Endpoint Security — hobby stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Antivirus / NGAV Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsClamAV Free unlimited OSS self-hosted, 0$; Defender for Endpoint P1 $3/user/mo or included in M365 Business Premium $22/user/mo, 90-day trial, free tier none standalone; SentinelOne Complete $15/device/mo ($179.99/device/yr) min 100 endpoints billed annually; CrowdStrike Falcon Go $59.99/device/mo ($719.88/yr per device) min 5 devices, Pro $79.99/device/mo, Enterprise $99.99/device/mo, 15-day trial, overage storage $0.40/GB over 5GB/device, extra device pro-rata
Endpoint Detection & Response (EDR)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWazuh Free unlimited agents self-hosted, community support; Carbon Black Standard $36/device/mo annual ($432/yr) min 50, $50/device/mo month-to-month; SentinelOne EDR $60/device/mo annual, Complete $75/device/mo, DataSet 7-day free 16GB/day; CrowdStrike Insight $99/device/mo ($1,188/yr per device) billed annually, Insight XDR $99.99/device/mo, Premium adds $10/device/mo for 90-day retention, overage $99 per additional device
Device Full-Disk Encryption Management
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsBitLocker/FileVault Native Free with OS (Windows Pro/Enterprise, macOS included), no central compliance without MDM - free unlimited; Sophos Central $28/device/yr ($2.33/device/mo) included in Intercept X Advanced, standalone $22/yr; Symantec $50/device/yr ($4.17/mo) min 25 licenses, $38/yr at 500+, management server appliance $5,000 one-time optional, overage recovery portal free
MDM / Unified Endpoint Management (UEM)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFleetDM OSS Free unlimited self-hosted; Mosyle Free 30 devices forever, Business $1/device/mo ($12/yr), Fuse $1.80/device/mo ($21.60/yr); Intune $8/user/mo standalone or $4/device/mo device-only, included in M365 Business Premium $22/user/mo, free trial 30 days; Jamf Pro $4/device/mo ($48/yr) min 25, Jamf Now $2/device/mo, overage $0.12/device/day, onboarding free
Patch Management Automation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAutomox Free 25 devices forever, Work $3/device/mo ($36/yr) after, Full $5/device/mo, API 10k calls/mo free then $0.02/call; ManageEngine Cloud Free 25 devices, $1.20/device/mo ($14.40/yr) min 75 devices, on-prem perpetual $1,095 for 100 devices; Ivanti $42/device/yr ($3.50/mo) min 100, patch content subscription $8k/yr, overage third-party patch catalog $2k/yr
Vulnerability Scanning - Endpoint Agent
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsOpenVAS Free unlimited self-hosted community; Tenable.io $2,500/yr for 100 assets ($2.08/asset/mo), Nessus Professional $3,990/yr per scanner 1 year; Rapid7 InsightVM $1.84/asset/mo min 100 ($184/mo), overage agent $1.84/mo; Qualys VMDR $20,000/yr for 100 assets ($16.67/asset/mo) min 64 assets, overage $195/asset/yr, 30-day trial, storage 1TB included
Device Control / USB / Peripheral Control
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsNative Intune/Jamf policies Free with MDM + USBGuard Free OSS unlimited devices; ManageEngine Device Control Plus Free 25 devices, then $795/yr for 50 devices ($1.33/device/mo); CrowdStrike Device Control Add-on $20/device/mo ($240/yr) requires Falcon Go/Pro base; Digital Guardian $40/device/mo ($480/yr) min 100 devices, PoC free, overage DLP add $10/device/mo
Application Control / Whitelisting
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWDAC/AppLocker Free with Windows Enterprise/Education, unlimited policies; Airlock Digital Free 25 endpoints forever, then $2.50/endpoint/mo ($30/yr) min 50; Carbon Black App Control $44/device/yr ($3.67/mo) min 100, App Control + EDR $60/device/mo ($720/yr), overage audit $500 per compliance report
Endpoint Firewall Policy Management
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsNative firewall Free unlimited rules; ManageEngine Firewall Analyzer Free 5 devices, $595/yr for 10 devices ($4.96/device/mo) trial 30 days; Palo Alto Cortex XDR FirewallMgmt included in Cortex $44/endpoint/mo, standalone firewall add-on $5/device/mo ($60/yr), log overage $0.25/GB over 100GB; Intune firewall policies free with Intune license
Web Content Filtering / DNS Protection for Endpoints
Your human-readable address on the web plus the DNS records that point it at your servers. Skipping this is not an option — users need a domain to reach you.Pricing & free-tier limitsCloudflare Gateway Free 50 users forever 1M DNS queries/mo 24h logs, Teams $7/user/mo unlimited queries 30-day logs; OpenDNS Home Free 1 network; DNSFilter $0.90/device/mo ($10.80/yr) DNS filtering only, Roaming $1.80/device/mo min 25 ($270/yr); Zscaler ZIA Business $3.50/user/mo ($42/yr) min 100, Transformation $6.50/user/mo, overage $0.10/GB over 5GB/user, 10GB log retention included
Endpoint Asset Inventory & Discovery
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsSnipe-IT/FleetDM OSS Free unlimited assets self-hosted; Lansweeper Free 100 assets, Pro $1.20/asset/mo ($14.40/yr) min 500 assets $7,200/yr; PDQ Inventory Free 14-day trial, Enterprise $500/yr per admin unlimited devices; Tanium Asset $6/device/mo ($72/yr) min 1000 $72k/yr requires Tanium Core $10/device/mo, overage API 100k queries/mo included
How this hobby endpoint security checklist works.
Each requirement below is something a hobby endpoint security build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.