Windows Cybersecurity Tools
Tools for network analysis, security testing, monitoring, forensics and auditing on Windows, for authorised security work.
These are established tools used by security professionals, administrators and students. Use them only on systems and networks you own or have explicit permission to test. Aptorise lists software; it doesn't provide attack instructions.
Part of the Cybersecurity toolkit, which explains when you would use each tool.
Network analysis
Capture traffic and map networks you're responsible for.
WiresharkNetwork protocol analyser for capturing and inspecting traffic.
Open SourceWin / Mac / Linux
Web application security testing
Find security issues in web applications you're authorised to test.
- Burp Suite Community Edition
A web security testing toolkit (free Community Edition).
FreemiumWin / Mac / Linux
Defensive monitoring
Record system activity to detect threats.
- Event ViewerBuilt into Windows
Investigate errors, crashes, sign-ins and service failures.
Open:
eventvwr.mscAll versions of Windows
Digital forensics
Examine disk images and evidence.
OSINT
Gather public information during authorised assessments.
Security auditing
Check signatures, permissions and autostart locations.
Incident response
Collect evidence and visibility during an incident.
Built-in protection
Security features included with Windows.
- Windows SecurityBuilt into Windows
Scan for malware, manage the firewall and check security settings.
Open:
Settings > Privacy & security > Windows SecurityWindows 10 and 11
- Windows SandboxBuilt into Windows
Run untrusted software in an isolated environment that's discarded when you close it.
Open:
Turn Windows features on or off > Windows SandboxWindows 10 and 11 Pro, Enterprise and Education