Maintenance
Part of Security foundations: accounts, backups and third parties
Best security foundations software 2027: an unranked guide
Best security foundations software 2027, grouped by job, not ranked. Compare functions, fit, and billing models; use trial and contract questions before buying.
The phrase best security foundations software 2027 covers different security jobs; this is an unranked category guide, not a product ranking or price comparison. It groups named tools by function, fit, and billing model. Check vendors for current editions and terms before buying.
Nothing here prevents compromise. Every control catches some things and misses others, and the vendor's own documentation is the place to check which.
What to take away
- Buy in the order things failidentity, backup, endpoint, email, visibility.
- 1Password, Keeper and Bitwarden all do per-user vaults and per-person sharing; the differences are administration and price model.
- Duo, Microsoft Entra and Okta cover MFA and single sign-on at different sizes and price points.
- Veeam, Acronis and Datto differ mainly in whether you or a partner runs the restore.
- KnowBe4, Proofpoint and Microsoft Defender for Office 365 split on price and on how much administration you can absorb.
Tools by category
Password managers
1Password stores credentials in a per-user vault, shares items through vaults rather than by sending secrets, and gives administrators a recovery path for business items. It suits teams that want strong sharing controls without much setup, and it is priced per user per month.
Keeper does the same job with a stronger emphasis on role-based access and compliance reporting. Its business subscription is priced per user, which suits regulated practices.
Bitwarden is open source, self-hostable, and priced per user with a free tier, which suits organizations with an IT generalist who wants to run it. All three export in usable formats.
Multi-factor authentication and single sign-on
Cisco Duo covers MFA and device trust, supports passkeys and hardware keys, and is priced per user per month. It suits businesses that want MFA without moving their whole directory.
Microsoft Entra ID bundles MFA, conditional access and single sign-on into Microsoft 365 tiers, so the marginal cost is often zero and the work is configuration.
Okta handles single sign-on across many applications and is priced per user per month, which suits companies running a dozen or more cloud apps. All three log authentication events; check retention on your tier.
Backup and recovery
Veeam backs up virtual machines, physical servers and Microsoft 365, and is licensed per workload or per socket. It suits businesses with an IT person who will run restores.
Acronis Cyber Protect combines backup with endpoint protection and is priced per workload or per device, which suits small teams that want one console. Datto sells through managed service providers, with appliances and cloud storage on a subscription, which suits businesses that would rather not run backup themselves.
Ask each vendor whether an administrator with your credentials can shorten retention or delete the archive. See backup and recovery for the restore test to run before you commit.
Endpoint management and detection
Microsoft Defender for Business ships with many Microsoft 365 Business Premium plans, covers inventory, patching, encryption reporting and detection, and is priced per user per month. It suits organizations already inside Microsoft 365.
CrowdStrike Falcon Go is a lighter version of the enterprise endpoint detection product, priced per device per year, and suits businesses that will pay for monitoring. SentinelOne offers similar detection with rollback, priced per endpoint, and suits teams that want automated response. None of these replaces patching.
The question that decides the value is who reads an alert at 2am, and endpoint security covers that fork.
Email security
Microsoft Defender for Office 365 adds impersonation protection, external sender marking and quarantine to Microsoft mail, priced per user per month. It suits small businesses using Microsoft 365 email. Proofpoint Essentials provides filtering, impersonation defense and quarantine for mixed mail platforms, priced per user per year, and suits businesses not on Microsoft.
KnowBe4 combines filtering with phishing simulation and training, priced per user per year, and suits organizations that want to measure user behavior. All three should help you implement SPF, DKIM and DMARC.
Check whether the report button routes to a monitored queue.
Logging and alerting
Microsoft Sentinel collects and analyzes security data from connected sources to detect and investigate threats. It is priced by data volume ingested and suits organizations already in Azure.
Huntress is priced per endpoint per month and includes a human review of alerts, which suits small teams with nobody to watch a dashboard.
Blumira combines log collection with a monitoring team, priced per endpoint or per user, and suits businesses that want alerts read by someone else. Retention length is the number to verify first.
How to run a trial that tells you something
A demonstration shows the product under conditions the vendor chose. A trial should test yours.
Trial tests that eliminate options
- Restore real data and time it
- Offboard a test user, check revocation
- Raise a real support ticket
- Give it to the least technical colleague
- Export your data before you commit
The offboarding test eliminates products faster than any feature comparison. So does the export test, because the alternative is discovering the format when you need to leave.
The commercial questions people forget
| Question | Why it matters |
|---|---|
| What is on our tier? | MFA, single sign-on, audit logs and retention are often upgrades |
| What is the pricing unit? | Users, devices, mailboxes and data volume behave differently at renewal |
| What does onboarding cost us in hours? | Your hours, not the vendor's estimate |
| Who administers this daily? | Administration is the real cost and never appears on the quote |
| What happens to our data when we leave? | Deletion timelines vary, and export formats vary more |
| Will the vendor notify us of an incident affecting our data? | Get the commitment in writing |
Total cost is license plus migration plus administration plus training plus the days it does not work. A cheap tool nobody configures correctly is the expensive option.
Commercial questions to ask
- What is included on our tier?
- What is the pricing unit and growth behaviour?
- What happens at renewal and cancellation?
- How many onboarding hours from us?
- Who administers it daily, and when?
- When is our data deleted after leaving?
Common questions
We already pay for a platform bundle. Is any of this necessary?
Turn on what the bundle includes before deciding. MFA, device encryption, basic anti-malware, mail filtering and audit logs are usually present and usually off. Measure the gap that remains after an afternoon of configuration, then buy against the measurement.
What if the supplier will not give us a trial?
Then you are comparing exit terms instead, which are knowable from the contract. Ask what happens when the console is unreachable, what the notice period is, and how the data comes out. A supplier who answers none of those in writing has narrowed the decision for you.
Who should run the evaluation?
Whoever will administer the tool afterwards, with the least technical colleague present for the parts that touch everyday users. A tool chosen by someone who never operates it is the most reliable way to end up with an unused console.
Our most urgent problem is at line five of the buying order. Can we skip ahead?
Confirm lines one to four are genuinely done, and do not assume they are. If they are not, money spent on visibility usually buys a record of something you could have prevented. Account work sits in identity and access, and the broader ordering of controls is in security foundations.
Is there anything worth having that costs nothing?
Several national bodies publish tools for small organizations at no charge, and the United States Cybersecurity and Infrastructure Security Agency keeps a list of no-cost cybersecurity services and tools. For example, CISA's Cyber Hygiene Services include Vulnerability Scanning and Web Application Scanning at no charge. The United States Federal Trade Commission's data security guidance for businesses is free general orientation. Read both before signing anything.
What any regulation or contract requires you to buy depends on your industry and jurisdiction. Ask your own advisers.
