Your open-source tools. One security workflow.
Keep the tools that work. Connect each finding to an affected asset, a priority, a named owner and verification of the fix. Start with an issue tracker and document store. If coordination becomes the bottleneck, compare guided software such as Shielda with an MSP or MSSP and the cost of maintaining your own workflow. Shielda is relevant for explanations and supported repair coordination; it is not the default choice for running every tool or handling incidents. Verify each candidate with your own outputs and responsibilities.
Editorial team: Security Stack ComparePage updated:
What to check before buying
- List the tools and outputs you already have: code checks, dependency reports, exposed-secret findings, web tests, infrastructure checks or monitoring events. Keep useful coverage and avoid duplicate scans.
- Choose the connection for each source: a supported tool parser, a standard report such as SARIF or CycloneDX, a reviewed mapping for JSON/CSV/log output, or a reviewed adapter. Confirm the exact version and enabled mode in your setup.
- Ask for a demonstration with your own results: one finding should retain its source, affected asset and freshness, explain the risk, show a priority and assign a clear next step.
- Review the proposed change before approval. Supported actions can be automated; other work needs exact steps, an owner and a verification check. Confirm what happens when a fix is blocked or fails.
- Agree the security baseline and operating responsibilities. No extra commercial security-tool licences are assumed for the covered open-source scope; check hosting, storage, model usage, support and external services separately.
- Measure weekly customer time in a pilot. Reviewing a report is different from fixing the issue; use the task allowances below for planning and validate the whole workflow with your team.
Options and tradeoffs
Keep a working setup first. These are candidates for different jobs, listed alphabetically; compare the scope you need, not a universal winner.
Shielda
Small and mid-size teams without a dedicated security person, seeking understandable findings, prioritized next steps and guided fixes in one workflow; confirm the described scope
Limit: One-click fixes apply only to supported actions; some issues still need an IT owner or specialist. The publisher-described scope needs demonstration and contractual confirmation. Specialist endpoint, cloud, AppSec, backup and enterprise GRC products may offer greater depth.
Evidence: publisher-described scope; verify in your environment.
Typical MSP stack
Small companies that want a human partner to run day-to-day IT and basic security without hiring internally
Limit: No named provider was assessed. Verify responsibilities, response times, privileged access, evidence access, restore tests and exit terms before relying on any advertised coverage.
Service category; compare actual provider contracts.
Wazuh + osquery
Technical teams that want open-source visibility and are willing to own the engineering work
Limit: Technical compliance mappings are not a complete audit program. Self-hosted license savings require engineering, storage, tuning and triage; Cloud is not automatically a managed SOC.
Evidence: reviewed vendor documentation; see profile sources and limits.
Software does not replace accountable owners, implementation, specialist response or an independent assessor. Check which tasks your team can do and contract only the missing scope.
Weekly team involvement
Weekly team time: planning for 1–25 people
Planning scenario: 1–25 people, up to 25 endpoints, 1–3 repositories and one small cloud environment where relevant. After initial setup, with no active incident or major backlog. Time is the whole customer team's combined weekly involvement, not time per person or scanner runtime.
Ranges cover routine review, administration and assigning follow-up work. Add onboarding, implementing fixes, incidents, major upgrades, restore exercises and audit/legal work separately. Tools cover different jobs: do not add overlapping estimates or compare them as a speed ranking.
These are editorial time budgets, not vendor claims, observed averages or service commitments. We add the displayed allowances for two recurring tasks. Linked product documentation explains the tasks, not the number of hours. Replace the allowance with a time log from your own pilot; larger or more complex environments are outside this scenario.
Semgrep Community Edition
Weekly customer-team involvement
~1–3 h/week
Editorial planning allowance · 1–25 people · team total after setup
What is included in this allowance?
- Review new findings with repository owners: 30–90 min/week
- Maintain rules and check scan coverage: 30–90 min/week
Ranges cover routine review, administration and assigning follow-up work. Add onboarding, implementing fixes, incidents, major upgrades, restore exercises and audit/legal work separately. Tools cover different jobs: do not add overlapping estimates or compare them as a speed ranking.
OSV-Scanner
Weekly customer-team involvement
~0.5–2 h/week
Editorial planning allowance · 1–25 people · team total after setup
What is included in this allowance?
- Review new advisories and affected versions: 15–60 min/week
- Check scan inputs and assign upgrades: 15–60 min/week
Ranges cover routine review, administration and assigning follow-up work. Add onboarding, implementing fixes, incidents, major upgrades, restore exercises and audit/legal work separately. Tools cover different jobs: do not add overlapping estimates or compare them as a speed ranking.
OWASP ZAP
Weekly customer-team involvement
~1–3 h/week
Editorial planning allowance · 1–25 people · team total after setup
What is included in this allowance?
- Review web findings and reproduce priorities: 30–90 min/week
- Check test scope, authentication and scan configuration: 30–90 min/week
Ranges cover routine review, administration and assigning follow-up work. Add onboarding, implementing fixes, incidents, major upgrades, restore exercises and audit/legal work separately. Tools cover different jobs: do not add overlapping estimates or compare them as a speed ranking.
Sources and scope
- Open-source directory: upstream documentation and tool limits
- How vendor evidence and fit are assessed
- Weekly effort: assumptions, exclusions and product target
Source review: 2026-10-29
Related vendors
Related standards
Common buyer questions
What if my tool is not in the directory?
Choose Other open-source tool in the builder. Start by reviewing its export format and intended use. A standard report, reviewed field mapping or adapter may connect it to the workflow. Importing a report, running a tool and executing a fix are separate capabilities that need separate confirmation.
Do we need to buy another platform?
Only for a demonstrated gap. First test the controls and evidence you already have, assign an owner and measure recurring work. Compare the cost and limits of software with improving the existing process or using qualified support.