CrowdStrike and Palo Alto sell detection and a network product, with people behind them. Vanta and Drata sell evidence for a questionnaire. Wazuh's engine is AGPL-3.0, with shared libraries dual-licensed GPL-2.0 or AGPL, and it watches hosts the client operates. osquery is dual-licensed Apache-2.0 and GPL-2.0 and asks those hosts questions. Neither is a managed SOC, and neither fills out a SOC 2 binder.
What is the honest split?
Own the agent and the log on the machines you run. Rent, or staff, the humans who answer the alert at 2am if you cannot. A compliance questionnaire is a process. Some of it can be automated from evidence you already collect. The stamp still comes from an auditor, not from a repository.
What we will not deploy as a CrowdStrike replacement?
Wazuh. It is a useful host sensor. It is not a substitute for a vendor's threat intelligence subscription and a retainer. If a customer contract names a class of product, read the contract before you uninstall the agent.
Where does hardening fit?
Beside the tool, not instead of it. Security assessment and hardening is the work of finding what is exposed and fixing it. A dashboard does not do that work.
What do we hand over?
We select the system, deploy it on infrastructure you control, connect it to the tools you keep, and write the runbook so your own team can operate it. Support after handover is optional. The rest of the map is in software you can stop renting; the engagement behind it is open-source business systems.
Name one process that still needs a person. We will tell you what a one-time build takes.
Contact us today