Continuous Application Security Monitoring on a $0 Budget

Application security monitoring is sold like it's enterprise-only. The marketing implies you need a $50,000/year contract, a SOC team, and an integration project. None of that is true if you're starting small. Here's the actual stack a one-person SaaS or pre-launch startup can deploy this afternoon, for nothing.

For the broader context on what ASM does and why, see the ASM pillar page.

The components

Continuous application security monitoring needs four things:

1. Telemetry capture. Every request, with method, path, IP, headers, status code, and (optionally) body.
2. A storage layer. Somewhere queryable, with at least 14 days of retention.
3. Detection logic. Either rule-based, ML-based, or AI-assisted classification of suspicious patterns.
4. An alerting/investigation surface. A dashboard or chat-based interface to act on the signals.

Each can be done free at small scale. Here's the cheapest reasonable stack.

Telemetry capture: OpenTelemetry SDK (free)

OpenTelemetry's Node SDK auto-instruments every major web framework. Install once, preload at startup:

npm install @opentelemetry/sdk-node @opentelemetry/auto-instrumentations-node
node -r @opentelemetry/auto-instrumentations-node/register app.js

This captures HTTP server spans (with method, path, status, latency), HTTP client spans, database queries, and exceptions. No code changes required, no per-request overhead beyond the standard OTel ~1ms.

For more depth in the application security context — request bodies (with redaction), full headers, IP intelligence — wrap OTel in a security-focused SDK. The SecureNow npm package does this; install adds the firewall plus richer tracing in one package.

Storage layer: SecureNow or self-hosted ClickHouse

Two options, one free to try and one free to run:

Option A: SecureNow (14-day free trial). Managed storage with every feature, free for 14 days and then $99 per app per month, so it falls outside a strict $0 budget once the trial ends. Sign up, point your OTel exporter at the ingestion URL, you're done.

Option B: Self-hosted ClickHouse. Run ClickHouse on a $5/month VPS or as a single Docker container. ClickHouse's storage is extremely efficient — 1 TB of compressed traces fits in roughly 100 GB of disk. The catch is operational overhead; expect 1–2 hours/month of maintenance once it's running.

If you have engineering time, self-host: it's the option that stays at $0. If you don't, a managed tool saves the setup work but costs money after the trial.

Detection logic: rules + AI

Free options vary in quality. The minimum viable version is rule-based detection — alerts on patterns like:

• Authentication failure spike from a single IP / ASN
• Multiple 4xx responses to admin endpoints
• High request rate from a single source
• Requests to known-vulnerable paths (/wp-admin, /.env, /phpinfo)

These can be implemented as ClickHouse SQL queries running on a cron, or as alert rules in any modern observability tool. SecureNow's alert rules can cover the same patterns; they're included in the 14-day trial and the $99/app/month plan.

For AI-assisted detection — the "is this an actual attack or noise?" classification — you typically need a paid tier or your own LLM API budget. Free options exist but are limited. The realistic free version is "rule-based detection that flags patterns; you investigate manually with grep."

Alerting / investigation surface

Three options ranked by quality (the first two are free):

Email alerts. Configure your detection rules to send email on match. Works fine for low-volume alerts; falls apart when you're getting more than 5 per day.

Slack webhook. Free if you already have Slack. One channel, alerts post automatically. Most teams' default.

Chat-based investigation (paid). Tools like SecureNow's AI investigation let you ask questions in plain English ("show me requests to /admin from new IPs in the last hour"). SecureNow includes it with no per-run fees: free during the 14-day trial, then part of the $99/app/month plan.

The actual setup, end to end

Putting it together for a small SaaS. The quickest route is a managed tool (SecureNow is free for 14 days, then $99 per app per month):

# 1. Install
npm install securenow

# 2. Sign up (14-day free trial, no credit card)
npx securenow login

# 3. Run with security capture + firewall
node -r securenow/register app.js

# 4. Verify it's working
npx securenow doctor

That's it. Within minutes you have:

• Full HTTP capture (method, path, status, IP, headers)
• A firewall blocking known-bad IPs from a feed refreshed hourly
• A dashboard at app.securenow.ai
• Default alert rules for credential stuffing, scanner activity, and rate-limit violations
• AI investigations with no per-run fees

If you'd rather stay at $0 and DIY without vendor dependencies:

# Telemetry
npm install @opentelemetry/sdk-node @opentelemetry/auto-instrumentations-node
node -r @opentelemetry/auto-instrumentations-node/register app.js

# Storage (single-container ClickHouse)
docker run -d --name clickhouse -p 9000:9000 clickhouse/clickhouse-server

# Wire OTel collector → ClickHouse
# (config not shown; standard OpenTelemetry collector setup)

# Alerts via cron + Slack webhook
# (write SQL queries against the spans table; alert on results)

The DIY version takes 1–2 days to set up and ~2 hours/month to maintain. The vendor version takes 5 minutes to set up, ~0 hours/month to maintain, and $99 per app per month after the trial. Both produce equivalent security visibility.

What to monitor first (the 5 free alerts)

If you can only set up five things, set up these in order:

1. Authentication failure spike. 4xx responses to /login, /auth, /api/auth/* exceeding 50 in 5 minutes from any single source.
2. Admin endpoint probing. Any 401/403/404 on paths starting with /admin, /wp-admin, /phpmyadmin, /.env, /.git. These are bots.
3. Error rate spike. 5xx responses exceeding your normal rate by 5×. Often the first signal of a deploy regression or active attack.
4. High volume from single IP. Any single IP exceeding 1,000 requests/hour. Tune for your normal traffic.
5. Suspicious user agents. Requests with user agents containing sqlmap, nikto, acunetix, masscan, python-requests/2.x (default scraper UA).

These five rules catch 80% of the threats a small SaaS will face in its first year.

When to start paying

Move to a paid tool when:

• Maintaining your own ClickHouse and detection rules takes more time than a paid tool costs
• Investigation by grep has become a daily chore
• You want extended retention (90+ days) for compliance
• Your team is more than 1 person and you need access controls

Most teams cross this threshold around the time they hit Series A or 1,000 paying users. Until then, the free stack is genuinely sufficient.

Related

• Application security monitoring guide
• SecureNow Firewall
• Web application security monitoring with OpenTelemetry