Open Source Tools
Open-source alternatives to commercial security products
Pick a commercial product to see open-source tools that cover the same job. Lists name only tools under an OSI-approved licence; source-available options are shown separately.
Passwords and credential auditing
1Password
AgileBits
1 open-source alternative: KeePassXC
Web application testing
Acunetix
Invicti
3 open-source alternatives: Nuclei, ZAP, Nikto
Adversary emulation and security testing
AttackIQ
AttackIQ
2 open-source alternatives: Atomic Red Team, Caldera
Identity, access and secrets management
Auth0
Okta
2 open-source alternatives: Keycloak, authentik
Web application testing
Burp Suite Professional
PortSwigger
4 open-source alternatives: mitmproxy, sqlmap, ffuf
Static code analysis (SAST)
Checkmarx One
Checkmarx
3 open-source alternatives: Semgrep, gosec, Bandit
WAF and edge protection
Cloudflare WAF
Cloudflare
4 open-source alternatives: CrowdSec, BunkerWeb, ModSecurity
Endpoint visibility and response
CrowdStrike Falcon
CrowdStrike
4 open-source alternatives: osquery, Wazuh, Falco
IDS, IPS and network monitoring
Darktrace
Darktrace
3 open-source alternatives · 1 source-available: Zeek, Suricata, Snort 3
Secrets detection
GitGuardian
GitGuardian
2 open-source alternatives: Gitleaks, TruffleHog
Identity, access and secrets management
HashiCorp Vault
HashiCorp (IBM)
2 open-source alternatives: Infisical, OpenBao
Reverse engineering and malware analysis
IDA Pro
Hex-Rays
2 open-source alternatives: Ghidra, radare2
Adversary emulation and security testing
KnowBe4
KnowBe4
1 open-source alternative: Gophish
OSINT and attack surface discovery
Maltego
Maltego Technologies
4 open-source alternatives: SpiderFoot, theHarvester, OWASP Amass
SIEM, XDR and log management
Microsoft Sentinel
Microsoft
1 open-source alternative · 1 source-available: Wazuh
Mobile application security
NowSecure
NowSecure
2 open-source alternatives: Frida, MobSF
Identity, access and secrets management
Okta
Okta
2 open-source alternatives: Keycloak, authentik
Digital forensics and incident response
OpenText Forensic (EnCase)
OpenText
3 open-source alternatives · 1 source-available: Velociraptor, Autopsy, Plaso (log2timeline)
Cloud and IaC security
Prisma Cloud
Palo Alto Networks
7 open-source alternatives: Trivy, Prowler, Kubescape
Vulnerability scanning
Qualys VMDR
Qualys
3 open-source alternatives: Nuclei, DefectDojo, OpenVAS (Greenbone)
Threat intelligence platforms
Recorded Future
Recorded Future
2 open-source alternatives: OpenCTI, MISP
Dependencies and SBOM (SCA)
Snyk
Snyk
8 open-source alternatives: Trivy, Semgrep, Grype
Dependencies and SBOM (SCA)
Sonatype Lifecycle
Sonatype
5 open-source alternatives: Grype, OSV-Scanner, Syft
SIEM, XDR and log management
Splunk Enterprise Security
Cisco (Splunk)
1 open-source alternative · 2 source-available: Wazuh
Vulnerability scanning
Tenable Nessus
Tenable
2 open-source alternatives: Nuclei, OpenVAS (Greenbone)
Static code analysis (SAST)
Veracode
Veracode
3 open-source alternatives: Semgrep, gosec, Bandit
Cloud and IaC security
Wiz
Wiz
6 open-source alternatives: Trivy, Prowler, Kubescape