Anmol Vats | Wazuh

"What I love about Wazuh is that it treats security as a community problem, not a vendor product. The ruleset is open, the architecture is transparent, and when something's missing you can just build it. That philosophy is rare in security tooling. What pulled me deeper was realising how much of the real-world attack surface isn't covered yet. Caddy is one of the fastest-growing web servers right now and had zero detection coverage in Wazuh. That's not a niche gap. And the fact that I could sit down, write a decoder and 29 MITRE ATT&CK-mapped rules, validate them end-to-end in Docker, and ship a PR in a week is a direct result of how well-designed the Wazuh architecture is. Beyond detection engineering, I find the XDR angle genuinely interesting. Wazuh correlating endpoint telemetry, cloud logs, and network events into one place without a licensing wall is something even paid platforms struggle to do cleanly. I want to understand every layer of that stack, contribute to it, and eventually work on it full time."

Anmol Vats

United States

Student
/ NYU

I got my first computer at sixteen, in 2020, right as COVID-19 pushed my entire high school onto Zoom. It did not take long to notice something odd about the calls we all suddenly lived in, with a weak or reused meeting password, anyone could walk straight into someone else’s class. Figuring out why some Zoom links let strangers in and others did not was my actual introduction to cybersecurity, learned through password cracking long before I knew the term for any of it.

“Zoom-bombing” became a defining phenomenon of the pandemic, as millions of students and workers moved online almost overnight and exposed just how weak most default passwords and shared meeting links really were. For a lot of people my age, that period doubled as an unplanned crash course in digital literacy and security. For me, it was the moment the field stopped being abstract.

My security career started as a bad habit. I couldn’t look at a system without wanting to know how it broke. That habit turned into a career that balances offensive research with real-world defensive engineering, spanning threat intelligence, detection engineering, and GRC automation.

Now I’m an MS Cybersecurity student at NYU (4.0 GPA). As a Wazuh ambassador, I validated the v5.0 beta2 release, and modernized 19 integrations including AWS, GitHub, Slack, Cortex XDR, FortiGate, and CrowdStrike. I also built and open sourced a Caddy web server detection ruleset, now merged upstream into Wazuh.

Before this, I spent two years at Safe Security doing GRC automation and detection engineering, co-ran a multi-node Wazuh XDR/SIEM deployment on AWS, and hold 4 CVEs from responsible disclosure work. On the side, I’ve been building zuumb, an AI-native triage layer on top of Wazuh. I’d rather build the tool than write the theory about it.

What keeps me coming back to Wazuh is how much ground it covers without locking you in. Unified XDR and SIEM, agent-based and agentless monitoring, multi-tenancy, rulesets you can actually customize to fit weird edge cases like a niche web server. It’s rare to find an open source platform that scales from a single home-lab setup to enterprise-wide coverage without losing that flexibility. Always open to good conversations with teams working on similar problems.

United States

Programming languages

Operating systems

Technologies

Available for