Introduction

opensecstack (SIN — Security Intelligence Network) is an open-source cybersecurity ecosystem for Europe and beyond: 11 integrated security platforms, a single sign-on identity layer (sinauth), and a cryptographic governance layer (CITADEL), all connected through typed SDK contracts and an immutable audit trail.

What is opensecstack?

It is built for the European regulatory and threat landscape — NIS2 compliance, API security, incident response, threat intelligence, AI-attack defence, and security operations. Every platform shares the same SDK contracts, every privileged action flows into the same governance layer, and every deployment can be self-hosted with zero vendor lock-in.

The software is open source under Apache-2.0 (tool platforms) and AGPL-3.0 (governance platforms). There is no SaaS requirement and no telemetry.

The ecosystem

The 11 platforms cover the security lifecycle:

• APIGuard — API security testing (OWASP API Top 10)
• NIS2 Compass — NIS2 Article 21/23 compliance
• IRFlow — incident response orchestration
• ThreatFlow — threat intelligence (STIX 2.1, MITRE ATT&CK)
• OpenScrub — DDoS mitigation (XDP/eBPF)
• CyberPath — security training (Docker/Wasm labs)
• SecureLab — attack simulation & detection validation
• OpenCSIRT — CSIRT operations (TAXII 2.1, CSAF 2.0)
• VertGuard — AI-attack defence (prompt injection, deepfake, MITRE ATLAS)
• SIN Community — developer knowledge hub
• sinauth — OAuth 2.0 / OIDC identity provider

Two cross-cutting layers

Beneath the platforms sit two layers that everything depends on:

• sinauth — the identity layer. Every platform delegates user and operator authentication to it over OpenID Connect (single sign-on, RS256 + JWKS, PKCE, TOTP MFA).
• CITADEL — the governance layer. Every privileged action is evaluated by the MARSHAL 5-gate engine and recorded in an append-only WORM audit chain with TripleHash integrity (SHA-256 + SHA-512 + BLAKE3) and Ed25519 anchors.

Next steps

Ready to run the stack? Head to the Quick Start to bring up the full ecosystem with Docker Compose in a few minutes, or read the Architecture overview first.