Founder summary
Speed, owner clarity, customer trust and what must happen next.
🌐 USA / OSS
Wazuh + osquery
Wazuh plus osquery is powerful if you have the technical appetite. It gives control, transparency and a lot of telemetry without a license bill. But it is not a one-button security team. Someone must host it, tune it, explain it, turn findings into tasks and make the evidence usable for management or auditors.
Starting price
Free self-hosted; Cloud from $571 / month
OSS / self-host or cloud
License can be free when self-hosted, but hosting, tuning, triage, reporting and ownership are real operational costs.
Official site Verified 2026-05-19
Open rating
Overall score: 63/100
Score basis: Weighted editorial score across eight visible dimensions: compliance readiness, evidence completeness, operational coverage, remediation workflow, SMB practicality, price clarity, data control and regional fit.
ConfidenceHigh confidence
Last reviewed2026-05-19
Citable rating summary
- Overall score: 63/100
- Confidence: High confidence
- Last reviewed: 2026-05-19
- Public rating dataset: /data/ratings.json
- Best fit: Technical teams that want open-source visibility and are willing to own the engineering work
- Caveats: Not enough when the team expects one tool to cover evidence, remediation, endpoint, cloud, code, backup and supplier risk at once.
Use the vendor page and public dataset together. Do not cite the score without confidence, last-reviewed date and caveats.
Buyer mode
Neutral: Neutral buyer view: compare Wazuh + osquery by score, fit, gaps, evidence sources, pricing caveats and where it is not enough before choosing a stack.
Compliance Readiness55/100
Public docs/ Medium confidenceEditorial inference/ High confidence
Evidence Completeness55/100
Public docs/ Medium confidenceEditorial inference/ High confidence
Operational Coverage70/100
Public docs/ Medium confidenceEditorial inference/ High confidence
Remediation Workflow40/100
Public docs/ Medium confidenceEditorial inference/ High confidence
SMB Practicality50/100
Public docs/ Medium confidenceEditorial inference/ High confidence
Price / TCO clarity74/100
Pricing page/ High confidenceEditorial inference/ High confidence
Data Control / BYOK95/100
Public docs/ Medium confidenceEditorial inference/ High confidence
Regional Fit80/100
Public docs/ Medium confidenceEditorial inference/ High confidence
Best fit
- Technical teams that want open-source visibility and are willing to own the engineering work
Known gaps
- Free software, but not free operations; workflow, reporting and remediation are buyer-owned
- License can be free when self-hosted, but hosting, tuning, triage, reporting and ownership are real operational costs.
Not enough for
- Not enough when the team expects one tool to cover evidence, remediation, endpoint, cloud, code, backup and supplier risk at once.
Evidence sources
Editorial inference/ High confidencePricing page/ High confidencePublic docs/ High confidence
Rating is directional. No tool purchase creates compliance. Use this rating as buyer guidance, then verify legal scope, implementation evidence and current vendor terms directly.
Boardroom briefs
Boardroom briefs
CFO summary
Subscription cost, quote risk, hidden owner time and audit surprises.
Auditor summary
Evidence freshness, traceability, owners, review cadence and caveats.
Security lead summary
Coverage gaps, integrations, remediation ownership and operational risk.
When not to buy
Negative-fit check
Use this section before a sales call. It is designed to reduce overbuying and false confidence, not to crown a default winner.
Do not buy this if
- Do not buy this if the team expects one product to cover evidence, remediation, endpoint, cloud, code, backup and supplier risk at once.
- Do not buy this only because the entry price looks low; verify tier limits, add-ons, taxes, renewal terms and owner time.
Buy this only if
- Buy this only if the strongest fit is really: Technical teams that want open-source visibility and are willing to own the engineering work.
- Buy this only if someone owns configuration, evidence capture, renewal review and follow-through after the purchase.
Pair it with
- Pair it with an evidence workflow when the tool is strong in one domain but weak at turning signals into audit-ready proof.
Replace it when
- Replace it when the tool no longer matches the main risk, the renewal cost outruns value or evidence remains manual despite the spend.
Badge snippets
Embeddable badges
These badges show that a vendor page was reviewed in Security Stack Compare. They are not certification, endorsement or proof of compliance.
Not certification
Compared
This vendor is listed in the Security Stack Compare buyer guide with visible scores, gaps and source notes.
Not certification
Evidence workflow reviewed
This review includes evidence workflow, receipt types, remediation ownership and audit-readiness caveats.
Not certification
Pricing transparency reviewed
This review includes public pricing signals, quote requirements, hidden-cost risk and verification caveats.
Not certification
SMB fit reviewed
This review includes SMB practicality, fit by company size, operational gaps and when the tool is not enough.
Capabilities
endpointImplementedmdrNot includedvulnImplementedcloudPartialcodeNot includedbackupNot includedidentityPartialsupplierNot includedcontractNot includedevidencePartialremediationNot includedexecReportsPartialbyokImplemented
Best compliance fit
ISO 27001PCI DSSCIS Controls v8
Main gap
Free software, but not free operations; workflow, reporting and remediation are buyer-owned
How we know
Self-hosted open-source use can avoid license fees, while Wazuh Cloud publishes paid plans starting at $571/month; operations and hosting still matter.
When to pair it
Wazuh + osquery is strongest in its core category. If the goal is audit-ready evidence, supplier risk, backup proof or cross-tool remediation, pair it with a separate evidence workflow rather than expecting this tool to cover the whole compliance program.
Evidence, remediation and reporting layer when this tool needs to support audits.
Guides
NIS2 tools for SMBs: evidence, suppliers and remediationA practical NIS2 security stack for SMBs: endpoint baseline, supplier risk, incident evidence, continuity proof, remediation and reporting.Open-source SMB security stack: what to use and what to addBuild an SMB-friendly open-source security stack with Wazuh, osquery, vulnerability scanning, backup proof and an evidence workflow.