Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

Prowler is an Open Cloud Security tool for AWS, Azure, GCP and Kubernetes. It helps for continuos monitoring, security assessments and audits, incident response, compliance, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more.

Open Policy Agent (OPA) is an open source, general-purpose policy engine.

immudb - immutable database based on zero trust, SQL/Key-Value/Document model, tamperproof, data change history

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

Tfsec is now part of Trivy

Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources

Open Source Cloud Native Application Protection Platform (CNAPP)

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

InSpec: Auditing and Testing Framework

CISO Assistant is a one-stop-shop for GRC, covering Risk, AppSec and Audit Management and supporting +70 frameworks worldwide with auto-mapping: NIST CSF, ISO 27001, SOC2, CIS, PCI DSS, NIS2, CMMC, PSPF, GDPR, HIPAA, Essential Eight, NYDFS-500, DORA, NIST AI RMF, 800-53, 800-171, CyFun, CJIS, AirCyber, NCSC, ECC, SCF and so much more

A FAST Kubernetes manifests validator, with support for Custom Resources!

HardeningKitty and Windows Hardening Settings

Security automation content in SCAP, Bash, Ansible, and other formats

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

Open-source infrastructure and data orchestration platform for risk decisioning

macOS Security Compliance Project

A suite of tools to automate software compliance checks.

Appshark is a static taint analysis platform to scan vulnerabilities in an Android app.