Vulnerability Management
Discovery, prioritization and tracking of known weaknesses across assets: vulnerability scanners, prioritization platforms and remediation workflows. Finding new application flaws belongs in Application Security; internet-wide search engines belong in OSINT & Reconnaissance.
HackerOne
Commercial CTEM platform for bug bounty, vulnerability disclosure, validation and remediation workflows with researcher and AI-assisted testing.
Vulnerability ManagementFreemium
Patchstack
Patchstack is a freemium security platform used to monitor vulnerabilities and block exploits for WordPress site owners, agencies, and plugin developers.
Application SecurityFreemium
Cloudflare Zero Wire
Cloudflare Zero Wire is a free public vulnerability intelligence feed on Cloudflare Radar with plain-language briefings on critical internet-facing CVEs.
Codex Security CLI
Codex Security CLI is a freemium, open-source tool used to find, validate, and fix code vulnerabilities for dev teams, with usage on a ChatGPT or API account.
EMBA
EMBA is an open-source firmware analyzer used to extract firmware, find vulnerabilities, and build SBOMs for penetration testers and product security teams.
DefectDojo
DefectDojo is an open-source vulnerability management platform used to import, deduplicate, and track scanner findings for AppSec and DevSecOps teams.
Vulnerability ManagementFreemiumOpen source
OpenSCAP
OpenSCAP is a free SCAP toolkit used to evaluate configuration baselines and vulnerability content on Linux hosts for compliance and security teams.
Vulnerability ManagementFreeOpen sourceNodeZero
NodeZero is a paid autonomous pentesting platform from Horizon3.ai used to find and safely exploit attack paths inside and outside a network for security teams.
Grype
Grype is a free open-source vulnerability scanner from Anchore used to find known flaws in container images, filesystems, and SBOMs for DevSecOps teams.
Vulnerability ManagementFreeOpen source
Kubescape
Kubescape is a free open-source Kubernetes security platform used to scan clusters, manifests, and Helm charts for risky settings for DevOps and security teams.
Dependency-Track
Dependency-Track is a free platform used to analyze SBOMs and track component and vulnerability risk in the software supply chain for AppSec teams.
Greenbone Community Edition (OpenVAS)
Greenbone Community Edition is a free open-source vulnerability management suite used to scan networks for known weaknesses for security teams.
Vulnerability ManagementFreeOpen source
Hadrian
Hadrian is a paid offensive security platform used to find and validate exploitable external exposures and run AI pentests for enterprise security teams.
Bugcrowd
Bugcrowd is a crowdsourced security platform for bug bounties, VDPs, pen testing and red team programmes with researcher matching and triage.
Vulnerability ManagementFreemium
Rapid7 InsightVM
Rapid7 InsightVM assesses assets, prioritises vulnerability risk and drives remediation, now powering Exposure Command vulnerability management.
Vulnerability ManagementPaid
Qualys
Qualys VMDR is cloud vulnerability management for discovering, prioritising and remediating risks across hybrid IT assets on a per-asset subscription.
Vulnerability ManagementPaid
Prowler
Open-source cloud security platform for multi-cloud posture, compliance and hardening checks, with optional managed Prowler Cloud plans.
Orca Security
Orca Security is a commercial agentless CNAPP that finds vulnerabilities, misconfigurations, identities and data risks across multicloud workloads.
Cloud SecurityPaid
Trivy
Aqua Security's open-source scanner for vulnerabilities, misconfigurations, secrets and SBOMs across containers, code, Kubernetes and cloud targets.
Nuclei
ProjectDiscovery’s template-driven vulnerability scanner for fast, community-powered checks across web apps, APIs, networks and cloud assets.
Tenable Nessus
Commercial vulnerability scanner from Tenable for discovering, scoring and reporting weaknesses across networks, systems and apps.
Vulnerability ManagementFreemium
Aikido Security
Commercial AppSec platform for SAST, SCA, secrets, cloud posture and DAST, with runtime protection and automated remediation.
Application SecurityFreemium
Wiz
Commercial cloud and AI security platform that maps code, cloud and runtime into a security graph to prioritise exploitable risk.
Cloud SecurityPaid