// PLANS

Compare plans

Every plan watches the same 1309 tools, about ~54 feature releases a day with the bug fixes dropped. What changes is how much of it reaches you. See what subscribers get →

Tax and billing

Free

No card.

Stay in touch weekly.

Subscribe free or read it on Substack

Head only, as plain posts.

Includes

Head delivered every Friday
One Grep, up to three tools, releases only
Tail and Head free to read on the site

Practitioner

$10/mo

or $100/yr save 17%

Stay current on the tools you run.

Subscribe or pay yearly

Everything in Free, plus

Tail daily and Diff
Three Greps per site for the tools you run, with no tool cap
Grep monthly and quarterly reports
Persona editions written for your role
Uniq on the tools you watch, monthly

Recommended

Researcher

$20/mo

or $200/yr save 17%

Search every past issue, compare tools side by side, and pull the data into your own tools.

Subscribe or pay yearly

Everything in Practitioner, plus

Keywords in a Grep: follow a capability across vendors
Uniq: how vendors reposition, reprice, rebrand, and change hands, monthly
API and MCP access to everything we track
Findings and charts that only paid plans can see
Uniq findings across the vendors we reviewed that month, with the tools you watch first

Business

$1,000/mo

or $10,000/yr save 17%

Follow every vendor and category you compete in.

Talk to us

or write to info@cybertoolchain.io

Everything in Researcher, plus

Unlimited Greps, for the vendors and categories you follow
Arranged with you by email

30-day refund, no questions asked Cyber Toolchain LLC info@cybertoolchain.io

You can sign in to both Cyber Toolchain and AI Toolchain with the same email. A paid plan covers the site where you subscribe. To get AI Toolchain too, add it to or , and one login gets you into each.

Compare every feature

Series	What it is	When	On the site	In your inbox
Tail	the daily release firehose	Every day usually by 11:30 UTC	Every issue free, no account	On a planfrom $10/mo
Grep	only the tools you run	When your tools ship with the daily — usually by 11:30 UTC	Not published here email only	Free1 Grep · up to 3 tools · releases only
Head	the week's top picks	Fridays usually by 17:00 UTC	Every issue free, no account	Freeno card
Ls	Toolchain improvements and new tools	Mondays	Every issue free, no account	Freeno card
Diff	what vendors changed and didn't announce	Wednesdays usually by 16:30 UTC	One sample the rest arrives by email	On a planfrom $10/mo
Uniq	how vendors reposition, reprice, rebrand, and change hands	Monthly	Not published here email only	On a planfrom $20/mo

Feature	Free	Practitioner	Researcher	Business
What arrives in your inbox
Head — the week's top picks Fridays, each with why it matters. Paid plans can switch on ten picks.	5 picks	Up to 10	Up to 10	Up to 10
Ls — Toolchain improvements and new tools Mondays. Every tool we started watching, with three to try first.	✓	✓	✓	✓
Tail — the daily releases Every day. The email leads with five to ten picks; every release is on the web. Whole watchlist or your categories.	—	✓	✓	✓
Grep — only the tools you monitor Its own email when something you follow ships. Paid Greps follow whole categories like detection engineering, with monthly and quarterly reports.	1 · up to 3 tools	3	5 · with keywords	Unlimited · with keywords
Diff — documentation and API changes Wednesdays. The exact lines vendors changed in docs and API references, often ahead of the release.	—	✓	✓	✓
Uniq — how vendors reposition, reprice, rebrand, and change hands Monthly. The commercial side of the market: partnerships, acquisitions and repositioning.	—	Your tools	Whole market	Whole market
Persona editions — written for your role Pick the persona that fits your role and each issue keeps only what you act on. See what each persona keeps →	—	✓	✓	✓
Charts, research and data on paid plans
Market signals, tool by tool and vendor by vendor See who documents what they ship, whose platforms go down, which categories are accelerating or stalling, and what each tool keeps breaking. See one of these charts →	—	—	✓	✓
Tool score cards and peer rankings Velocity, docs quality and breaking-change discipline, each linked to evidence. Researcher adds each tool’s rank in its category; coverage varies. Your toolchain’s score card →	—	Score cards	Plus peer ranks	Plus peer ranks
Every vendor’s pricing and website history Every change to plans and prices, dated, and each vendor’s site back to 2021. Plus open roles by product area, refreshed weekly. Browse the vendors →	—	—	✓	✓
Capability Search Search the tool features we have indexed for up to six capabilities, with evidence links. No match does not mean a tool lacks it. Try a search →	✓	✓	✓	✓
API and MCP access Query the data from your scripts, or ask Claude or any MCP client. We test 17 use cases against it. What the API serves →	—	—	50,000 / day	50,000 / day
Webhooks when a tool ships Coming soon Get a signed request at your own HTTPS address when a tool you follow ships, so your systems can react.	—	—	✓	✓
A quarterly report on your category, written for a board A one-page PDF each quarter on peer rankings, filings, pricing and hot categories, every figure sourced.	—	—	—	✓
Answers from everything we track Coming soon Ask a question and get an answer from every release and doc change we’ve tracked.	—	—	500 / month	Unlimited
Free for everyone, no account
Read every Tail and Head issue, the tools directory, open charts and RSS Grep, Diff, and Uniq arrive by email only.	✓	✓	✓	✓
For the vendors we track: their own release-notes score If you make a tool we track, see your own score and what cost you points. How the scores are computed, on any paid plan →	✓	✓	✓	✓

Questions

Why so much of this is free

Security practitioners should know what their tools can actually do, and most of that never reaches them, so the issues and the tools directory stay open to anyone with no account, along with many of the charts.

Subscriptions fund that work and save you from watching a hundred vendors yourself.
You get the releases, documentation changes, and market shifts that matter to your stack, along with the commands and examples to start using them. Researcher and Business add analytics on who documents what they ship, whose platform goes down, where the market is moving, and what keeps breaking. Every paid subscription helps fund the Cyber Toolchain. You can read a real issue before you pay.

What counts as a release

A release only appears if it ships something new. We drop bug-fix-only releases and trim the rest down to the new capability and the steps to try it, along with any screenshots the release itself published.

How the filtering works

Pick tools, categories, or both, and your inbox gets only what matches. Researcher adds keywords, so you can follow tools that integrate with a specific API (Google Calendar, say), model (Jev), hardware (RTX 5060), or technology (eBPF, AF_XDP) across every vendor.

Changing or cancelling

Change plan or cancel whenever you like, from a link in any issue. Annual billing is two months cheaper than monthly and can be cancelled the same way.

Who the Researcher plan is for

Researcher is for anyone with a question bigger than one issue, like analysts, founders, and product teams sizing a market. You can query every release, tool, and chart from your own scripts and your AI assistant, follow a capability across vendors with keywords, and read analytics that only paid plans can see.

Who the Business plan is for

If you compete in a market or invest in one, you'll want to see what changed across all of it. Business includes everything in Researcher plus unlimited Greps, so you can follow every vendor and category that matters to you, and we'll set up your coverage with you by email.

Not sure yet? Read the latest issue or see what subscribers get.

The newsletter samples are real entries from published issues. Each Summary introduces the sample; the issue excerpt itself appears under The Sample. The charts use invented names and numbers to illustrate the format. Where the issue is open to read, the sample links to it, so you can read the surrounding entries and judge the coverage for yourself.

About TailEverything that shipped across the watchlist that day, and the features each release brings, with runnable commands where they help. The email leads with five to ten releases we picked, more on a day with more worth reading. Every release is in the issue on the web. A quiet day publishes nothing rather than padding an issue.

Sample

// TAIL — the daily release firehose

A real entry from issue 039

Published August 8, 2026 · read that issue

TAIL 039 paid · every day

SummaryOne release added twenty-eight capabilities, and the entry names every new command and config key exactly as you would type it. Four behavior changes break existing workflows, and the commands to drive the new features are included. Reading the upstream release notes to this depth would take an afternoon.

The Sample

Radare2 reverse-engineering

28 capabilities 4 breaking changes 3 worked examples

Radare2 6.2.0 adds Rust v0 demangling, resource extraction commands, WebAssembly type support, PPC64 ELFv2 calling convention, struct synthesis, and more.

Adds iuo command to open binary resources inline and ix command to extract sections, segments, and resources.
Adds iU command (with iUx extraction) and rabin2 -xU flag for listing and extracting binary resources; old iR is renamed to iU and old iU moved to iu.
Adds anal.gpseed config key to seed a PIC base register during ESIL analysis.
Adds asm.cmt.reguse config key to emit register-use comments in disassembly.
Adds dir.binsdb config key (from binpath/dirprefix) for PE/MDMP ordinal lookups.
Adds types.fields config key to gate propagation of callee types into struct and union fields during aaft.
Adds scr.drag config key to enable click-and-drag scrolling in disasm, hex, and graph views.
Adds Lcc command to list all plugins registered with the new command API.

…and 20 more, in this one entry.

Worked example — carried in the issue

Seed a PIC base register before ESIL-based analysis so position-independent code resolves correctly.

r2 /bin/firmware.elf
> e anal.gpseed=0x10000
> aaa

39 more entries in that issue. Every Tail issue is free to read on the site.

Read issue 039 in full →

About HeadThe week's top picks — the releases we'd flag first — each with a short "why it matters". If nothing clears the bar, no issue ships. Plus one top pick each month, and one each quarter.

Sample

// HEAD — the week's top picks

A real entry from issue 012

Published September 18, 2026 · read that issue

HEAD 012 free · fridays

SummaryThe week's pick out of every release we read. Zeek 9.0 in twenty-four capabilities: a UDP packet source that takes VXLAN and GENEVE mirror traffic, two NTP logs that did not exist before, new TLS events. Five changes break existing deployments, and the entry names each one.

The Sample

Zeek network-analysis

24 capabilities 5 breaking changes 3 worked examples

Zeek 9.0 adds UDP packet source for VXLAN/GENEVE mirroring, ZIP analyzer, NTP control/private logs, new TLS events, and LDAP SASL forwarding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds zeek -i udp::0.0.0.0:4789:vxlan UDP packet source (bundled zeek-packet-source-udp plugin) to receive VXLAN or GENEVE mirror traffic over UDP without raw packet capture; uses SO_REUSEPORT for multi-worker kernel load-balancing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds VNI-aware connection tracking via policy/frameworks/conn_key/packet_source/udp/vxlan_vni policy script when using the UDP packet source.
Adds policy/files/zip/register.zeek to map the bundled Spicy ZIP file analyzer to the application/zip MIME type; recursive ZIP depth is controlled by Spicy::max_file_depth.
Adds policy/protocols/conn/multicast-participants.zeek producing a new multicast_participants.log with IGMP-derived data about hosts participating in multicast connections.
Adds two new NTP logs — ntp_control.log and ntp_private.log — covering NTP modes 6 and 7, which were previously unlogged.
Adds Log::json_string_escape_policy (type JSON::STRING_ESCAPE_POLICY_*) to make control-character and invalid UTF-8 escaping in JSON logging configurable; default remains JSON::STRING_ESCAPE_POLICY_HEX.
Extends zeek.conf and zeek-systemd-generator to support multiple interfaces and multi-host deployments.
Adds ssl_extension_encrypted_client_hello event carrying information about the TLS encrypted_client_hello extension.

…and 16 more, in this one entry.

Worked example — carried in the issue

Receive VXLAN mirror traffic over UDP on a busy sensor where multiple Zeek workers share the load via kernel SO_REUSEPORT balancing — no raw packet capture interface needed.

zeek -i udp::0.0.0.0:4789:vxlan

8 more entries in that issue. Every Head issue is free to read on the site.

Read issue 012 in full →

About DiffChanges to the product documentation and API reference pages of the tools we watch, from new capabilities, settings, endpoints and changed behavior to wording fixes and individual character changes. Docs changes are a leading indicator: capabilities often land there before they are announced anywhere else.

Sample

// DIFF — what vendors changed and didn't announce

A real entry from issue 004

Published July 29, 2026 · read that issue

DIFF 004 paid · wednesdays

SummaryFound in the docs, not in a release post. Cribl AI now runs an MCP server, so Cursor, Claude Code or Codex can work with your Sources, Pipelines and Search Notebooks, and Guard recommends an action for each detection. The full diff shows the lines the page gained.

The Sample

Cribl data-pipeline

6 capabilities 2 worked examples

＋ New in the docs docs.cribl.io

Cribl AI gains an MCP server for external agent access and Guard recommendations for actionable detection guidance.

Read on docs.cribl.io →

└──▷ DETAILED CHANGES · 6FULL DIFF · what the page said before, and says now

New MCP server lets external AI clients (Cursor, Claude Code, Codex) connect to Cribl…

New in the docs

New MCP server lets external AI clients (Cursor, Claude Code, Codex) connect to Cribl environments and interact with Sources, Destinations, Pipelines, and Search Notebooks via natural language.

Guard recommendations surface a suggested action (create a rule, mark mitigated, or…

New in the docs

Guard recommendations surface a suggested action (create a rule, mark mitigated, or ignore) for each detection so practitioners can act on findings without leaving the UI.

MCP Integrations setting allows Cribl to call tools from an approved list of external agents via MCP.

Web Search option enables a Cribl agent to search the web for information during Search investigations.

Bring Your Own Model (BYOM) support lets operators route Cribl AI through their own…

New in the docs

Bring Your Own Model (BYOM) support lets operators route Cribl AI through their own cloud-hosted or self-hosted AI provider instead of Cribl-managed models.

AI feature entry points remain visible and surface a actionable error message when a…

New in the docs

AI feature entry points remain visible and surface a actionable error message when a configured custom provider is unreachable, rather than failing silently.

12 edits

WasNow

12 edits

Worked example — carried in the issue

Connect Cursor or Claude Code to your Cribl environment so an AI agent can query Pipelines and Search Notebooks through natural language.

In Settings > Global > AI Settings, enable MCP Server, then select Copy bearer token and provide it to your MCP client (e.g., Cursor or Claude Code) as a bearer token to connect.

164 more entries in that issue. Diff ships wednesdays to subscribers only.

Read issue 004 in full →

About UniqWhat the vendors we watch changed about how they sell themselves — the category they claim, the buyer they name, the plan names and prices on the pricing page — and the words the whole market is picking up or dropping. One vendor rewording its hero is a data point; nine doing it in the same quarter is the market moving, so every shift is counted across the cohort rather than reported one page at a time. It also covers every acquisition and partnership those vendors announce, each with a short summary and how it compares with the deals of the year before.

Sample

// UNIQ — how vendors reposition, reprice, rebrand, and change hands

From issue 003, as subscribers got it

Published September 8, 2026 · covers 2026-08-02 to 2026-09-01

UNIQ 003 paid · monthly

SummaryFour identity vendors rewrote the sentence that says what they are in the same month, and all four put AI in the new one. Uniq reads vendor homepages and pricing pages every month and shows you who changed the pitch, word for word, who changed how they price, and which terms the whole market moved toward.

The Sample

Rewrote their category

ConductorOne2026-08-31

was~~Access infrastructure for AI transformation~~

nowAI-Native Identity Governance

Okta (Auth0)2026-09-01

was~~easy to implement, adaptable authentication and authorization platform~~

nowSecure AI Agent & User Authentication

Cisco (Duo)2026-08-31

was~~Complete Identity Security & MFA Solutions~~

nowIAM & MFA Identity Security for Business, Humans, AI

Teleport2026-09-02

was~~The AI Infrastructure Identity Company~~

nowUnified Identity Securing Classic & AI Infrastructure

Changed how they price

Dradis Framework prices published → quote only

new plan Professional

no longer listed ~~AssessRemediate~~

Dradis Framework's pricing page now lists a single Professional plan at a quote-only price, with the previously listed Assess and Remediate plans no longer shown; collapsing multiple named tiers into one quote-based plan suggests a move toward custom, sales-led pricing rather than self-serve.

CrowdStrike prices published

new plan Falcon Free Trial

CrowdStrike's page now shows a Falcon Free Trial plan alongside its public pricing, giving prospective buyers a no-cost way to try the product before committing to a paid tier.

The market moved

Terms vendors picked up (▲) or dropped (▼) between two readings, and how many vendors moved.

▲ 4 organizations CrowdStrike, Databricks, Mend.io, Okta (Auth0)

▲ 4 agent Cyera, Dradis Framework, Legit Security, Snyk, Zscaler

▲ 3 context ConductorOne, Databricks, Okta (Auth0)

▼ 3 real-time Cyera, Dradis Framework, NVIDIA

6 more rewrites in that issue. Uniq ships monthly to subscribers only.

// CHARTS — ANALYTICS PUBLISHED NOWHERE ELSE

How the market charts present measured tools

Invented tools and invented numbers — an illustration of the view, not a measurement. The real versions are on the analytics page with their labels masked.

illustration

Who is slipping, who is breaking, and where a category is heading — based on the data available for each chart. Coverage varies by tool and metric. Read the live charts and their coverage notes. These illustrations show the format, not current rankings.

Who documents what they ship

Release-notes quality, scored 0-100 on the median note.

Without one

▒▒▒▒▒▒▒▒▒▒▒▒ 88 / 100

▒▒▒▒▒▒▒▒▒ 71 / 100

▒▒▒▒▒▒▒▒▒ 46 / 100

▒▒▒▒▒▒▒▒▒ 22 / 100

With a plan

Northwind Scanner 88 / 100

Kestrel Vault 71 / 100

Pinegrove EDR 46 / 100

Halberd Cloud 22 / 100

Whose platform goes down

Hours degraded or down in the last 90 days, from the vendor’s own status page.

Without one

▒▒▒▒▒▒▒▒▒ 41h 20m

▒▒▒▒▒▒▒▒ 24h 05m

▒▒▒▒▒▒▒▒▒ 8h 30m

▒▒▒▒▒▒▒▒▒▒▒▒ 2h 45m

With a plan

Halberd Cloud 41h 20m

Vellum SIEM 24h 05m

Kestrel Vault 8h 30m

Northwind Scanner 2h 45m

Whose fixes don’t hold

Share of fixes that reopen the same failure within a quarter.

Without one

▒▒▒▒▒▒▒▒▒ 38% reopen

▒▒▒▒▒▒▒▒ 25% reopen

▒▒▒▒▒▒▒▒▒ 16% reopen

▒▒▒▒▒▒▒▒▒▒▒▒ 5% reopen

With a plan

Pinegrove EDR 38% reopen

Vellum SIEM 25% reopen

Halberd Cloud 16% reopen

Northwind Scanner 5% reopen

Researcher and Business carry the full analysis, across release-notes quality, platform reliability, category momentum and the defect analysis.