Your free, self-hosted security AI
Deterministic analyzers do the reasoning, so this works with zero setup. Add a local LLM and it becomes a full analyst assistant — still free, still offline.
Step 1 — Get a free AI brain (optional, ~5 min)
Install Ollama, then pull a model. CORS must be open for the browser to reach it.
# macOS / Linux curl -fsSL https://ollama.com/install.sh | sh export OLLAMA_ORIGINS='*' # required: lets this page talk to Ollama ollama serve # pull a general model (good baseline, ~4.7 GB) ollama pull llama3.1 # or a security-specialised 8B from Cisco Foundation AI (~4.9 GB) ollama pull hf.co/fdtn-ai/Foundation-Sec-8B-Instruct-GGUF:Q4_K_M # tiny + fast, runs on minimal hardware (~2.5 GB) ollama pull hf.co/DexopT/Qwen3-4B-Cybersecurity-GGUF:Q8_0
Step 2 — What each analyzer does works offline
| Tool | Use it for | AI step |
|---|---|---|
| IOC workbench | Extract, defang and pivot on IPs/domains/hashes/URLs from any alert or report | Optional |
| Phishing / header analysis | SPF/DKIM/DMARC, reply-to mismatch, lookalike domains, risky URLs, dangerous attachments | Optional |
| Log & alert triage | Brute force, lateral movement, persistence, exfil, ransomware prep — auto-mapped to MITRE ATT&CK | Optional |
| Secret scanner | Find AWS keys, tokens, private keys, DB strings in code, configs or pasted logs | No |
| Password auditor | Entropy, pattern weaknesses, crack-time estimates | No |
| Rule & prompt builder | Generate Sigma / YARA / SPL / KQL, IR reports, STRIDE threat models, hardening checklists | Yes |
IOC workbench
Paste raw alert text, a threat report or an email. Extracts indicators, defangs them for safe sharing, flags private/suspicious ones, and gives you one-click enrichment pivots.
Phishing & email header analysis
Paste full raw headers (in Gmail: ⋮ → Show original) or a whole .eml. Checks authentication, sender identity, lookalike domains, URL structure and social-engineering language.
Log & alert triage
Paste auth logs, syslog, Windows event excerpts, EDR alerts or firewall logs. Detects attack patterns, aggregates top offenders, maps findings to MITRE ATT&CK and drafts an analyst summary.
Secret & credential scanner
Runs 20+ detector patterns over code, config, .env files or pasted logs. Values are masked in the output. Everything is client-side — secrets never leave the page.
Password auditor
Estimates entropy and crack time, detects keyboard walks, repeats, dates, leetspeak and common-password reuse. Input is never stored or transmitted — this is pure local maths.
Rule & prompt builder
Turns a plain description into a hardened, structured prompt for a detection rule, report or threat model. Send it to your local model, or copy it into any free chatbot.
AI copilot
Talks to a model running on your own machine via Ollama. No account, no key, no cost, no data egress. If it can't connect, use Copy for free chatbot and paste into any free tier.
Free & open-source tool stack
Everything here is free to use. Open-source platforms are self-hosted with your own LLM (Ollama or a free key), so there's no subscription.
Full AI SOC platforms open source
Single-file MIT tool. Polls SentinelOne, CrowdStrike, Defender, Elastic, Splunk and triages every alert with local Ollama. Nothing leaves the host.
github.com/zrnge/AgentZLangGraph multi-agent triage with least-privilege agents, human-in-the-loop gates and a verifiable audit chain. Has a no-LLM offline mode.
github.com/bbrookhart/secure-agentic-socMIT-licensed self-hostable SOC. Correlates events, runs AI investigation, exposes a 13-tool MCP server for IDE access. One-command docker demo.
github.com/agtlab/AiSOCApache-2.0 multi-tenant SOC automation for Wazuh alerts, with TheHive/Cortex/MISP integration and a scope-aware chat analyst.
github.com/soctalk/soctalk13 specialised SOC agents (triage, investigator, threat hunter, MITRE, forensics, malware…) driven by Markdown playbooks, 30+ MCP integrations.
github.com/t0rnad3/vigilApache-2.0 agentic layer over your existing stack: 30+ connectors for Splunk, Elastic, Sentinel, CrowdStrike, Qualys, Tenable, Snyk, Jira.
github.com/openkai-security/openkaiLocal-first Wazuh + Suricata platform with governed AI providers, semantic memory and case workflow. Ollama is the default path.
github.com/bluesaphire76/sovereign-ai-socAir-gapped SOC: Wazuh, Suricata, Security Onion, TheHive, Cortex, OpenCTI plus a LangGraph triage engine on local Mistral.
github.com/ihebmabroukii/DeepInv8 local agents (detection, forensics, reporting, vuln scan, compliance) with a RAG knowledge base of 2,100+ CVEs/MITRE entries.
github.com/abhishekk-y/ALISSOffensive / pentest agents authorised use only
Apache-2.0 autonomous pentest agents that validate findings with real proof-of-concept exploits. 59k+ stars, GitHub Actions integration.
github.com/usestrix/strixMIT. Fully offline recon/pentest agent: local Ollama + Kali sandbox + Caido proxy + 1.09M-record local security knowledge base. No API keys.
github.com/pikpikcu/aireconMIT CLI + MCP server. Findings only earn "VERIFIED" when a machine oracle re-runs the exploit. Runs `--no-llm` with no key at all.
pentestai.xyzDual-mode defensive/red-team agent with CVE research, IOC enrichment via VirusTotal/AbuseIPDB, and guardrails on every action.
github.com/cogensec/gideonTerminal-native multi-agent security operator: recon, CVE research, SAST, exploit dev, reporting. Can reuse a Claude Code subscription instead of an API key.
github.com/RevoltSecurities/RAIFree web checkers no signup
Paste an email, URL or .eml. AI verdict plus domain intel, DKIM, VirusTotal, CAPE sandbox and CT-log monitoring.
phishscan.ioFree header/body analysis: sender identity, Reply-To, Return-Path, SPF/DKIM/DMARC and link reputation. Accepts .eml/.msg.
phishingbox.com/email-analyzer7 free AI security tools: message threat analyser, link/file safety scanner, device security check. No account required.
my7.aiFree URL reputation check against ESET threat intelligence.
eset.com/us/home/link-checkerEight structural checks (homoglyphs, shorteners, suspicious TLDs, IP URLs) entirely in your browser — no rate limits.
findutils.comFree Chrome extension: static IOC blocking plus 97 on-page heuristic detections with matched keywords shown.
github.com/Nehboro/nehboroOpen security models to run locally Apache-2.0 / open weights
Cisco Foundation AI. 8B Llama-3.1 backbone tuned for security. Reasoning variant shipped Jan 2026.
huggingface.co/fdtn-aiICLR 2026 cybersecurity generalist. 11.8B tokens of continual pretraining + 266K multi-turn SFT samples.
risys-lab.github.io/RedSage35B MoE with only ~3B active per token — big-model depth at small-model speed. 20 GB Q4 GGUF, Apache-2.0.
huggingface.co/IMPERUM4B fine-tuned on 1.28M samples. GGUF quantised — runs on modest laptops.
huggingface.co/DexopTMIT-licensed Llama-3.1-8B security fine-tune, 360+ likes, GGUF available.
huggingface.co/AlicanKiraz0