CyphrQProtect: prevent and control
Prevent attacks and control access: identity, privileged access, network, firewalls, WAF, email, data and code (NIST CSF: Protect).
Up to five options per category, in alphabetical order: the order means nothing and nothing here is a ranking, a recommendation or an endorsement. We earn nothing from any vendor. For wider market coverage, see analyst reports such as Gartner Magic Quadrants and Forrester Waves, and test any tool against your own needs.
Identity and access management (IAM, SSO, MFA)
One sign-in for every app, strong authentication, and rules for who can reach what.
| Name | What it is | Type |
|---|---|---|
| authentik | Open-source identity provider with SSO. | Open source |
| Keycloak | Open-source identity and access management. | Open source |
| Microsoft Entra ID | Microsoft's cloud identity service (formerly Azure AD). | Paid |
| Okta | Cloud identity, single sign-on and MFA. | Paid |
| Ping Identity | Identity and access management for workforce and customers. | Paid |
Privileged access management (PAM / PIM)
Controls, records and limits administrator access.
| Name | What it is | Type |
|---|---|---|
| BeyondTrust | Privileged access and remote access security. | Paid |
| Delinea | Privileged access management for people and machines. | Paid |
| Idira (Palo Alto Networks) | Palo Alto Networks' identity security platform; cyberark.com now redirects here. | Paid |
| JumpServer | Open-source bastion host and privileged access management. | Open source |
| OpenBao | Open-source secrets management for keys, passwords and certificates. | Open source |
Network access control (NAC)
Checks every device that joins the network and decides what it may reach.
| Name | What it is | Type |
|---|---|---|
| Cisco Identity Services Engine (ISE) | Cisco's network access control and policy engine. | Paid |
| Forescout | Device visibility and network access control, including OT and IoT. | Paid |
| HPE Aruba Networking ClearPass | Policy-based network access control. | Paid |
| PacketFence | Open-source network access control. | Open source |
Firewalls (NGFW)
Filter traffic between networks by application, user and threat.
| Name | What it is | Type |
|---|---|---|
| Check Point Quantum | Check Point's next-generation firewalls. | Paid |
| Fortinet FortiGate | Fortinet's next-generation firewalls. | Paid |
| OPNsense | Open-source firewall and routing platform. | Open source |
| Palo Alto Networks NGFW | Palo Alto Networks' next-generation firewalls. | Paid |
| pfSense CE | Open-source firewall and router. | Open source |
Web application firewalls (WAF)
Block attacks against websites and APIs before they reach the application.
| Name | What it is | Type |
|---|---|---|
| Akamai App & API Protector | Akamai's web application and API protection. | Paid |
| AWS WAF | Amazon's web application firewall. | Paid |
| Cloudflare WAF | Cloudflare's cloud web application firewall. | Paid |
| ModSecurity | Open-source WAF engine, often used with the OWASP Core Rule Set. | Open source |
| OWASP Coraza | Open-source WAF engine compatible with ModSecurity rules. | Open source |
Email security
Filters phishing, malware and impersonation in email.
| Name | What it is | Type |
|---|---|---|
| Microsoft Defender for Office 365 | Email and collaboration protection for Microsoft 365. | Paid |
| Mimecast | Email security and resilience. | Paid |
| Proofpoint Email Protection | Proofpoint's email security. | Paid |
| Rspamd | Open-source spam and phishing filtering for mail servers. | Open source |
Data loss prevention (DLP)
Finds sensitive data and stops it leaving. No maintained open-source DLP suite is listed.
| Name | What it is | Type |
|---|---|---|
| Forcepoint DLP | Forcepoint's data loss prevention. | Paid |
| Microsoft Purview DLP | DLP across Microsoft 365, endpoints and cloud apps. | Paid |
| Netskope DLP | Cloud-delivered DLP for web, SaaS and private apps. | Paid |
| Symantec DLP (Broadcom) | Broadcom's Symantec data loss prevention. | Paid |
Application security (SAST and SCA)
Finds flaws in code and vulnerable open-source dependencies before release.
| Name | What it is | Type |
|---|---|---|
| Checkmarx | Application security testing platform. | Paid |
| OWASP Dependency-Check | Open-source tool that finds known-vulnerable dependencies. | Open source |
| Semgrep | Static analysis with an open-source community edition. | Open source |
| Snyk | Developer security for code, dependencies, containers and infrastructure as code. | Paid |
| Veracode | Application security testing platform. | Paid |
Password managers
Generate and store unique passwords and passkeys.
| Name | What it is | Type |
|---|---|---|
| 1Password | Password manager for people and businesses. | Paid |
| Bitwarden | Open-source password manager with paid business plans. | Open source |
| Dashlane | Password manager for people and businesses. | Paid |
| KeePassXC | Open-source, offline password manager. | Open source |
| Keeper | Password manager with business features. | Paid |
SASE / SSE and zero trust network access (ZTNA)
Connect people to applications by identity and device state instead of by network location.
| Name | What it is | Type |
|---|---|---|
| Cloudflare One | Cloudflare's zero trust and secure access service edge platform. | Paid |
| Netskope | Security service edge for web, cloud apps and private access. | Paid |
| OpenZiti | Open-source zero trust networking. | Open source |
| Pomerium | Identity-aware access proxy with an open-source core. | Open source |
| Zscaler | Cloud security service edge and zero trust access. | Paid |
Data security posture management (DSPM)
Finds where sensitive data lives in cloud and SaaS stores and who can reach it.
| Name | What it is | Type |
|---|---|---|
| Cyera | Data security platform that discovers and classifies data. | Paid |
| Microsoft Presidio | Open-source detection and anonymisation of personal data in text and images. | Open source |
| Sentra | Cloud data security and posture management. | Paid |
| Wiz DSPM | Data security posture management inside the Wiz cloud platform. | Paid |