Best Free Cybersecurity Tools
In plain words
PlayCISO offers 90+ free, browser-based cybersecurity tools — threat modeling, breach-cost and risk calculators, scanners, PCI and framework readiness scores, AI and OT security tools — most with no signup and nothing uploaded.
This is a curated directory of the genuinely free tools on PlayCISO, grouped by what they do. Nothing here is a trial or a teaser: each one is usable at no cost, and most run entirely in your browser with no signup and nothing uploaded. If a tool sends data somewhere to work, its own page says so. Paid (Pro) tools exist — priced at $5, $10 and $40 — but none of them appear on this page.
Jump to a category: Threat modeling & architecture · Scanners · Risk & cost calculators · PCI & framework readiness scores · AI & LLM security · OT & ICS security · Hands-on labs — defense & operations · Cryptography & PKI labs · Simulators & drills · Utilities, templates & references
Threat modeling & architecture
Draw a system, map its threats, and turn the output into a board-ready risk picture.
Draw your system and let an AI copilot map the threats against it.
Blueprint a reference architecture with live compliance coverage.
Paste an RFC or design doc, triage the security findings, and sign it off.
Watch a simulated breach move through an enterprise, step by step.
Collect risks from the studios into one board-ready register.
Browse a reference library of security controls.
Design your security team’s structure before you hire for it.
The ten projects nearly every security program runs, packaged.
Scanners
Point-in-time checks that run in the browser — paste or pick an input and read the findings.
npm, package, browser-extension, model and prompt scanners in one place.
Paste an MCP config or manifest for a static security review — nothing is fetched.
Check a host for indicators from the March 2026 LiteLLM supply-chain attack.
Checklists and readiness scores for adopting, migrating or offloading AI.
Risk & cost calculators
Put real numbers behind a breach, a budget or a deadline — nothing invented, sources cited where it matters.
Benchmark breach costs by industry and company size.
Estimate the all-in cost of a breach for your organisation.
Compare your security spend against peers.
Work out your notification deadlines across regulations.
Score how likely a breach could push your business toward insolvency.
See how fast a leaked password or token loses its value.
PCI & framework readiness scores
Self-assess against a standard, get a score, and see where the gaps are — before an assessor does.
A plain-language checklist of PCI DSS requirements.
Self-assess your PCI DSS readiness and get a score.
Find which PCI self-assessment questionnaire type applies to you.
Spot the gaps between where you are and PCI compliance.
Rehearse the questions a PCI assessor will ask.
Score your maturity against the ASD Essential Eight.
Score your program against the NIST Cybersecurity Framework 2.0.
Maturity wheel, roadmap, crosswalk, flashcards and tabletop for NIST CSF 2.0.
Assess how prepared you are for a ransomware incident.
Gauge how insurable your security posture looks.
Rate your zero-trust maturity across its pillars.
Benchmark your SOC against a persona, or build your own.
AI & LLM security
Model, attack and defend AI systems — from OWASP LLM risks to running a model locally in your browser.
Answer nine questions for a threat model mapped to the OWASP LLM Top 10.
A guide to the OWASP Top 10 risks for LLM applications.
Build a small LLM pipeline, then attack it to see injection break it.
Run a small open-weights model locally — no key, no cost, nothing uploaded.
See how text clusters with a live similarity heatmap and 2-D map.
What refusal-removed “uncensored” models are and why they matter.
OT & ICS security
Operational-technology tooling — segmentation, protocols, exposure and incident drills for industrial environments.
Place OT assets into Purdue levels and get scored on IEC 62443 segmentation.
A filterable reference of 20+ OT protocols — ports, auth, weaknesses.
Look up ICS device credential posture and CVE themes by vendor.
Paste OT firewall rules to flag IT→OT any-any and risky paths.
Rank PLCs, HMIs and RTUs by criticality and exposure.
Paste a building/refrigeration controller config for exposure findings.
Paste an ICS traffic log to flag unauthorised writes and scanning.
Paste a Shodan/Censys export to find exposed OT hosts.
Put a number on a cooling outage or plant-down event.
Filterable ICS advisories with exploited-first prioritisation.
A supermarket refrigeration ransomware simulation, scored.
Hands-on labs — defense & operations
Interactive drills where you make the call and get scored — firewalls, cloud, detection, forensics and incident response.
Order allow/deny rules and replay packets; catch shadowed and any→any rules.
Build a web-filtering egress policy and catch data exfil.
Tune SPF, DKIM and DMARC and learn why forwarded mail survives on DKIM.
Build Entra-style access policies and catch legacy-auth gaps and lockouts.
Find and remediate cloud misconfigurations with a live posture score.
Write SIEM rules on a labelled log stream and tune precision and recall.
Triage 50 realistic cases like an analyst — priority, team and first action, scored.
Sequence an incident response: image before wipe, eradicate before restore.
Reconstruct a breach from the artifacts and separate evidence from red herrings.
Spot the Stuxnet-style setpoint/logic tamper on the HMI before it trips.
Drive a simulated Modbus network, see it has no auth, then defend it.
Keep the safety system trustworthy against a TRITON-style attack.
Find the real process upset hidden in an alarm flood, under the clock.
A safe simulation of refusal-removal attacks — no real model involved.
Cryptography & PKI labs
Work with real crypto in the browser — certificates, TLS, hashing, signatures and key lifecycle.
Flag the broken certs in a queue — expired, SHA-1, short key, SAN mismatch.
Assemble a valid cert chain and catch the missing intermediate.
Design a CA hierarchy; a validator scores it against best practice.
Decide valid / revoked / unknown from OCSP and CRL evidence.
Work a cert fleet’s renewal queue and prevent expiry outages.
Rotate a pinned certificate with zero client breakage.
Diagnose and fix mutual-TLS handshake failures from the cert facts.
Harden a server’s TLS config to A+ without breaking a required client.
Order the TLS 1.2 vs 1.3 handshake and find where downgrade/MITM hits.
Audit CSRs for mistakes, or build a correct one — CN, SANs, key strength.
Verify integrity with live SHA-256/512 and learn why MD5/SHA-1 are retired.
Compute and verify real HMAC tags; catch the length-extension trap.
Encrypt with real AES-GCM and see the nonce-reuse catastrophe.
Sign and verify with real RSA-PSS/ECDSA, then catch the forgeries.
Pick safe PBKDF2 params and salt, then crack an unsalted scheme.
Exploit alg:none, weak secrets and key confusion — then harden.
Run keys through generate→rotate→retire→destroy and handle a compromise.
Decode real DER into a TLV tree and identify the X.509 structures.
Spot the mis-issued or rogue certs for your domain in a CT feed.
Measure real Shannon entropy and spot the predictable keys.
Simulators & drills
Fast, scored scenarios — practice judgement calls from the SOC floor to the boardroom.
Practice spotting the bad logs in a stream of 1,000.
Friend-request scam simulator — accept the real, reject the fakes.
Scam-call simulator — answer or decline five incoming calls.
Survive a 10% budget cut, get a CISO score, challenge a colleague.
Defend a security budget under pressure and see the trade-offs.
Face an audit and defend your controls.
Gamified practice for CSA, IAPP, ISACA and ISO/IEC 42001.
Utilities, templates & references
Everyday helpers and reference material — files, resumes, templates, diagrams and API directories.
Shrink a PDF by recompressing its images — text stays sharp.
Re-encode a video down to something you can actually send.
A resume critique tuned to security roles and your market.
Ready-to-use policy, plan and report templates.
A starter set of governance, risk and compliance documents.
A browsable library of 120+ security architecture diagrams.
A directory of security-relevant APIs.
A bank of incident and tabletop scenarios to run.
Frequently asked questions
What are the best free security tools?
It depends on the job. For design work, PlayCISO’s Threat Model Studio and Architecture Studio map threats and controls against a system you draw. For numbers, the Breach Cost Calculator, Security Budget Benchmark and Cyber Insolvency Risk assessment put figures behind a decision. For compliance, the PCI Readiness Score, NIST CSF 2.0 Score and Essential Eight Score self-assess against a standard. For AI systems there is an LLM Threat Model and an in-browser LLM sandbox, and for industrial environments a full OT/ICS set. All of the tools listed on this page are free.
Are these really free?
Yes. Every tool listed on this page is free to use. PlayCISO also sells paid (Pro) tiers at $5, $10 and $40 that unlock a separate set of advanced tools, but none of those are on this page — this is the free directory only.
Do I need to sign up?
Most tools run entirely in your browser with no account required. A few features that save or sync your work will ask you to sign in, but the core of each tool here is usable without signing up.
Is anything uploaded or stored?
Many of the tools — the scanners, the crypto and PKI labs, the in-browser LLM sandbox — run entirely client-side, so the data you paste or load never leaves your browser. Where a tool does send data to produce a result, its own page says so.
Can I use them commercially?
Yes. You can use the free tools for real work at your organisation — to run a threat model, estimate a breach cost, self-assess PCI or NIST CSF readiness, or harden an AI or OT environment. They are decision-support and training aids, not a substitute for a formal audit or a qualified assessor’s sign-off.
Which free tools help with compliance?
The PCI Checklist, PCI Readiness Score, SAQ Selector, Gap Assessor and QSA Interview cover PCI DSS. Beyond PCI, the NIST CSF 2.0 Score and Toolkit, Essential Eight Score, Zero Trust Maturity and Security Ops Maturity model let you self-assess against common frameworks and see where your gaps are.