Best IT Security Software for Linux - Page 18
View:
Compare the Top IT Security Software for Linux as of November 2025 - Page 18
Sort By:
-
1
Trellix Data Encryption
Trellix
Trellix Data Encryption products secure devices and removable media to ensure that only authorized users can access the information they contain. Deploy encryption policies through a single management console, while monitoring encryption status and generating compliance reports. Choose from an extensive catalog of policy options to secure information across devices, files, and removable media - easily managed from a single location. Trellix Native Drive Encryption centralizes and simplifies management of both BitLocker and FileVault into a central console that is available on-premises or via SaaS. This saves time and resources for organizations managing multiple operating systems, since reporting and administrative tasks like encryption key and pin management are centralized. -
2
Ingalls MDR
Ingalls Information Security
Our Managed Detection and Response (MDR) service is designed for advanced detection, threat hunting, anomaly detection and response guidance utilizing a defense-in-depth approach which monitors and correlates network activity with endpoints, logs and everything in between. Unlike a traditional Managed Security Service Provider (MSSP), our service is geared toward proactive prevention. We do this by utilizing the very latest in cloud, big data analytics technology, and machine learning along with the cybersecurity industry’s leading incident response team, to identify threats to your environment. We leverage the best of the commercial, open source, and internally-developed tools and methods to provide the highest fidelity of monitoring possible. We have partnered with Cylance to provide the best endpoint threat detection and prevention capability available on the market today, CylancePROTECT(™). -
3
Stacklet
Stacklet
Stacklet builds on the Cloud Custodian project to offer an out-of-the-box solution with powerful management capabilities and advanced features to help businesses realize value. Stacklet is built by the original developer and maintainer of Cloud Custodian. Cloud Custodian is used by thousands of well-known global brands today. The project’s community has hundreds of active contributors including Amazon, Microsoft and Capital One and is growing rapidly. Stacklet provides a best-of-breed solution for cloud governance addressing needs around Security, Cost Optimization and Regulatory Compliance. Tooling to manage Cloud Custodian at scale across thousands of cloud accounts, policies and regions. Access to best practice policy sets which solve business problems out-of-the-box. Data and visualizations to understand policy health, resource auditing, trends and anomalies. Real-time inventory, historical revisions and change management of cloud assets. -
4
SISA ProACT
SISA Information Security
It’s time to rewire your security operations. SISA’s Managed detection and response solution is scalable and adaptable to the everchanging threat landscape and delivers 10x value by accelerating time to investigation and optimizing total operational costs. The platform offers a unified experience through integrated portals: GUI interface, Client site appliance, and Agent for resource monitoring. The indigenous algorithm, a “conscious” one, continuously reviews security events to decrease the dwell time from ticket to resolution. From breach investigations to damage assessments and remediation, take advantage of timely and actionable information through digital forensics. Out-of-the-box brand intel solution to initiate takedowns on unauthorized apps and content from in-depth, laser focused research on worldwide and dark web. With custom response solutions including host isolation or traffic blocking, directly respond to endpoints and close incidents with agility and speed. -
5
Akamai Guardicore Segmentation simplifies segmentation, reduce your attack surface and prevent lateral movement with fast and simple segmentation that works everywhere. Granular visibility and segmentation controls for Data Center, Cloud and Hybrid Cloud Environments. The Akamai Guardicore Segmentation Platform is the simplest and most intuitive way to visualize activity in data center and cloud environments, implement precise segmentation policies, protect against external threats, and detect possible breaches quickly. Akamai Guardicore Segmentation collects detailed information about an organization’s IT infrastructure through a mix of agent-based sensors, network-based data collectors, and virtual private cloud (VPC) flow logs from cloud providers. Relevant context is added to this information through a flexible and highly automated labeling process that includes integration with existing data sources like orchestration systems and configuration management databases.
-
6
Centreon
Centreon
Centreon is a global provider of business-aware IT monitoring for always-on operations and performance excellence. The company’s holistic, AIOps-ready platform is designed for today’s complex, distributed hybrid cloud infrastructures. Centreon monitors the complete IT Infrastructure from Cloud-to-Edge for a clear and comprehensive view. Centreon removes blind spots, monitoring all equipment, middleware and applications that are part of modern IT workflows, from on-premise legacy assets to private and public cloud environments, all the way to the edge of the network, where smart devices and customers combine to create business value. Centreon is constantly current, able to support the most dynamic environments. With auto-discovery capabilities it can keep track of Software-Defined Network (SDN) elements, AWS or Azure cloud assets, Wi-Fi access points or any other component of today’s agile IT infrastructure. -
7
Cisco Cyber Vision
Cisco
The deeper integration between IT, cloud and industrial control networks (ICS) is exposing your industrial operations to cyber threats. Cisco Cyber Vision has been specifically developed for OT and IT teams to work together to ensure production continuity, resilience and safety. You can now deploy Industrial Internet of Things (IIoT) technologies and capture the benefits of your industry digitization efforts. Kick-start your OT security project by building an accurate list of all your industrial assets, communication patterns and network topologies. Feed your SOC (security operations center) with OT context and leverage the time and money you have invested in IT cybersecurity to secure your OT network. Take OT security to the next level: Have detailed information to comply with regulations and enable effective collaboration between OT and IT experts. -
8
iboss
iboss
iboss is a cloud security company that enables organizations to reduce cyber risk by delivering a Zero Trust Secure Access Service Edge platform designed to protect resources and users in the modern distributed world. Applications, data, and services have moved to the cloud and are located everywhere, while users needing access to those resources are working from anywhere. The iboss platform replaces legacy VPN, Proxies, and VDI with a consolidated service that improves security, increases the end-user experience, consolidates technology, and substantially reduces costs. Built on a containerized cloud architecture, iboss delivers security capabilities such as SWG, malware defense, Browser Isolation, CASB, and Data Loss Prevention to protect all resources via the cloud instantaneously and at scale. The iboss platform includes ZTNA to replace legacy VPN, Security Service Edge to replace legacy Proxies, and Browser Isolation to replace legacy VDI. This shifts the focus from protecting -
9
Sangfor Athena EPP
Sangfor Technologies
Sangfor Athena EPP is a modern endpoint protection platform that combines next-generation antivirus (NGAV), endpoint detection and response (EDR), and endpoint management in a single solution. It delivers comprehensive protection, detection, and response across all endpoints within an organization’s network. The platform offers asset and patch management to maintain visibility and control over devices and software. Athena EPP includes dedicated ransomware protection, forensic analysis, threat hunting, and ransomware recovery capabilities. Its flexible architecture supports on-premises, cloud, and hybrid deployments, making it suitable for organizations of all sizes. Third-party validations and certifications highlight its proven effectiveness and reliability in endpoint security. -
10
Symantec EDR
Broadcom
Quickly discover and resolve threats with deep endpoint visibility and superior detection analytics, reducing mean time to remediation. Overcome cyber security skills shortages and streamline SOC operations with extensive automation and built-in integrations for sandboxing, SIEM, and orchestration. Fortify security teams with the unmatched expertise and global scale of Symantec Managed Endpoint Detection and Response services. Roll out Endpoint Detection and Response (EDR) across Windows, macOS, and Linux devices using Symantec Endpoint Protection (SEP)-integrated EDR or a dissolvable agent. Supported by deep endpoint visibility, precisely detect and actively hunt threats to quickly expose and fully resolve them, no matter how persistent. Instantly detect advanced attack methods using behavioral policies continually updated by Symantec researchers. -
11
Oracle Audit Vault and Database Firewall monitors Oracle and non-Oracle database traffic to detect and block threats, as well as improves compliance reporting by consolidating audit data from databases, operating systems, directories, and other sources. It can be deployed on-premises or in the Oracle Cloud. Oracle Audit Vault and Database Firewall (AVDF) is a complete Database Activity Monitoring (DAM) solution that combines native audit data with network-based SQL traffic capture. AVDF includes an enterprise quality audit data warehouse, host-based audit data collection agents, powerful reporting and analysis tools, alert framework, audit dashboard, and a multi-stage Database Firewall. Dozens of out-of-the-box compliance reports provide easy, schedulable, customized reporting for regulations such as GDPR, PCI, GLBA, HIPAA, IRS 1075, SOX, and UK DPA.
-
12
TruU Identity Platform. The most advanced and complete passwordless identity solution today. TruU utilizes specialized AI and ML algorithms to identify individuals with 99.99% accuracy. Use local phone PIN or biometrics adaptively to secure access across the enterprise, from desktops to VDI. Turn on behavioral biometrics when you are ready for maximum UX that does not sacrifice on security. TruU enables your remote workforce seamlessly through out-of-the-box VPN and VDI integration. Architected for high security throughout an employee's lifecycle, from onboarding to user self-service. Use iOS or Android phones to unlock Windows, Mac or Linux workstations, even when offline. We integrate into leading PACS to eliminate kludgy badges and transform the workplace experience. It’s estimated that 80% of data breaches start with compromised credentials, particularly passwords. It’s also true that strict password policies frustrate end users and lead to behaviors that make compromise easier.
-
13
Drata
Drata
Drata is the world’s most advanced security and compliance automation platform with the mission to help companies earn and keep the trust of their users, customers, partners, and prospects. Drata helps hundreds of companies streamline their SOC 2 compliance through continuous, automated control monitoring and evidence collection, resulting in lower costs and less time spent preparing for annual audits. The company is backed by Cowboy Ventures, Leaders Fund, SV Angel, and many key industry leaders. Drata is based in San Diego, CA.Starting Price: $10,000/year -
14
AD Enterprise
AccessData
Today’s digital forensics teams face many challenges in a world filled with an overwhelming amount of data. From multiple office locations, to massive employee pools and remote workers, AD Enterprise provides deep visibility into live data directly at the endpoint, helping you conduct faster, more targeted enterprise-wide post-breach, HR and compliance investigations in a single, robust solution. With AD Enterprise, you can respond quickly, remotely and covertly while maintaining chain of custody, and facilitate focused forensic investigations and post-breach analysis, without interruption to business operations. Preview live data at the endpoint, then filter on any attributes and choose to retrieve only the data that matters to your investigation, saving time and cost. Perform collections from endpoints in multiple locations by deploying our remote Enterprise Agent to a broad range of operating systems, including Windows, Mac, Linux and more. -
15
KeyTalk
KeyTalk
KeyTalk is independent of Certificate Authorities and linked to a large number of public CAs both GMO GlobalSign and Digicert QuoVadis. Switching between CAs is simple and easy, even when thousands of certificates and end-points are involved. A vendor lock-in is therefore no longer the case. KeyTalk contains an internal CA for the generation of private certificates and keys. Did you use previously expensive public certificates for internal purposes? Or did you run into the limited functionality of Microsoft CS and other private CAs? Then, you will like our internal CA, private PKI certificate issuance. KeyTalk keeps track of the lifecycle of your certificates in a fully automated way. This way, you always have a complete and up to date overview of all your certificates, including the certificate name, SAN and validity. Also, things like used crypto keys and algorithms of internal and external certificates can be included. -
16
MaxPatrol
Positive Technologies
MaxPatrol is made for managing vulnerabilities and compliance on corporate information systems. Penetration testing, system checks, and compliance monitoring are at the core of MaxPatrol. Together, these mechanisms give an objective picture of the security stance across IT infrastructure as well as granular insight at the department, host, and application level, precisely the information needed to quickly detect vulnerabilities and prevent attacks. MaxPatrol makes it a cinch to keep an up-to-date inventory of IT assets. View information about network resources (network addresses, OS, available network applications and services), identify hardware and software in use, and monitor the state of updates. Best of all, it sees changes to your IT infrastructure. MaxPatrol doesn't blink as new accounts and hosts appear, or as hardware and software are updated. Information about the state of infrastructure security is quietly collected and processed. -
17
SCYTHE
SCYTHE
SCYTHE is an adversary emulation platform for the enterprise and cybersecurity consulting market. The SCYTHE platform enables Red, Blue, and Purple teams to build and emulate real-world adversarial campaigns in a matter of minutes. SCYTHE allows organizations to continuously assess their risk posture and exposure. SCYTHE moves beyond just assessing vulnerabilities. It facilitates the evolution from Common Vulnerabilities and Exposures (CVE) to Tactics, Techniques, and Procedures (TTPs). Organizations know they will be breached and should focus on assessing detective and alerting controls. Campaigns are mapped to the MITRE ATT&CK framework, the industry standard and common language between Cyber Threat Intelligence, Blue Teams, and Red Teams. Adversaries leverage multiple communication channels to communicate with compromised systems in your environment. SCYTHE allows you to test detective and preventive controls for various channels. -
18
Cmd
Cmd
A powerful yet lightweight security platform that provides insightful observability, proactive controls, threat detection and response for your Linux infrastructure in the cloud or datacenter. Your cloud infrastructure is a massive multi-user environment. Don’t protect it with security solutions originally built for endpoints. Think beyond logging and analytics solutions that lack the necessary context and workflows for true infrastructure security. Cmd’s infrastructure detection and response platform is optimized for the needs of today’s agile security teams. View system activity in real time or search through retained data, aided by rich filters and triggers. Leverage our eBPF sensors, contextual data model and intuitive workflows to gain insight into user activity, running processes and access to sensitive resources. No advanced degree in Linux administration required. Create guardrails and controls around sensitive actions to complement traditional access management. -
19
Secfense
Secfense
Protect your company, employees, and customers with simpler and stronger authentication. Deploy 2FA in minutes, not weeks. 2FA (and other user access security policies) built into the fabric of the infrastructure, not rigidly fixed to the applications. Enabling the use of any 2FA methods available on the market now and in the future without changing the core. Protection is available across the entire organization, spanning from on-premise, public and private cloud. Secfense is deployed in between your users and the applications they access. It learns the traffic patterns related to authentication. It can then enforce multi-factor authentication login and other sensitive actions without interfering with the applications existing code or database. Up-to-date 2FA methods are always available on the platform. Application changes don’t affect Secfense and applied methods. Take control over session expiration rules across all apps. Don’t rely on VPNs, base trust on users and their devices. -
20
SolidPass
SolidPass
SolidPass is a leader in next-generation strong authentication, and protects enterprises and their customers from fraud, digital attacks, and information theft through advanced security software. Solidpass converts mobile phones, internet browsers, and desktop applications into robust security tokens. By eliminating the need for hardware tokens, SolidPass brings the highest levels of security at a fraction of the cost, and without the hassle of traditional, physical two-factor authentication tokens. SolidPass has bridged the traditional trade-off between usability and stronger security, and makes Challenge-Response (CR) and Transaction Data Signing (TDS) simple to use by incorporating advancements such as barcode scanning. Barcode scanning-based authentication can be used for Challenge-Response (CR) and Transaction Data Signing (TDS). Barcode scanning adds usability and convenience. -
21
Zenmap
Zenmap
Zenmap is the official Nmap Security Scanner GUI. It is a multi-platform (Linux, Windows, Mac OS X, BSD, etc.) free and open source application which aims to make Nmap easy for beginners to use while providing advanced features for experienced Nmap users. Frequently used scans can be saved as profiles to make them easy to run repeatedly. A command creator allows interactive creation of Nmap command lines. Scan results can be saved and viewed later. Saved scan results can be compared with one another to see how they differ. The results of recent scans are stored in a searchable database. You can download Zenmap (often packaged with Nmap itself) from the Nmap download page. Zenmap is quite intuitive, but you can learn more about using it from the Zenmap User's Guide or check out the Zenmap man page for some quick reference information. -
22
OpenSCAP
OpenSCAP
The OpenSCAP ecosystem provides multiple tools to assist administrators and auditors with assessment, measurement, and enforcement of security baselines. We maintain great flexibility and interoperability, reducing the costs of performing security audits. The OpenSCAP project provides a wide variety of hardening guides and configuration baselines developed by the open source community, ensuring that you can choose a security policy which best suits the needs of your organization, regardless of its size. Security Content Automation Protocol (SCAP) is U.S. standard maintained by National Institute of Standards and Technology (NIST). The OpenSCAP project is a collection of open source tools for implementing and enforcing this standard, and has been awarded the SCAP 1.2 certification by NIST in 2014. In the ever-changing world of computer security where new vulnerabilities are being discovered and patched every day, enforcing security compliance must be a continuous process. -
23
Vega
Subgraph
Vega can help you find and validate SQL Injection, cross-site scripting, inadvertently disclosed sensitive information, and other vulnerabilities. It is written in Java, GUI based, and runs on Linux, OS X, and Windows. Vega can help you find vulnerabilities such as: reflected cross-site scripting, stored cross-site scripting, blind SQL injection, remote file include, shell injection, and others. Vega also probes for TLS / SSL security settings and identifies opportunities for improving the security of your TLS servers. Vega includes an automated scanner for quick tests and an intercepting proxy for tactical inspection. The Vega scanner finds, SQL injection, and other vulnerabilities. Vega includes a website crawler powering its automated scanner. Vega can automatically log into websites when supplied with user credentials. -
24
Blokada
Blokada
Blokada is the popular ad blocker and privacy app for Android and iOS. It's being supported and actively developed by the amazing open source community. If you want to efficiently block ads, trackers, malware, save on your data plan, speed up your device and protect your privacy with just one application, then Blokada is for you. It is free, secure and open source. For ultimate privacy protection, upgrade to Blokada Plus and connect through our VPN. We use WireGuard®, the most advanced VPN protocol, to encrypt your network activity and hide your IP address. Blokada Slim is a lightweight version of the app, and it only contains features allowed by the Google Play policy. Blokada is not only the privacy app. It is also the community of people who care about their digital privacy and wellbeing. You will find us on our forum, where you can ask any questions you may have. We are also present on other social media and chats. -
25
FortiSandbox
Fortinet
Unlike previous generation of viruses that were non-sophisticated and low in volume, antivirus tools were sufficient to provide reasonable protection with their database of signatures. However, today’s modern malware entails new techniques such as use of exploits. Exploiting a vulnerability in a legitimate application can cause anomalous behavior and it’s this behavior that attackers take advantage of to compromise computer systems. The process of an attack by exploiting an unknown software vulnerability is what is known as a zero-day attack aka 0-day attack, and before sandboxing there was no effective means to stop it. A malware sandbox, within the computer security context, is a system that confines the actions of an application, such as opening a Word document, to an isolated environment. Within this safe environment the sandbox analyzes the dynamic behavior of an object and its various application interactions in a pseudo-user environment and uncovers any malicious intent. -
26
REMnux
REMnux
REMnux® is a Linux toolkit for reverse-engineering and analyzing malicious software. REMnux provides a curated collection of free tools created by the community. Analysts can use it to investigate malware without having to find, install, and configure the tools. The easiest way to get the REMnux distro is to download the REMnux virtual machine in the OVA format, then import it into your hypervisor. You can also install the distro from scratch on a dedicated host or add it to an existing system running a compatible version of Ubuntu. The REMnux toolkit also offers Docker images of popular malware analysis tools, making it possible to run the them as containers without having to install the tools directly on the system. You can even run the REMnux distro as a container. For details about installing, using, and contributing to REMnux, as well as for information about the tools included in the toolkit, see the REMnux documentation site. -
27
Joe Sandbox
Joe Security
Tired of high level malware analysis? Perform one of the deepest analysis possible - fully automated or manual - from static to dynamic, from dynamic to hybrid, from hybrid to graph analysis. Rather than focus on one, use the best of multiple technologies including hybrid analysis, instrumentation, hooking, hardware virtualization, emulation and machine learning / AI. Check out our reports to see the difference. Deeply analyze URLs to detect phishing, drive by downloads, tech scam and more. Joe Sandbox uses an advanced AI based algorithm including template matching, perptual hashing, ORB feature detection and more to detect the malicious use of legit brands on websites. Add your own logos and templates to extend the detection capabilities. Interact with the sandbox through Live Interaction - directly from your browser. Click through complex phishing campains or malware installers. Test your software against backdoors, information leakage and exploits (SAST and DAST). -
28
BlackArch Linux
BlackArch Linux
BlackArch Linux is an Arch Linux-based penetration testing distribution for penetration testers and security researchers. You can install tools individually or in groups. BlackArch Linux is compatible with existing Arch installs. The BlackArch Full ISO contains multiple window managers. The BlackArch Slim ISO features XFCE Desktop Enviroment. The full ISO contains a complete, functional BlackArch Linux system with all the available tools in the repo at build time. The slim ISO contains a functional BlackArch Linux system with a selected set of common/well-known tools and system utilities for pentesting. The netinstall ISO is a lightweight image for bootstrapping machines with a minimal set of packages. BlackArch Linux is compatible with existing/normal Arch installations. It acts as an unofficial user repository. You can install BlackArch Linux using the Slim medium which features GUI installer. -
29
Pica8 PICOS
Pica8
The one-of-a-kind PICOS open NOS with tightly coupled control planes gives network operators surgical, non-disruptive control of their enterprise applications, deep and dynamic traffic monitoring, and even attack mitigation, all in real time. There’s no better way to implement zero-trust networking and software-defined perimeters than PICOS. Our flagship open network operating system installs on 1G- to 100G-interface open switches from a broad array of Tier 1 manufacturers. This fully featured license offers the most comprehensive support for enterprise features on the market. It includes the Debian Linux distribution, with an unmodified kernel for maximum DevOps programmability. Enterprise Edition also includes AmpCon, an Ansible-based automation framework that couples Zero-Touch Provisioning (ZTP) with the Open Network Install Environment (ONIE) to simplify installation and operation of open network switches across the enterprise. -
30
Kali Linux
Kali
Kali Linux is an open-source, Debian-based Linux distribution geared towards various information security tasks, such as Penetration Testing, Security Research, Computer Forensics and Reverse Engineering. You can take any Linux and install pentesting tools on it, but you have to set the tools up manually and configure them. Kali is optimized to reduce the amount of work, so a professional can just sit down and go. A version of Kali is always close to you, no matter where you need it. Mobile devices, Docker, ARM, Amazon Web Services, Windows Subsystem for Linux, Virtual Machine, bare metal, and others are all available. With the use of metapackages, optimized for the specific tasks of a security professional, and a highly accessible and well documented ISO customization process, it's always easy to generate an optimized version of Kali for your specific needs. Whether you are a seasoned veteran or a novice, our documentation will have all the information you will need to know.
