What’s File Integrity Monitoring (FIM) and is it worth it?

FIM watches a defined set of files / directories and alerts when anything changes. For Magento the standard scope is app/, vendor/, pub/, and the web-server config dirs.

Why it matters: the #1 post-exploitation move on a breached Magento store is to drop a webshell into pub/media/wysiwyg/ or a backdoor into a custom module. FIM catches both within minutes, the difference between a 4-hour incident and a 4-month one.

Three implementation tiers:

• Free / DIY: AIDE (Linux) or OSSEC. Cron-runs nightly, emails a diff. Good for solo stores; manual triage.
• Mid-tier ($50, $200/mo): Wazuh, Tripwire OS. Centralised dashboard, real-time alerts. Good for stores with a small ops team.
• Enterprise (commercial): CrowdStrike Falcon, SentinelOne. Full EDR + FIM + threat intel correlation. Worth it for stores doing $50M+ GMV.

Common false-positive sources to whitelist: Magento’s generated/ directory (PHP DI cache), var/cache/, var/log/, pub/static/ (recompiled on deploy). Anywhere else changes are a real alert.

The audit’s q21 rewards FIM at any tier. A "No" here is one of the most-skipped controls in mid-market Magento, install it before next quarter.