Resources · “Zero Budget, Zero Excuses” talk
The (almost) $0 cyber toolkit
The tools presented in the talk: what they do, their strengths, their limits and the real effort they take. Remember: free is never free. What you save in dollars, you pay for in hours.
Who covers what?
All 18 tools across 10 cybersecurity domains. Click a tool to jump to its card.
Strong coverage
Medium
Partial
Know and measureProtectDetect and respondGovern and raise awareness
The red column? No tool in the kit covers backup. Why it matters ↓
Deployment and maintenance effort:LowMediumHigh
Know and measure
Know what you protect, from whom, and where the gaps are.
Threat intelligence sharing platform: indicators of compromise, campaigns, threat actors. Tells you what is hitting your sector.
Threat intel · strongDetection · partialResponse · partial
DeploymentHigh
MaintenanceMedium
Pros
- Industry standard, very large community
- Many free intelligence feeds
- Integrates with SIEMs (e.g. Wazuh)
Cons
- Steep learning curve
- Without triage, lots of noise
- Needs regular analysis time
Greenbone / OpenVAS
Free (community edition)
Network vulnerability scanner for servers, workstations and devices. Finds missing patches and misconfigurations.
Vulnerabilities · strongNetwork · partial
DeploymentMedium
MaintenanceMedium
Pros
- Broad coverage of known vulnerabilities
- Exportable reports
- Can be scheduled
Cons
- Community feed lags behind the commercial one
- False positives to validate
- Scans can be heavy on the network
Semperis Purple Knight
Free
Security posture assessment for Active Directory and Entra ID: an overall score and prioritized indicators of exposure.
Identity · strongVulnerabilities · partial
DeploymentLow
MaintenanceLow
Pros
- Results in minutes
- Prioritized, explained findings
- No infrastructure to install
Cons
- Point-in-time snapshot, no continuous monitoring
- Remediation is up to you
- Made by a commercial vendor
Semperis Forest Druid
Free
Maps attack paths to Tier 0 (AD and Entra ID): shows how an attacker could become an administrator.
Identity · strong
DeploymentLow
MaintenanceLow
Pros
- Focused on what really matters (Tier 0)
- Visual and quick to run
- Great for prioritizing identity work
Cons
- Centred on the Microsoft ecosystem
- Requires AD expertise to fix findings
- Point-in-time analysis
Prowler
Free (open source) · paid cloud version
Cloud security posture assessment (AWS, Azure, GCP, Microsoft 365, Kubernetes): hundreds of checks and compliance reports.
Vulnerabilities · mediumGovernance · partialIdentity · partial
DeploymentLow
MaintenanceLow
Pros
- Quick to run (command line or container)
- Mapped to frameworks (CIS, ISO, etc.)
- Dashboard included
Cons
- Lots of findings to triage
- Needs broad read permissions
- No automatic remediation
Protect
Close the doors attackers use most.
OPNsense / pfSense
Free (software) · hardware required
Open source firewall and router: network segmentation, VPN, filtering, intrusion detection (Suricata).
Network · strongDetection · partial
DeploymentMedium
MaintenanceMedium
Pros
- Enterprise-grade firewall features
- Large community and many plugins
- Full web interface
Cons
- Hardware and high availability are on you
- One bad rule = outage or hole
- Guaranteed support only in paid versions
CIRA Canadian Shield
Free
Canadian protective DNS service from CIRA: blocks known malicious sites, phishing and ransomware.
Network · medium
DeploymentLow
MaintenanceLow
Pros
- One DNS change = instant protection
- Canadian service
- Zero maintenance
Cons
- Can be bypassed (hard-coded or encrypted DNS)
- Little visibility or reporting in the free version
- DNS filtering only
Passbolt
Free (community edition, unlimited users)
Open source, self-hosted team password vault: end-to-end encryption, group sharing, browser extension.
Identity · medium
DeploymentMedium
MaintenanceMedium
Pros
- Unlimited users in the community edition
- Your data stays with you
- Goodbye to the “passwords” spreadsheet
Cons
- SSO, LDAP and audit logs are paid-edition features
- Critical service to host, back up and maintain
- No account recovery in the community edition
Microsoft Defender
Already paid for (included in Windows)
Antivirus and protection built into Windows. Advanced features (EDR, central console) depend on your licences.
Endpoints · strongDetection · mediumVulnerabilities · partialResponse · partial
DeploymentLow
MaintenanceLow
Pros
- Already on your workstations
- Solid baseline protection
- Central management possible (Intune)
Cons
- Several advanced protections are off by default
- EDR and console depend on licensing
- Microsoft ecosystem only
Detect and respond
See what is happening and react fast when it hits.
Open source SIEM / XDR: threat detection, file integrity, vulnerabilities, compliance, with agents on workstations and servers.
Detection · strongGovernance · partialVulnerabilities · partialEndpoints · partial
DeploymentHigh
MaintenanceHigh
Pros
- Very complete for a free tool
- Agents for Windows, Linux and macOS
- Rules and dashboards included
Cons
- Significant tuning to limit false positives
- Needs server resources
- Expertise required to run it well
OpenObserve
Free (open source) · paid enterprise version
Centralized logs, metrics and traces, with very low-cost storage and SQL search.
Detection · mediumResponse · partial
DeploymentMedium
MaintenanceMedium
Pros
- Long log retention at low cost
- Lightweight and fast
- SQL search
Cons
- Not a SIEM: detection rules are yours to build
- Younger ecosystem
- Some features in the enterprise version
Velociraptor
Free (open source)
Digital forensics and threat hunting on endpoints: remote collection of artifacts, at scale.
Response · strongEndpoints · partialDetection · partial
DeploymentMedium
MaintenanceMedium
Pros
- Very powerful for investigations
- Many ready-to-use artifacts
- Lightweight agent
Cons
- Query language (VQL) to learn
- An expert's tool
- Deploy it before the incident, not during
Zabbix
Free (open source)
Availability and performance monitoring. Not a security tool, but an unusual load is often a first signal.
Network · partialDetection · partial
DeploymentMedium
MaintenanceMedium
Pros
- Mature, many templates
- Configurable alerts
- Overview of the whole infrastructure
Cons
- Does not detect attacks by itself
- Long initial setup
- Risk of alert fatigue
NetCure (in-house)
In-house (vibe coding)
Network sensor built by Curseur: collects flow metadata (who talks to whom, on which ports, how much) and flags abnormal behaviour. An in-house alternative to commercial network detection products such as Darktrace.
Detection · mediumNetwork · partial
DeploymentMedium
MaintenanceHigh
Pros
- Network visibility with no budget
- Fits your exact needs
- Metadata only, no content recorded
Cons
- Doesn't do everything a commercial product does
- You are the support team
- Code to review, secure and document
DFIR-IRIS
Free (open source)
Collaborative incident response platform: cases, timeline, evidence, tasks and decisions in one place.
Response · strong
DeploymentMedium
MaintenanceLow
Pros
- The whole incident documented in one place
- Collaborative for the whole team
- Useful for the post-mortem and the insurer
Cons
- Must be ready before the incident
- Requires a team process
- Self-hosted
Govern and raise awareness
Frame the decisions and change behaviours.
CISO Assistant
Free (community edition) · paid version
Open source governance, risk and compliance platform: risk register, controls, risk acceptances and many frameworks (ISO 27001, NIST CSF, etc.).
Governance · strong
DeploymentMedium
MaintenanceLow
Pros
- Many frameworks included
- Risk register and signed risk acceptances
- Open source and self-hostable (Docker)
Cons
- Requires discipline to keep up to date
- Some features in the paid version
- Can get heavy if you try to map everything
GoPhish
Free (open source)
Open source phishing simulation framework: campaigns, landing pages, statistics (opened, clicked, submitted data, reported).
Awareness · strong
DeploymentMedium
MaintenanceMedium
Pros
- Complete, measurable campaigns
- Very flexible
- No per-user cost
Cons
- Development is not very active
- Deliverability takes work (spam filters, allow lists)
- Templates and internal communication are up to you
Riot (TryRiot)
Free plan for small teams · paid beyond
Continuous security awareness platform: short trainings, phishing simulations, data breach alerts.
Awareness · strong
DeploymentLow
MaintenanceLow
Pros
- Turnkey, ready-made content
- Integrates with Microsoft 365, Google and Okta
- Short format that suits employees
Cons
- Paid beyond the free plan
- Third-party cloud service (employee data)
- Less customizable than an in-house tool
The gap in the kit: backup
None of the tools above replaces solid backups. There is no way around it: backup costs something (storage, licences, an off-site or immutable copy). And even if the infrastructure team runs it, it is up to cybersecurity to make sure it works: regular restore tests, an immutable or offline copy, protected backup accounts.
Want to build your cyber program without blowing the budget?
Let's talk
Effort ratings, strengths and limits reflect Curseur's field experience and are provided for guidance only. Licences, prices and features change: check them on each vendor's official site before deploying. Curseur is not affiliated with any of the vendors mentioned.
Questions? Contact us or write to info@curseur.ca
