Skip to content
HCF
HCF

Security tools

Defensive tools, honestly labelled

HCF's tools for authorized, defensive security work. None has been released yet. Each page says what works today and what is still planned.
tools
5
with working code
3
released
0

Spotlight

Furthest along

Most advanced

Status: Development

FortiScan CLI

FortiScan CLI brings FortiScan's approach to the command line. It runs locally, never needs a hosted service, and treats authorized scope as a hard boundary.

  • Installation and configuration diagnostics
  • Groundwork for refusing targets outside an authorized scope
  • Read-only checks against one explicitly authorized target (planned)
  • Terminal and machine-readable reports (planned)
View FortiScan CLI

HCF / FORTISCAN CLI

STATUS
DEVELOPMENT
CATEGORY
COMMAND-LINE SECURITY AUDITING
WORKING
2
PLANNED
2
AVAILABLE
NO

Installation diagnostics and configuration work today. Security checks and reports are not implemented yet.

Where everything stands

From concept to production

  1. 1 item atConcept
  2. 1 item atResearch
  3. 2 items atPrototype
  4. 1 item atDevelopment
  5. 0 items atBeta
  6. 0 items atProduction

4 more

The rest of the portfolio

  • Status: Prototype

    Website security assessment

    FortiScan

    A website security scanner for sites you own or are authorized to assess.

  • Status: Prototype

    Mobile security

    Mobile Security Scanner

    A prototype app that shows a phone's security and privacy posture in plain terms.

  • Status: Research

    Endpoint defense

    DEF

    Defensive Endpoint Firewall Monitor: visibility into what a device's firewall is doing.

  • Status: Concept

    Web application security

    FCLxZ

    A planned modular web application assessment tool.

Responsible use

Three rules that come with every tool

Assessing systems without authorization may be illegal where you live.
  1. 01Only with permissionUse security tools only on systems you own or have explicit, documented permission to assess.
  2. 02Observe, don't attackHCF tools are designed for read-only, bounded checks. They are not built to exploit or brute-force.
  3. 03Results are not guaranteesAutomated checks cannot prove a system is secure. A clean result means only that nothing was observed.

Follow the work

Want to know when a tool is ready?

Ask about a toolAdvisories