Services.

Everything Bedim Security publishes is open source — free to use, free to read, free to change. This page is about the part that is not free: our time.

Use the products first

The three products are open source and free — not freemium, not trial-limited; the complete artifacts are on GitHub and the recordings on the Capabilities page are the real runs that produced them.

• stig-baselines — DISA STIG baseline checklists (CKL) generated from official DISA XCCDF sources, STIG Viewer ready.
• soc-openclaw — a full security operations center run with OpenClaw as the agentic analyst, on a hardened estate.
• agentic-ai — the agentic workforce system, built for smaller models.

Open source gives you something no vendor datasheet can: you can read every line before it touches your systems. So inspect it — for malicious code, for sloppiness, for anything you would not sign your name to. You should do that with everything you deploy; ours is simply where it is actually possible. The xz-utils backdoor (CVE-2024-3094) was caught in 2024 because an engineer noticed a half-second delay in a binary — and the source was open, so the anomaly was findable. Closed source offers a promise where that evidence would be.

Free means no license keys, no feature tiers, nothing calling home. Fork it, change it, break it, rebuild it. It is yours the moment you clone it.

The instructions are public

Tutorials and quick setups are published and verified — the same commands that were actually run, not a tidied-up version of them:

• stig-baselines how-to — the full guide to DISA STIG checklists: the STIG Viewer workflow, per-OS scans, OpenSCAP automation.
• soc-openclaw guide — step by step to a home SOC with an agentic analyst.
• Recorded runs — the live OpenSCAP-to-CKL conversion, checklist generation for 22 platforms, an automated Proxmox hardening run, and a live high-availability failover.

Each repository carries its own README and docs. Start there; the recordings show what the commands look like mid-run.

Set it up yourself — that is the better path

Your data stays on your hardware. Your control plane is yours. The skills stay with your team instead of leaving with a vendor, and an operation you built is an operation you can audit — which is the entire thesis of this site. We would rather you run it yourself than rent it from us.

Where we come in

Two honest reasons to pay for help: you hit something where a second pair of hands is worth having, or scheduling is the constraint — the hours for a STIG pipeline or a SOC build do not exist in your week. For either, Bedim Security offers support and contracting: setup assistance, baseline tuning, Wazuh and SOC operations, hardening pipelines, or the whole build delivered under contract.

For calibration, here is what open-source support and managed security cost in the wider market:

• Proxmox VE subscriptions — the platform is free and open source; the optional support subscription runs €370–€1,100 per CPU socket per year.
• Ubuntu Pro — $25 per workstation per year, $500 per server per year.
• Wazuh professional support — the platform is free; Cloud/Lumen adds a free small-fleet tier and charges per endpoint above it, with expert support quoted per engagement.
• SOC as a service — typically $8–$25 per endpoint per month in 2026.
• Managed SIEM and log monitoring — commonly $1,000–$10,000 per month.

Prices move; the links are the source. The pattern does not move: the code is free and the time is paid. That is exactly why the open source is here — take the whole stack, run it yourself, and use us only for the hours you would rather not spend.

Three named offers — priced against national standards

Bands anchor to published national benchmarks — the calibration list above, the government's own compliance-cost models, and the national vCISO pricing guides. A pilot prices the final line; the band is the honest ceiling until then.

• STIG-readiness fast-track — fixed-fee per estate (5-50 hosts), $8,000-$20,000. The estate passes a DISA STIG assessment with per-control evidence packs. Anchors: the government models a Level 1 self-assessment at ~$6,000 for a small entity and its Level 2 assessment at $31,234; observed assessor quotes run $35K-$125K+, paying for the audit only — implementation stays a separate budget line. The fast-track is the line that gets you through either (the government's own model, the compiled CMMC data).
• Fractional compliance retainer — monthly, $3,000-$6,000/mo entry tier: continuous compliance operations with the measured monthly report. Anchors: national vCISO pricing runs $3K-$20K per month (guide), with most real engagements at $4,500-$12,500 (benchmarks) — the entry band sits at the bottom of the national range because the run work is automated.
• MDR-lite — monthly per host (5-50 hosts), $8-$25/host/mo: agent enrollment, continuous detection, a daily patch/risk sweep per host, severity-routed alerting with human-in-the-loop dispositions, and the measured monthly report. Anchors: the calibration list above (SOC as a service at $8-$25 per endpoint per month) plus the published MDR norm of $10-$30 per endpoint per month. Guidance-only response: client hosts are never auto-remediated.