprise customers operate heterogeneous power environment. They may have an IBM i supporting critical business applications. Then they may have AIX running an enterprise workload, and Linux supporting modern applications. In that way, managing security separately for each of these environments can create operational complexity and security silos. PowerSC provides a framework for bringing security and compliance capabilities together across the Power infrastructure.”
The list of specific security capabilities that PowerSC brings to IBM i and other platforms is impressive. It automatically audits system configurations against policy standards for a range of security frameworks, such as PCI DSS, CIS, GDPR, and others. It provides real-time monitoring of security policy configuration changes, as well as real-time file integrity monitoring. It provides endpoint detection and response, and uses ClamAV for malware detection. It also integrates with SIEM tools to help correlate cross-platform attacks; provides checks for MFA and password rules; and integrates with IBM’s ransomware prevention capabilities.
Reddy provided more details on the specific capabilities of PowerSC. When setting the product up, users have the choice of using a predefined set of profiles for IBM i, or creating their own. In either case, if anyone manually changes specific security settings, PowerSC will automatically flag that and send an alert to the product’s GUI, as well as to a SIEM product.
PowerSC integrates in both the northbound and southbound directions, she said. “Southbound we integrate with the operating system features and northbound we integrate with the different SIEM products like QRadar, or whatever it is…. so that we can feed the logs into those into those consoles,” she said.
PowerSC features a simulation mode, which allows users to test how manual changes they make will impact compliance with the security profile. Users can also schedule the product to periodically check to ensure the policies have not drifted.
“The advantage of this is once you create the policy, once you assign VMs to this policy, everything is taken care of for you,” Reddy said. “It’s all automated. It runs up, it applies the profiles, and it starts checking at scheduled intervals.”
PowerSC also has an auto-remediation capability that allows the product to automatically fix any failures. Users can also propagate policies from one VM to any number of additional VMs with just the click of a button.
“Today you have about a hundred VMs in the network. Tomorrow you are going to add another hundred VMs to the same workspace,” Reddy said. “From this to the same environment, you can just assign that those VMs to this policy and everything will be same for the whole environment. Basically, it will create, it will apply these rules and it will start checking. So all your regulations are same across all 200 VMs in the network.”
It also includes file integrity monitoring capabilities. If anybody makes changes to a file immediately, the administrator gets a notification saying a file has changed.
While PowerSC doesn’t support the dozens of exit points in IBM i (you will need to buy a separate network security tool to do that), it does detect other types of unauthorized access, such as intrusion attempts. According to Reddy, PowerSC supports native IBM i intrusion detection capabilities, which are set within IBM i Navigator.
“PowerSC basically identifies events, and it can start detecting all the threats or intrusion detection type of events and notify it to administrators,” Reddy said. “If there are any port scan types of attacks or whatever policy you set, these are displayed through the UI.”
PowerSC provides an integrated tool and dashboard for tracking security threats and compliance across IBM i, AIX, and Linux.
PowerSC ships with ClamAV, the open source virus and malware detection engine. PowerSC allows users to configure and manage ClamAV from the PowerSC console. Users can schedule ClamAV to scan the entire file system or just portions of the file system. There’s also a feature in PowerSC called threat hunting, which is similar to malware scanning but more targeted and designed to see if the IBM i is impacted by a particular virus or threat.
“Basically we download all the hash files. . . . and you can just check to see if your environment is impacted by that virus or not,” Reddy said. “It’s different from malware scanning. It’s not a predefined database. These are like actual threats that are announced by some organizations or government agencies.”
Users can configure PowerSC to take specific actions when it detects a threat. For instance, if a port scan attack is detected, admins can use the shell scripting function to take immediate action, such as shutting down the port or cutting off access to a particular host. There’s also a Swagger tool that lets users write the scripts and deploy them as JSON files. “Instead of using the UI, you can write your own built in scripts,” Reddy said. “So this will provide you all the details for that particular command line operation.”
There’s also patch management functionality in PowerSC. If a user thinks they may be missing some PTFs (which is unlikely if they are keeping up with Doug Bidwell’s IBM i PTF Guide), they can run the tool and see if there are unapplied PTFs for their particular IBM i release. IBM supports a bulk update functionality for patch remediation on other operating systems, but it decided against doing that for IBM i, she said.
The ransomware protection is done through integration with IBM’s Copy Services Manager and IBM Cyber Vault. “If there is a threat detected, Copy Services Manager pushes that ransomware event to PowerSC. PowerSC then reads the event and displays it to the system administrator as high alert,” Reddy said. “It sends an email to system administrator saying that there’s ransomware detected on for this device. It basically shuts down your VMs immediately.”
A relatively new addition to PowerSC is quantum safety. In short, this feature ensures that the customer is running quantum-safe cryptographic algorithms, which is another way to say that they are not running old crypto algos.
“Anything less than TLS 1.2 or 1.3, anything that belongs to TLS 1.1 or earlier, we scan and we identify,” Reddy said. “The other thing is if the certificates are nearing expiration, we also have an interval where we check to see if the certificates are nearing expiration. We notify users of that as well.” The software also checks to ensure that the SSH keys are using good ciphers (i.e. if they are a year old or less) and whether they need to be recycled.
“We just scan through each port to see what that application is using for encrypting data,” Reddy said. “That’s one more feature that will be coming out in the next release on IBM i. We are scanning and then we’ll provide you the application name, as well as the cipher that is being used to encrypt data on that port. That’s an additional feature for the next release.”
Finally, PowerSC brings the IBM i user CART-like capabilities. CART stands for Continuous Automated Red Teaming, and is one of the emerging best practices for ensuring security on enterprise systems.
“This is only for informational purposes. You cannot take actions, but it will show what was the default value that was that your system was shipped with? And what’s the current value?” Reddy said. “And if something is really wrong, then we kind of give a hazard sign. Basically in the UI, you can see that something is really wrong with the password policy settings. If something is nomax, then it tells you that this is not allowed.”
Varshney highlighted one important detail about PowerSC: It is included in both IBM i P30 Enterprise Edition and P20 Standard Edition. “The end client does not need to purchase it separately,” she said. “If you are having IBM i P30 Enterprise Edition and P20 Standard Edition, the clients are entitled to use PowerSC.”
For more info on PowerSC, check out the IBM product page. You can also watch Varshney’s and Reddy’s entire Guided Tour on the product by checking out the archive of presentations at the COMMON website.
RELATED STORIES
Implement, Teach, And Get Out Of The Way
Report Writing Punishes IBM Power i Shops
With Subscription Price, IBM i P20 And P30 Tiers Get Bigger Bundles
