Which security tool does what? A map for beginners

Security tooling can look like a wall of unfamiliar names. Most of the well-known open source tools fall into a handful of families, and each family answers one question about your own systems. This article walks through those families with an everyday analogy and names the projects described elsewhere in this topic. None of them requires a security background to run once against something you own.

Vulnerability scanners: the recall notice

A vulnerability scanner compares what is installed with lists of known problems, the way a car manufacturer’s recall database tells you that your model year has a faulty part. It does not test whether the part has failed; it tells you that a fix exists and you have not applied it. Trivy (aquasecurity/trivy) does this for container images, project dependencies and infrastructure files, and is usually the first scanner a team adopts because it needs no setup.

Secret detection: checking your pockets before the laundry

Secret scanners look for passwords, API keys and private keys that ended up in source code or Git history. The analogy is checking your pockets before clothes go in the wash: cheap to do every time, expensive to skip once. Gitleaks (gitleaks/gitleaks) is the standard tool, run as a pre-commit hook on your machine and again in CI.

Static analysis: a proofreader who knows the dangerous phrases

Static analysis reads source code without running it and flags patterns known to cause bugs or security holes, like a proofreader who has a list of phrases that always cause trouble in contracts. Semgrep (semgrep/semgrep) is popular because its rules are written in the shape of the code they match, so you can read a rule and understand why it fired.

Host audit: the home inspector

A host audit tool runs on a server and checks its configuration against hardening advice: password policies, SSH settings, file permissions, kernel parameters, pending updates. It is the home inspector who walks through the building with a checklist and writes up what should be fixed, in order of importance. Lynis (CISOfy/lynis) is the best known open source example and ends every run with a list of suggestions.

Web application testing: the locksmith you hired

Web application scanners interact with a running site the way an attacker would, sending unusual inputs to find injection, scripting and configuration flaws. This is the locksmith you hired to try your own doors; the same actions against someone else’s doors are a crime, so these tools are used only on applications you own or have written permission to test. OWASP ZAP (zaproxy/zaproxy) is the free standard, with a safe baseline mode for a first look.

Network inventory: the floor plan

Network mappers discover which hosts exist on a network and which ports and services they expose. They draw the floor plan of your network as it really is, which is often different from the one in the documentation, and let you confirm that a firewall rule really closed the door you meant to close. Nmap (nmap/nmap) has filled this role since 1997. As with web scanners, scan only networks you administer.

References: the manual on the shelf

Not every security resource is a tool. The OWASP Cheat Sheet Series (OWASP/CheatSheetSeries) gives short answers to concrete questions such as how to store passwords or validate input. Curated lists such as awesome-security-hardening (decalage2/awesome-security-hardening) point to hardening guides and benchmarks for each operating system and service. For the two building blocks most people eventually need, age (FiloSottile/age) encrypts files and step-ca (smallstep/certificates) issues certificates for your own internal services.

Where to begin

If you only run one tool today, run a scanner against something you own. Each of these takes a minute and asks for nothing but a terminal:

trivy fs .
gitleaks dir .
sudo lynis audit system

The first report will be longer than you like. That is normal; read the entries on each tool in this topic for how to interpret it, and the how-to Scan your own code and containers in CI: Gitleaks, Semgrep and Trivy for turning the one-off run into a habit.

Official documentation

• OWASP Top 10
• OWASP Cheat Sheet Series
• Trivy documentation