Security tools for assessment and operations.

Security assessment tool for AWS, Azure, GCP, and Kubernetes. Performs hundreds of security checks against cloud best practices and compliance frameworks like CIS, NIST, and PCI-DSS.

Automation to assess M365 tenant against CISA baselines. CISA's official tool for evaluating Microsoft 365 security configurations against SCuBA guidance.

PowerShell-based test automation framework for Microsoft 365 security configuration monitoring. Continuous compliance monitoring with customizable test cases.

Multi-cloud security auditing tool for AWS, Azure, GCP, and more. Generates comprehensive HTML reports with findings organized by service and severity.

Universal SQL interface for cloud APIs - query cloud resources with SQL. Supports hundreds of plugins for AWS, Azure, GCP, and SaaS applications.

Cloud-native runtime security for containers and Kubernetes (CNCF). Detects anomalous activity in containers using system call monitoring and customizable rules.

Kubernetes policy engine for security and automation. Define policies as Kubernetes resources to validate, mutate, and generate configurations.

Kubernetes security posture management and compliance. Scans clusters against NSA/CISA hardening guidelines and generates remediation recommendations.

Checks Kubernetes deployment against CIS Kubernetes Benchmark. Automated compliance checking for master and worker node configurations.

Policy controller for Kubernetes using Open Policy Agent. Enforce organizational policies as admission controller webhooks.

Main Sigma rule repository for SIEM detection. Generic signature format for log events that can be converted to various SIEM query languages.

Automated YARA rule standardization and quality assurance. Validates and normalizes YARA rules for consistent detection capabilities.

Sysmon configuration file template with high-quality event tracing. Widely-used baseline configuration for Windows endpoint monitoring.

Endpoint visibility and collection tool for digital forensics. Advanced artifact collection and hunting across thousands of endpoints using VQL queries.

Security auditing tool for Unix/Linux systems. Performs in-depth security scans covering system hardening, compliance, and vulnerability detection.

Open source host-based intrusion detection system. Monitors file integrity, log analysis, rootkit detection, and real-time alerting.

American Fuzzy Lop plus plus - improved fuzzing tool. Fork of AFL with many improvements including custom mutators, persistent mode, and QEMU support.

Continuous fuzzing for open source software. Google's infrastructure for running fuzzers 24/7 against critical open source projects.

In-process, coverage-guided, evolutionary fuzzing engine. LLVM-based fuzzer ideal for testing libraries and code units with minimal setup.

Reveal hidden relationships across identity and access management systems. Graph-based tool for mapping AD attack paths and identifying privilege escalation routes.

Community Edition of BloodHound with enhanced features. Includes improved UI, API access, and extended query capabilities for enterprise environments.

Framework to interact with Azure AD for offensive and defensive security. Enumerate and analyze Azure AD configurations, permissions, and attack paths.

Static analysis for Terraform, CloudFormation, Kubernetes, and more. Scans infrastructure as code for misconfigurations, secrets, and compliance violations.

Security scanner for Terraform code. Fast static analysis specifically designed for finding security issues in Terraform configurations.

Static code analyzer for infrastructure as code. Detects compliance and security violations across Terraform, Kubernetes, and cloud configs.

Keeping Infrastructure as Code Secure - find security vulnerabilities. Supports Terraform, Kubernetes, Docker, CloudFormation, and more.

Infrastructure as Code tool. Define and provision cloud infrastructure using declarative configuration files with state management and drift detection.

Agentless automation tool for configuration management. Define infrastructure state using YAML playbooks and execute over SSH without agents.

LLMNR, NBT-NS and MDNS poisoner with rogue authentication servers. Essential tool for capturing NTLMv2 hashes during internal penetration tests.

Powerful network analysis framework for security monitoring. Generates detailed logs of network activity for threat hunting and incident response.

High performance Network IDS, IPS and security monitoring. Multi-threaded engine with support for protocol detection and file extraction.

Swiss army knife for pentesting networks (formerly CrackMapExec). Automates credential testing, command execution, and lateral movement across networks.

Large scale packet capture, indexing, and database system (formerly Moloch). Full packet capture with powerful search and session reconstruction.

Penetration testing framework. World's most used penetration testing software with extensive exploit database, payloads, and auxiliary modules.

Privilege escalation enumeration suite for Windows and Linux. Comprehensive scripts for Windows and Linux privilege escalation vectors.

Modern adversary emulation and red team framework. Cross-platform implant framework with encrypted C2, staging, and evasion capabilities.

Automatic SQL injection and database takeover tool. Detects and exploits SQL injection flaws with support for multiple database backends.

Collection of multiple types of lists used during security assessments. Usernames, passwords, URLs, sensitive data patterns, and fuzzing payloads.

Open source threat intelligence and sharing platform. Share, store, and correlate Indicators of Compromise across organizations.

Scalable security incident response platform. Case management for SOC teams with Cortex integration for automated analysis.

Open cyber threat intelligence platform. Structured threat intelligence management with STIX2 support and relationship mapping.

Fast and customizable vulnerability scanner. Template-based scanning engine with thousands of community-contributed detection templates.

In-depth attack surface mapping and asset discovery. Comprehensive subdomain enumeration using multiple data sources and techniques.

Fast passive subdomain enumeration tool. Discovers subdomains using passive sources without touching target infrastructure.

Find secrets in git repos with high entropy detection. Scans commit history for API keys, passwords, and other sensitive data leaks.

Fast secret scanner for git repos, files, and directories. Supports custom rules and integrates with CI/CD pipelines for pre-commit scanning.

AWS secret prevention tool for git. Pre-commit hooks that prevent committing AWS credentials and other secrets to repositories.

Comprehensive security scanner for containers and IaC. Scans container images, filesystems, git repos, and Kubernetes manifests for vulnerabilities.

Intelligent component analysis platform for supply chain security. Continuous SBOM analysis with vulnerability tracking across projects.

Vulnerability scanner for container images and filesystems. Fast scanning with support for multiple vulnerability databases and SBOM input.

Lightweight static analysis for finding bugs and enforcing code standards. Pattern-based code scanning with extensive rule library.

Vulnerability scanner for dependencies using OSV database. Google's open-source vulnerability database scanner for package ecosystems.

Scanner detecting JavaScript libraries with known vulnerabilities, generates SBOM. CLI and browser extension for identifying outdated JS dependencies.

Security linter for Python code. Static analysis tool that finds common security issues in Python applications.

Full-featured vulnerability scanner and manager. Network vulnerability scanning with extensive plugin library and reporting.