The world's most widely-used network protocol analyser. Captures and dissects traffic in real time across 3000+ protocols. Essential for SOC analysts, network forensics, and incident response.

The definitive network scanner. Discovers hosts, open ports, running services, OS fingerprints, and vulnerabilities via NSE scripts. Core tool for every penetration test and network audit.

Cisco's open-source IDS/IPS with real-time traffic analysis and packet logging. Uses signature-based detection with a vast community ruleset. Deploy inline (IPS) or passive (IDS).

High-performance multi-threaded IDS/IPS/NSM engine. Compatible with Snort rules, adds protocol detection, file extraction, TLS certificate logging, and EVE JSON output for SIEM ingestion.

Enterprise network performance monitoring. Automated topology mapping, SNMP-based device polling, bandwidth analysis, and alerting. Widely deployed in large enterprises. Note: Supply chain compromise in 2020 (SUNBURST/SolarWinds hack).

Network analysis framework that generates rich log files (conn.log, dns.log, http.log, ssl.log, files.log) rather than raw packet captures. Essential for threat hunting and security monitoring pipelines.

Lightweight CLI packet analyser built into every Unix/Linux system. No GUI — pure terminal power. Essential for remote capture when Wireshark isn't available, and for quick on-box triage.

Comprehensive infrastructure monitoring covering servers, VMs, networks, and IoT devices. Free up to 100 sensors. Supports SNMP, WMI, REST, packet sniffer, and custom scripts.

Scans the entire internet in under 6 minutes. Asynchronous transmission — up to 10M packets/sec. Use for large-scale asset discovery, attack surface mapping, and finding exposed services at scale.

Open-source firewall/router platform based on FreeBSD. Full stateful firewall, VPN (OpenVPN/WireGuard/IPsec), IDS/IPS via Suricata plugin, traffic shaping, and VLAN segmentation. Used in home labs to enterprise networks.

Passive network forensic analysis tool. Reconstructs files, images, emails, and credentials from pcap files. Excellent for CTF challenges and incident response pcap analysis. GUI-based.

High-speed web-based traffic analysis. Monitors network flows in real time with geo-location, protocol breakdown, and security alerts. Integrates with Suricata for IDS alerts overlay on traffic view.

The industry-standard web application security testing platform. Intercepts, modifies, and replays HTTP/S requests. Proxy, Scanner, Repeater, Intruder, Decoder — the complete web pentest toolkit. Community edition is free; Pro adds active scanner.

OWASP's free web application scanner. Automated active/passive scanning, spider, fuzzer, and API testing. Excellent for CI/CD pipeline integration (headless mode). The free alternative to Burp Pro for automated scanning.

Enterprise-grade Static Application Security Testing. Analyses source code for vulnerabilities without execution. Supports 25+ languages. Deep data-flow analysis finds SQLi, XSS, path traversal across complex codebases. Integrates with Azure DevOps, Jenkins, GitHub Actions.

Cloud-based AppSec platform covering SAST, DAST, SCA (open-source), and manual penetration testing. Provides eLearning to fix found vulnerabilities. Widely used for compliance (FedRAMP, PCI-DSS). Policy-based gates in CI/CD pipelines.

Automatic SQL injection detection and exploitation tool. Supports all major databases (MySQL, Oracle, MSSQL, PostgreSQL). Can dump databases, crack hashes, read/write files, and execute OS commands via SQLi.

Developer-first security platform for finding and fixing vulnerabilities in open-source dependencies, containers, IaC, and code. Deep integration with GitHub/GitLab/Bitbucket. SCA leader — tracks CVEs in npm, PyPI, Maven, etc.

Fast, lightweight SAST with a simple rule syntax that matches code patterns. 3000+ community rules for finding security bugs in 30+ languages. Used in CI/CD pipelines for shift-left security. Rules as YAML — security teams write custom detections easily.

Web server scanner detecting dangerous files, outdated software, server misconfigurations, and common vulnerabilities. Tests 6700+ items. Noisy — detected by IDS. Best used in authorised engagements for quick server hardening checks.

Fast web content discovery via wordlist-based directory/file fuzzing. Gobuster is Go-based and concurrent; ffuf is ultra-fast with advanced filtering. Find hidden paths, admin panels, backup files, and subdomains.

Continuous code quality and security analysis. Tracks security hotspots, bugs, vulnerabilities, and code smells across 30 languages. Community edition free. Gate builds on quality/security criteria. Used by 300K+ organisations globally.

Automated web vulnerability scanner with deep-crawl engine. Finds SQLi, XSS, XXE, SSRF, misconfigurations in web apps and APIs. Proof-based scanning verifies exploitability. Integrates with Jira, GitHub, and CI/CD pipelines.

Palo Alto's CNAPP (Cloud Native Application Protection Platform). Combines CSPM, CWPP, CIEM, DSPM and container/Kubernetes security. Covers AWS, Azure, GCP. Real-time compliance posture against CIS Benchmarks, SOC2, PCI-DSS.

Centralised AWS security findings aggregator. Consolidates alerts from GuardDuty, Inspector, Macie, IAM Access Analyzer, and third-party tools. Automated compliance checks against CIS AWS Foundations, PCI-DSS, and NIST.

Microsoft's CSPM and cloud workload protection for Azure, AWS, and GCP. Secure Score dashboard, threat protection for VMs/containers/databases/App Service. Defender for Servers includes Microsoft Defender for Endpoint integration.

Polygraph-based anomaly detection for cloud environments. Builds behavioural baselines and alerts on deviations — accounts, processes, file changes, network connections. Excellent for detecting novel attacks that signature tools miss.

Open-source cloud security auditing tool supporting AWS, Azure, and GCP. Runs 400+ security checks against CIS Benchmarks, NIST, GDPR, HIPAA, PCI-DSS. CLI-based — ideal for quick posture assessment or CI/CD integration.

Aqua Security's comprehensive vulnerability scanner for containers, Kubernetes, IaC (Terraform/CloudFormation/Helm), filesystems, and git repositories. The go-to shift-left tool for container security in CI/CD pipelines.

CNCF runtime security engine for containers and Kubernetes. Detects anomalous behaviour in real time using kernel syscall tracing (eBPF). Rules detect shell spawned in container, privilege escalation, sensitive file reads, crypto mining, and more.

Multi-cloud security auditing tool by NCC Group. Collects configuration data across AWS/Azure/GCP/OCI/Alibaba and presents a risk-scored HTML report with findings grouped by service and severity.

AWS-native threat detection service. Analyses CloudTrail, VPC Flow Logs, DNS logs, and EKS audit logs using ML and threat intel. Detects crypto mining, credential compromise, C2 traffic, unusual API calls, and data exfiltration patterns.

Infrastructure-as-Code (IaC) static analysis tool. Scans Terraform, CloudFormation, Kubernetes YAML, ARM templates, Dockerfile, and Helm charts for security misconfigurations before deployment. 2000+ built-in checks.

Open-source Security Incident Response Platform (SIRP). Case management, task assignment, observables tracking, and timeline reconstruction. Integrates with MISP for threat intelligence and Cortex for automated analysis. GDPR-compliant evidence handling.

SANS Institute's free DFIR workstation — an Ubuntu VM pre-loaded with 200+ forensic tools. Volatility, Autopsy, Plaso, log2timeline, bulk_extractor, Rekall, and more. The standard reference environment for digital forensics and incident response.

Malware Information Sharing Platform — the open standard for threat intelligence sharing. Stores, correlates, and distributes IoCs (IPs, domains, hashes, CVEs). Syncs with global threat intel communities. Integrates with TheHive, Splunk, and SIEM tools.

Network forensics analysis tool that reconstructs application data (emails, HTTP sessions, VoIP calls, FTP transfers) from pcap files. Web-based GUI. Useful for reconstructing what happened during an incident from network captures.

Advanced digital forensics and incident response platform. Deploys agents to endpoints for live forensics, threat hunting, and evidence collection at scale. Uses VQL (Velociraptor Query Language) for custom hunts. Rapidly triage thousands of endpoints simultaneously.

Palo Alto's SOAR platform — automates incident response via playbooks. 900+ integrations with SIEM, EDR, ticketing, and threat intel tools. Warroom collaboration, automated triage, and case management. Reduces MTTR from hours to minutes.

GCHQ's "cyber Swiss Army knife" — browser-based tool for encoding/decoding, encryption, compression, data analysis, and format conversion. 400+ operations chainable via drag-and-drop. Essential for malware analysis and CTF challenges.

Creates forensic super-timelines from disk images, filesystem artefacts, browser history, registry hives, event logs, and more. Produces a single CSV timeline of all artefact timestamps for incident reconstruction. Used in SANS FOR508.

The market-leading SIEM and log analytics platform. Indexes machine data at scale, enables ad-hoc search with SPL (Search Processing Language), and builds dashboards, alerts, and correlation rules. Splunk ES adds security analytics on top.

Cloud-native SIEM/SOAR on Azure. Uses KQL (Kusto Query Language) for analytics, built-in threat intelligence, UEBA, and automated playbooks via Azure Logic Apps. Pay-per-GB ingestion. 150+ connectors for Microsoft and third-party sources.

SIEM built on the Elastic Stack (Elasticsearch + Kibana). Free tier includes detection engine with MITRE ATT&CK-mapped prebuilt rules, timeline investigation, and case management. EQL (Event Query Language) for complex behavioural detections.

Open-source XDR and SIEM. Combines HIDS (host intrusion detection), log analysis, vulnerability detection, file integrity monitoring, and compliance (PCI-DSS, HIPAA, GDPR). Free alternative to commercial SIEMs for smaller organisations.

Free open-source Linux distro bundling Suricata IDS, Zeek NSM, Elastic SIEM, TheHive, Fleet (osquery), and Kibana dashboards. Deploys as a full SOC platform. Used in university cybersecurity labs and SMB security teams worldwide.

Enterprise SIEM with network flow analytics, log management, and behavioural analytics. Uses "Offenses" for prioritised incident management. Deep integration with IBM X-Force threat intelligence. QRadar SOAR adds automated playbooks.

Centralised log management with security analytics. Open-source core with commercial Operations tier. GELF format, pipeline processing rules, streams for real-time log routing. Lighter alternative to ELK for mid-size organisations.

Open-source Cyber Threat Intelligence platform using STIX 2.1 data model. Manages threat actors, campaigns, malware, indicators, TTPs, and relationships. Graph-based knowledge management. Integrates with MISP, TheHive, and SIEMs via connectors.

OSINT and link analysis platform. Visually maps relationships between people, organisations, domains, IPs, emails, and social media via automated "transforms". Used for threat actor attribution, attack surface mapping, and fraud investigations.

Search engine for internet-connected devices. Indexes banners from servers, cameras, industrial control systems, and IoT devices worldwide. Essential for attack surface management, finding exposed services, and threat actor infrastructure tracking.

The pattern-matching tool for malware researchers. Write rules describing malware families by strings, byte patterns, or conditions. Scan files, memory, and processes. Used by every major threat intel team and AV vendor to detect and classify malware.

Multi-AV scanner aggregating 70+ AV engine results for files, URLs, domains, and IPs. Community comments, behavioral analysis (sandbox), and relationship graphs between samples. Essential first-check for any suspicious file or indicator.

Generic SIEM detection rule format — write rules once, convert to Splunk SPL, KQL, EQL, QRadar AQL, etc. 3000+ community rules on GitHub covering MITRE ATT&CK TTPs. The Snort/YARA equivalent for log-based detection.

The leading memory forensics framework. Analyses RAM dumps from Windows, Linux, and macOS. Extracts processes, network connections, DLL injection evidence, registry hives, and passwords from memory. Critical for malware analysis and incident response.

GUI frontend for The Sleuth Kit disk forensics framework. Analyses disk images, filesystem artefacts, browser history, email, registry, and deleted files. Extensible with plugins. The go-to free forensic tool for Windows disk analysis in law enforcement and DFIR.

NSA's open-source reverse engineering suite. Disassembles, decompiles, and analyses binary code across x86, ARM, MIPS, and 50+ architectures. Script-extensible with Java/Python. The free alternative to IDA Pro — used by malware analysts worldwide.

First-look malware analysis tool for Windows executables. Displays imports, exports, strings, entropy, VirusTotal results, and indicators of compromise — all statically without executing the file. Gold standard for initial malware triage.

Interactive online malware sandbox. Execute suspicious files/URLs in a real Windows VM and watch network activity, process tree, registry changes, and API calls in real time. Shareable reports. Free public submissions.

Firmware analysis and extraction tool. Identifies embedded file systems, compression formats, and executable code inside binary blobs. Essential for IoT/embedded device security research — extract squashfs, jffs2, and other filesystems from firmware images.

The leading ICS/OT threat detection and response platform. Understands industrial protocols (Modbus, DNP3, EtherNet/IP, BACnet, IEC 104). Identifies asset inventory, network segmentation gaps, and threat behaviour specific to ICS environments. Used in energy, water, manufacturing.

Extended IoT (XIoT) security platform covering OT, IoT, IoMT (medical devices), and IT/OT convergence. Passive discovery of all connected assets, vulnerability management, network segmentation policy, and anomaly detection without disrupting operations.

OT and IoT security and visibility platform. Guardian sensor provides passive network monitoring of industrial and IoT environments. AI-powered anomaly detection learns normal OT behaviour. Vantage cloud management provides enterprise-wide OT visibility.

Full-featured vulnerability scanner — the open-source alternative to Nessus. Daily updated NVT (Network Vulnerability Tests) feed covering 80,000+ CVEs. Scans network devices, servers, and OT equipment. Greenbone Community Edition is free; Enterprise adds compliance reports.

Converged IT/OT vulnerability management. Passively discovers all OT assets and maps CVEs to specific firmware versions. Integrates with Tenable.sc for unified IT+OT risk view. Detects Modbus/DNP3 anomalies and known ICS attack patterns.

Post-binwalk firmware filesystem analysis script. Hunts extracted firmware for hardcoded passwords, private keys, SSL certificates, email addresses, IP addresses, and common IoT backdoor patterns. Fast automated triage of IoT firmware security.

Agentless IoT/OT device security platform. Discovers and classifies every connected device (managed, unmanaged, IoT, OT, IoMT) without requiring agents or network changes. 500M+ device behaviour profiles for anomaly detection. Used in healthcare, manufacturing, and enterprise.

Nmap NSE scripts and standalone tools for scanning ICS/SCADA devices. Redpoint identifies Modbus, BACnet, EtherNet/IP, DNP3, and Siemens S7 devices. PLCScan identifies specific PLC models and firmware. Essential for ICS penetration testing and asset discovery.