OpenKAT: innovative open-source tool for security and compliance
OpenKAT (Open Vulnerability Analysis Tool) is a groundbreaking open-source solution for continuously monitoring digital security and compliance. Under the leadership of Brenno de Winter (Chief Security Officer at the Ministry of Health, Welfare and Sport) and Jan Klopper (OpenKAT project leader), this tool has been developed to give organizations insight and control over their entire digital attack surface. OpenKAT was born from the need to rapidly improve security during the COVID-19 crisis – a period in which many new systems (such as CoronaMelder and CoronaCheck) had to be brought up to the correct security level quickly and reliably (). The Minister of Health, Welfare and Sport called OpenKAT “an instrument to be proud of” ().
Thought leadership and vision of Brenno de Winter and Jan Klopper
The power of OpenKAT comes from the vision of its initiators. Brenno de Winter and Jan Klopper recognized that traditional approaches were inadequate in a complex and rapidly changing environment. This is how OpenKAT was born when the demand for security increased and the digital playing field grew faster than human ability to keep track of - combined with stricter compliance requirements and the need for an integrated overview (Z-CERT and VWS develop scan tool for software vulnerabilities - Z-CERT). De Winter emphasizes that the great thing about KAT is how security and vulnerabilities can be continuously monitored, allowing systems to quickly improve through continuous monitoring (and all this without a negative privacy impact) (VWS is working on ‘super tool’ for analyzing vulnerabilities - Computable.nl). Under their leadership, OpenKAT was designed in response to the question: “The question is not are we safe, but do we see vulnerabilities?”(). This line of thinking underlines their thought leadership in the project and lays the foundation for a proactive security approach.
Special and innovative product
OpenKAT is a unique product because it offers something that did not exist before: a holistic tool that covers all facets of cybersecurity and compliance (). Where many existing solutions only address part of the puzzle – for example only a vulnerability scanner, an asset inventory or a SIEM – OpenKAT combines all these insights into one complete picture. The project links self-developed features to proven open-source tools to form a “super tool” () (What is OpenKAT? | CERT-WM). This means that OpenKAT, for example, brings together results from Shodan, Binary Edge, specific pentest tools, CMS scanners and its own security tests in one overview (VWS is working on ‘super tool’ for analyzing vulnerabilities - Computable.nl). The result is broader insight: not only technical vulnerabilities are identified, but also misconfigurations and deviations that can lead to compliance risks (What is OpenKAT? | CERT-WM). In addition, OpenKAT records a timeline of security status, making it easy to track developments for better or worse (What is OpenKAT? | CERT-WM). An application that could make such a historical “snapshot comparison” across the full range of all stated requirements did not yet exist () – this is where the innovative power of OpenKAT lies.
The power of open source in security and compliance
OpenKAT was set up from the ground up as an open-source initiative, which is a conscious and powerful choice. The software has been developed in complete transparency according to open-source principles and meets the highest quality requirements in the areas of accessibility, privacy and security ([](https://www.tweedekamer.nl/downloads/document?id=2021D51356#:~:text=Kamer4%20is%20deze%20software%20samen, Ontwerpphase%20wordt%20daarbij%20nagedacht%20over)). Open source means that anyone can view, use and contribute the code, which leads to more trust and better quality. After all, “with more eyes we also see more”, according to the ministry, which hopes that OpenKAT will mobilize a broad community of companies, (semi-)governments and experts (). OpenKAT is not a commercial service but a freely available tool that can be used and expanded by anyone (). This open character makes the solution innovative by definition – everyone can reap the benefits (OpenKAT, seeing with cat’s eyes – Page 2 – De Winter Information Solutions). It also increases the self-reliance of organizations and the government, because people are less dependent on expensive external suppliers for security solutions (). The open-source community behind OpenKAT encourages rapid development, knowledge sharing and continuous improvement, which is crucial in keeping up with today’s threats.
Key functionalities and technical innovations
OpenKAT distinguishes itself by a number of important technical features that contribute to better security and compliance in an accessible way:
Evidence-based attack surface management: OpenKAT maps the entire digital landscape (attack surface) and continuously monitors it for vulnerabilities. All findings are recorded forensically accurately, including the moment of discovery (OpenKAT, seeing with cat’s eyes – Page 2 – De Winter Information Solutions). This creates a provable audit trail: organizations can demonstrate that security standards were met at a certain point in time, or how long a particular vulnerability has existed. This approach based on hard data (evidence) makes it easier to demonstrate compliance to auditors and regulators.
Comparison between two moments in time: Thanks to the built-in timeline, OpenKAT can compare the status of systems at different moments. For each scan, the tool stores a “copy of reality” (). Changes in the landscape are thus made visible and irrefutably recorded (). This makes trend analyzes and progress reports possible: you can see at a glance whether the security posture is improving or deteriorating. In addition, it can be tested afterwards whether systems in the past were vulnerable to a now known problem () – a feature that is unique and has, for example, helped with the continuous monitoring of the CoronaCheck system ().
Policy-driven alerts via business rules: OpenKAT goes beyond generating a flat list of notifications. Through flexible business rules and a knowledge base, the tool links technical results to context and policy. Vulnerabilities are weighed based on the interests and risks of the organization (VWS is working on ‘super tool’ for analyzing vulnerabilities - Computable.nl). For example: to avoid being woken up at night by a low-risk system, OpenKAT uses scenarios in which only critical findings in core systems are given high priority (OpenKAT, seeing with cat’s eyes – Page 2 – De Winter Information Solutions). Conversely, this smart context link ensures that a small technical failure that causes a major compliance risk is not overlooked (OpenKAT, seeing with cat’s eyes – Page 2 – De Winter Information Solutions). Organizations can add rules themselves to determine which situations deserve an alert and which can be automatically documented. This targeted alert mechanism reduces noise and ensures that the right people are warned in a timely manner about really important issues (OpenKAT, seeing with cat’s eyes – Page 2 – De Winter Information Solutions).
Keiko, our mascot
Because the name is the Vulnerability Analysis Tool, but can be abbreviated as CAT, it was only logical to have a cat as a mascot. That is Keiko, Brenno de Winter’s beautiful cat. As an ocikat, she is naturally inquisitive, friendly and social.
Conclusion: OpenKAT as a game-changer in security and compliance
OpenKAT is an example of how thought leadership, innovation and open-source collaboration can merge into a powerful product. At a time where cyber threats are continuously evolving and regulations are becoming increasingly strict, OpenKAT offers organizations the opportunity to proactively and demonstrably have their security and compliance in order. The integration of various tools into one clear whole and the use of demonstrable data and business logic makes this solution particularly effective and user-friendly. For a business audience, OpenKAT is not only a technical tour de force, but also a strategic advantage: it simplifies the work of security teams, increases confidence in your own IT environment and shows auditors and stakeholders that you are “in control”. Thanks to the pioneering role of Brenno de Winter and Jan Klopper and the broad open-source community, OpenKAT is an innovative product model for the power of open technology in security and compliance – now and in the future.
OpenKAT
Do you want to use OpenKAT for your organization and not have to do everything yourself? There are several partners who offer OpenKAT hosted and on premise.