SimplifiedCS

Active Directory (AD) is still the control plane for most enterprises - compromise it and an attacker owns the estate. These tools find weak configurations, dangerous permissions and attack paths before an adversary does.

PingCastle

Now maintained by Netwrix under the Non-Profit Open Software License 3.0. It runs unprivileged LDAP/WMI queries and produces a risk score across stale objects, privileged accounts, trusts and anomalies, mapped to MITRE and ANSSI controls.

When: You need a fast, defensible baseline of AD security health (a first-day assessment, or a recurring quarterly check).

Why: Gives an executive-friendly score plus prioritised, actionable findings without needing domain admin.

How: Download the binary, run PingCastle.exe --healthcheck from a domain-joined machine with a standard user account; review the HTML report. Internal use is free even in for-profit companies; you may not resell it as a paid service (that needs a commercial licence).

Purple Knight (Semperis)

Free point-in-time assessment for AD and Entra ID that scores indicators of exposure and compromise (IOEs/IOCs).

When: You want a second, identity-focused lens alongside PingCastle, especially for hybrid AD + Entra.

Why: Strong at surfacing security indicators (e.g. risky Kerberos, delegation, AD CS) with remediation guidance.

How: Download, run from a domain-connected host, export the report. Pairs well with PingCastle - overlap is healthy, gaps differ.

BloodHound Community Edition (SpecterOps)

The modern, containerised rewrite (v8.x) with a web UI, Postgres + Neo4j back end, and OpenGraph so it now maps attack paths beyond AD/Azure into other identity platforms. Data is collected by SharpHound (AD) and AzureHound (Entra).

When: You need to see privilege-escalation and lateral-movement paths to Domain/Enterprise Admin - for both red-team planning and blue-team remediation.

Why: Graph theory turns thousands of ACLs and group memberships into concrete "shortest path to Domain Admin" answers you can actually cut.

How: curl -L https://ghst.ly/getbhce | docker compose ... (official one-liner) to stand up the containers, run SharpHound/AzureHound to collect, upload the JSON/zip, then explore pre-built queries. (Legacy BloodHound v4 is deprecated - use CE.)

ADRecon

PowerShell/.NET collector that dumps AD into a formatted Excel/CSV report (users, groups, GPOs, trusts, ACLs, Kerberos policies).

When: You want a comprehensive inventory and offline artefact for an audit. Why: One command, broad coverage, easy to hand to auditors.

Locksmith

Focused scanner for the eight common AD Certificate Services escalation paths (ESC1-ESC8).

When: ADCS is deployed (it usually is) and you need to know if it's an escalation shortcut. Why: AD CS misconfigurations are a top real-world escalation route; Locksmith both finds and can help remediate them.

Group3r / ADeleg

Group3r audits GPOs for security-relevant settings and findings; ADeleg reviews AD delegation and permissions for over-privilege. Use them to close the gaps the scanners above flag.

Identity moved to the cloud; so did the attack surface. These tools assess Microsoft 365 / Entra ID / Azure against recognised baselines and turn configuration into something you can test like code.

CISA ScubaGear

CISA's PowerShell tool that checks an M365 tenant against the SCuBA Secure Configuration Baselines. It queries M365 APIs, evaluates them with Open Policy Agent (Rego) and reports in HTML/JSON/CSV. Controls are mapped to NIST SP 800-53 and MITRE ATT&CK, and it now ships a GUI for building the YAML config. (Companion tools: ScubaGoggles for Google Workspace, ScubaConnect for automated, multi-tenant runs.)

When: You need an authoritative, government-grade M365 hardening assessment (Entra ID, Exchange, SharePoint, Teams, Defender, Power Platform).

Why: It's the reference implementation of the SCuBA baselines - great for regulated environments and for a defensible "are we configured securely?" answer.

How: Install-Module ScubaGear, then Invoke-SCuBA -ProductNames *. Some checks assume Entra ID P2 / Defender for Office 365 licences.

Maester

Open-source, Pester-based security-as-code framework for Microsoft 365. It wires together EIDSCA, CISA SCuBA, CIS Microsoft 365 and ORCA checks into one test suite, can simulate Conditional Access changes with Graph "what-if", and runs in CI for continuous monitoring.

When: You want configuration drift treated as a failing test, not a once-a-year surprise - daily posture reports, CA policy safety nets, privileged-role assertions.

Why: Turns static baselines into executable, version-controlled tests; excellent for DevSecOps-minded teams and MSPs (multi-tenant).

How: Install-Module Maester, scaffold a tests repo, connect to Graph/Exchange, run Invoke-Maester; schedule it in a pipeline for continuous checks.

ORCA (Office 365 Recommended Configuration Analyzer)

PowerShell module (by Cam Murray) that analyses Exchange Online Protection and Defender for Office 365 configuration against Microsoft's recommendations.

When: You specifically want mail-flow / anti-phishing / anti-malware hygiene reviewed. Why: Concise, focused, early guidance on EOP/MDO settings; its controls are also surfaced inside Maester.

How: Install-Module ORCA, then Get-ORCAReport.

365Inspect (Soteria)

Open-source PowerShell utility that audits an M365 tenant against best practices and produces an HTML report with remediation advice. (Note: its commercial successor line - 365Inspect+ → M365SAT - has moved to a paid model; the original 365Inspect remains free.)

Monkey365

PowerShell tool that assesses M365 and Azure subscriptions against CIS and other benchmarks, with rich HTML/Excel reporting. Good when you want one tool spanning both M365 workloads and Azure IaaS/PaaS.

PSRule for Azure

Test framework that validates Azure resources (and Bicep/ARM/Terraform-produced resources) against the Azure Well-Architected Framework and security best practices. Straddles this section and IaC (see Infrastructure as Code below) - run it both pre-deploy on templates and post-deploy on live resources.

AzureHound

The Entra ID collector for BloodHound; use it to map cloud attack paths (app registrations, role assignments, ownership chains). See Active Directory & On-Prem Identity above for BloodHound itself.

Microsoft Secure Score

Built into the Microsoft 365 Defender / Entra portals. Free with your tenant, it gives an ongoing posture score and improvement actions. Use it as the always-on baseline; use ScubaGear/Maester for depth and rigour.

Microsoft Purview Compliance Manager

Microsoft's own compliance posture tool inside the Purview portal. It scores your tenant against a library of regulatory and standards templates (GDPR, HIPAA, ISO 27001, NIST, PCI DSS and more), turns each requirement into a tracked, assignable improvement action, and gives auditors a documented trail of what's implemented versus outstanding.

When: You need to demonstrate compliance progress against a named regulation or standard, not just general security hygiene.

Why: It's the vendor-native way to map Microsoft 365/Purview configuration directly to compliance obligations, with built-in scoring and evidence-gathering rather than a manual spreadsheet.

How: In the Microsoft Purview portal, go to Compliance Manager, add an assessment from the regulation/standard template library, and work through the scored improvement actions it generates.

Configuration Analyzer for Threat Policies (Defender for Office 365)

Built into the Microsoft Defender portal. It compares your live anti-spam, anti-malware, anti-phishing, Safe Links and Safe Attachments policies against Microsoft's Standard and Strict preset security profiles, flags anywhere you're configured less securely than the presets, and lets you apply the recommended setting directly.

When: You want a fast, authoritative check that mail-flow protection hasn't drifted below Microsoft's own recommended baseline. Why: It's first-party, always current with Microsoft's own recommendations, and pairs well with ORCA above (ORCA gives the standalone report; Configuration Analyzer gives the live, in-portal comparison with one-click remediation).

How: In the Microsoft Defender portal, go to Email & collaboration → Policies & rules → Threat policies → Configuration analyzer.

Cloud Security Posture Management (CSPM) tools scan cloud accounts for misconfigurations, over-broad IAM and compliance gaps across providers.

Prowler

The de-facto open-source CSPM. Hundreds of checks across AWS, Azure, GCP, Kubernetes and Microsoft 365, mapped to CIS, NIST, PCI, HIPAA, GDPR, ISO and more.

When: You need a broad, compliance-mapped scan of one or many cloud accounts, ad hoc or scheduled.

Why: Huge check coverage, framework mappings out of the box, active development, HTML/JSON/CSV output.

How: pip install prowler, then prowler aws / prowler azure / prowler gcp with appropriate read-only credentials.

ScoutSuite (NCC Group)

Collects configuration from cloud provider APIs and produces an offline HTML report highlighting risk across services.

When: You want a multi-cloud auditing snapshot with a clean, navigable report to review with stakeholders. Why: Read-only, quick to run, good for point-in-time reviews and client assessments.

CloudSploit / Steampipe + Powerpipe

CloudSploit provides open-source misconfiguration scans. Steampipe lets you query your cloud as SQL and, with Powerpipe, run packaged CIS/NIST benchmark dashboards - powerful for custom checks and reporting.

CloudFox

Enumerates exploitable attack surface in a cloud account (roles, secrets, endpoints) from an offensive perspective - pair with Prowler's defensive view.

Microsoft Defender for Cloud - Secure Score

Azure's own risk-based posture score, applying the Microsoft Cloud Security Benchmark (MCSB) by default the moment Defender for Cloud is turned on for a subscription. It aggregates findings into a single score, weighted by asset risk and criticality, with a ready-made workbook for tracking the score over time.

When: Your workloads are primarily Azure and you want the vendor-native posture score alongside (not instead of) Prowler/ScoutSuite's broader multi-cloud, framework-mapped view.

Why: Free baseline coverage with zero setup once Defender for Cloud is enabled, and it stays current with Microsoft's own benchmark without needing a separate tool to maintain.

How: In the Azure or Microsoft Defender portal, open Defender for Cloud and review the Secure Score / Security posture page; drill into individual recommendations to remediate.

You can't defend what you can't see. These give telemetry, detection and response on Windows/Linux/macOS endpoints and servers.

Wazuh

Open-source security platform combining host-based intrusion detection, log analysis, file-integrity monitoring, vulnerability detection and compliance reporting, with a central manager and dashboards.

When: You need SIEM/XDR-style visibility and detection without licensing costs - endpoints, servers, cloud workloads, containers.

Why: One platform for detection, FIM, compliance (PCI/CIS) and alerting; large ruleset and community.

How: Deploy the Wazuh manager + indexer + dashboard (Docker or packages), roll out agents to hosts, tune rules.

osquery (Meta)

Exposes the OS as a relational database you query with SQL ("select * from processes where ...").

When: You want live or scheduled fleet questions - "which hosts have this process / listening port / vulnerable package?" Why: Lightweight, cross-platform, scriptable; underpins many detection and inventory workflows (pair with Fleet for management).

Velociraptor (Rapid7)

Endpoint DFIR and hunting at scale using its VQL query language; collect artefacts, hunt IOCs, respond across thousands of hosts.

When: Incident response, threat hunting, or targeted forensic collection. Why: Fast, flexible, purpose-built for hunting and IR without heavyweight infrastructure.

Sysmon

Free Sysinternals driver that logs rich process, network and file/registry events to the Windows Event Log - the raw material for most Windows detections (feed it to Wazuh/your SIEM and pair with Sigma rules, see Detection Engineering & Threat Hunting below).

Containers and Kubernetes add layers - images, registries, manifests, the control plane and runtime. Scan each, and enforce policy at admission.

Trivy (Aqua)

The Swiss-army scanner: container images, filesystems, Git repos, Kubernetes clusters, IaC/misconfiguration, secrets and SBOMs, all in one binary. (It absorbed the retired tfsec engine - see Infrastructure as Code below.)

When: Almost any "is this artefact vulnerable/misconfigured?" question in a pipeline or on a cluster.

Why: Broad coverage, fast, CI-friendly (SARIF output), single tool to learn.

How: trivy image <name>, trivy fs ., trivy k8s cluster, trivy config <dir>.

Grype + Syft (Anchore)

Syft generates a Software Bill of Materials (SBOM); Grype scans it (or an image) for known vulnerabilities. Use them when SBOM generation and supply-chain transparency are the goal.

kube-bench

Checks a cluster against the CIS Kubernetes Benchmark (control plane, nodes, policies). Run after any cluster build or upgrade to prove baseline hardening.

Kubescape (CNCF)

Scans manifests, Helm charts and live clusters against the NSA/CISA hardening guidance, CIS Benchmark and MITRE ATT&CK for Kubernetes, with a risk score and CI integration.

Falco (CNCF)

Runtime security: watches syscalls/kernel events and alerts on suspicious behaviour (shell in a container, unexpected outbound connections, sensitive file reads).

When: You need runtime detection, not just build-time scanning. Why: The reference open-source K8s runtime detection engine; rules map to real attacker behaviour.

Polaris / kubeaudit

Static best-practice and security checks on workloads (resource limits, privilege, securityContext). Good pre-deployment gates.

OPA Gatekeeper vs Kyverno

Admission controllers that enforce policy (block privileged pods, require signed images, enforce labels). Gatekeeper uses Rego/OPA; Kyverno uses Kubernetes-native YAML policies (gentler learning curve). Choose one to move from finding to preventing misconfiguration.

Shift security left: scan code, dependencies, secrets and running apps inside the pipeline so issues are caught before release.

Semgrep

Fast, rule-based static analysis across many languages; write custom rules in a readable pattern syntax. Great first SAST gate in CI.

How: semgrep --config auto . locally or in a pipeline; SARIF output for PR annotations.

CodeQL (GitHub)

Treats code as data you query for vulnerability patterns; powers GitHub code scanning. Free for open-source and available in GitHub Advanced Security. Deep, semantic, lower false-positive rate.

SonarQube Community

Self-hosted static analysis for quality and security hotspots across many languages; the Community edition is open source. Use as the central code-health gate.

Bandit

Targeted Python SAST for common insecure patterns (eval, weak crypto, hardcoded secrets). Cheap to add to any Python repo.

Gitleaks / TruffleHog

Detect secrets (keys, tokens, credentials) in code and history. TruffleHog additionally verifies whether found credentials are live. Run as a pre-commit hook and in CI.

OWASP Dependency-Check

Software Composition Analysis: flags dependencies with known CVEs. Complement with Dependabot/Renovate to actually raise the update PRs.

OWASP ZAP

The leading open-source DAST proxy; spider and actively scan a running web app for injection, auth and config flaws. Automatable in CI (baseline scan) or driven manually for deeper testing.

Nuclei (ProjectDiscovery)

Runs a huge community library of YAML templates against targets to find known vulns, misconfigurations and exposures - fast, and easy to fold into pipelines or recon.

Sigstore / cosign

Sign and verify container images and artefacts to secure the supply chain (provenance, tamper-evidence). Enforce signature checks at admission with Kyverno/Gatekeeper (see Container & Kubernetes Security above).

Catch misconfigurations in Terraform, Bicep, ARM, CloudFormation, Kubernetes and Dockerfiles before they're deployed.

Consolidation note (important): tfsec is deprecated - its checks were merged into Trivy (same AVD-... check IDs), so use trivy config. Terrascan was archived by Tenable in November 2025 and is read-only - don't start new pipelines on it. The maintained open-source choices today are Checkov, Trivy and KICS.

Checkov (Palo Alto / Prisma Cloud)

1,000+ built-in policies across Terraform, CloudFormation, Kubernetes, Helm, ARM, Bicep and Dockerfiles, with graph-based checks that follow references between resources. Frequent releases.

When: Your primary IaC gate - especially Terraform-heavy estates.

How: pip install checkov, then checkov -d .; wire into pre-commit and CI with SARIF output.

Trivy config

The same Trivy binary from Container & Kubernetes Security scans IaC and misconfigurations, inheriting the tfsec ruleset. Handy when you already use Trivy for images and want one tool.

KICS (Checkmarx)

~2,000 queries (Rego) across Terraform, Kubernetes, Docker, CloudFormation, Ansible, Helm and OpenAPI. Good when you want one scanner spanning config formats beyond IaC.

PSRule for Azure

Purpose-built for Azure: validates Bicep, ARM and Terraform-produced Azure resources against the Well-Architected Framework and security rules. The strongest choice specifically for Bicep/Azure teams; run pre-deploy in CI and post-deploy against live resources.

Bicep linter

Built into the Bicep tooling/CLI; catches syntax, best-practice and some security issues as you author. First line of defence - free, instant, in-editor.

Azure Policy

Governance at the platform level: audit or deny non-compliant resources at deploy time and flag drift continuously (e.g. "no public storage", "encryption required"). This is how you enforce what the scanners above only detect.

Find hosts, open services and known vulnerabilities across the network.

Nmap

The foundational network mapper: host discovery, port/service/version detection and the NSE scripting engine for light vulnerability checks.

How: nmap -sV -sC <target>; use NSE scripts for targeted checks. Only scan authorised ranges.

OpenVAS / Greenbone Community Edition

Full open-source vulnerability scanner with a large, updated feed of network vulnerability tests. The free path to authenticated and unauthenticated vuln scanning at scale.

Nessus Essentials (Tenable)

Free tier of the industry-standard scanner, limited to 16 IPs. Great for labs and small environments; the commercial tiers remove the limit.

Edgescan

Commercial vulnerability-management / penetration-testing-as-a-service platform combining automated scanning with human validation (low false positives), triage, reporting and remediation tracking through a portal. Listed because it's a common enterprise requirement; the open-source stack above (Nmap + OpenVAS + ZAP/Nuclei) covers much of the scanning function if budget is the constraint.

Validate defences by thinking like an attacker.

Metasploit Framework

The standard open-source exploitation platform: modules for scanning, exploitation, post-exploitation and payloads. Use for validating that known vulnerabilities are actually exploitable in your environment.

Burp Suite Community (PortSwigger)

Intercepting proxy for manual web app testing (repeater, decoder, basic scanner). The free edition is the entry point for web pen testing; Professional adds an active scanner.

NetExec (nxc)

The maintained successor to CrackMapExec: sweep and exploit AD/SMB/WinRM/LDAP at scale (auth spraying, share enumeration, command execution). Core AD pen-test tooling.

Impacket

Python classes for network protocols (SMB, Kerberos, MSRPC) powering many well-known scripts (secretsdump.py, psexec.py, GetUserSPNs.py for Kerberoasting). The building blocks of AD attacks.

Responder

Poisons LLMNR/NBT-NS/mDNS to capture hashes on a LAN - demonstrates a classic, still-common internal weakness.

Mimikatz

Extracts credentials/tickets from Windows memory (pass-the-hash, pass-the-ticket, golden tickets). Included so defenders understand the technique; expect EDR to flag it.

Hashcat / John the Ripper

GPU/CPU password cracking to test password policy strength against captured hashes.

Kali / Parrot OS

Security distributions bundling hundreds of the above tools - the usual working environment for testing.

The human layer. Train users, simulate attacks and rehearse incident response.

Gophish

Open-source phishing framework: build campaigns, landing pages and track click/credential rates with dashboards.

When: You want to run your own phishing simulations without per-user licensing.

Why: Full control, self-hosted, good reporting; the free path to measuring susceptibility.

How: Deploy the single binary, configure sending profile and templates, launch a campaign against a consented user list.

KnowBe4

Commercial awareness platform with a large training library and automated phishing simulations, reporting and risk scoring. Listed because it's a frequent enterprise standard; Gophish covers the simulation half if you build/curate training separately.

Microsoft Attack Simulation Training

Built into Defender for Office 365 (E5 / add-on); runs realistic simulations and assigns training within the M365 admin experience.

CISA Tabletop Exercise Packages (CTEP)

Free, ready-made scenario packs (ransomware, insider threat, ICS, etc.) to run discussion-based incident-response rehearsals. Pair with the design of your own tabletop exercises to test the response plan, not just the tools.

Prove and manage security against frameworks (CIS, NIST, ISO 27001, SOC 2, PCI, GDPR).

OpenSCAP

Scans systems against SCAP-format baselines (CIS, DISA STIG, etc.) and can generate remediation. The open-source way to prove OS-level hardening for audits.

How: oscap xccdf eval --profile <cis|stig> --results out.xml <datastream>.

Wazuh (compliance mode)

Beyond detection (see Endpoint, EDR & Host Visibility above), Wazuh maps checks to PCI-DSS, CIS, GDPR and NIST and produces compliance dashboards - a free continuous-compliance option.

Eramba Community

Open-source GRC: risk register, control management, policy lifecycle and audit tracking. A starting point for a formal GRC programme without licensing cost.

OneTrust / Vanta / Drata

Commercial platforms. OneTrust centres on privacy/GRC (assessments, data mapping, vendor risk); Vanta and Drata automate evidence collection for SOC 2 / ISO 27001 audits. Listed because they're common requirements; the open-source options above cover assessment and risk tracking if you're building in-house.

Turn telemetry into detections and hunt for what got through.

Sigma

A generic, YAML-based detection-rule format you write once and convert to your SIEM's query language (Splunk, Elastic, Sentinel, etc.). The community ruleset gives you a running start on detections.

YARA

Rule language for identifying files/malware by patterns; used across IR, hunting and sandboxing.

MITRE ATT&CK & Navigator

The shared map of adversary tactics and techniques. Use it to prioritise detections, measure coverage (Navigator heatmaps) and structure red/blue exercises.

Atomic Red Team

Small, mapped tests that execute individual ATT&CK techniques so you can confirm your detections actually fire. Closes the loop between offence (see Offensive Security & Penetration Testing above) and detection.

Wazuh + OpenSearch

A fully open-source SIEM stack for collecting, searching and alerting on the telemetry from Sysmon, osquery, cloud logs and more.

Safe places to learn and validate the tools above.

GOAD

Multi-machine vulnerable AD environment for practising the identity attacks and defences from Active Directory & On-Prem Identity and Offensive Security & Penetration Testing above, safely.

DetectionLab

Spins up a Windows domain wired with Sysmon, Wazuh/Velociraptor and logging so you can practise detection engineering (see Detection Engineering & Threat Hunting above) end to end.

OWASP Juice Shop / DVWA / WebGoat

Intentionally vulnerable apps to practise ZAP, Burp and secure-coding concepts (see Application Security, CI/CD & Secure SDLC above).