The latest articles on DEV Community by Vishnu Ajith (@vishnu_ajith_98100c5d1c03). https://dev.to/vishnu_ajith_98100c5d1c03 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3934846%2F6c146353-384c-4382-9f73-7ad45a455544.png https://dev.to/vishnu_ajith_98100c5d1c03 en Vishnu Ajith Sat, 16 May 2026 12:24:05 +0000 https://dev.to/vishnu_ajith_98100c5d1c03/we-built-a-free-open-source-alternative-to-wiz-for-azure-here-is-how-it-works-49oo https://dev.to/vishnu_ajith_98100c5d1c03/we-built-a-free-open-source-alternative-to-wiz-for-azure-here-is-how-it-works-49oo <p>Enterprise cloud security tools like Wiz, Prisma Cloud, and <br> Microsoft Defender for Cloud cost upwards of $500,000 per year. <br> Most organisations running on Azure simply cannot afford them.</p> <p>So we built OpenShield — a free, open source Cloud Security <br> Posture Management (CSPM) platform for Azure.</p> <h2> What is OpenShield </h2> <p>OpenShield scans your Azure subscription for misconfigurations, <br> maps every finding to compliance frameworks, and ships an <br> automated remediation playbook for every single rule.</p> <p>It is built in Python, MIT licensed, and completely free.</p> <p>github.com/openshield-org/openshield</p> <h2> What it detects </h2> <p>OpenShield currently has 20+ scan rules across six categories:</p> <ul> <li>Storage - public blob access, missing lifecycle policies, disabled diagnostic logging</li> <li>Network — open SSH/RDP, missing NSGs, no DDoS protection, WAF disabled, VPN using IKEv1, Network Watcher not enabled</li> <li>Identity — overprivileged service principals, MFA not enforced, unrestricted guest access in Entra ID</li> <li>Database — public PostgreSQL access, SQL auditing disabled</li> <li>Compute — VMs with no NSG, unencrypted disks</li> <li>Key Vault — soft delete disabled, public network access, diagnostic logging disabled</li> </ul> <p>Every rule returns a structured finding with the resource ID, <br> description, remediation steps, and a link to the playbook.</p> <h2> Compliance mapping </h2> <p>Every finding is automatically mapped to four frameworks:</p> <ul> <li>CIS Azure Benchmark</li> <li>NIST CSF</li> <li>ISO 27001</li> <li>SOC 2 Type II</li> </ul> <p>This means you get compliance posture out of the box with <br> no manual mapping required.</p> <h2> Remediation playbooks </h2> <p>This is the part that makes OpenShield different from most <br> open source security tools.</p> <p>Every scan rule ships with a hardened CLI playbook. When you <br> get a finding, you do not just learn what is wrong — you get <br> the exact command to fix it.</p> <p>Example playbook for AZ-STOR-004 (storage diagnostic logging):<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>./fix_az_stor_004.sh my-resource-group my-storage-account <span class="se">\</span> /subscriptions/.../resourceGroups/log-rg/.../logstore </code></pre> </div> <p>Playbooks are hardened with input validation, shell injection <br> prevention, secure temp file handling, and confirmation prompts <br> before making any changes.</p> <h2> Microsoft Sentinel integration </h2> <p>OpenShield pushes findings directly to Microsoft Sentinel via <br> Log Analytics. Four KQL detection rules are included out of <br> the box:</p> <ul> <li>HIGH severity findings in the last 24 hours</li> <li>Misconfiguration wave detection</li> <li>Persistent misconfigurations</li> <li>New resource type critical findings</li> </ul> <p>This means you get SIEM-level visibility from a free open <br> source tool.</p> <h2> The API </h2> <p>A Flask REST API exposes scan results, compliance scores, and <br> findings data. It is deployed on Render and live at:</p> <p><a href="https://openshield-api.onrender.com" rel="noopener noreferrer">https://openshield-api.onrender.com</a></p> <p>Endpoints include:</p> <ul> <li>GET /api/findings — list all findings with filters</li> <li>GET /api/score — security posture score (0-100)</li> <li>GET /api/compliance/cis — CIS compliance breakdown</li> <li>GET /api/compliance/nist — NIST compliance breakdown</li> <li>POST /api/scans/trigger — trigger a live scan</li> </ul> <h2> CI pipeline </h2> <p>Every pull request runs seven automated checks:</p> <ol> <li>Python syntax check on all rule files</li> <li>Rule structure validation and RULE_ID uniqueness</li> <li>Hardcoded credential scan</li> <li>Playbook existence and bash syntax validation</li> <li>Compliance JSON validation across all four frameworks</li> <li>API syntax check</li> <li>Compliance vs rule cross-reference</li> </ol> <p>This means every contribution is validated before it touches <br> the main branch.</p> <h2> How to run it </h2> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>git clone https://github.com/openshield-org/openshield <span class="nb">cd </span>openshield pip <span class="nb">install</span> <span class="nt">-r</span> requirements.txt <span class="nb">cp</span> .env.example .env <span class="c"># Add your Azure credentials to .env</span> python scanner/engine.py </code></pre> </div> <p>You need an Azure service principal with Reader role on your <br> subscription. Full setup guide is in the repo.</p> <h2> How it was built </h2> <p>OpenShield was built in public by students and engineers from <br> Ulster University, Southampton Solent University, and Middlesex <br> University alongside researchers at Quentangle Quantum Systems <br> in London.</p> <p>Every contributor has a PR merged into a production grade open <br> source security tool. That goes on their GitHub profile and CV <br> permanently.</p> <h2> Contributing </h2> <p>OpenShield is actively looking for contributors. If you want <br> to add a scan rule, write a remediation playbook, or improve <br> the compliance mappings, the contributing guide gets you <br> making your first PR in under 30 minutes.</p> <p>github.com/openshield-org/openshield</p> <p>Good first issues are labelled and waiting. The whole team <br> is available on Discord to help you through your first PR.</p> <h2> What is next </h2> <ul> <li>React dashboard with live demo URL</li> <li>30+ scan rules</li> <li>BSides Birmingham conference talk</li> <li>OWASP project listing</li> </ul> <p>If you work in cloud security and want a free tool that <br> actually works, or you want your first open source contribution <br> on a real security project — come build with us.</p> <p>github.com/openshield-org/openshield</p> security azure cloud devsecops