.png){kind=small}
Security tools
Free tools to check your security
Start with our quick health check to find your biggest gaps, then explore trusted free tools our team recommends for testing websites, networks, cloud and containers.
Security health check
How secure is your organisation?
Answer ten quick questions about the basics that stop most attacks. You will get a score and your top priorities straight away.
- Takes about three minutes
- Instant score and priorities
- Nothing is stored or sent anywhere
0out of 100
Your results
Your top priorities
This quick check is a starting point, not a security assessment. It covers common basics only, and results depend on the answers given.
Trusted free tools
Free tools our team recommends.
Well-known, widely used tools and references for a first look at your own security. Each one is provided by its owner, not by ThreatGaurd.
Only scan or test systems that you own or have written permission to test. Running some of these tools against other people’s systems may be illegal.
Websites and applications
Web and API testing- ZAP by the ZAP project Open source A widely used web application scanner that finds common vulnerabilities in websites and APIs. Use it for: Scanning your own web applications in a test environment. (opens in a new tab)
- HTTP Observatory by MDN (Mozilla) Free online Checks a website’s security headers and settings and gives a grade with advice. Use it for: A quick check of your website’s security headers. (opens in a new tab)
- SSL Server Test by Qualys SSL Labs Free online Grades the TLS configuration of a public web server, including certificates, protocols and ciphers. Use it for: Checking your HTTPS setup is strong and up to date. (opens in a new tab)
Networks and systems
Network assessment- Nmap by the Nmap project Open source A network discovery tool that shows which hosts are reachable and which ports and services are open. Use it for: Finding exposed services on networks you own. (opens in a new tab)
- Lynis by CISOfy Open source A security auditing tool for Linux and Unix systems that suggests hardening improvements. Use it for: Reviewing the configuration of your Linux servers. (opens in a new tab)
- CIS-CAT Lite by Center for Internet Security Free download The free version of the CIS configuration assessment tool, which checks systems against CIS Benchmarks. Use it for: Measuring a system against a CIS Benchmark. (opens in a new tab)
Cloud and containers
Cloud security services- Prowler by Prowler Open source Checks AWS, Azure, Google Cloud and Kubernetes against security best practice and compliance frameworks. Use it for: A first review of your cloud configuration. (opens in a new tab)
- Trivy by Aqua Security Open source Scans container images, Kubernetes, code repositories and infrastructure as code for vulnerabilities, misconfigurations and secrets. Use it for: Checking container images before you deploy them. (opens in a new tab)
- kube-bench by Aqua Security Open source Checks whether a Kubernetes cluster is deployed according to the CIS Kubernetes Benchmark. Use it for: Reviewing the setup of your Kubernetes clusters. (opens in a new tab)
Threats and vulnerabilities
Managed vulnerability management- Known Exploited Vulnerabilities by CISA Reference A catalogue of vulnerabilities that attackers are known to be exploiting, which should be fixed first. Use it for: Deciding which vulnerabilities to patch first. (opens in a new tab)
- National Vulnerability Database by NIST Reference The US government repository of vulnerability information, including CVE details and CVSS scores. Use it for: Looking up the details of a specific CVE. (opens in a new tab)
- MITRE ATT&CK by MITRE Reference A knowledge base of real-world attacker tactics and techniques, used to plan defences and testing. Use it for: Understanding how attackers operate. (opens in a new tab)
- Have I Been Pwned by Troy Hunt Free online Shows whether an email address appears in known data breaches. Use it for: Checking whether your accounts were exposed in a breach. (opens in a new tab)
- OWASP Top 10 by OWASP Foundation Reference The best-known list of the most critical web application security risks. Use it for: Training developers on common web risks. (opens in a new tab)
ThreatGaurd is not affiliated with these tools or their owners, and they are listed for information only. Names and trademarks belong to their respective owners. Check each tool’s own terms before use.
Go further
Free tools find the obvious. Experts find the rest.
Tools are a great first step, but they miss business logic flaws, chained attacks and context. Our specialists test the way real attackers think.