How Cyber Tool Stack researches and verifies the landscape.

Product and company facts are checked against current first-party sources whenever possible: vendor documentation, product pages, official company announcements, standards bodies, and project repositories. Independent technical sources may be used for context or to resolve ambiguity. Each tool, vendor, lesson, and framework record stores its source URLs and a visible verification date.

The directory is representative, not exhaustive. A product must have a clear security use, a stable public identity, enough verifiable information to classify it, and a meaningful fit within at least one capability taxonomy. Inclusion does not imply a score, recommendation, market position, or commercial relationship.

Categories are organized by the primary security problem they address. Multi-purpose tools can belong to more than one category. Capability claims are mapped only when present in the verified profile; “not verified” means this guide makes no current support claim, not that the product lacks the capability.

Comparison pages place existing verified profiles side by side. They do not declare a universal winner. Best fit, deployment, operating model, ecosystem, licensing context, and tradeoffs are shown so readers can identify which questions need a proof of concept or current vendor quote.

Pricing is deliberately represented only as free, freemium, or relative tiers ($, $$, $$$). The labels are directional and never dollar quotes. Facts can change after their verification date, so readers should confirm editions, packaging, acquisitions, licensing, and support with the primary source before making a decision.

The same structured records used to build the pages are published as static JSON for search systems, research tools, and AI retrieval. Source URLs and verification dates are retained in the exports so downstream answers can preserve provenance.

• Tools JSON
• Vendors JSON
• Categories JSON
• Glossary JSON