Identify: assess and anticipate

Know your weaknesses and threats: vulnerability scanning, penetration testing, threat intelligence and cloud posture (NIST CSF: Identify).

Up to five options per category, in alphabetical order: the order means nothing and nothing here is a ranking, a recommendation or an endorsement. We earn nothing from any vendor. For wider market coverage, see analyst reports such as Gartner Magic Quadrants and Forrester Waves, and test any tool against your own needs.

Vulnerability management

Scans systems for known vulnerabilities and misconfigurations and tracks them to closure.

Name	What it is	Type
Greenbone OpenVAS	The open-source OpenVAS network vulnerability scanner.	Open source
Qualys VMDR	Vulnerability management, detection and response.	Paid
Rapid7 InsightVM	Rapid7's vulnerability management.	Paid
Tenable Nessus	One of the most widely used vulnerability scanners.	Paid
Trivy	Open-source scanner for containers, code repositories and cloud configuration.	Open source

Penetration testing and web app scanning

Tests applications and networks the way an attacker would.

Name	What it is	Type
Burp Suite Professional (PortSwigger)	The standard toolkit for manual web application testing.	Paid
Invicti	Automated dynamic application security testing (DAST).	Paid
Nmap	The open-source network discovery and port scanner.	Open source
Tenable Web App Scanning	Tenable's web application scanner.	Paid
ZAP	Open-source web application scanner and proxy.	Open source

Threat intelligence platforms

Collects and shares indicators and reporting on attackers.

Name	What it is	Type
CrowdStrike Falcon Adversary Intelligence	CrowdStrike's threat intelligence.	Paid
Google Threat Intelligence	Google's threat intelligence, including Mandiant and VirusTotal data.	Paid
MISP	Open-source platform for sharing threat indicators.	Open source
OpenCTI (Filigran)	Open-source platform for organising cyber threat intelligence.	Open source
Recorded Future	Commercial threat intelligence.	Paid

Cloud security posture (CSPM / CNAPP)

Finds misconfigurations and risks across cloud accounts.

Name	What it is	Type
Cloud Custodian	Open-source rules engine for cloud governance and compliance.	Open source
Microsoft Defender for Cloud	Microsoft's cloud security posture and workload protection.	Paid
Prisma Cloud (Palo Alto Networks)	Palo Alto Networks' cloud-native application protection platform.	Paid
Prowler	Open-source cloud security assessment for AWS, Azure, Google Cloud and Kubernetes.	Open source
Wiz	Cloud security platform covering posture, workloads and identities.	Paid

Exposure management and breach and attack simulation (BAS)

Tests which weaknesses an attacker could actually use and whether your controls stop them.

Name	What it is	Type
Atomic Red Team	Open-source library of small attack tests mapped to MITRE ATT&CK.	Open source
Cymulate	Breach and attack simulation and exposure management.	Paid
MITRE Caldera	Open-source adversary emulation platform.	Open source
Pentera	Automated security validation that tests exposed attack paths.	Paid
Picus Security	Breach and attack simulation and exposure validation.	Paid