CyphrQRespond and recover
Contain and investigate: automation, managed response services and malware analysis (NIST CSF: Respond and Recover).
Up to five options per category, in alphabetical order: the order means nothing and nothing here is a ranking, a recommendation or an endorsement. We earn nothing from any vendor. For wider market coverage, see analyst reports such as Gartner Magic Quadrants and Forrester Waves, and test any tool against your own needs.
SOAR (security orchestration, automation and response)
Automates repetitive response steps and ties security tools together.
| Name | What it is | Type |
|---|---|---|
| Cortex XSOAR (Palo Alto Networks) | Palo Alto Networks' SOAR platform. | Paid |
| Google Security Operations (SOAR) | Google Cloud's SIEM and SOAR platform. | Paid |
| Shuffle | Open-source security automation. | Open source |
| Splunk SOAR | Splunk's security orchestration and automation. | Paid |
| StackStorm | Open-source event-driven automation. | Open source |
MDR and managed SOC services
A provider's analysts watch and respond around the clock. These are services, so there is no open-source option.
| Name | What it is | Type |
|---|---|---|
| Arctic Wolf | Managed detection and response and security operations. | Paid |
| CrowdStrike Falcon Complete | CrowdStrike's managed detection and response. | Paid |
| Expel | Managed detection and response across cloud, endpoint and SaaS. | Paid |
| Rapid7 MDR | Rapid7's managed detection and response. | Paid |
| Sophos MDR | Sophos's 24/7 managed detection and response. | Paid |
Malware analysis and reverse engineering
Disassemblers, debuggers and sandboxes for understanding malicious files.
| Name | What it is | Type |
|---|---|---|
| Binary Ninja | Reverse engineering platform with a decompiler. | Paid |
| Ghidra (NSA) | The US National Security Agency's open-source reverse engineering suite. | Open source |
| IDA Pro (Hex-Rays) | The long-standing commercial disassembler and decompiler. | Paid |
| Joe Sandbox | Commercial malware analysis sandbox. | Paid |
| x64dbg | Open-source debugger for Windows programs. | Open source |
Immutable backup and ransomware recovery
Keeps backup copies that attackers cannot change or delete, so you can restore after an attack.
| Name | What it is | Type |
|---|---|---|
| BorgBackup | Open-source deduplicating backup tool. | Open source |
| Cohesity | Data protection and recovery platform. | Paid |
| restic | Open-source encrypted backup tool. | Open source |
| Rubrik | Data protection and cyber recovery. | Paid |
| Veeam | Backup and recovery with immutable storage options. | Paid |