Hexward Labs
Cybersecurity content and self-hosted security tools
Hexward Labs publishes short, practical cybersecurity lessons and builds a family of free, self-hosted tools for firewall audits, vulnerability prioritisation, certificate and DMARC monitoring, and network visibility. Your data stays on your network.
- 12
- Single-binary tools
- SQLite
- Local storage
- Apache-2.0
- Free editions
- 0
- Telemetry
Teach
Step-by-step lessons on Cisco Secure Firewall, segmentation, migration and email security.
Published as short videos and written guides.
Build
Twelve single-binary tools with SQLite storage.
Free editions are Apache-2.0 and fully usable. Paid editions add support and extras.
Stay transparent
What the tool does is what the page says.
- TelemetryNone.
- LimitsPublished next to the features.
- ErrorsExplicit, never silent.
Featured tools
Six of the twelve.
RuleForge
Converts firewall configurations between Cisco ASA, Cisco FTD, PAN-OS, FortiGate and Check Point, with a mapping report for rules it can't translate one-to-one.
View on Products → Firewall rule auditingRuleHawk
Finds shadowed, redundant and unused rules and tracks policy drift.
View on Products → TripwiresDecoy
Self-hosted canary tokens and honeypots that alert on unauthorized access.
View on Products → External exposure monitoringAttack Surface Monitor
Scheduled enumeration of internet-facing exposure, flagging changes.
View on Products → Vulnerability prioritisationPatchlight
Ranks CVEs using CISA KEV and EPSS.
View on Products → TLS monitoringCertLight
Monitors certificate expiry, hostname mismatches, broken chains and weak keys.
View on Products →Lessons
Short videos, one topic at a time.
Loops are ambient visuals. The lessons are on the Videos page.
Watch the lessons →Latest guides
Written for the person doing the migration.
- Firewall migration after Expedition end of lifeGuide →
- Cisco ASA to Palo Alto: mapping and cutoverGuide →
- Self-hosted alternatives to Thinkst CanaryGuide →
- Open source firewall rule auditGuide →
- Lightweight self-hosted SIEMGuide →