CrowdSec vs Wazuh
CrowdSec
crowdsec.netWazuh
wazuh.comSide by side
| Figure | CrowdSec | Wazuh |
|---|---|---|
| Price from | $49/mo | $571/mo |
| Free plan | Yes | Yes |
| Free trial | Yes | Yes |
| Open source | Yes | Yes |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| iOS | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 8 | 5 |
| Spec score · Intrusion Detection and Prevention Software | 9.3 (#1) | 8.6 (#6) |
| Documentation depth | The documentation includes installation guides, architecture, data sources, remediation, APIs, integrations, compilation and contribution/testing guidance. | The documentation includes quickstarts, installation, API reference, deployment guides, capability manuals, compliance use cases, integrations and release notes. |
| Founded | 2020 | 2015 |
| Headquarters | Montrouge, France | Campbell, California, United States |
| Limit: Trustpilot complaint | A Trustpilot reviewer complained about receiving an unsolicited CrowdSec sales call in October 2025. | The sole reviewer reported repeated manager/indexer failures, false-positive vulnerability findings and an interface that resets during interactions. |
| Notable news | CrowdSec published a September 17, 2026 statement about source-code exposure that occurred in May 2026. | LinkedIn reported Wazuh 5.0 Release Candidate 1 with the Wazuh Common Schema, Sigma-rule support, native CTI, a dashboard AI assistant, HTTPS agent communication and broader regulatory mappings. |
| Rating on G2 | 4.7 out of 5 from 87 reviews. | 4.5 out of 5 from 72 reviews. |
| Rating on Gartner Peer Insights | 5.0 out of 5 from 1 rating. | 4.4 out of 5 from 57 ratings. |
| Rating on Trustpilot | 2.8 out of 5 from 3 reviews. | 3 out of 5 from 1 review. |
| Support | CrowdSec Console Premium lists optional premium service and support for $1K/month. | Wazuh offers free community support as well as support services and professional hours for Cloud environments. |
| Threat intelligence | The IP Reputation offering includes 32 criteria of context, timelined activity, autonomous system and IP range reputation, MITRE techniques classification, and hourly updated data. | Wazuh documents integrations with VirusTotal, MISP, URLHaus, AlienVault and other intelligence sources. |
| What it does | CrowdSec Security Engine analyzes logs and HTTP requests with behavior-based scenarios, then uses remediation components to block malicious activity. | Wazuh is a free open-source platform for threat prevention, detection and response across on-premises, virtualized, containerized and cloud workloads. |
Plans
CrowdSec
- IP Reputation API$49 a month
- Platinum Blocklists$1,900 a month
- Live Exploit Tracker$2,000 a month
- CommunityFree
- Community Security EngineFree
- IP Reputation API access$49 a month
- Local CTI replication$9,000 a month
- CrowdSec Console PremiumPriced on request
Wazuh
- Wazuh open sourceFree
- Small$571 a month
- Medium$923 a month
- Large$1,467 a month
- CustomPriced on request
In their own words
CrowdSec
CrowdSec is an open-source security stack designed to detect and block malicious IP addresses to protect infrastructure and applications. Its Security Engine analyzes logs and requests for harmful behavior, while the Remediation Component blocks IPs identified by that engine across supported platforms. CrowdSec says analysis takes place locally and logs do not leave the user's infrastructure. Its AppSec Component can provide web application firewall protection. The free Community offering includes real-time decision management, audit support, AWS CloudTrail scenarios, CAPI allow lists, and Kubernetes audit acquisition. IP Reputation data includes contextual criteria, activity timelines, autonomous system and IP range reputation, MITRE technique classification, and hourly updates. Listed integrations include Microsoft Sentinel, AWS log sources, WordPress, Cloudflare, Docker, and Kubernetes. The Community Security Engine is free. The IP Reputation API is listed at $49 a month for 5,000 queries; other listed services include blocklists and threat-intelligence options. CrowdSec lists Linux, macOS, and Windows among its platforms, with API, extension, self-hosted, and web options.
Wazuh
Wazuh unifies XDR and SIEM to analyze security data across endpoints, clouds, and networks for threat detection, incident response, and compliance work. Its rules identify errors, misconfigurations, malicious activity, and policy violations in operating system and application logs. File Integrity Monitoring tracks changes to content, permissions, ownership, and other file attributes. Vulnerability detection compares endpoint software inventories with updated CVE databases. Built-in active responses can take countermeasures, including blocking network access from a threat source. Wazuh can monitor AWS, Microsoft Azure, Google Cloud, Microsoft 365, and GitHub services, virtual machines, and activity. Its integrations guide also covers Elastic Stack, OpenSearch, Splunk, and Amazon Security Lake. Default rulesets provide mappings for PCI DSS, HIPAA, NIST 800-53, TSC, and GDPR, but those mappings do not themselves certify compliance. Wazuh runs on API, Linux, macOS, self-hosted, web, and Windows platforms. Its self-hosted open-source plan is free; paid plans start at $571 a month, and a 14-day trial is listed. Agents support Linux, Windows, macOS, Solaris, AIX, and HP-UX and require an average of 35 MB of RAM.