Security & Privacy·Standings

Compare Offensive Security Tools

Offensive security tools help assess systems for weaknesses through testing and simulated attacks; compare their testing scope and deployment options to find a fit.

The board shows a signal score out of 10, plus marks for a public API, open-source code, and a free tier. Compare those with the listed integrations and pricing details.

  • 22 platforms
  • 1 with a public API on this page
  • 10 with a free tier
  • Checked 28 Sept 2026
  1. 1
    KL
    Kali Linuxkali.org

    A free, open-source Linux distribution with tools for security audits, forensics and other security tasks.

    7.7 APIOpenFree Free tier
  2. 2
    OZ
    OWASP ZAPzaproxy.org

    A free, open-source program that checks websites for security issues with scans, alerts and a site crawler.

    7.6 APIOpenFree Free tier
  3. 3
    AP
    AttackIQ Platformattackiq.com

    A security platform for modeling attacks, prioritizing attack paths and validating controls.

    6.7 APIOpenFree Free tier · from $4,995/mo
  4. 4
    SR
    Stratus Red Teamstratus-red-team.cloud

    A free, open-source tool for running cloud attack techniques to check detections across AWS, Azure and GCP.

    6.3 APIOpenFree Free tier
  5. 5
    I
    ImmuniWebimmuniweb.com
    6.3 APIOpenFree Free tier · from €595/yr
  6. 6
    AR
    Atomic Red Teamatomicredteam.io

    A free library of security tests mapped to MITRE ATT&CK for checking detection coverage.

    6.2 APIOpenFree Free tier
  7. 7
    PT
    Pentest-Tools.com API Scannerpentest-tools.com

    An online tool that checks APIs for security flaws and accepts REST, GraphQL and Postman formats.

    6.2 APIOpenFree Free tier · from $95/mo
  8. 8
    BL
    BlackArch Linuxblackarch.org

    BlackArch Linux is an Arch Linux based penetration testing distribution for penetration testers and security researchers.

    5.9 APIOpenFree Free tier
  9. 9
    PS
    Picus Security Platformpicussecurity.com

    A paid platform that simulates attacks against security products and helps teams address risks and retest.

    5.9 APIOpenFree —
  10. 10
    AS
    Astra Securitygetastra.com

    A security service that checks online services and cloud systems for weaknesses, including login-protected areas.

    5.6 APIOpenFree From $699/yr
  11. 11
    S
    SCYTHEscythe.io

    SCYTHE is a continuous Adversarial Exposure Validation platform that emulates real adversary behavior to validate security controls in an organization's…

    5.6 APIOpenFree —
  12. 12
    CP
    Cymulate Platformcymulate.com

    A web platform that validates security controls with attack simulations and defense guidance.

    5.3 APIOpenFree —
  13. 13
    N
    NodeZerohorizon3.ai

    A paid platform that maps exploitable routes through networks and cloud systems and helps check fixes.

    5.3 APIOpenFree —
  14. 14
    SE
    Social-Engineer Toolkit (SET)github.com

    A free, self-hosted toolkit for automated external security testing.

    5.1 APIOpenFree Free tier
  15. 15
    BD
    BreachLock DASTbreachlock.com

    A web application scanner that tests running apps from the outside and supports login sessions.

    5.0 APIOpenFree From $5,000/yr
  16. 16
    M
    Metasploitmetasploit.com
    4.9 APIOpenFree Free tier
  17. 17
    MP
    Metasploit Prorapid7.com
    4.3 APIOpenFree —
  18. 18
    BS
    Burp Suite Professionalportswigger.net

    A desktop security testing program that automates attacks against websites on Windows, macOS and Linux.

    4.3 APIOpenFree —
  19. 19
    CI
    Core Impactfortra.com
    4.1 APIOpenFree —
  20. 20
    HP
    HackerOne Pentesthackerone.com
    4.1 APIOpenFree —
  21. 21
    V
    vPenTestvonahi.io
    4.1 APIOpenFree —
  22. 22
    BP
    4.0 APIOpenFree —

Places #1, #2, #3, #4, #5 on this board are open to sponsors. Take #1 · Other ways to advertise

How to choose

What testing scope do I need?

Choose a tool whose stated testing scope fits the systems and security questions you need to assess. Compare scope alongside automated attacks and attack simulation libraries.

Where does the tool need to run?

Check the deployment options against your environment. The board compares Linux, web, Windows, API, macOS, and self-hosted availability.

Can I try it before paying?

Check whether a free plan or free trial is listed, then compare the paid starting price. Some tools list pricing on request, so a starting price may not be available.

Which integrations should I check?

Compare the listed integrations with the apps and systems your team already uses. A public API mark indicates an API is listed; check the tool's details for the connections you need.

Should I check the licence or open-source status?

If you need to read or change the code, check the tool's open-source status and licence. The board includes an open-source mark, but the licence terms should be reviewed separately.

Questions

What does offensive security software do?

It supports security assessments that test systems for weaknesses, including automated attacks and attack simulations.

How do I choose an offensive security tool?

Compare testing scope, deployment options, automated attacks, simulation libraries, integrations, and pricing against your needs.

Can I use offensive security tools for free?

The board marks whether a free plan or free trial is listed. Check the individual tool's pricing details for its terms.

What platforms should I compare for offensive security software?

Compare Linux, web, Windows, API, macOS, and self-hosted deployment options with your environment.

What does the signal score mean on this board?

It is a score out of 10 based on published information about use, public API availability, documentation depth, open-source code, and a free tier.

Some top positions on this board can be paid placements, standing where they were sold. The facts on each platform are not for sale. How we rank · Disclosure