Strix
Open-source AI penetration-testing agents for apps and APIs, validating findings with PoCs plus an optional managed cloud.
Cybersecurity tools, platforms and training
A curated directory of cybersecurity tools, platforms and training for practitioners, researchers and learners.
Top voted
Hydra
THC Hydra is a free, multi-protocol online login brute-forcing tool for authorized password audits across many network services.
Hashcat
Free, open-source password recovery utility that cracks many hash types on CPU and GPU hardware for authorized audits and penetration tests.
HackerOne
Commercial CTEM platform for bug bounty, vulnerability disclosure, validation and remediation workflows with researcher and AI-assisted testing.
Vulnerability ManagementFreemium
Snyk
Developer security platform for finding and fixing issues in application code, open-source dependencies, containers and infrastructure as code.
Application SecurityFreemium
Parrot OS
Debian-based open-source security OS from Parrot Security CIC, with Security, Home, HTB and related editions for authorized testing and privacy work.
Kali Linux
Open-source Debian-based penetration testing distribution from OffSec for authorized assessments, research, forensics and reverse engineering.
sqlmap
Open-source tool that automates detection and exploitation of SQL injection flaws and related database takeover techniques for authorized testing.
Nmap
Open-source network scanner for host discovery, port and service mapping, and OS detection, with NSE scripting and companion tools in the suite.
OpenAI Daybreak Red Team
Daybreak Red Team is a paid early-access platform used to pentest web applications with a coordinated team of agents for authorized security teams.
NVIDIA OpenShell
OpenShell is a free open-source runtime used to sandbox autonomous AI agents under declared access policies for security and platform teams.
Juntei
Juntei is a free open-source Windows artifact parser used to build forensic timelines from non-event-log evidence for DFIR incident responders.
Hermes Security
Hermes Security is a free open-source plugin used to review a local repository for security bugs for developers and AppSec teams who run Hermes Agent.
BLA (Blind LLM Agents)
BLA (Blind LLM Agents) is a free open-source CLI and MCP server used to protect release artifacts from AI reverse-engineering agents for software authors.
Malcolm
Malcolm is a free open-source network traffic analysis suite used to ingest PCAPs, Zeek logs, and Suricata alerts for SOC analysts and DFIR teams.
ScubaGear
ScubaGear is a free public-domain assessment tool used to check Microsoft 365 tenants against CISA secure configuration baselines for M365 admins.
Cloud SecurityFree
zizmor
zizmor is a free open-source static analyzer used to find and fix security flaws in GitHub Actions workflows for developers and DevSecOps teams.
Patchstack
Patchstack is a freemium security platform used to monitor vulnerabilities and block exploits for WordPress site owners, agencies, and plugin developers.
Application SecurityFreemium
Mate Security
Mate Security is an AI SOC platform whose agents triage and investigate every alert, hunt threats from CTI reports, tune detections, and take response actions.
Hacktron AI
Hacktron is an AI offensive security platform for continuous red teaming, white-box pentests with source code, and security review of every pull request.
Cloudflare Zero Wire
Cloudflare Zero Wire is a free public vulnerability intelligence feed on Cloudflare Radar with plain-language briefings on critical internet-facing CVEs.
Sapper
Sapper is an open-source multi-agent pentest orchestrator where an AI commander directs worker agents that use Kali tools in authorized labs and CTFs.
Immersive
Immersive, formerly Immersive Labs, runs Immersive One, a cyber readiness platform with hands-on labs, cyber ranges, crisis simulations and AI security labs.
Training & LabsPaid
LuLu
LuLu is a free, open-source macOS firewall from Objective-See that alerts you when an app or process tries to make a new outgoing network connection.