Reviewed project metadata and official links for red, blue, purple, and cross-team security work.
This is a dated, editorially reviewed seed. Links go to upstream projects or vendors. A listing is not authorization, safety certification, legal advice, or a recommendation to deploy a tool. Confirm scope, licensing, current maintenance, and your organization's rules before use.
Application-security finding management, deduplication, and remediation workflow.
BSD-3-Clause for the open-source Community repository; commercial editions differ.
Reviewed Oct 12, 2026
SBOM-driven software supply-chain and vulnerability management.
Apache-2.0
Reviewed Oct 12, 2026
Multiuser finding normalization, remediation tracking, and reporting.
GPL-3.0
Reviewed Oct 12, 2026
Endpoint visibility and device-management platform built around osquery.
MIT core/free portions with separately licensed enterprise, documentation, and third-party components.
Reviewed Oct 12, 2026
Multi-component vulnerability-management stack and reporting workflow.
Components have separate licenses; gvmd is AGPL-3.0-or-later.
Reviewed Oct 12, 2026
Cloud posture, identity, compliance, and exposure assessment.
Apache-2.0 for the canonical open-source project; managed editions have separate terms.
Reviewed Oct 12, 2026
Security monitoring, endpoint visibility, logging, and vulnerability management.
GPL-2.0 core with an OpenSSL exception; AGPL-3.0 components also apply.
Reviewed Oct 12, 2026