Security scanners, audits & threat intel tools: top picks for 2026

Ghidra is an open-source software reverse engineering framework from the NSA, offering disassembly, decompilation, graphing and scripting for compiled code.

Trivy is an open-source security scanner that finds vulnerabilities, misconfigurations, secrets and SBOM data in containers, filesystems, Git repos, VM images and Kubernetes.

All-in-one open source intelligence tool that runs on-demand checks on any website, covering DNS, SSL, headers, server info and security configuration.

A coding-agent skill that runs multi-phase security audits with isolated agents, independent verification, and machine-readable findings.

A CLI tool for detecting hardcoded secrets such as passwords, API keys and tokens in git repos, files and stdin.

A end-to-end encrypted messaging app and network that uses no user identifiers, with iOS, Android, desktop and terminal clients.

Open-source AI coworker for your desktop that completes everyday tasks and security reviews, using your own model keys and approval-gated actions.

A safe, private runtime for autonomous AI agents that enforces file, system call, and network policies per sandbox.

Open-source disk encryption software for creating encrypted volumes and partitions, forked from TrueCrypt 7.1a with security enhancements.

Self-hosted code quality and security platform that scans projects for bugs, vulnerabilities and maintainability issues, with Quality Gates for CI pipelines.

A curated Awesome list of threat intelligence resources, covering IP and domain feeds, malware samples, data formats, frameworks, tools and research.

A curated, categorized list of privacy- and security-focused software and online services, from password managers to operating systems.

A macOS app that stores SSH keys in the Secure Enclave so private keys cannot be exported, with Touch ID or Apple Watch access control.

Network traffic monitor that flags communication with known malicious domains, IPs, URLs and User-Agents using indicator lists called trails.

A command-line password manager for teams, compatible with the standard UNIX pass tool, storing secrets encrypted with GPG and versioned in git.

Self-hosted home server platform acting as a secure reverse proxy, app manager, and gateway with auth, MFA, SSO, and anti-bot protection.

Converts untrusted PDFs, office documents and images into safe PDFs by rasterizing them inside a sandbox.

A bash tool that stores private files encrypted with GPG inside a git repository, shared with trusted users by their public keys.

Open-source password manager built with Flutter for mobile, desktop and web, compatible with KeePass 2.x KDBX 3 and KDBX 4 databases.

Self-hosted network reconnaissance tool in Go that discovers, identifies and monitors devices on your local network with a live web console.

Structured study notes in 18 modules covering Linux terminal, networking, permissions, scripting and kernel basics, based on the Linux Basics for Hackers book.

A curated awesome-list of security tools, testing apps and jailbreak resources for macOS and iOS.

Open-source Android authenticator app from 2FAS that generates TOTP and HOTP one-time codes for two-factor login.

A Go implementation of the endlessh SSH tarpit that exports Prometheus metrics and ships with a Grafana dashboard for attacker statistics.

Web toolkit for analyzing any domain, combining DNS lookups, IP geolocation, WHOIS and SSL certificate history in one interface.

JARM is an active TLS server fingerprinting tool that sends crafted Client Hello probes to identify server configurations and spot malicious infrastructure.

A Web Application Firewall middleware for the Caddy web server, with regex rules, IP/DNS/ASN/GeoIP filtering, rate limiting and Tor exit-node blocking.

Self-hosted Kubernetes-based infrastructure that runs untrusted code in lightweight VM sandboxes, controlled via a CLI, HTTP API and Python SDK.

A Windows endpoint security app combining YARA rules, PE machine-learning inference, signature checks, optional cloud analysis, and a kernel minifilter driver.

A web management platform for operating Fail2Ban across one or more Linux hosts, covering bans, jails, filters and alerts.

A fast Go-based Dockerfile linter with 60+ best-practice rules, quality scoring, and security checks for secrets and ARG usage.

A Python CLI that automatically locks your desktop when your paired Bluetooth phone or smartwatch moves out of range.