Small Tools, Big Impact
The security industry is noisy. Big headlines. Big funding rounds. Big names – Palo Alto, Wiz (cough Google), and the like. But underneath all that noise is a quiet revolution: small, agile, open-source tools delivering rock-solid security – often with far more precision, focus, and transparency than their heavyweight counterparts.
Over the past years, I've kept an eye on projects that punch above their weight – many of them proudly born in Europe. These tools don't come with hype. They come with results. And here are a few of my absolute favorites:
Aikido Security
🇧🇪 Belgium | Cloud Security Posture Management (CSPM)
Aikido is a fast-growing Belgian startup redefining CSPM with developer-friendly insights and a beautifully simple UI. Unlike complex platforms overloaded with dashboards, Aikido focuses on what's actually wrong and helps teams fix it, fast. Their energy is contagious, and their vision is as sharp as their product.
Chainguard
🇺🇸 USA | Secure Container Images, Supply Chain Security
Chainguard is the team behind Wolfi (a minimal, secure container base image) and hardened container images with Sigstore signing. Their mission is bold: make secure-by-default software supply chains a reality. Their images are trusted by many – and built for real-world use in production. This is supply chain security done right.
Trivy (by Aqua Security)
🇮🇱 Israel | Vulnerability Scanner, IaC, SBOM
One of the most beloved tools in the DevSecOps space – and for good reason. Trivy is fast, accurate, and integrates everywhere. Whether you're scanning containers, Kubernetes manifests, or your Terraform, Trivy just works. Aqua’s commitment to open source makes this tool a community favorite.
Prowler
🌍 Global (Spain origins) | AWS Security Auditing
Prowler is a legendary CLI tool for AWS environments. It scans your cloud infrastructure against best practices and CIS benchmarks, delivering actionable, audit-friendly reports. For teams looking to strengthen their AWS posture with open-source power, Prowler is a must-have.
Steampipe (by Turbot)
🇺🇸 USA | Cloud Inventory & Guardrails with SQL
Steampipe is… fun. Yes, fun. It lets you query your entire cloud environment using plain SQL – across AWS, Azure, GCP, GitHub, and more. With plugins and dashboards, you can turn your security checks into real-time, code-based guardrails. It’s a dream for compliance automation nerds (guilty as charged).
Tracee (by Aqua Security)
🇮🇱 Israel | eBPF-based Runtime Security
If you’re into runtime detection, Tracee is your open-source hero. Built on eBPF, it gives you deep insight into what’s actually happening inside your containers and Linux hosts. It’s light, powerful, and endlessly hackable – exactly what you want in a security observability tool.
Gitleaks
🇳🇴 Norway | Secrets Detection for Git
Gitleaks is the kind of tool that catches what you really don’t want in your repos: secrets, tokens, keys, credentials. It’s fast, easy to run locally or in CI, and trusted by thousands. Developed originally by a solo engineer and now part of Gitleaks LLC – this is open-source dedication at its best.
Syft & Grype (by Anchore)
🇺🇸 USA | SBOM Generation & Vulnerability Scanning
Syft creates detailed Software Bill of Materials (SBOMs), and Grype scans them for vulnerabilities. Together, they form a clean, composable pipeline for container security and compliance. Anchore's tools are mature, CLI-friendly, and ready for production-scale use.
There’s a reason I keep recommending these tools: they embody everything I love about security done right. Clear purpose. Great engineering. Thoughtful design.
They may not have Super Bowl ads or billion-dollar valuations – but they have something better: focus.
And focus is what makes security work.
#CloudSecurity #OpenSource #DevSecOps #SecurityEngineering
