Skip to content
SPECIFICTION
Get listed

CrowdSec

crowdsec.net

From $49/mo Free plan Open source WebWindowsmacOSLinuxiOSAPI
Visit crowdsec.net
Spec score 9.3 #1 of 39 in Intrusion Detection and Prevention Software

What it is

CrowdSec is an open-source security stack designed to detect and block malicious IP addresses to protect infrastructure and applications. Its Security Engine analyzes logs and requests for harmful behavior, while the Remediation Component blocks IPs identified by that engine across supported platforms. CrowdSec says analysis takes place locally and logs do not leave the user's infrastructure. Its AppSec Component can provide web application firewall protection. The free Community offering includes real-time decision management, audit support, AWS CloudTrail scenarios, CAPI allow lists, and Kubernetes audit acquisition. IP Reputation data includes contextual criteria, activity timelines, autonomous system and IP range reputation, MITRE technique classification, and hourly updates. Listed integrations include Microsoft Sentinel, AWS log sources, WordPress, Cloudflare, Docker, and Kubernetes. The Community Security Engine is free. The IP Reputation API is listed at $49 a month for 5,000 queries; other listed services include blocklists and threat-intelligence options. CrowdSec lists Linux, macOS, and Windows among its platforms, with API, extension, self-hosted, and web options.

Spec sheet

What it does
CrowdSec Security Engine analyzes logs and HTTP requests with behavior-based scenarios, then uses remediation components to block malicious activity.Read 15 Oct 2026 · docs.crowdsec.net
Purpose
The open source CrowdSec Security Stack detects and blocks malicious IPs to safeguard infrastructure and application security.Read 28 Sep 2026 · crowdsec.net
Deployment
Official documentation describes single-host, multi-machine, centralized-log, Kubernetes, container and WAF-only deployments.Read 15 Oct 2026 · docs.crowdsec.net
Free plan
YesRead 21 Sep 2026 · crowdsec.net
Paid from
49Read 21 Sep 2026 · crowdsec.net
Support
CrowdSec Console Premium lists optional premium service and support for $1K/month.Read 28 Sep 2026 · crowdsec.net
Headquarters
Montrouge, FranceRead 28 Sep 2026 · crowdsec.net
Founded
2020Read 28 Sep 2026 · crowdsec.net
API integrations
The CTI API documentation lists native integrations including Microsoft Sentinel, Splunk, TheHive, OpenCTI, Maltego, MISP, QRadar and Security Copilot.Read 15 Oct 2026 · docs.crowdsec.net
Application security
The AppSec Component turns the Security Engine into a web application firewall and can protect web applications from the latest vulnerabilities.Read 28 Sep 2026 · crowdsec.net
AppSec
AppSec rules are part of the log processor and can filter HTTP requests from compatible web servers.Read 15 Oct 2026 · docs.crowdsec.net
Behavior detection
The Security Engine analyzes logs and requests to detect malicious behaviors and attacks.Read 28 Sep 2026 · crowdsec.net
Blocklist integrations
Hosted blocklist endpoints support plain text, F5, FortiGate, Palo Alto, Check Point, Cisco, Juniper, MikroTik, pfSense, OPNsense, Sophos and remediation-component formats.Read 15 Oct 2026 · docs.crowdsec.net
Commercial usage
The pricing FAQ says commercial use of CrowdSec data in an offering is available through its Partnership Program, with partner pricing on request.Read 28 Sep 2026 · crowdsec.net
Community features
The free Community offering includes real-time decision management, audit support, AWS CloudTrail scenarios, CAPI allow lists, and Kubernetes audit acquisition.Read 28 Sep 2026 · crowdsec.net
Community intelligence
Participating engines share detected attacks and receive a curated community blocklist of validated attackers.Read 15 Oct 2026 · docs.crowdsec.net
Company profile
LinkedIn lists CrowdSec as a privately held computer and network security company with 11–50 employees, Paris headquarters and a 2020 founding year.Read 15 Oct 2026 · linkedin.com
Data handling
CrowdSec's privacy policy says only contextualized IP addresses with incident date, time, and type are processed in the described ecosystem service, and says no directly identifying data is included in those lists.Read 28 Sep 2026 · crowdsec.net
Default ports
The Security Engine uses localhost-bound TCP ports 6060 for Prometheus metrics and 8080 for its API by default.Read 15 Oct 2026 · docs.crowdsec.net
Detection engine
The log processor analyzes data sources and HTTP requests, while the Local API connects processors, remediation components and the Central API.Read 15 Oct 2026 · docs.crowdsec.net
Documentation depth
The documentation includes installation guides, architecture, data sources, remediation, APIs, integrations, compilation and contribution/testing guidance.Read 15 Oct 2026 · docs.crowdsec.net
Funding
CrowdSec announced a €14 million Series A funding round in 2022 led by BREEGA and Supernova Invest.Read 15 Oct 2026 · crowdsec.net
Hardware requirements
Recommended minimums are one CPU core, 100 MB free RAM, 1 GB free disk and amd64, arm64 or armhf hardware.Read 15 Oct 2026 · docs.crowdsec.net
Integration examples
The integrations directory lists Microsoft Sentinel, Juniper, AWS log sources, WordPress, Chrome Extension, Windows Firewall, Cloudflare, Docker, and Kubernetes integrations.Read 28 Sep 2026 · crowdsec.net
Kubernetes requirements
The documented Kubernetes installation requires kubectl and Helm, and the default SQLite database does not support replication.Read 15 Oct 2026 · docs.crowdsec.net
Legal name and founders
Crunchbase lists the legal name as CrowdSec SAS and founders Laurent Soubrevilla, Philippe Humeau and Thibault Koechlin.Read 15 Oct 2026 · crunchbase.com
Licence
The CrowdSec Security Engine repository is released under the MIT License.Read 15 Oct 2026 · github.com
Limit: G2 users
G2 reviewers report a steep learning curve for advanced configurations and weaker maturity in enterprise reporting, compliance and centralized management.Read 15 Oct 2026 · g2.com
Limit: Gartner reviewer
The same Gartner review says advanced setup guidance remains insufficient.Read 15 Oct 2026 · gartner.com
Limit: Trustpilot complaint
A Trustpilot reviewer complained about receiving an unsolicited CrowdSec sales call in October 2025.Read 15 Oct 2026 · trustpilot.com
Linux installation
The recommended Linux installation uses CrowdSec's repository and installs the engine with apt, yum, dnf, zypper or opkg depending on distribution.Read 15 Oct 2026 · docs.crowdsec.net
macOS limitation
CrowdSec does not compile the Security Engine for macOS and instructs users to run the Linux container through Docker.Read 15 Oct 2026 · docs.crowdsec.net
Notable news
CrowdSec published a September 17, 2026 statement about source-code exposure that occurred in May 2026.Read 15 Oct 2026 · crowdsec.net
Notable release
CrowdSec 1.8.0, released August 31, 2026, added WAF bot detection, a dedicated Kubernetes datasource, HTTP helpers and LAPI performance improvements, while fixing two denial-of-service vulnerabilities.Read 15 Oct 2026 · github.com
Observability
The product provides Console alert management, Prometheus metrics and the cscli administration command.Read 15 Oct 2026 · docs.crowdsec.net
Praise: G2 users
G2's review summary says users repeatedly praise ease of use, effective threat detection, community blocking and open-source flexibility.Read 15 Oct 2026 · g2.com
Praise: Gartner reviewer
The published Gartner review praises lightweight real-time log analysis, crowd-powered reputation, smooth Linux deployment and stable firewall integration.Read 15 Oct 2026 · gartner.com
Prevention
The Remediation Component blocks malicious IPs identified by the Security Engine across various platforms.Read 28 Sep 2026 · crowdsec.net
Privacy and GDPR
CrowdSec says it processes contextualized IP addresses, uses GDPR Article 28 security clauses with subcontractors and applies EU standard contractual clauses for transfers outside the EU.Read 15 Oct 2026 · crowdsec.net
Privacy architecture
The Security Engine performs analysis locally and logs never leave your infrastructure; the page describes it as GDPR compliant.Read 28 Sep 2026 · crowdsec.net
Public APIs
CrowdSec documents an HTTP/JSON enrichment API using x-api-key authentication, offline CTI replicas and a Service API for selected SaaS features.Read 15 Oct 2026 · docs.crowdsec.net
Rating on Apple App Store
CrowdSec Monitor, an unofficial third-party app, is rated 5.0 out of 5 from 1 rating on the US App Store.Read 15 Oct 2026 · apps.apple.com
Rating on G2
4.7 out of 5 from 87 reviews.Read 15 Oct 2026 · g2.com
Rating on Gartner Peer Insights
5.0 out of 5 from 1 rating.Read 15 Oct 2026 · gartner.com
Rating on GetApp
No reviews; the listing shows a free starting price and free trial.Read 15 Oct 2026 · getapp.com
Rating on Trustpilot
2.8 out of 5 from 3 reviews.Read 15 Oct 2026 · trustpilot.com
Rating on TrustRadius
7.9 out of 10 from 2 reviews and ratings.Read 15 Oct 2026 · trustradius.com
Remediation
Bouncers can enforce decisions through iptables, firewalls, web servers or reverse proxies.Read 15 Oct 2026 · docs.crowdsec.net
SDKs
The integrations catalog lists Python and PHP SDKs for interfacing applications with the CrowdSec Central API.Read 15 Oct 2026 · crowdsec.net
Security controls
The privacy policy states that employee access requires multi-factor authentication and that automated data encryption is implemented where possible.Read 28 Sep 2026 · crowdsec.net
Security update
CrowdSec 1.8.1, released September 3, 2026, fixed a Brave Browser bot-detection false positive and corrected LAPI alert-query and challenge handling issues.Read 15 Oct 2026 · github.com
Supported systems
Documentation lists Linux, FreeBSD, Windows, macOS, Docker, Kubernetes, OPNsense, pfSense and WHM.Read 15 Oct 2026 · docs.crowdsec.net
Target users
The Security Stack page lists MSSPs, IT and services, hosting, education, ecommerce, finance, government, media, and healthcare among industries using or suited to the product.Read 28 Sep 2026 · crowdsec.net
Threat intelligence
The IP Reputation offering includes 32 criteria of context, timelined activity, autonomous system and IP range reputation, MITRE techniques classification, and hourly updated data.Read 28 Sep 2026 · crowdsec.net

Plans and prices

IP Reputation API $49 a month From $49/month 5,000 queries · 32 context criteria · hourly updated data · multiple API keys · optional local replication Read 15 Oct 2026 · crowdsec.net
Platinum Blocklists $1,900 a month Starting at $1900/month for SMB All blocklists · any number of company endpoints · firewall and CDN integrations Read 15 Oct 2026 · crowdsec.net
Live Exploit Tracker $2,000 a month Starting at $2k/month for SMB; company-size based CVE exploitation status · attacker IPs · vendor targeting · hourly refreshed IPs · OEM pricing available Read 15 Oct 2026 · crowdsec.net
Community Free Free plan for enthusiasts and individuals · behavioral detection · security response automation Read 15 Oct 2026 · crowdsec.net
Community Security Engine Free Free; the Security Engine is and always will be free Open source MIT license · free CrowdSec Console account available Read 28 Sep 2026 · crowdsec.net
IP Reputation API access $49 a month $49 /month for 5000 queries 5000 queries Read 28 Sep 2026 · crowdsec.net
Local CTI replication $9,000 a month From $9K/month Local synchronization of CrowdSec threat-intelligence data Read 15 Oct 2026 · crowdsec.net
CrowdSec Console Premium Priced on request Pay as you grow per enrolled Security Engine Premium blocklist · alert-surge notifications · advanced stack management · health monitoring · extended alert retention · SaaS API · multi-channel notifications · optional emergency fixes $1K/month · optional premium support $1K/month Read 15 Oct 2026 · crowdsec.net

Every CrowdSec plan and price →

Strong points and limits

Strong points

  • Security Engine analyzes logs and requests locally.
  • Remediation Component blocks identified malicious IPs.
  • AppSec Component can provide web application firewall protection.
  • Community Security Engine is free.
  • IP Reputation data updates hourly.

Limits

  • IP Reputation API plan lists 5,000 queries.
  • IP Reputation API is $49 a month.
  • CrowdSec Console Premium support is listed at $1K/month.

Who it suits

CrowdSec suits teams looking to detect and block malicious IP activity across infrastructure or protect web applications. Listed industries include hosting, education, ecommerce, finance, government, media, and healthcare.

CrowdSec in depth

Read the full write-up

CrowdSec is a security stack that detects suspicious behavior in logs and requests, then blocks malicious IPs across infrastructure and applications. It suits teams that can operate their own security tooling and want local analysis backed by community threat intelligence. The free engine is a strong starting point, while richer reputation data and premium services can become a significant recurring cost.

Overview

CrowdSec connects behavior detection with IP remediation: its Security Engine identifies malicious activity, and its Remediation Component applies blocks across supported platforms. The AppSec Component adds web application firewall protection against current vulnerabilities. Hybrid deployment, inline blocking, multi-scope network coverage, and cloud workload support make it relevant to environments spanning more than one kind of infrastructure.

Analysis happens locally, and logs remain within your infrastructure. For its ecosystem service, CrowdSec says it processes contextualized IP addresses with incident date, time, and type, without directly identifying data in those lists. Its privacy policy also describes employee multi-factor authentication and automated encryption where possible.

Key features

Detection and blocking

The engine analyzes both logs and requests for malicious behavior and attacks, then the remediation component blocks the IPs it identifies. That joined workflow is useful to infrastructure operators who need prevention as well as detection. The value depends on having a suitable deployment and remediation setup across the platforms you run.

Web application security

The AppSec Component turns the engine into a web application firewall and is intended to protect web applications from the latest vulnerabilities. This broadens CrowdSec beyond infrastructure monitoring for teams responsible for public-facing applications.

Community intelligence and integrations

The free Community offering includes real-time decision management, audit support, AWS CloudTrail scenarios, CAPI allow lists, and Kubernetes audit acquisition. The integrations directory covers services and environments including Microsoft Sentinel, Juniper, AWS log sources, WordPress, Chrome Extension, Windows Firewall, Cloudflare, Docker, and Kubernetes. That range can help teams fit CrowdSec into mixed environments, though the value of each integration depends on their existing stack.

The IP Reputation offering adds 32 criteria of context, activity timelines, autonomous-system and IP-range reputation, MITRE technique classification, and hourly updates. These richer signals are aimed at teams that need more context for IP decisions than the community engine alone provides.

Pricing

CrowdSec uses a freemium model. The Community Security Engine costs nothing, is open source under the MIT license, and includes access to a free CrowdSec Console account. These options suit teams starting with core detection and community capabilities.

IP Reputation API access costs $49 a month, billed monthly, for 5,000 queries. It fits teams that need enriched IP context on a defined query allowance; buyers should weigh that cap against expected use. The same API offer is also presented as IP Reputation API at $49 a month for 5,000 queries.

Platinum Blocklists start at $1,900 a month for SMBs and provide access to all blocklists on any number of endpoints within the company. This is aimed at organizations needing broad internal endpoint coverage, but the starting price is a substantial step up from the API plan. Live Exploit Tracker starts at $2,000 a month for SMBs, varies by company size, and offers OEM pricing; it is for buyers with a specific need for exploit tracking and a budget for size-based pricing.

Local CTI Replication provides local synchronization of threat-intelligence, IP reputation, and CTI data, with custom pricing. CrowdSec Console Premium includes a premium community blocklist, alert surge notifications, advanced stack management, background-noise filtering, stack health monitoring, and centralized list management, also with custom pricing. Optional premium service and support through CrowdSec Console Premium is priced at $1K/month. Commercial use of CrowdSec data in an offering is available through the Partnership Program, with partner pricing on request.

Platforms

CrowdSec supports API, extension, Linux, macOS, self-hosted, web, and Windows environments. Its hybrid deployment model, inline blocking, multi-scope network coverage, and cloud workload support suit teams protecting a mix of infrastructure and applications.

Who it's for

CrowdSec is suited to operators in hosting, IT and services, and managed security services, as well as teams in education, ecommerce, finance, government, media, and healthcare. It is strongest for organizations that can manage a security stack and want to connect local behavioral analysis with IP-based prevention. Teams seeking turnkey private access or a narrower network detection tool may prefer a different fit.

Pros and cons

Local analysis keeps logs on your infrastructure. This is a practical advantage for teams that want behavior analysis without sending their logs away.

Detection, IP blocking, and web application protection share one stack. The combination can cover infrastructure and web applications within a single security approach.

The free MIT-licensed engine includes meaningful community features. Teams can begin with the core engine and community capabilities without a paid engine plan.

Richer intelligence can cost considerably more. The API has a 5,000-query monthly allowance, while blocklists and exploit tracking start at 1900.00 USD and $2,000 a month.

Several commercial options use custom pricing. Buyers considering local CTI replication or Console Premium will need a quote to assess their costs.

Alternatives

Wazuh is worth considering for teams that want a free, open-source, self-hosted option with Linux, macOS, Windows, API, and web support; its Small plan starts at $571 a month. OSSEC suits readers looking for a free command-line option with core OSSEC rules and no dedicated support staff. pfSense is an alternative for readers seeking free open-source firewall and router software, with a separate Plus software offering.

Zscaler Private Access is an alternative for readers considering a paid private-access product. WatchGuard FireCloud is another paid option, with Internet Access for 1–50 licenses starting at $97.75 a year per user license. SELKS is free and open source under GPL 3.0-or-later, though it has no planned releases after January 1, 2025. Suricata is a free, open-source option under GPLv2. Atomic OSSEC priced on request per agent, with bulk discounts available.

Browse the broader Intrusion Detection and Prevention Software category to compare more tools.

Verdict

Choose CrowdSec if you want a free, locally analyzing security engine that links behavioral detection to IP blocking, with an application security component for web workloads. Its main advantage is that breadth without a paid engine license; its main drawback is the jump in cost for expanded reputation data, blocklists, and premium services. Teams that need only a free, focused tool or require predictable costs for larger-scale intelligence should compare alternatives before committing.

Verdict

CrowdSec combines local behavior analysis with IP remediation and a web application security component. The Community Security Engine is free, while the listed IP Reputation API costs $49 a month for 5,000 queries.

Where Specifiction places it

Alternatives to CrowdSecAll alternatives →