Hexward Labs
Cybersecurity content and self-hosted security tools
Short, practical cybersecurity lessons, and a family of free, self-hosted tools for firewall audits, vulnerability prioritisation, certificate and DMARC monitoring, and network visibility, with an optional AI assistant that explains findings in plain language. Your data stays on your network.
- 12
- Single-binary tools
- SQLite
- Local storage
- Apache-2.0
- Free editions
- 0
- Telemetry
- AI
- Optional, local
Teach
Step-by-step lessons on Cisco Secure Firewall, segmentation, migration and email security.
Published as short videos and written guides.
Build
Twelve single-binary tools with SQLite storage.
Free editions are Apache-2.0 and fully usable. Paid editions add support and extras. Every tool also has an optional AI Explain button.
Stay transparent
What the tool does is what the page says.
- TelemetryNone.
- LimitsPublished next to the features.
- ErrorsExplicit, never silent.
- AIOptional, and it only explains.
AI Assist, optional
Plain-language explanations from a small model that runs on your own hardware.
Every tool has an Explain button that says what a finding means and what to check first. The free setup uses an open model in a separate container on your network, with no cloud AI service. Paid editions add larger models and the option to use your own endpoint. English is supported today.
- DetectThe tool's own engine finds and scores the issue.
- ExplainAI Assist writes what it means in plain language.
- DecideYou stay in control. It never creates or re-scores a finding.
Featured tools
Six of the twelve.
RuleForge
Converts firewall configurations between Cisco ASA, Cisco FTD, PAN-OS, FortiGate and Check Point, with a mapping report for rules it can't translate one-to-one.
View on Products → Firewall rule auditingRuleHawk
Finds shadowed, redundant and unused rules and tracks policy drift.
View on Products → TripwiresDecoy
Self-hosted canary tokens and honeypots that alert on unauthorized access.
View on Products → External exposure monitoringAttack Surface Monitor
Scheduled enumeration of internet-facing exposure, flagging changes.
View on Products → Vulnerability prioritisationPatchlight
Ranks CVEs using CISA KEV and EPSS.
View on Products → TLS monitoringCertLight
Monitors certificate expiry, hostname mismatches, broken chains and weak keys.
View on Products →Lessons
Short videos, one topic at a time.
Loops are ambient visuals. The lessons are on the Videos page.
Watch the lessons →Latest guides
Written for the person doing the migration.
- Firewall migration after Expedition end of lifeGuide →
- Cisco ASA to Palo Alto: mapping and cutoverGuide →
- Self-hosted alternatives to Thinkst CanaryGuide →
- Open source firewall rule auditGuide →
- Lightweight self-hosted SIEMGuide →