Request a demo

File integrity monitoring tools, compared

Most file integrity monitoring tools are built for a security team: an agent on every server, a server to run it on, and a sales call before you see a price. Here are 15 tools side by side, what each one needs from you, and who each one suits. We make Alertica, one of them. Every other entry is checked on its maker's own site.

Updated Oct 25, 2026

See the table
Agent per server: Tripwire, Qualys, CimTrak, CrowdStrike, Datadog, Defender Agent plus your own server: Netwrix, Wazuh, OSSEC, ManageEngine Script on each server: AIDE, Sansec File on the site: Sucuri Hosted, agentless: Alertica, SiteLock
Where each tool runs
  • Agent per server Tripwire, Qualys, CimTrak, CrowdStrike, Datadog, Defender 6
  • Agent plus your own server Netwrix, Wazuh, OSSEC, ManageEngine 4
  • Script on each server AIDE, Sansec 2
  • File on the site Sucuri 1
  • Hosted, agentless Alertica, SiteLock 2

Hosted and agentless

Checks your servers and sites from outside. Nothing to install.

  • Alertica

    • Hosted, agentless
    • Free plan

    Alertica logs in to your servers and websites from outside, over SFTP, FTPS, FTP or SSH. Nothing is installed on the server, so an attacker who gets in can't switch it off. It alerts on files added, changed and deleted. Over SSH it fingerprints each file, so an edit that keeps the date and size gets its own alert: "Content changed, date unchanged". Ready-made checks cover WordPress, Magento and five other platforms. Scans run weekly on Free, daily on Pro and hourly on Enterprise. Alerts go by email, and by SMS on Pro.

    Price
    A free plan for one site that never expires. Pro is $20 per site a month. Enterprise, with on-premises installation, is quoted.
    Best for
    Websites and servers where you can't or won't install anything, shared hosting included. Agencies with many client sites. Small teams with no security staff.
    Watch out for
    It can't tell you who changed a file, it isn't real time, and it doesn't watch Windows file shares or the registry.
    See plans

Enterprise suites

An agent on each server, priced by quote.

  • Tripwire Enterprise Fortra

    • Agent per server

    The oldest name in file integrity monitoring. An agent on each host records who changed what, and when, in real time, with before-and-after views of each change. It also checks configurations against policies for PCI, NIST, CIS and other standards.

    Price
    Custom quote only. Tripwire publishes no price.
    Best for
    Large IT teams with an audit program and the staff to run it.
    Watch out for
    An agent to deploy and keep running on every server, and a sales process before you see a price.
    Alertica and Tripwire compared

  • Qualys FIM Qualys

    • Agent per server
    • Trial

    One app of the Qualys cloud platform. It runs on the Qualys Cloud Agent, the single agent that Qualys apps share, and watches network devices without an agent.

    Price
    No price on the site. Qualys prices by the apps and assets you pick, and quotes. At launch in 2017, yearly subscriptions started at $4,995. There is a free trial.
    Best for
    Companies that already use Qualys.
    Watch out for
    An agent on each machine, and a quote before you start.

  • Netwrix Change Tracker Netwrix, formerly NNT

    • Agent plus your own server

    Tracks changes on Windows, Linux and Unix servers, Oracle and SQL Server databases, and network devices, and checks systems against CIS and DISA STIG benchmarks. Netwrix's docs say an agent usually collects the data. Agentless checks are scripted, and run from the Change Tracker server or a proxy agent.

    Price
    Request pricing. Sold through a demo, with no price on the site.
    Best for
    Large mixed estates that have to meet hardening standards.
    Watch out for
    A sales process before you start. Agentless still means running its server.

  • CimTrak Cimcor

    • Agent per server
    • 14-day trial

    Agents on servers, endpoints and workstations, and agentless checks for network devices and hypervisors. It takes a hash of each critical file, registry key and configuration setting, and alerts when one changes. Cimcor lists NASA and the Air Force among its customers.

    Price
    Quote only, priced by the number of endpoints, billed yearly with a one-year minimum term. A 14-day free trial.
    Best for
    Government agencies and regulated enterprises.
    Watch out for
    An agent on most systems, and a yearly contract.

Part of a platform you may already run

A module you switch on, if you already pay for the platform.

  • Falcon FileVantage CrowdStrike

    • Agent per server
    • 15-day trial

    The file integrity module of the CrowdStrike Falcon platform. It runs on the same lightweight Falcon agent, and shows what changed, who did it and how, in real time. CrowdStrike's 2022 datasheet says it requires Falcon Insight.

    Price
    Not in any bundle with a public price. Falcon Go, Pro and Enterprise list at $59.99 to $184.99 per device a year, and FileVantage isn't in any of them. A 15-day free trial of CrowdStrike.
    Best for
    Teams already on Falcon.
    Watch out for
    You buy into the Falcon platform first.

  • Datadog Workload Protection Datadog

    • Agent per server
    • 14-day trial

    Datadog's runtime security product. It collects file change events through the Datadog Agent, on Linux and Windows hosts and containers.

    Price
    $15 per host a month, billed yearly. A 14-day free trial of the Datadog suite.
    Best for
    Teams already on Datadog.
    Watch out for
    Datadog doesn't recommend running it without its Infrastructure Monitoring, which is priced separately.

  • Defender for Cloud FIM Microsoft

    • Agent per server
    • Azure free credit

    File integrity monitoring for files and the registry, in Defender for Servers Plan 2. It uses the Microsoft Defender for Endpoint agent and agentless scanning, and keeps change logs in a Log Analytics workspace. For servers outside Azure, Microsoft recommends connecting them through Azure Arc.

    Price
    Part of Defender for Servers Plan 2, billed through Azure.
    Best for
    Teams whose servers already run in Azure.
    Watch out for
    The Azure setup: a workspace, the Defender agent, and Arc for servers outside Azure.

Free and open source file integrity monitoring tools

Free to use. You install, configure and run them yourself.

  • Wazuh Wazuh, Inc.

    • Agent plus your own server
    • Open source

    A free, open source security platform. An agent on each host reports to a Wazuh server, indexer and dashboard that you host. For 1 to 25 agents, Wazuh asks for 4 vCPU and 8 GiB of RAM. Its file integrity monitoring runs in real time or on a schedule, and can show who or what made a change.

    Price
    Free to run yourself. Wazuh Cloud, hosted by Wazuh and still with agents, starts at $571 a month for up to 100 agents, with a 14-day trial.
    Best for
    Technical teams who want a full SIEM and will run it.
    Watch out for
    A platform to host, update and look after.
    Alertica and Wazuh compared

  • OSSEC Atomicorp

    • Agent plus your own server
    • Open source

    A free, open source intrusion detection system. A manager receives data from agents and checks files by their MD5, SHA1 and SHA256 checksums. It can also check hosts with no agent, over SSH, once you register each host with a script and set up the check yourself.

    Price
    Free. Atomic OSSEC, the commercial version, starts at $5 per agent a month.
    Best for
    Admins who are at home with config files and SSH keys.
    Watch out for
    You install and run the manager yourself, on Linux or another Unix-like system.
    Alertica and OSSEC compared

  • AIDE and Samhain Open source projects

    • Script on each server
    • Open source

    AIDE builds a database of your files and compares the server against it. It runs on each server, you schedule it yourself, and it writes its report to the screen, a file or syslog. For many servers, its manual suggests copying each database to one machine and comparing them there. Samhain is a similar open source tool, with a client and server for central logging.

    Price
    Free.
    Best for
    A few Linux servers, and someone who reads the reports.
    Watch out for
    AIDE's own README warns that an attacker can replace its binary or tamper with its database. The manual says to keep the binary on read-only media and the config off the machine. Doing that on every server is work.

File integrity monitoring software for small IT teams

Priced for small teams, and installed on your side.

  • EventLog Analyzer and DataSecurity Plus ManageEngine

    • Agent plus your own server
    • 30-day trial

    EventLog Analyzer is a log tool you install on Windows or Linux, and it also comes as a cloud edition. Its file integrity monitoring uses an agent on Linux, and can watch checksum changes. DataSecurity Plus audits Windows file servers, and NetApp and Nutanix storage.

    Price
    EventLog Analyzer from $795 a year for 10 log sources. Its free edition, for 5 log sources, doesn't include file integrity monitoring. DataSecurity Plus from $745 a year for 2 Windows file servers. Both have 30-day trials.
    Best for
    Windows file shares, and small IT teams who can host software.
    Watch out for
    An agent on each Linux server, and software to host unless you take the cloud edition. Neither product mentions websites, FTP or SFTP.

For websites and online stores

Website security that also watches files.

  • Sucuri GoDaddy

    • File on the site
    • None for file checks

    Website security: a firewall, malware and hack removal, and a server-side scanner that tracks file changes. The scanner is a file that must sit in your site's root web directory, and the host needs PHP. It works on any platform.

    Price
    Platform plans from $229 a year per site.
    Best for
    Sites that want a firewall and cleanup in one plan.
    Watch out for
    A file on the server that an attacker who gets in can delete.
    Alertica and Sucuri compared

  • Sansec eComscan Sansec

    • Script on each server

    A malware scanner for Magento, Shopware, Sylius, PrestaShop, WooCommerce and OpenCart. It runs on your Linux server: you log in over SSH, install it and schedule it with cron. Sansec advises running it as root where you can.

    Price
    €115 a month, billed yearly, as listed. The Shield firewall and cleanup start on the €229 plan.
    Best for
    Magento stores that want malware detection and a firewall.
    Watch out for
    It needs SSH access and a scheduled job on your server, and the firewall protects Magento only.
    Alertica and Sansec compared

  • SiteLock Sectigo

    • Hosted, agentless
    • None for file scans

    Website security sold through many web hosts. Its file scan connects to your server over FTP or SFTP, so nothing is installed on the site. It scans daily, and malware it finds is removed automatically. It also scans the database and checks your CMS, plugins and themes for known issues.

    Price
    From $19.99 a month, billed monthly. The firewall starts on the $29.99 Pro plan.
    Best for
    Site owners who want malware found and removed for them.
    Watch out for
    File scans come with a paid plan only, not with its free WordPress plugin.

Not listed: SolarWinds Security Event Manager and PA File Sight, which watch Windows only; Trend Micro Deep Security, whose pages say too little about integrity monitoring to compare; and WordPress plugins such as Wordfence, which cover one platform from inside the site.

File integrity monitoring tools at a glance

One row per tool, in the order above. Prices are the starting price each maker publishes.

Tool How it runsWebsites on shared hostingPublic priceFree optionBest for
Alertica Hosted, agentless Yes Free plan, or $20 per site a month on Pro Free plan Servers and sites, no agents
Tripwire Enterprise Agent per server No Quote only Not published Large teams with audits
Qualys FIM Agent per server No Quote only Trial Existing Qualys customers
Netwrix Change Tracker Agent plus your own server Not published Quote only Not published Large mixed estates
CimTrak Agent per server No Quote only 14-day trial Government and regulated firms
Falcon FileVantage Agent per server No Quote only 15-day trial Teams already on Falcon
Datadog Workload Protection Agent per server No $15 per host a month 14-day trial Teams already on Datadog
Defender for Cloud FIM Agent per server No In Defender for Servers Plan 2 Azure free credit Servers in Azure
Wazuh Agent plus your own server Needs SSH Free, or Cloud from $571 a month Open source Teams who want a SIEM
OSSEC Agent plus your own server Needs SSH Free, or $5 per agent a month Open source Hands-on Linux admins
AIDE and Samhain Script on each server No Free Open source A few Linux servers
EventLog Analyzer and DataSecurity Plus Agent plus your own server No From $745 a year 30-day trial Windows file servers
Sucuri File on the site With a file in the web root From $229 a year per site None for file checks Firewall and cleanup together
Sansec eComscan Script on each server Needs SSH €115 a month, billed yearly Not published Magento malware detection
SiteLock Hosted, agentless Yes From $19.99 a month None for file scans Malware found and removed

Checked on each maker's own site, 25 October 2026. Sources.

How to choose a file integrity monitoring tool

Four questions narrow the list quickly.

  1. Where are the files?

    Windows file shares point to ManageEngine DataSecurity Plus. For Windows or Linux servers you control, most groups above have an option. For websites on hosting where you can't install anything, the short list is Alertica, SiteLock and Sucuri.

  2. Can you run an agent on every server?

    An agent has to be installed, updated and kept running on each machine. If nobody will do that, the hosted and agentless options are your short list.

  3. Who will read the alerts?

    Without a security team, pick a tool that sends a plain alert by email or SMS. A tool built to feed a SIEM assumes someone is watching the SIEM.

  4. Do you need it for PCI DSS?

    PCI DSS v4.0.1 requirement 11.5.2 asks for a change-detection mechanism that alerts on changes to critical files and compares them at least weekly. It doesn't name a tool. What differs between tools is the work it takes to run them. Requirement 11.6.1 watches the payment page's headers and content for tampering, which file monitoring on the server doesn't cover.

Other tools for other jobs

Alertica watches the files on your servers and websites from outside. A few jobs need a different tool, on its own or next to Alertica.

Knowing who changed a file
Tripwire or Wazuh, or the server's own audit logs.
Alerts the moment a file changes
A tool with an agent on each server, such as Tripwire, Wazuh or CrowdStrike.
Windows file shares and the registry
ManageEngine DataSecurity Plus for file shares. CimTrak or Defender for Cloud for the registry.
Malware cleanup and a firewall
Sucuri or SiteLock, or Sansec for Magento stores.
You already run CrowdStrike, Datadog or Azure
Switch on their file integrity module.

Questions about file integrity monitoring tools

What people ask before they pick one.

Not sure which fits? Tell us what you need to watch
  • What is a file integrity monitoring tool?

    A file integrity monitoring tool records what your important files look like and alerts you when one is added, changed or deleted. You hear about an unexpected change, like a new script in an upload folder or an edited config file, before it does damage. Tools differ in how they look: an agent on the server, a scanner you run, or a check from outside.

  • Is there a free file integrity monitoring tool?

    Yes. AIDE, Samhain, OSSEC and Wazuh are free and open source, and Alertica has a free plan for one site that never expires. The open source tools cost time instead of money: you install, configure and run them yourself, on each server or on a server of your own.

  • Does file integrity monitoring need an agent?

    Not always. Most enterprise tools need an agent on every server. Alertica checks from outside over SFTP, FTPS, FTP or SSH, so nothing is installed. Wazuh and OSSEC can also check a host over SSH without an agent, run from a server you host.

  • Which file integrity monitoring tools work on shared hosting?

    Tools that connect from outside, like Alertica or SiteLock over FTP or SFTP, or that place one scanner file in the web root, like Sucuri. Agents need a server you control, and shared hosting doesn't let you install one. Tools that run over SSH work only where your host gives you SSH access.

  • How much does file integrity monitoring software cost?

    From free to a yearly contract quoted by sales. The open source tools are free to run yourself. Published prices start at $229 a year per site for Sucuri, $795 a year for ManageEngine EventLog Analyzer and $15 per host a month for Datadog. Enterprise suites quote. Alertica has a free plan for one site that never expires, or $20 per site a month on Pro.

Sources

Every competitor entry was checked on the maker's own pages, linked here.

Product names are trademarks of their owners. Alertica isn't affiliated with any of them. Tell us if an entry is out of date.

More comparisons

Alertica's ready-made checks by platform

Try it on one site, free

Connect one server or website and see what the first scan finds. If you'd rather see it on a call first, we'll show you.

Request a demo Free plan