Best IT Security Software for Linux - Page 13
View:
Compare the Top IT Security Software for Linux as of November 2026 - Page 13
Sort By:
-
1
Grafana Loki
Grafana
Grafana Loki is an open source log aggregation system designed to efficiently collect, store, and query logs from various sources. Unlike traditional logging systems, Loki is optimized for cloud-native applications, making it a great fit for modern, containerized environments like Kubernetes. It works seamlessly with Grafana for visualizing log data alongside metrics and traces, providing a unified observability platform. Loki indexes only metadata, such as labels and timestamps, which reduces the amount of data stored and improves query performance compared to more traditional log management systems. This lightweight approach allows for easier scalability and cost-effective storage. Loki also supports log aggregation from various sources, including Syslog, application logs, and container logs, and integrates with other observability tools to provide a complete view of system performance.Starting Price: Free -
2
Security Onion
Security Onion
Security Onion is a comprehensive open source platform for intrusion detection, network security monitoring, and log management. It provides a set of powerful tools to help security professionals detect and respond to potential threats across an organization's network. Security Onion integrates various technologies, including Suricata, Zeek, and Elastic Stack, to collect, analyze, and visualize security data in real-time. Security Onion’s intuitive user interface allows for easy management and analysis of network traffic, security alerts, and system logs. It also includes built-in tools for threat hunting, alert triage, and forensic analysis, helping users identify potential security incidents quickly. Security Onion is designed for scalability, making it suitable for environments of all sizes, from small businesses to large enterprises.Starting Price: Free -
3
Malcolm
Malcolm
Malcolm is an open source security monitoring platform designed to help security professionals collect, process, and analyze network data for threat detection and incident response. It integrates multiple powerful tools to gather and visualize network traffic, log data, and security alerts. Malcolm’s user-friendly interface allows security analysts to easily investigate potential threats by providing detailed insights into network activity. It is designed for scalability, offering flexible deployment options across various environments, from small businesses to large enterprises. Malcolm’s modular design ensures users can customize the platform to suit their specific security requirements, while its integration with other observability tools ensures comprehensive monitoring. While Malcolm is great for general-purpose network traffic analysis, its creators see a particular need in the community for tools providing insight into protocols used in industrial control systems (ICS).Starting Price: Free -
4
ZTX Platform
SecureTrust Cyber
The ZTX Platform is a fully managed, engineer-led cybersecurity solution that delivers Zero Trust security in a streamlined, scalable package. It unifies SASE, XDR, SIEM, RMM, and micro-segmentation into a single platform installed and operational within one business day. ZTX is licensed per seat, making it cost-effective and flexible for growing organizations. The platform offers centralized monitoring, real-time threat detection, automated response, and strict policy enforcement. Each user session is isolated via encrypted tunnels, preventing lateral movement and ensuring compliance. Ideal for companies seeking simplified, high-performance cybersecurity without managing multiple tools.Starting Price: $30/month per device -
5
OpticalBackup
OpticalBackup
OpticalBackup is a secure, long-term way to protect important data. Files are encrypted and written to tamper-proof optical discs designed to last for decades—offline, immutable, and safe from ransomware or deletion. The process is simple and fully automated. Upload your files, and OpticalBackup handles the rest: burning, labeling, and either storing your discs in a secure facility or shipping them to you. No hardware, scripts, or manual steps needed. Discs can’t be altered once written, ensuring data integrity over time. Ideal for critical files like legal records, personal archives, creative work, or sensitive business data. Flexible subscription plans include cloud access, encryption, and storage or delivery options. OpticalBackup also supports the 3-2-1 backup rule, adding a physical, offline layer to your strategy. Preserve what matters most—with confidence it’ll still be there in decades.Starting Price: $33/month -
6
ESET PROTECT Complete is a comprehensive cybersecurity solution designed to safeguard business endpoints, cloud applications, and email systems. It offers advanced protection against ransomware and zero-day threats through cloud-based sandboxing technology and machine learning-driven detection. It includes full disk encryption capabilities, aiding compliance with data protection regulations. ESET PROTECT Complete also provides robust security for mobile devices, file servers, and email servers, incorporating anti-malware, anti-phishing, and anti-spam measures. Its centralized, cloud-based management console allows for streamlined deployment, monitoring, and response to security incidents across the organization. Additional features include vulnerability and patch management, ensuring that software vulnerabilities are promptly identified and addressed.Starting Price: $287.72 one-time payment
-
7
ESET PROTECT Elite
ESET
ESET PROTECT Elite is an enterprise-grade cybersecurity solution that integrates extended detection and response with comprehensive multilayered protection. It offers advanced threat defense using adaptive scanning, machine learning, cloud sandboxing, and behavioral analysis to prevent zero-day threats and ransomware. The platform includes modern endpoint protection for computers and smartphones, server security for real-time data protection, and mobile threat defense. It also features full disk encryption, helping organizations comply with data protection regulations. ESET PROTECT Elite provides robust email security, including anti-phishing, anti-malware, and anti-spam technologies, along with cloud app protection for Microsoft 365 and Google Workspace. Vulnerability and patch management capabilities allow for automatic tracking and patching of vulnerabilities across all endpoints.Starting Price: $275 one-time payment -
8
Gblock
Jacopo Beschi
Gblock is a Chrome extension that protects your privacy in Gmail by blocking email senders from tracking you. Gblock provides you with full protection against email tracking, shielding you from tracking links, spy pixels, and anonymizing you via our proxy. Plus, with automated tracker detection, Gblock stays up to date to block new trackers as they are released! ✔️ SPY PIXEL PROTECTION ✔️ TRACKING LINK PROTECTION ✔️ AUTOMATED TRACKER DETECTION _________________________________________________________ 30 DAYS FREE TRIAL, NO CREDIT CARD REQUIRED Gblock comes with a 30-day trial, after which a paid subscription is required.Starting Price: $12/year -
9
WEDOS Protection
WEDOS Group SA
WEDOS Protection is a modern security solution combining powerful DDoS mitigation, CDN acceleration, and intelligent traffic filtering — designed for high availability, stability, and optimal web performance. It protects serious online businesses against volumetric and sophisticated application-layer attacks, including botnets and L7 exploits. Our global infrastructure WEDOS Global uses edge servers distributed worldwide to analyze and control traffic in real time. The service provides DNS protection, an advanced Web Application Firewall (WAF), HTTPS proxy, smart caching, anti-bot filters, and multiple protection layers that together form a robust security and performance ecosystem. ✅ Effective L3–L7 DDoS mitigation ✅ Global content acceleration via proprietary network ✅ Easy to implement – no code changes needed ✅ High availability and low latency even during attacks An ideal choice for high-traffic websites, ecommerce projects, agencies, and hosting providers.Starting Price: $1 -
10
KubeArmor
AccuKnox
KubeArmor is a cloud-native runtime security enforcement engine designed for Kubernetes workloads, containers, and virtual machines. It leverages eBPF and Linux Security Modules (LSMs) like AppArmor and SELinux to preemptively harden workloads and prevent attacks without modifying pods or containers. KubeArmor enforces real-time policy-based controls on process behavior, file access, networking, and resource usage. It simplifies complex security settings by providing Kubernetes-native policy management and detailed policy violation logging. Installation is straightforward via Helm charts, and it integrates seamlessly with multiple cloud marketplaces. KubeArmor’s proactive inline mitigation approach improves security beyond traditional post-attack responses.Starting Price: Free -
11
Devolutions PAM
Devolutions
Devolutions Privileged Access Manager (PAM) discovers privileged accounts, automates password rotation, approves check-outs, enforces just-in-time (JIT) privilege elevation, and records every session—giving small and midsize businesses (SMBs) enterprise-grade control without enterprise-grade hassle. Bundle PAM with the Privileged Access Management package and it slots straight into Devolutions Hub delivered as SaaS (Software-as-a-Service) or a self-hosted on-premises (on-prem) Devolutions Server, while Remote Desktop Manager provides one-click launches and Gateway supplies secure tunnels. One integrated stack takes you from standing privileges to true zero-standing-privilege—all under a single pane of glass, complete with granular RBAC (Role-Based Access Control) and tamper-proof audit logs.Starting Price: $50/month/user -
12
SurePassID
SurePassID
SurePassID is an advanced, deploy-anywhere multi-factor authentication platform built to secure both IT and OT (operational technology) environments, including critical infrastructure, legacy systems, on-premise, air-gapped, hybrid cloud, or fully cloud-based operations. It supports a wide variety of authentication methods; passwordless, phishing-resistant approaches like FIDO2/WebAuthn (with FIDO2 PIN, biometric, or push), as well as one-time passwords (OTP via OATH HOTP/TOTP), mobile push, SMS, voice, and traditional methods. SurePassID integrates with common operating systems, including domain and local logins, RDP/SSH remote access, and even legacy or embedded Windows systems often found in OT/ICS/SCADA environments, enabling offline 2FA when needed. It also supports securing VPNs, network devices, appliances, legacy applications, web apps (via SAML 2.0 or OIDC identity provider functionality), and network-device access protocols.Starting Price: $48 per year -
13
Primo
Primo
Primo is an all-in-one AI-powered IT operations platform that helps organizations buy, track, secure, and remotely manage company devices and software from a single, centralized system by combining identity, mobile device management (MDM), endpoint detection and response, SaaS management, and global hardware procurement so teams no longer juggle multiple disconnected tools; IT can enforce security policies, push apps and updates, monitor and remediate issues across macOS, Windows, and Linux devices, and coordinate zero-touch deployments at scale, all while keeping identity and access workflows in sync with HR data to automate onboarding, offboarding, and permission changes. It integrates with 60+ HR and email tools to ensure a single source of truth for users and devices, offers real-time compliance and activity logs, supports role-based access and single sign-on, and provides AI-assisted automation to reduce manual work and improve security posture.Starting Price: €8 per month -
14
Proton Authenticator
Proton
Proton Authenticator is a privacy-first two-factor authentication app that generates time-based one-time passwords to add an extra layer of login security for online accounts beyond just a password, so users can secure accounts across all their devices. It is open source and uses end-to-end encryption, meaning all cryptographic operations and secret keys are generated and stored locally, and even Proton cannot see your unencrypted 2FA data, offering transparency and strong privacy by design. Users can sync 2FA codes across devices with encrypted backups (including via iCloud or a Proton Account), import existing codes from other authenticator apps, and export them if needed, giving flexibility and control over 2FA secrets without vendor lock-in. Proton Authenticator is free to use, has no ads or tracking, and supports secure practices like biometric locks and offline access, so users can generate login codes.Starting Price: Free -
15
Ente Auth
Ente
Ente Auth is a free, open-source two-factor authentication app that helps users generate and manage time-based one-time passwords to secure logins for online accounts with an extra layer of verification beyond just a password, offering end-to-end encrypted backups so you never lose your codes and they remain private even to the service itself. It syncs codes across mobile, desktop, and web clients using fully encrypted channels, lets users import existing 2FA tokens by scanning QR codes or manual entry, and provides features like offline code generation, tagging and searching of codes, pinning favorites, icon identification, and quick “next code” display for faster logins. Backups are encrypted with audited cryptography, giving users peace of mind that only they can decrypt and access their 2FA secrets, and codes can be shared securely with teammates via encrypted links with optional expirations.Starting Price: Free -
16
HCL BigFix SaaS Remediate
HCL Software
HCL BigFix SaaS Remediate is a cloud-native automated vulnerability remediation platform that closes the gap between detecting a vulnerability and fixing it — without any infrastructure to deploy or maintain. While traditional tools scan and report, BigFix automates the entire remediation lifecycle. Deploy in minutes. Access 500,000+ pre-tested Fixlets covering 120+ OS versions and 700+ third-party applications. Achieve 99.5%+ first-pass patch success across your endpoints. Key capabilities: Automated patch deployment, CyberFOCUS Analytics for threat-prioritized remediation using CISA KEV and MITRE ATT&CK data, IVR with Tenable, Prescriptive Guidance to focus effort on highest-risk exposures, and Protection Level Agreements (PLAs) to track and prove remediation performance. Purpose-built for IT and security teams that need faster remediation, zero infrastructure overhead, and measurable risk reduction. -
17
ComputeSDK
ComputeSDK
ComputeSDK is a free and open-source toolkit designed to enable developers to safely run external or user-generated code within their applications through a unified and consistent interface. It provides a TypeScript-native API that abstracts multiple compute providers, allowing developers to switch between environments such as E2B, Vercel, Daytona, Modal, and others without modifying their core codebase. It is built around isolated sandbox environments, which ensure that executed code runs securely without impacting the host infrastructure, making it suitable for applications that require controlled execution of untrusted code. ComputeSDK supports key capabilities such as executing code and shell commands, managing filesystems, creating and destroying sandboxes, and integrating with modern web frameworks like Next.js, Nuxt, and SvelteKit.Starting Price: $500 per month -
18
VORXOC
Helxon
VorXOC by Helxon is a unified SOC platform designed to simplify and strengthen modern cybersecurity operations. The platform centralizes security monitoring, threat detection, incident response, and security analytics into a single dashboard, helping organizations reduce alert fatigue and improve response efficiency. VorXOC integrates with cloud platforms, SIEMs, firewalls, endpoint security tools, and other security solutions to provide real-time visibility across IT environments. The platform supports threat hunting, automated workflows, security monitoring, and advanced analytics for modern enterprises and managed security operations teams.Starting Price: $500/month -
19
SikkerKey
SikkerKey
SikkerKey allows you to manage application secrets across every machine in your stack using secure, machine-authenticated requests instead of bearer tokens. Instead of distributing replayable scoped tokens, SikkerKey verifies machine identity with asymmetric cryptographic proof, giving teams a stronger security primitive without the usual complexity. Run a single bootstrap command, approve the machine in the dashboard, and it’s ready to securely request the secrets it needs.Starting Price: $25/month -
20
Hyground
Hyground
Hyground is an AI-powered DevOps and SRE co-pilot — not a chatbot wrapper, but a full-stack operational intelligence system that runs inside the customer's Kubernetes cluster with no data egress. The agent connects to 21+ enterprise systems and investigates incidents across logs, metrics, traces, and K8s events. Engineers ask questions in plain language and get answers grounded in their own data — no new query languages to learn. AutoRCA turns an alert webhook into an autonomous root-cause investigation, then posts findings back to Slack or Teams. Investigation starts the instant an alert fires, not when an engineer wakes up. Customers report up to 85% MTTR reduction. Built on Google's Agent Development Kit, Hyground uses a multi-agent architecture and learns from your infrastructure over time. Resolved incidents extend the knowledge base, so runbooks stay current. -
21
HackerAI
HackerAI
HackerAI is an AI-powered penetration testing assistant built to help security teams scan targets, analyze vulnerabilities, investigate findings, and write reports faster. It works as a cybersecurity copilot for penetration testers, bug bounty hunters, and security auditors, giving users a conversational way to move through authorized security testing workflows. Instead of working through every stage of a test alone, users can chat with HackerAI to plan recon, interpret scan results, understand potential weaknesses, identify next steps, and turn technical findings into clearer security reports. It is designed for AI-assisted vulnerability research and security assessments, helping users find and fix vulnerabilities by chatting with AI. HackerAI is available through its web experience and desktop downloads for macOS, Windows, and Linux, with mobile options for iOS and Android so AI-powered penetration testing guidance can stay accessible across devices.Starting Price: Free -
22
HoneyWire
HoneyWire
HoneyWire is an open-source deception platform deploying canary tripwires across internal networks to detect lateral movement and intrusion activity. How it works: - TUI wizard instantly deploys lightweight, distroless "HoneyWires" onto any Linux host. - Synthetic services run silently with zero reason for legitimate users or scanners to interact with them. - If an attacker touches a HoneyWire, a high-fidelity alert routes directly to the centralized Hub. Deployment Types: - Web Router Decoy: Emulates admin router logins to trap web reconnaissance. - Canary TCP Tarpit: Binds to critical ports to log payloads and slow attacks. - File Canary (FIM): Monitors files to flag unauthorized access to decoy assets. - ICMP Canary: Detects stealthy ping sweeps and raw network mapping. - Network Scan Detector: Catches port scanning across local subnets. The Hub: A self-hosted, Web-UI control center managing node configurations, fleet, and alert routing, with frictionless UX.Starting Price: Free -
23
FolSec
FolSec
FolSec is a comprehensive data access management and security platform designed to protect enterprise file systems across on-premises and cloud environments. It provides centralized visibility and control over NTFS permissions, Active Directory groups, user access, and file activities. The platform enables organizations to discover sensitive data, create meaningful access matrices, identify excessive or unauthorized permissions, manage access requests, and review user privileges. Its audit and anomaly detection capabilities monitor who accessed, modified, moved, or deleted data and can detect suspicious behavior, insider threats, mass file operations, and ransomware activity. FolSec also includes file analysis, stale and duplicate file detection, permission backup and recovery, automated response actions, Active Directory reporting and management, and secure file sharing with expiration, password, download, IP, and two-factor authentication controls. -
24
Vulnotes
Vulnotes
Vulnotes is a modern, all-in-one platform for managing cybersecurity audits and writing penetration testing reports, covering the entire engagement lifecycle, from mission planning to the final deliverable. - 📅 Plan & Schedule Missions With Calendar And Availability Management - 👥 Assign Your Team With Roles & Permissions - ✍️ Write Reports In A Visual Editor - 👀 See A Live Preview Of Your Report As You Write It - 🤝 Collaborate In Real Time With Your Whole Team - 🗂️ Reuse Findings With A Vulnerability Template Library - 🤖 Generate Vulnerabilities From Screenshots With Built-In, Multi-Provider AI - 🌍 Translate Automatically Across Languages - 🔒 Keep Data Safe With Automatic Anonymization & Local AI Models - ✅ Review & Validate Reports Before They Ship - 📄 Export Beautiful Deliverables (DOCX, PDF, CSV, JSON, ZIP) In One Click - ☁️ Run It In The Cloud Or 💻 Self-Hosted On-PremiseStarting Price: $48/month -
25
CaaB
CaaB
CaaB is a simple, powerful cloud platform built specifically for managed service providers, combining high-performance infrastructure with a unified, fully white-label Cloud Web Manager. MSPs can deploy and manage virtual machines, virtual desktops, managed Kubernetes, cloud storage, CDN, cloud backup, dedicated firewalls, load balancers, web application firewall, and disaster recovery from one environment. The Cloud Web Manager provides an easy-to-navigate GUI, full automation and API access, multi-tenant user management, two-factor authentication, and usage reporting, helping partners manage customer cloud services under their own brand. Virtual machines are designed for high performance and easy scaling, with customizable hardware, SSD storage, Linux or Windows operating systems, and rapid deployment. Managed Kubernetes removes the need to install, manage, and operate clusters manually, with automated management, built-in security, portability, etc.Starting Price: $101 per month -
26
WPSniffer
Kerger
WPSniffer is a free, open-source command-line malware scanner for WordPress and other PHP sites. It scans files on the host where installed, using YARA-X and community YARA Forge rule packages to detect suspicious code such as webshells. Operators can use supplied rules or add their own .yar/.yara files, choose core, extended, or full rule sets, and pin a rule release for repeatable scans. The Python package scans selected paths, accepts paths from standard input, supports filters, and can run in scheduled jobs or CI workflows. Caching, file-size limits and per-file timeouts help manage larger scans. Reports are available in readable, CSV or TSV formats, with selectable columns and optional email delivery. WPSniffer serves administrators, developers, hosting operators and security teams investigating compromised sites or checking server files for malware. Scans run locally; files are not sent to an external service.Starting Price: $0 -
27
Cerbos
Cerbos
Cerbos is an authorization management platform for defining, deploying and evaluating access-control policies across applications and services. Developers can use its policy decision point (PDP) to evaluate authorization requests, while teams author and manage policies for role-, relationship- and attribute-based access control. Cerbos supports local, self-hosted and cloud-based workflows, with policy testing, observability and audit information for reviewing authorization decisions. Cerbos Hub provides a managed environment for organizing and distributing policies, and the open-source Cerbos PDP can be deployed alongside application workloads. The platform is intended for engineering, security and product teams that need consistent, fine-grained authorization for users, services and other identities across distributed systems.Starting Price: $25/month -
28
LayerV
LayerV
LayerV is private access infrastructure for people and AI agents. It lets organizations provide controlled access to internal web applications, APIs, and infrastructure without exposing the application origin through a direct public route. A connector is placed beside a private resource, and access can be issued only after the organization’s own sign-in and policy logic authorizes the request. Teams can use LayerV to share temporary access, limit who or what can reach a resource, and revoke access when it is no longer needed. The product is intended for developers, IT administrators, and security teams building or operating systems that need access control for employees, contractors, and software agents. Supported use cases include protecting internal tools and APIs, providing temporary access to private resources, and enabling AI agents to reach approved systems without making those systems publicly accessible.Starting Price: $0 -
29
Pryv.io
Pryv
Personal Data & Privacy Management Software - A ready-to-use solution for personal data and consent management. - Pryv.io is a solid foundation on which you build your own digital health solution, so you can collect, store, share and rightfully use personal data. - Maintained and developed by Pryv. Features - Provides latest Pryv.io core system ready for production - User registration and authentication - Granular consent-based access control rights - Data model made for privacy, aggregation and sharing - Full data life-cycle: collect - store - change - delete - REST & Socket.io API - Ease of software integration and configuration - Seamless connectivity and interoperability -
30
Motadata
Motadata
Motadata ObserveOps is a unified observability platform that brings metrics, logs, flows, traces, and topology together in one product. Built on Motadata's DFIT deep learning framework, it ingests telemetry from networks, servers, cloud workloads, containers, and applications, then correlates the signals so teams can pinpoint root cause without jumping between tools. The platform runs adaptive AI that does not need pre-training, supports OpenTelemetry-native ingestion, and integrates with Motadata ServiceOps for closed-loop incident workflows. Six deployment modes cover on-premise, private cloud, public cloud, and hybrid setups, including High Availability, Disaster Recovery, and HA-over-WAN for regulated and distributed environments. Over 500 enterprises across 30+ countries use it for full-stack observability.
