Guides and comparisons for choosing tools, written to the same editorial standard as the profiles.
ZAP explores one web app deeply through crawling and a proxy; Nuclei sweeps many hosts for known issues. How to choose, and when to run both.
7 min read
Semgrep matches code shapes without a build; CodeQL queries a semantic database of your program. How that choice plays out in ownership, noise and depth.
7 min read
OSV-Scanner and Anchore Grype compared on the axis that decides it: scanning resolved lockfiles against open advisories, or cataloging built images.
7 min read
Gitleaks digs through git history with TOML rules; detect-secrets gates new commits against a baseline. How each fits pre-commit, CI and legacy repos.
7 min read
Garak scans a model endpoint with a probe library; PyRIT builds multi turn red team campaigns. Who runs each and how results feed a release call.
7 min read
Checkov and KICS both gate IaC in pull requests. The choice turns on how you write policy: Python and graph checks, or Rego queries.
7 min read