Zero-Budget Security Stack: 7 Free Tools That Actually Work Together

Most lists of free security tools are actually lists of demos, freemium tiers, or abandoned projects that were last updated in 2018. This guide applies three filters before including any tool: it must be actively maintained (commit activity in the last 90 days), it must be deployable by a small team without vendor professional services, and it must produce output that a practitioner can act on, not just dashboards with green lights.

The second problem with most lists is they treat tools as independent items. Real security coverage requires integration. A vulnerability scanner that cannot feed findings into your SIEM, and a SIEM that cannot correlate endpoint alerts with network anomalies, leaves you with three separate consoles and no ability to see attack chains. This stack is designed around integration as a first-class requirement.

Wazuh is a free, open-source XDR and SIEM platform that replaces two of the most expensive categories in a commercial security stack. It provides host-based intrusion detection, file integrity monitoring, vulnerability detection, log collection and aggregation, and a web dashboard for alert triage, all from a single agent-plus-manager architecture.

Why it leads the stack: Wazuh is the integration hub that everything else feeds into. Once your Wazuh manager is running, all other tools in this list can ship their logs and alerts to Wazuh for centralized correlation.

Deployment: Install the Wazuh manager on a dedicated Linux host (4 vCPUs, 8 GB RAM handles up to 50 agents comfortably). Deploy the Wazuh agent to every endpoint. The agent collects Windows Event Logs, Linux syslog, macOS unified logs, and application logs from paths you define. Out of the box, Wazuh includes rules for detecting common attack techniques: brute force authentication, privilege escalation, web shell activity, rootkit indicators, and policy violations.

Integration points: Wazuh natively ingests Zeek logs (Tool 2), OpenVAS findings (Tool 3), and supports custom log parsers for any other text-based log source. It also supports webhook output to Slack or Teams for alert notifications.

Limitation to know: Wazuh's default ruleset generates significant noise without tuning. Spend the first two weeks after deployment identifying your top 10 noisiest rules and suppressing known-good activity before treating alert volume as meaningful.

Zeek (formerly Bro) is a network analysis framework that passively monitors network traffic and generates structured log files covering every connection, DNS query, HTTP request, SSL certificate, file transfer, and authentication event it observes. It does not generate alerts by default. Instead, it produces a rich stream of structured logs that are far more useful than raw packet captures for detection engineering and threat hunting.

Why network visibility matters: Endpoint agents miss activity that happens between hosts, between network segments, or on devices that cannot run agents (printers, IoT, OT equipment, network gear). Zeek fills this gap.

Deployment: Zeek runs on a Linux host with a network interface in promiscuous mode, positioned at a network tap or SPAN port. For small environments with a single internet uplink, deploying Zeek inline at the perimeter captures most high-value traffic. The log output is written to files in /usr/local/zeek/logs/ by default.

Integration with Wazuh: Configure Wazuh to monitor Zeek's log directory. Add a custom Wazuh decoder for Zeek's JSON format (the Wazuh community maintains one). Once connected, Wazuh can correlate Zeek network events with host-level events from the Wazuh agent, enabling detections like: endpoint makes outbound connection to IP that was observed in Zeek DNS logs as a newly registered domain.

High-value Zeek logs: conn.log (all connections with bytes transferred, duration, originator/responder), dns.log (all DNS queries and responses), ssl.log (TLS certificate details including self-signed certs and certificate mismatches), http.log (all HTTP requests with user agents and response codes), files.log (all file transfers with MIME type and MD5 hash).

OpenVAS, now distributed as Greenbone Community Edition, is a full-featured vulnerability scanner that checks systems against a database of over 50,000 network vulnerability tests (NVTs) and maps findings to CVE identifiers and CVSS scores. It is the open-source equivalent of Nessus Essentials but without the 32-IP scan limit.

Deployment: Install the Greenbone Community Edition via Docker (the recommended path as of 2024) or via packages on Kali Linux or Debian. The Docker compose deployment runs the full stack (scanner, manager, web UI) with a single command. Greenbone feeds update daily via the Greenbone Community Feed.

Scan strategy for small teams: Run authenticated scans (providing OS credentials to the scanner) against all internal hosts weekly. Authenticated scans detect locally installed software vulnerabilities, missing patches, and misconfigurations that unauthenticated scans miss entirely. Unauthenticated scans are appropriate for internet-facing assets and network devices.

Integration with Wazuh: The Greenbone Manager exposes an API (GMP protocol) that allows automated export of findings. The Wazuh vulnerability detection module can be configured to import Greenbone scan results and correlate them with agent data to identify which running hosts have which vulnerabilities, enabling risk-prioritized alerting.

Sysmon (System Monitor) is a free Windows system service from Microsoft's Sysinternals suite that generates detailed event logs for process creation, network connections, file creation, registry changes, DNS queries, and driver loads. It dramatically improves the detection value of Windows Event Logs by adding command-line arguments, parent process context, and network connection details that the default Windows audit policy does not capture.

Deployment: Sysmon is a single EXE that installs as a Windows service. The critical variable is the configuration file, which controls what Sysmon logs and what it ignores. The most widely used starting configuration is the SwiftOnSecurity Sysmon configuration on GitHub, which is actively maintained and tuned to reduce noise while retaining high-value events. Do not run Sysmon without a configuration file; the default config generates excessive volume.

Integration with Wazuh: The Wazuh Windows agent automatically collects Sysmon events from the Windows Event Log (Microsoft-Windows-Sysmon/Operational channel). Wazuh ships with built-in rules for common Sysmon-based detections: process injection indicators, credential dumping patterns (LSASS access), lateral movement via remote services, and persistence via scheduled task creation.

When to skip Sysmon: If you already have a commercial EDR deployed (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint), Sysmon is redundant. Those platforms collect the same telemetry and more. Sysmon is the right choice when you have Windows endpoints with no other endpoint agent.

CrowdSec is a free, open-source intrusion prevention system that combines local behavioral detection with a crowd-sourced threat intelligence network. When CrowdSec detects an attack (brute force, web scraping, exploitation attempts), it can automatically block the source IP via firewall integration. More importantly, it shares anonymized attack data with a global network and receives reputation data back, giving you access to IP reputation signals from thousands of organizations at no cost.

Deployment: CrowdSec installs on any Linux host. The Security Engine (the detection component) reads log files you point it at (SSH auth logs, web server access logs, application logs) and applies behavioral detection scenarios. Bouncers (the blocking components) integrate with your firewall, Nginx, HAProxy, or cloud security groups to act on decisions.

Why this matters for small teams: The CrowdSec threat intelligence network means your block list is continuously updated based on what other organizations are seeing. A newly active scanning bot or exploitation campaign that hits other CrowdSec users will be in your block list before it reaches your infrastructure, without requiring you to maintain your own threat intel pipeline.

Integration with Wazuh: CrowdSec logs its detection decisions in JSON format. Configure Wazuh to monitor CrowdSec's decision log for correlation with other signals. An IP that CrowdSec blocked at your perimeter that also appears in Zeek connection logs from an internal host is a high-priority investigation signal.

Canary tokens from canarytokens.org are free, instrumented decoy files, URLs, and credentials that generate an alert when accessed or used. They are one of the highest signal-to-noise detection mechanisms available. When a canary token fires, it means something or someone accessed a file or resource that has no legitimate business reason to be accessed. False positive rate: near zero.

Types relevant to a small team:

Word document tokens: Drop a document named something like Salary_Data_2026.docx or IT_Passwords.xlsx in a network share. If it is opened, you get an immediate alert with the source IP and username. This detects insider threats and attackers doing file reconnaissance after initial compromise.

DNS tokens: Create a DNS canary token and embed the domain in a web application configuration file, a cloud credentials file, or a backup script. If the file is exfiltrated and the credential is used, the DNS token fires from the attacker's infrastructure.

AWS key tokens: Generate a canary AWS access key pair. Store it in a location where real credentials would be kept (a developer's dotfiles, a CI config). If the key is ever used, you get an alert with the AWS API call made and the source IP, which is almost certainly the attacker's infrastructure.

Deployment: Create tokens at canarytokens.org (no account required, tokens are free). Configure alert delivery to your email or a webhook. For Wazuh integration, configure the webhook to POST to a custom API endpoint that logs the event to a file Wazuh monitors.

Placement strategy: Seed canary tokens throughout your highest-value locations: file shares, backup directories, admin credential stores, cloud configuration repositories, and developer environments. More tokens in more locations means faster detection when an attacker is moving laterally.

Have I Been Pwned (HIBP) offers a free API tier that lets you check email addresses against its database of compromised credentials from data breaches. For organizations, the domain search API (free for organizational use after verification) lets you check all email addresses at your domain against the breach database automatically.

Why this matters operationally: When employee credentials appear in a public breach, the exposed password may also be used on corporate systems (password reuse). Getting this notification allows you to force a password reset and review for unauthorized access before an attacker exploits the reuse.

Deployment: Use HIBP's domain notification feature by verifying your domain ownership and setting up email alerts. For automation, query the API programmatically. A simple Python script that runs weekly, queries HIBP for your domain, and sends new breach notifications to your ticketing system or Slack can be built in under an hour.

Integration with the broader stack: When HIBP reports that a set of your users appeared in a breach, cross-reference those user accounts in Wazuh for authentication anomalies in the days following the breach date. Attackers who buy breached credentials often test them within 48-72 hours of the breach being published to criminal forums.

Do not try to deploy all seven tools simultaneously. The following sequence minimizes dependencies and gets you to meaningful coverage progressively.

Week 1: Wazuh manager and agents. Get log collection and baseline alerting running first. This is your integration hub; everything else connects to it.

Week 2: Sysmon on Windows endpoints. Install with SwiftOnSecurity config. Confirm Wazuh is collecting Sysmon events and review the additional detection coverage it enables.

Week 3: Zeek at the perimeter. Deploy to a Linux host with SPAN port access. Configure Wazuh to ingest Zeek logs. Run your first threat hunting queries against Zeek DNS logs for newly registered domains and unusual protocol patterns.

Week 4: OpenVAS authenticated scan of internal hosts. Review the top 20 critical findings. Create a prioritized remediation list. Configure weekly scheduled scans.

Week 5: CrowdSec on internet-facing systems. Install on your web server, SSH gateway, and VPN concentrator. Review the first week of block decisions to confirm accuracy.

Week 6: Canary tokens. Deploy 10-15 tokens across your highest-risk locations: admin credential stores, file shares, cloud configuration files. Document where each token is deployed.

Ongoing: HIBP domain monitoring. Set up the notification subscription and create a runbook for handling breach notifications (force reset for affected accounts, review auth logs for 30 days prior).

Be honest with yourself about the gaps this stack does not cover, so you can make risk-informed decisions about where to spend a limited budget.

Email security: This stack has no email gateway, sandboxing, or anti-phishing capability. Email is the primary initial access vector in 90% of breaches. If you have budget for exactly one paid tool, an email security platform (Proofpoint Essentials, Microsoft Defender for Office 365, or even Google Workspace's built-in protections) should be it.

Cloud posture: If you operate in AWS, Azure, or GCP, this stack does not cover cloud misconfiguration or API-level detection. Use each cloud provider's native free tier tools (AWS Security Hub free tier, Azure Security Center free tier) to cover cloud-specific risks.

Endpoint response: Wazuh and Sysmon give you detection visibility on endpoints but limited automated response capability. Isolating a compromised host, killing a malicious process, and collecting forensic memory dumps all require manual intervention or a paid EDR platform.

Advanced persistent threats: Sophisticated nation-state actors with custom tooling specifically designed to evade common detection rules will not be caught by this stack. This stack is calibrated for the commodity threat landscape: ransomware affiliates, opportunistic exploitation, credential stuffing, and insider threats. If you are a high-value target for nation-state actors, you need commercial tooling and a dedicated security team.