Catch attackers already inside

Intel

Threat Intelligence

A subscription threat intelligence service that delivers verified vulnerability data and analysis for production GenAI models.

Defend

Digital Risk & Executive Protection

Comprehensive digital protection package combining continuous monitoring with hands-on support to reduce exposure and respond to threats in real time.

Monitor

Threat Intelligence

Enables detection of breached data, stolen credentials, and doxing threats across the Deep and Dark Web to stop security threats before they escalate.

Detection

SIEM

Connect and optimize your detection stack across identity, endpoint, cloud, email, and SIEM with AI-driven tuning.

Federated SIEM

SIEM

Connect security sources including your existing SIEM and search across all of them with a unified schema.

Threat Hunt

Threat Intelligence

Hunt at the speed of the threat through proactive threat detection using plain language descriptions or threat intelligence feeds.

A10 Networks

Network Detection & Response (NDR)

A10 Networks delivers secure, high-performance networking solutions that protect and scale critical applications across core, cloud, and edge environments

Account Takeover Protection

Identity Threat Detection & Response (ITDR)

Detects and remediates compromised Microsoft 365 and Google Workspace accounts by analyzing behavioral patterns unique to each user, then automatically locks attackers out through session revocation and forced credential resets.

Identity Threat Protection

Identity Threat Detection & Response (ITDR)

Uses behavioral AI to detect identity-based attacks that evade traditional security tools, identifying hijacked sessions, abused OAuth grants, and privilege misuse that rules and risk scores miss.

Account Takeover Protection

Identity Threat Detection & Response (ITDR)

Learns normal sign-in, device, and behavioral patterns for each user to detect and mitigate email account takeovers, then locks out attackers through session revocation and credential resets.

Absolute Security

Endpoint Detection & Response (EDR)

Absolute Security’s endpoint product line centers on **Absolute Secure Endpoint**, which uses a firmware-embedded Persistence agent to keep a durable connection to managed devices even after reimaging or software tampering. Within EDR, it is better understood as an endpoint visibility, control, and recovery platform than a pure malware-detection engine. It is best for enterprises that need continuous endpoint reachability, remote containment, and fleet-wide remediation across laptops and other managed devices, especially in distributed workforces.

Resilience

Endpoint Detection & Response (EDR)

Empower your organization to withstand and recover from cyber security threats and attacks on endpoints and installed mission-critical applications through application self-healing and confident risk response.

Abstract

SIEM

Abstract, founded in 2023, has built a revolutionary platform to redefine security operations, launching the world's first AI-Gen Composable SIEM.

AbuseIPDB

Threat Intelligence

AbuseIPDB provides high-fidelity IP reputation data and a massive crowd-sourced database of reported malicious infrastructure. It offers a high-performance API and on-premises feeds used for real-time traffic analysis, automated enrichment in SOC workflows, and blocking of known bad actors. This platform complements SIEM and SOAR systems by providing the contextual intelligence needed to identify botnets, scanners, and brute-force actors before they breach the network.

Bulk IP Checker

Threat Intelligence

Check multiple IP addresses against the abuse database in batch operations

Bulk IP Reporter

Threat Intelligence

Report multiple abusive IP addresses to the community database for crowd-sourced threat intelligence

CIDR Block Checker

Threat Intelligence

Evaluate entire IP address ranges rather than individual addresses for malicious activity

IP Reputation Database & Lookup API

Threat Intelligence

Query a central database of abusive IP addresses for malicious activity to identify threats in real-time

AbuseHQ

Threat Intelligence

A comprehensive abuse management platform.

Guardian

Threat Intelligence

An all-inclusive suite of tools to enhance organizational security and compliance with abuse desk management, email blocklisting, and threat intelligence capabilities.

Acalvio Technologies

Deception Technology

Acalvio is the leader in autonomous cyber deception, defending against APTs, insider threats, and ransomware. Its AI-powered Preemptive Cybersecurity Platform, protected by 25 patents, delivers threat detection across IT, OT, and cloud environments and advances Identity Threat Detection and Response (ITDR) with Honeytoken-driven Zero Trust security.

360 Deception

Deception Technology

A three-vector deception framework that combines fake assets appearing legitimate, real assets appearing suspicious, and intentionally deceptive artifacts to detect, divert, and degrade attacker operations.

ShadowPlex

Deception Technology

An AI-powered deception platform that detects, diverts, and contains adversaries across IT, OT, cloud, and identity systems before they can cause damage.

Acttrident

SIEM

ActTrident™ is a United Kingdom cybersecurity company building a focused platform across human-centered security, AI security, quantum-oriented security planning, and governance-led product lines.

Adaptiva

Endpoint Detection & Response (EDR)

Adaptiva, the autonomous endpoint management company, delivers the fastest way to patch and manage endpoints at scale.

AhnLab

Endpoint Detection & Response (EDR)

AhnLab provides endpoint security products centered on Windows endpoint protection and centralized management. Its V3 Endpoint Security line uses anti-malware scanning, URL and DNS protection, device control, and cloud-assisted detection through Smart Defense. AhnLab Endpoint PLUS consolidates endpoint controls into a single management console, and the vendor also offers EDR and OT endpoint security adjacent to the core endpoint portfolio. It is best suited for enterprises that want endpoint prevention and response from a vendor with long-standing experience in anti-virus and endpoint control, especially in Windows-heavy environments.

Endpoint Detection & Response

Endpoint Detection & Response (EDR)

Identifies and responds to advanced threats on endpoint systems using behavioral analysis, AI-driven investigation, and proactive threat hunting.

Airlock Digital

Endpoint Detection & Response (EDR)

Airlock Digital was founded in Adelaide, Australia, by cybersecurity professionals determined to build the most effective and scalable application control technology in the world.

AirMDR

Endpoint Detection & Response (EDR)

We're passionate about delivering awesome detection and response to security teams of all sizes.

Endpoint MDR

Endpoint Detection & Response (EDR)

Investigates alerts from endpoint detection tools and correlates data across security solutions to detect and remediate endpoint threats.

Identity MDR

Identity Threat Detection & Response (ITDR)

Monitors credential-based threats by integrating with identity providers to detect account takeovers and unauthorized access attempts.

Network MDR

Network Detection & Response (NDR)

Integrates with network appliances including firewalls and IDS/IPS systems to detect and remediate network threats.

AlienVault USM (AT&T Cybersecurity)

SIEM

AT&T Cybersecurity AlienVault USM Anywhere is a cloud-hosted SIEM platform that unifies asset discovery, vulnerability assessment, intrusion detection, behavioral monitoring, and incident response for on-premises, cloud, and hybrid environments. It correlates security events from logs, network traffic, and cloud APIs like AWS CloudTrail and CloudWatch, retaining data for 90 days. Integrated with OTX threat intelligence and AlienLabs feeds, it targets SMBs and resource-constrained teams needing all-in-one threat detection without separate tools. OSSIM offers a limited open-source alternative for single-server on-premises use.

Alpha Level

Threat Intelligence

Alpha Level is a next-generation cybersecurity company transforming how Security Operations Centers (SOCs) detect and respond to threats. Alpha Level combines statistical modeling, anomaly detection, and agentic AI to filter out non-actionable alerts, surface rare and high-risk behaviors, and provide contextualized evidence for investigation. The result is a data-driven, behavior-based detection system that improves signal quality while reducing cost.

Autonomous Hunter

Extended Detection & Response (XDR)

Self-learning anomaly detection that applies behavioral analysis to raw telemetry across users, devices, network traffic, and cloud environments to surface attacks that rule-based systems miss.

alphaMountain.ai provides AI-driven domain and IP threat intelligence focuses on web reputation and content classification. Utilizing proprietary machine learning, it offers real-time detection of malicious sites, phishing domains, and risky infrastructure through high-speed APIs and feeds. It is typically integrated into web gateways, SIEMs, and firewalls to provide a dynamic layer of categorization and risk assessment for internet-bound traffic.

AI-powered threat intelligence providing domain/IP reputation scoring and URL classification with continuously trained machine learning for real-time threat updates.

Web-based threat intelligence search tool that delivers instant security analysis for domains, URLs, and IP addresses with malware, phishing, and risk detection.

Agentic AI

Extended Detection & Response (XDR)

An intelligence-native platform that unifies security data and threat intelligence with agentic AI to detect hidden threats, prioritize incidents, and enable faster response through AI-guided workflows.

Anomali ThreatStream

Threat Intelligence

Anomali ThreatStream is a threat intelligence platform that aggregates IOCs and IOAs from hundreds of global sources including Anomali Labs curated feeds, OSINT, premium feeds, and ISACs. It enriches telemetry via automated correlation, campaign analysis, and ML-based scoring for confidence and severity. The Next-Gen version integrates agentic AI for natural language queries via Anomali Copilot, MITRE ATT&CK mapping, and pushes high-confidence intelligence into SIEM, SOAR, EDR, and firewall workflows. Trusted by enterprises and governments for over a decade, it accelerates investigations 300x faster, ideal for CTI and SOC teams operationalizing intelligence at scale.

ThreatStream Next-Gen

Threat Intelligence

The industry's leading threat intelligence platform providing curated access to the world's largest repository of threat intelligence with operational enrichment and AI-ready APIs.

Unified Security Data Lake

SIEM

A security-focused data platform that ingests multi-source telemetry, enriches it with threat intelligence, and enables rapid investigation and automated response with enriched context.

Anvilogic

SIEM

Anvilogic is a threat detection and hunting platform that works alongside existing data platforms (Snowflake, Databricks, Splunk) rather than replacing them. It provides a library of pre-built detection rules, a detection-as-code workflow, and multi-platform hunt capabilities. Popular with teams who want to improve detection quality without migrating their data infrastructure, Anvilogic helps detection engineers measure and close MITRE ATT&CK coverage gaps while standardising rules across heterogeneous data lakes and SIEM stacks.

Federated Search

SIEM

Query across SIEMs, data lakes, and cloud storage from a single interface using natural language and structured search.

ANY.RUN

Threat Intelligence

ANY.RUN helps security teams detect malware and phishing earlier and respond with confidence. It combines real-time interactive analysis with threat intelligence from live attacks, delivering immediate visibility into behavior, indicators, and active campaigns. This helps SOCs and MSSPs assess risk faster, reduce uncertainty, and act without delays. ANY.RUN fits into SOC workflows across monitoring, triage, incident response, and threat hunting.

Arctic Hub

Threat Intelligence

National-scale cybersecurity platform that integrates ~100 threat data sources, performs automated asset discovery, and delivers targeted early warning notifications to at-risk organizations.

EWS Classic

Threat Intelligence

Continuously monitors external networks to identify vulnerable services, compromised machines, and data breaches, enabling organizations to fix problems before they cause harm.

EWS Flex

Threat Intelligence

Multi-tenant early warning service that delivers scoped security findings to individual units within distributed organizations while maintaining centralized oversight.

NCSC Feed

Threat Intelligence

Curated threat intelligence data feed that identifies vulnerabilities and exposures affecting large numbers of systems globally, formatted for automated analysis and distribution.

Argus by EzProtect

Endpoint Detection & Response (EDR)

Making Salesforce the safest place for enterprise data.

Argus

Extended Detection & Response (XDR)

Autonomous threat detection and incident response platform for Salesforce that assigns ownership to threats, enforces SLAs, and maintains immutable evidence trails throughout the incident lifecycle.

EzProtect Platform

Endpoint Detection & Response (EDR)

Salesforce-native security solution that scans files and links before they enter an organization, with signature detection, behavioral analysis, true file type inspection, and live URL threat intelligence.

Arista Networks (Awake Security)

Network Detection & Response (NDR)

Arista Networks is an industry leader in data-driven, client to cloud networking for large data center/AI, campus and routing environments. Arista's award-winning platforms deliver availability, agility, automation, analytics and security through an advanced network operating stack.

NDR (Network Detection and Response)

Network Detection & Response (NDR)

AI-Driven security solution for the new network that delivers comprehensive visibility, continuous diagnostics, and enforcement across hybrid enterprise networks with autonomous threat detection.

Extended Detection and Response

Extended Detection & Response (XDR)

A NextGen SIEM platform that ingests security data from multiple sources and uses AI-powered analysis to correlate signals across users and assets to identify genuine threats.

Threat Intelligence

Threat Intelligence

Aggregates threat data from government advisories, OSINT sources, and vendor research, automatically extracting indicators of compromise and enriching them with threat data.

Atera Networks

Endpoint Detection & Response (EDR)

Atera is an all-in-one IT management platform that helps IT teams and MSPs monitor, manage, and secure their environments from a single interface. It combines RMM, helpdesk, automation, and Robin by Atera, our patented AI agent, solves issues autonomously, streamlines workflows, and lets your people get back to work. With real-time insights and proactive alerts, Atera reduces manual tasks, boosts efficiency, and helps teams scale support effortlessly.

Watchtower

Threat Intelligence

An AI-powered threat intelligence analyzer that automatically transforms global threat data into customized adversary emulation scenarios tailored to specific environments.

Dynamic Defense

Network Detection & Response (NDR)

Detect threats in real-time, including malware, phishing, and ransomware before they hit your business.

Dynamic Defense with Palo Alto Networks

Extended Detection & Response (XDR)

AI-driven threat prevention and automated response and enforcement delivery as a fully cloud-based service integrating AT&T's carrier-grade threat intelligence with Palo Alto Networks' Prisma Access platform.

Attivo Networks (now part of SentinelOne)

Deception Technology

At SentinelOne, we exist for those who protect what matters most. We believe security should be intelligent, unified, and always on.

Aurigin

Identity Threat Detection & Response (ITDR)

Aurigin.ai enables proof of ownership and authenticity for all sensitive communication devices and digital content.

Identity Threat Protection

Identity Threat Detection & Response (ITDR)

Provides real-time detection and remediation of identity-related threats through continuous monitoring and behavioral analysis across federated and local identities.

Privilege Manager

Endpoint Detection & Response (EDR)

Mitigates malware and modern security threats by removing local administrative rights and enforcing least privilege on endpoints.

Axoflow

Security Data Pipeline

Ensure security-relevant data is available, accessible, and affordable to SecOps.

AxoLake

Security Data Pipeline

Petabyte-scale, tiered data lake built on open formats that enables organizations to store security data cost-effectively while maintaining fast access through federated search.

AxoRouter

Security Data Pipeline

Automated engine that collects, aggregates, pre-processes and routes all kinds of security data at carrier-grade scale without requiring manual configuration.

AxoSyslog Commercial Version

Security Data Pipeline

Commercially supported evolution of syslog-ng providing reliable, scalable log collection, processing, and routing for cloud-native environments with dedicated support.

Axoflow Platform

Security Data Pipeline

Autonomous Security Data Layer that automates the collection, curation, and storage of security data from any source without requiring manual pipeline management.

Axur

Digital Risk & Executive Protection

Axur focuses on External Threat Protection (ETP) and brand protection by monitoring the digital landscape for brand abuse, data leaks, and fraudulent activities. The platform automates the detection and takedown of phishing sites, unauthorized apps, and leaked credentials across the deep, dark, and open web. It complements internal security controls by mitigating risks that originate outside the traditional network perimeter.

Brand Protection

Digital Risk & Executive Protection

Safeguarding brand assets and intellectual property from unauthorized use.

Cyber Threat Intelligence

Threat Intelligence

Threat data and intelligence analysis for proactive security monitoring.

Data Leakage

Digital Risk & Executive Protection

Monitoring and detection of unauthorized data exposure.

Deep & Dark Web Monitoring

Threat Intelligence

Surveillance and monitoring of hidden internet areas for threats.

Executives & VIPs

Digital Risk & Executive Protection

Specialized protection and monitoring for high-profile individuals.

Takedown

Digital Risk & Executive Protection

Removal services for identified threats across surface, deep, and dark web.

Threat Hunting

Threat Intelligence

Active discovery and investigation of threats within systems.

Managed XDR

Extended Detection & Response (XDR)

Comprehensive cybersecurity-as-a-service combining extended detection and response technology with a 24/7 Security Operations Center.

Beacon Security

SIEM

At Beacon, we're building the unified, intelligent data layer that empowers defenders to see more, move faster, and act with confidence in an AI-driven world.

Agent Lake

Security Data Pipeline

A data layer designed specifically for AI agents, providing normalized telemetry and security context across 150+ sources

Dark Web Monitoring

Threat Intelligence

Continuously scans dark web marketplaces, forums, and breach repositories for an organization's exposed credentials, alerting the team when leaked or stolen credentials appear.

Digital Risk Protection

Digital Risk & Executive Protection

A managed security service that monitors threats across the open, deep, and dark web, providing credential monitoring, executive protection, and brand defense through 1,500+ intelligence sources.

Threat Hunting

Threat Intelligence

A hypothesis-based threat hunting service that reduces blind spots and counters evasive threats through an eight-step repeatable process of research, evaluation, analysis, notification, detection writing, testing, and malware reverse engineering.

Bindplane

Security Data Pipeline

We are committed to helping organizations gain visibility into their IT infrastructure providing an orchestration engine that is easy to use and flexible enough to meet diverse needs.

Pipeline Intelligence

Security Data Pipeline

The AI-Native Telemetry Pipeline That Builds Itself, reducing the time spent building and running telemetry pipelines by up to 80%.

Unified Telemetry Pipelines

Security Data Pipeline

A Unified Telemetry Pipeline Built on OpenTelemetry, the industry's first OTel-Native Telemetry Pipeline providing visibility and control at enterprise scale.

Bitdefender GravityZone

Endpoint Detection & Response (EDR)

At Bitdefender, cybersecurity isn't just what we do, it's who we are. For over two decades, we've been at the forefront of protecting individuals, businesses, and governments against sophisticated cyber threats and attacks. Our AI-driven technologies and world class security expertise make us a trusted partner in safeguarding what matters most.

GravityZone Business Security

Endpoint Detection & Response (EDR)

Ideal for small businesses looking for simple, yet efficient security with affordable endpoint protection.

GravityZone Business Security Enterprise

Endpoint Detection & Response (EDR)

The ultimate solution for unified prevention, protection, detection, and response designed to address the entire threat lifecycle.

GravityZone Extended Detection and Response (XDR)

Extended Detection & Response (XDR)

Achieve unparalleled detection and response speed and efficiency across endpoints, identities, network, SaaS applications, cloud workloads, mobile devices and beyond.

GravityZone Small Business Security

Endpoint Detection & Response (EDR)

Easy-to-manage, enterprise-grade protection for small businesses, scalable and affordable to grow with business needs.

Advanced Threat Protection

Threat Intelligence

Zero-day threat protection powered by integrations with leading vendors like CrowdStrike, Cylance, and Bitdefender, leveraging AI and behavior-based detections to identify known and unknown threats.

Adversary & Ransomware Intelligence

Threat Intelligence

Threat actor and extortion-related threat monitoring

Brand & Executive Intelligence

Digital Risk & Executive Protection

Protection against brand impersonation and executive targeting

Identity Intelligence & Credentials

Threat Intelligence

Monitoring of exposed credentials and identity compromises

Sectoral Intelligence

Threat Intelligence

Industry-specific threat and exposure data

BlackBerry CylancePROTECT

Endpoint Detection & Response (EDR)

BlackBerry® equips governments, critical industries and leading automakers with secure, reliable software that drives productivity, resilience, and mission-critical performance.

BlackCloak

Digital Risk & Executive Protection

BlackCloak is a digital executive protection vendor whose closest fit for the Privacy & Consent Management category is its online privacy and identity-defense capability for high-profile individuals, executives, and family offices. It focuses on reducing exposed personal data, suppressing data-broker records, and tightening privacy settings across online accounts and connected devices. BlackCloak is best suited for organizations that need to protect executive digital footprints as part of a broader risk-reduction program, rather than a traditional enterprise consent platform for website or app data flows. It also sells adjacent cybersecurity services, but those are outside this category scope.

Platform

Digital Risk & Executive Protection

Digital Executive Protection Platform that secures an executive's digital footprint while keeping their personal lives private, through end-to-end protection for digital executive exposure.

Agentic Threat Hunting

Threat Intelligence

Platform that agentifies threat hunting processes by running a continuous library of hypotheses across data sources to automatically surface confirmed leads as cases.

Bloom Security is an endpoint security vendor focused on the AI-era workstation, positioned around endpoint visibility, behavioral analysis, prevention, and response rather than traditional malware-only EDR. The company says its platform gives enterprises context across tools, agents, extensions, and software on employee devices, with risk-based policy enforcement and remediation. It appears aimed at large enterprises that need to manage modern endpoints running AI agents and browser extensions without blanket lockdowns. The company launched from stealth with a $20 million seed round and reports deployments at dozens of large US and European enterprises.

Endpoint security rebuilt for the AI era, giving teams visibility into every AI tool, agent, extension, and endpoint risk

Blumira

SIEM

Blumira is a cloud-native SIEM and XDR platform designed for mid-market organizations and MSPs. It combines log ingestion from 75+ integrations with pre-built threat detection rules maintained by an in-house SecOps team, automated response capabilities including host isolation, and 24/7 managed security operations support. The platform provides one year of searchable log retention, compliance reporting for frameworks including HIPAA, PCI DSS, CMMC 2.0, and NIST, targeting organizations seeking detection and response without dedicated security staff.

Cloud SIEM

SIEM

Pre-configured detections across your environment

Honeypots

Deception Technology

Deception technology to detect lateral movement

Bolster AI

Digital Risk & Executive Protection

Bolster AI is a brand and phishing protection vendor that focuses on detecting and removing phishing, impersonation, and scam activity across email and other external digital channels. In the narrow Security Awareness & Phishing Simulation category, it is better understood as an anti-phishing and reporting-response product than a traditional employee training platform: it ingests user-reported emails, analyzes suspicious messages, and automates triage and takedown workflows. It is best suited for enterprises that need to reduce phishing dwell time and offload manual abuse handling, especially teams operating customer-report or abuse-mailbox programs.

Booli

SIEM

Booli is an identity-centric SIEM vendor that focuses on log ingestion, event correlation, and investigation context built around user identity. Its platform is positioned for SOCs and MSSPs that want cloud-native log management with reduced alert noise, long-term retention options, and compliance-oriented reporting. Public materials emphasize stitching security events back to identities, custom correlation pipelines, and high-context alerts rather than broad XDR or endpoint telemetry coverage.

Booli SIEM

SIEM

A native security operations platform where detection, correlation, investigation, and reporting are built around identity state from the start.

BrandShield

Digital Risk & Executive Protection

BrandShield is a Digital Risk Protection (DRP) and External Threat Management platform that secures brands against online fraud, impersonation, and phishing. It uses AI to monitor the web, social media, and app stores for brand misuse, fraudulent domains, and counterfeit activity. The platform provides automated takedown capabilities to remove malicious content, protecting company reputation and customer trust.

Data Layer

Security Data Pipeline

Contextualizes, normalizes, and cleanses exposure data while preserving relationships between assets, vulnerabilities, controls, identities, and business context through the proprietary Cyber Risk Graph.

Carbon Black (Broadcom)

Endpoint Detection & Response (EDR)

Carbon Black (Broadcom) is an endpoint detection and response platform designed for SOC teams running incident response and threat hunting across hybrid, air-gapped, and offline environments. Acquired by Broadcom from VMware in 2023, it continuously records unfiltered endpoint telemetry from laptops, servers, and cloud workloads, then reconstructs attack kill chains for forensic analysis. Strengths include behavioral EDR, live query and remote response, application control for locked-down systems, and on-prem deployment options that suit regulated industries and customers with strict data residency requirements. Best fit for mature SOCs and existing Broadcom/Symantec customers consolidating endpoint security tooling.

Cellebrite

Threat Intelligence

Cellebrite is the global leader in partnering with public and private organizations to transform how data is managed in investigations to protect and save lives, accelerate justice and ensure data privacy.

Genesis

Threat Intelligence

AI-powered investigative platform that uncovers source-traced leads from 35+ file formats and 100+ languages in minutes.

Guardian

Threat Intelligence

Cloud-native digital evidence management software that centralizes evidence, preserves chain of custody, and enables secure evidence sharing with real-time case visibility.

Inseyets

Threat Intelligence

The Definitive Digital Forensics Software Suite that extracts, analyzes, and manages digital evidence from mobile devices and other sources.

Pathfinder

Threat Intelligence

AI-powered multi-device analytics platform that consolidates evidence from 30+ digital sources to uncover critical leads and accelerate investigation analysis.

Adversary Investigation

Threat Intelligence

Transforms first-party internet scanning data into real-time infrastructure maps for tracking attackers and pivoting from initial indicators to full campaign footprints.

Search

Threat Intelligence

Internet infrastructure lookup tool enabling security teams to quickly search for and analyze hosts, services, and infrastructure across the global Internet.

An intelligence warning and analysis service that delivers actionable insights on cyber, physical, and information threats in weekly briefings and reports.

SkyInsights

Threat Intelligence

On-chain intelligence and risk analytics platform designed to enhance security, compliance, and transparency across the blockchain ecosystem with real-time threat detection.

Skynet

Threat Intelligence

Web3 security, due diligence and insights platform that evaluates cryptocurrency projects with letter-grade security ratings and comprehensive risk assessment.

Reactor

Threat Intelligence

Investigate and trace funds across blockchains

Harmony Endpoint Protection

Endpoint Detection & Response (EDR)

360-degree endpoint protection with advanced capabilities against ransomware, malware, and phishing in a single client.

Threat Intelligence

Threat Intelligence

Maps internal and external threat intelligence to your environment to prioritize weaponized threats and drive preemptive action.

Chronicle Security Operations (Google Cloud)

SIEM

Google Security Operations (formerly Chronicle Security Operations) is a cloud-native SIEM and SOAR platform on Google Cloud, unifying threat detection, investigation, and response. It ingests petabytes of security telemetry via forwarders, ingestion APIs, and third-party connectors like Office 365 and Azure AD. Built on Chronicle SIEM, it normalizes data into the Unified Data Model (UDM) for sub-second searches, supports up to 3,500 single-event and 200 multi-event detection rules, and integrates Google Threat Intelligence from Mandiant and VirusTotal. Best for large enterprises needing scalable analysis of massive log volumes without on-premises hardware.

C

DNS Defense

Network Detection & Response (NDR)

A cloud-delivered security service that uses the Domain Name System (DNS) layer to prevent users and devices from connecting to malicious or unwanted internet destinations.

C

Malware Protection

Threat Intelligence

Blocks requests to malware, ransomware, phishing, and botnets before they reach your network or endpoints by enforcing protection at the DNS and IP layers.

C

Umbrella Investigate

Threat Intelligence

Gives the most complete view of the relationships and evolution of internet domains, IPs, and files, helping to pinpoint attackers' infrastructures and predict future threats.

Insight

Threat Intelligence

Threat intelligence from the Cloudmark Global Threat Network enabling security services

CloudSEK is a digital risk protection platform (DRPP) that utilizes AI to monitor the deep, dark, and open web for external threats. It provides automated detection of leaked credentials, brand impersonation, and exposed infrastructure to quantify digital risk. The platform complements internal SOC operations by providing an external-facing view of an organization's attack surface and supply chain vulnerabilities.

AI Command center & Cyber Risk Quantification platform for comprehensive threat detection and risk management

Comprehensive external digital risk protection platform using a Contextual AI engine combining cyber threat intelligence and attack surface monitoring to detect and prevent cyber threats

Intelligence

Threat Intelligence

Delivers real-time, verified phishing threat intelligence to security operations centers, enabling them to identify and respond to email-based threats that bypass standard security filters.

Cognyte

Threat Intelligence

We are a market leader in investigative analytics software that empowers a variety of government and other organizations with Actionable Intelligence for a Safer World™.

LUMINAR

Threat Intelligence

AI-powered external threat intelligence platform that consolidates external attack surface management, compromised credentials monitoring, vulnerability intelligence, threat actor profiling, dark web monitoring, and credit card fraud mitigation.

Network Intelligence

Network Detection & Response (NDR)

Security analytics platform designed to help organizations identify and prevent threats through intelligent data analysis of communication network sources.

ADR (Application Detection and Response)

Endpoint Detection & Response (EDR)

Detects and responds to attacks on applications and APIs in real-time by operating within the application runtime to provide behavioral threat detection and blocking.

Corelight

Network Detection & Response (NDR)

We put evidence at the heart of security.

Open NDR

Network Detection & Response (NDR)

Open-core Network Detection & Response platform combining AI-driven detection, network visibility, and autonomous incident investigation capabilities.

Cybersecurity Platform

Extended Detection & Response (XDR)

Unified workspace security platform that consolidates endpoint, email, cloud, network, identity, data protection, and security awareness training into one dashboard powered by a single AI agent, automatically remediating over 95% of threats.

Endpoint Detection & Response

Endpoint Detection & Response (EDR)

Enables IT teams to reboot, shut down, and isolate compromised devices and processes with allow/block list controls.

Endpoint Security

Endpoint Detection & Response (EDR)

Sets device posture, deploys next-generation antivirus, and allows or blocks processes across endpoints.

Corrata

Endpoint Detection & Response (EDR)

Corrata is changing that. Because mobile is now central to how organisations operate, it needs to be central to how they protect themselves.

Essentials

Endpoint Detection & Response (EDR)

Entry-level offering for fleets up to 250 devices with AI-powered endpoint detection and data loss prevention

Hunt

Threat Intelligence

Threat intelligence platform that continuously monitors threat feeds and the public web to surface relevant security threats and propose forward-looking detections.

CounterCraft

Deception Technology

CounterCraft provides the Cyber Deception Platform, a scalable distributed system that deploys digital twin replicas of organizational IT and OT environments to lure attackers into controlled decoys. It captures adversary tactics, techniques, and procedures via kernel-level implants and ActiveBehavior automation, which simulates user logins and activities to maintain authenticity. The platform delivers zero-false-positive alerts and real-time threat intelligence through stealthy ActiveLink exfiltration. Trusted by governments, nation-states, and Fortune 500 enterprises in finance and critical infrastructure, it detects targeted attacks within weeks of deployment, ideal for organizations needing proactive defense against sophisticated threats.

Cribl

Security Data Pipeline

Cribl is the AI Platform for Telemetry.

Criminal IP

Threat Intelligence

Criminal IP delivers Decision-Ready Intelligence powered by AI and OSINT, enabling precise threat analysis and deep investigations into IPs, domains, and URLs with reputation data, threat scoring, along with real-time detection of malicious indicators such as C2, IOCs, and other critical threats. Its API is designed to integrate seamlessly with workflows SIEM, SOAR, and XDR for enhanced visibility and automation.

Managed SIEM

SIEM

Maintains high-quality telemetry for MDR by monitoring data source health, curating detection content, and managing log ingestion across Sentinel, Splunk, Sumo Logic, and NGSIEM.

Trusted Behavior Registry

Endpoint Detection & Response (EDR)

An automated system that resolves approximately 99% of known good behaviors automatically through deterministic behavioral validation.

Federated Search

Security Data Pipeline

A querying capability that sends search requests to multiple security data sources in their native language and assembles answers into a single investigation without data normalization or centralization.

Counter Adversary Operations

Threat Intelligence

An AI-powered unified threat intelligence and managed hunting platform that disrupts adversaries across endpoints, identity, cloud, and AI applications.

CrowdStrike Falcon

Endpoint Detection & Response (EDR)

CrowdStrike secures the most critical areas of risk – endpoints and cloud workloads, identity, and data – to keep customers ahead of today's adversaries and stop breaches.

Falcon Endpoint Security

Endpoint Detection & Response (EDR)

AI-native endpoint protection and detection & response platform that stops ransomware, supply chain attacks, and AI-driven threats before they become breaches.

Falcon Guardian

Endpoint Detection & Response (EDR)

AI Detection and Response solution that discovers, governs, and secures AI agents with runtime visibility and control by connecting AI activity with endpoint telemetry.

Falcon Next-Gen Identity Security

Identity Threat Detection & Response (ITDR)

Continuously discovers identity risk, validates access, enforces least privilege, and stops identity-based attacks across human, non-human, and AI identities.

Falcon Next-Gen SIEM

SIEM

The AI-native next-gen SIEM for the agentic SOC, unifying cross-domain security data, AI-powered detection, and automated response to stop breaches.

Falcon Platform

Extended Detection & Response (XDR)

One unified platform to secure the agentic enterprise, merging security data, AI intelligence, automation, and elite expertise to stop breaches.

Falcon Prevent

Endpoint Detection & Response (EDR)

Next-generation antivirus and endpoint protection that stops malware, ransomware, and sophisticated attacks with behavioral analysis and threat prevention.

Falcon Threat Intelligence

Threat Intelligence

Expert cybersecurity threat intelligence team conducts continuous threat hunting within the platform to identify and investigate advanced threats.

Access Intelligence

Identity Threat Detection & Response (ITDR)

Provides runtime control over API access for AI agents, services, and machines through scoped, temporary access tokens and continuous authorization evaluation.

Managed EDR

Endpoint Detection & Response (EDR)

Managed Endpoint Detection and Response providing full endpoint visibility, detection, and response backed by a 24/7 AI-assisted SOC.

Managed ITDR

Identity Threat Detection & Response (ITDR)

Enterprise-grade ITDR solution delivering identity protection for attacks like credential theft, session hijacking and rogue OAuth apps, backed by a 24/7 AI-assisted SOC.

Managed SIEM

SIEM

Delivers managed threat response and robust compliance support at a predictable price with security log monitoring.

Cybereason

Endpoint Detection & Response (EDR)

Cybereason provides Endpoint Detection and Response (EDR) that correlates endpoint telemetry across machines into MalOp™ narratives, revealing full attack chains from initial compromise to lateral movement. It uses behavioral analysis, machine learning on threat feeds ranked by historical accuracy, and cross-machine correlation for real-time detection of sophisticated threats. The platform supports instant remediation like process termination, file quarantine, persistence removal, and machine isolation. Best for enterprises needing high analyst efficiency (1:200,000 endpoint ratio) and advanced threat hunting without alert fatigue, as validated by top Forrester Wave and MITRE ATT&CK scores.

Defense Platform

Extended Detection & Response (XDR)

Comprehensive security platform that enables organizations to detect earlier and remediate faster with one lightweight agent across the entire environment.

EDR

Endpoint Detection & Response (EDR)

Endpoint detection and response solution that enables security teams to stop chasing alerts and end malicious operations before they take hold.

NGAV

Endpoint Detection & Response (EDR)

Multi-layered next-generation antivirus that combines 9 independent prevention layers to detect threats earlier and stop ransomware before execution.

Threat Hunting

Threat Intelligence

Proactive threat hunting capability that empowers defenders to hunt out adversaries and uncover even the most complex attacks.

XDR

Extended Detection & Response (XDR)

Cybereason XDR is an open XDR platform that integrates telemetry from endpoints, cloud workloads, identities, networks, workspaces, and OT into MalOps, correlated visual narratives of malicious operations. Powered by Google Chronicle for petabyte-scale storage and the Cybereason MalOp Engine, it processes over 23 trillion events weekly, correlating IOCs and IOBs for predictive ransomware protection and attack prediction. Vendor-agnostic with over 65 integrations via Cybereason Connect, it suits enterprises seeking unified visibility and response across hybrid environments without stack replacement.

Agentic MXDR

Extended Detection & Response (XDR)

Co-managed security operations service unifying AI agents, expert analysts, and outcome intelligence into one platform that automates threat detection, investigation, and response at AI speed.

Cybersixgill

Threat Intelligence

Cybersixgill is a deep and dark web threat intelligence provider acquired by Bitsight, delivering automated collection and analysis across cybercriminal underground forums, markets, and messaging platforms. The platform serves Fortune 500 companies, financial institutions, governments, and law enforcement with real-time IOC feeds, threat actor profiling, and vulnerability exploit scoring. Cybersixgill indexes historical data from the 1990s and monitors 95+ million threat actor profiles to enable proactive threat detection and remediation.

Cyble

Threat Intelligence

Cyble is an AI-native threat intelligence provider that delivers deep visibility into dark web activities, brand exposure, and digital risks. The platform automates the collection and analysis of leak sites, underground forums, and cybercrime chatter to provide actionable intelligence. It complements existing SOC workflows by providing external context that helps prioritize internal alerts and block emerging threats proactively.

HawkINT

Threat Intelligence

AI-powered threat intelligence platform designed to deliver proactive threat detection and intelligence capabilities integrated with SIEM, XDR, NDR, and cloud detection systems.

ITDR

Identity Threat Detection & Response (ITDR)

Identity Threat Detection and Response solution that monitors identity systems like Active Directory and Microsoft Entra ID to detect credential misuse and automate incident response.

SIEM NDR

Network Detection & Response (NDR)

Network Detection and Response platform that uses behavioral analytics, machine learning, and deep packet inspection to detect lateral movement, command-and-control activity, and data exfiltration.

SIEM XDR

Extended Detection & Response (XDR)

Enterprise-grade Extended Detection and Response platform designed to consolidate threat detection and incident response into a single unified view.

Exploit Intelligence

Threat Intelligence

Maps real-world attacker activity and in-the-wild threats to external exposures, enabling security teams to prioritize remediation based on actual threat behavior rather than theoretical severity scores.

CyDeploy

SIEM

Continuous Change Assurance for Critical Enterprises.

CYJAX

Threat Intelligence

Real-time threat intelligence, curated analysis, and actionable insights. All in one unified platform.

Cyber Threat Intelligence

Threat Intelligence

Actionable insights to stay ahead of threats through analyst-curated, validated, and prioritized intelligence.

Investigative Intelligence

Threat Intelligence

Deep-dive investigations combining advanced analytics with expert intelligence to uncover hidden connections, attribute attacks, and provide evidence-based insights for law enforcement.

Physical Security Intelligence

Digital Risk & Executive Protection

Intelligence-driven physical security that combines digital and physical signals to detect, prioritize, and respond to physical threats before they escalate.

Endpoint Security

Endpoint Detection & Response (EDR)

Unified endpoint security that stops attacks without compromising performance or complexity.

Honeypot

Deception Technology

Lure attackers into revealing themselves by deploying lightweight decoys to detect lateral movement and gather threat intel.

Next-Gen SIEM

SIEM

A modern SIEM built for speed and scale that ingests, searches, and visualizes billions of log events without the maintenance headache.

XDR

Extended Detection & Response (XDR)

An AI-native unified security platform that correlates telemetry from endpoints, cloud, email, and network to detect and respond to complex, multi-vector attacks in minutes.

CRI

Threat Intelligence

A predictive cybersecurity tool that identifies vulnerabilities by collecting and analyzing public data from the web, dark web, and deep web without invasive testing.

Cymulate

Deception Technology

Cymulate provides a SaaS-based Breach and Attack Simulation (BAS) platform that automates cyberattack simulations across the full APT kill-chain, validating security controls in email, browser, network, endpoint, and cloud vectors. It integrates exposure data with AI-driven analysis for continuous threat exposure management (CTEM), prioritizing exploitable risks and automating mitigations. Market leader in automated security validation per Frost & Sullivan, trusted by financial services and global enterprises. Best for SecOps teams in mid-to-large organizations needing 24/7 validation of SIEM/EDR detections and red teaming without manual effort.

Detection Studio

SIEM

Automates SIEM rule validation by mapping detection rules to real-world attack techniques, executing simulations to test whether rules trigger as expected.

Endpoint Security

Endpoint Detection & Response (EDR)

Stop Every Threat. Protect Every Endpoint with unified, AI-powered endpoint protection, detection, and response capabilities.

Identity Security

Identity Threat Detection & Response (ITDR)

Secure every user. Protect every identity with real-time identity threat detection and response.

Network Security

Network Detection & Response (NDR)

Stop Network Threats. Block Malicious Domains with AI-powered detection and response across entire networks.

Cyware

Threat Intelligence

Cyware enables security teams at leading global organizations to operationalize threat intelligence data and execute real-time actions by integrating intelligence management, automating workflows, and promoting secure collaboration for a stronger, unified defense.

Collaborate

Threat Intelligence

A secure, bi-directional threat intelligence sharing and collaboration platform that enables organizations to exchange, contextualize, and act on cyber threats together.

Intel Exchange

Threat Intelligence

An AI-powered Threat Intelligence Platform that automatically ingests, enriches, correlates, and operationalizes threat data to enable security teams to respond faster.

Intelligence Suite

Threat Intelligence

A unified cyber threat intelligence platform that combines threat feeds, intelligence management, malware sandboxing, digital risk protection, and AI-powered automation into a single solution for rapid CTI program deployment.

Darktrace

Network Detection & Response (NDR)

Darktrace is a network detection and response vendor centered on self-learning behavioral analytics for north-south and east-west traffic. Its NDR product baselines normal activity for users, devices, and segments, then flags anomalous connections, command-and-control behavior, data transfer outliers, and other suspicious network patterns in on-premises, cloud, and hybrid environments. The platform is aimed at teams that need visibility beyond endpoint telemetry and want automated investigation and containment for network-level threats, including encrypted traffic and novel attack paths. Darktrace also sells adjacent security products, but this profile is limited to NDR capabilities.

ENDPOINT

Endpoint Detection & Response (EDR)

Full visibility from packet to process through Self-Learning AI to detect and autonomously respond to threats on endpoints

IDENTITY

Identity Threat Detection & Response (ITDR)

Unify your identity security with proactive risk management, real-time threat detection, and autonomous response

NETWORK

Network Detection & Response (NDR)

Combat known and novel network security threats using Self-Learning AI that learns normal behavior for your organization

Databahn

Security Data Pipeline

Databahn offers an intelligent data pipeline platform designed to optimize security data operations (SecDataOps) for SIEM and XDR environments. It enables organizations to ingest, filter, and normalize massive volumes of telemetry before it reaches expensive analytics platforms, significantly reducing licensing costs. By delivering high-quality, governed data, it improves the performance of detection engines and AI-driven security automation.

Databricks

SIEM

Databricks is not a legacy SIEM vendor; it positions its security offering as an open security lakehouse for ingesting, normalizing, querying, and retaining security telemetry at large scale. In the SIEM scope, it emphasizes open formats such as Delta Lake and Apache Iceberg, schema normalization with OCSF, and long-term retention in cloud object storage. It is best suited for buyers that want to centralize high-volume logs, reduce proprietary indexing costs, and keep data queryable for investigations and compliance workloads. Databricks also offers adjacent data-platform products, but the SIEM-relevant value is primarily log-centric analytics and retention.

Lakewatch

SIEM

The agentic SIEM built for machine speed defense, consolidating security telemetry and IT logs into a unified lakehouse platform with AI-driven threat hunting and detection-as-code.

Datadog Cloud SIEM

SIEM

Datadog is the leading observability and security platform for the AI era, providing businesses with unified visibility across the technology stack to manage complexity at scale. It brings applications, infrastructure, data, models, and security into one place, using AI to detect and resolve issues before they impact customers. Trusted globally by Fortune 500 companies and high-growth AI leaders, Datadog enables businesses to move faster with clarity and confidence.

Dataminr

Threat Intelligence

DarkInvader is a modern cyber security company specialising in External Attack Surface Management (EASM). For over three years, we've been developing a cutting-edge SaaS solution that empowers organisations to discover and monitor their assets, identify infrastructure and Web application vulnerabilities, and monitor surface Web and Dark Web OSINT.

Dark Web Monitoring

Threat Intelligence

Uses proprietary crawler alongside trusted sources to detect compromised data, identify fraudulent activities, and reduce breach risks.

OSINT Monitoring

Threat Intelligence

Uses automated modules to gather intelligence on companies and domains, collecting publicly available information that could expose security risks.

Delivers real-time visibility into database user interactions and activities across cloud and on-premises environments.

Dark Web Monitoring and Response

Threat Intelligence

Delivers actionable visibility into cybercriminal activity across the open, deep, and dark web.

DeleteMe

Digital Risk & Executive Protection

DeleteMe offers a specialized privacy-as-a-service platform that automates the removal of employee PII from data broker sites and public search engines. This reduces the searchable attack surface used by threat actors for social engineering, executive impersonation, and physical security threats. It provides CISOs with a proactive tool to mitigate human-centric risks by reducing the availability of personal metadata online.

Identity Threat Protection

Identity Threat Detection & Response (ITDR)

Proactively detect and address identity-related threats by delivering high-quality insights into the most vulnerable identities to reduce the impact of compromise.

Alfred AI

Threat Intelligence

An LLM agent that autonomously discovers and builds tests for CVEs that are relevant to customers by scanning for emerging threats and engineering payload-based exploits.

Devo

SIEM

Devo's integrated platform includes data-powered SIEM, SOAR, and UEBA. AI and intelligent automation help your SOC make the right decisions in real time.

Behavior Analytics

Identity Threat Detection & Response (ITDR)

Helps uncover anomalous user and entity behavior throughout your organization, delivering next-level risk context across the entire MITRE ATT&CK framework.

Data Analytics Cloud

Security Data Pipeline

Data-agnostic, real-time analytics platform that conquerss data complexity, instantly detects threats, and enables custom security solutions without index-based limitations.

Security Data Platform

SIEM

Purpose-built to unleash the power of your SOC with integrated SIEM, SOAR, and UEBA capabilities including AI-powered threat detection, automated case management, and autonomous investigations.

DNS

Network Detection & Response (NDR)

Fast, resilient DNS to optimize security and availability.

Digital.ai

Endpoint Detection & Response (EDR)

Digital.ai is an industry-leading technology company dedicated to helping Global 5000 enterprises achieve digital transformation goals.

Digital Shadows SearchLight

Threat Intelligence

Digital Shadows SearchLight is a digital risk protection service that monitors over 100 million data sources across the open, deep, and dark web in 27 languages for cyber threats, data exposure, brand abuse, infrastructure vulnerabilities, physical threats, VIP exposure, and third-party risks. It combines scalable data analytics with human intelligence analysts to triage alerts, prioritize risks, and provide remediation options including managed takedowns. Tailored for enterprises, it integrates with Microsoft Sentinel for alert synchronization and triage, Splunk for data ingestion, and ThreatConnect for threat actor correlation, offering comprehensive external attack surface visibility.

D

DNIF

SIEM

Securing your digital world with trusted expertise and ease.

D

HYPERCLOUD

SIEM

Cloud-native Security Information and Event Management (SIEM) solution that offers real-time threat detection and automated alert prioritization, empowering security teams to quickly identify and respond to risks.

D

Doppel

Digital Risk & Executive Protection

The Doppel Platform elevates your social engineering defense from reactive to strategic, combining AI precision, human expertise, and real-time intel to protect what matters most.

D

EmberAI

Threat Intelligence

An AI-powered security platform that brings operational technology expertise and threat intelligence into analyst workflows to accelerate threat detection and incident response.

D

WorldView

Threat Intelligence

Delivers OT-specific threat intelligence that helps organizations anticipate adversaries and prioritize risks through early warning systems and adversary tactics mapped to MITRE ATT&CK for ICS.

Insider Risk Management

Extended Detection & Response (XDR)

Behavioral intelligence platform designed to identify and prevent insider threats by monitoring user activity across endpoints and networks to detect malicious, negligent, or compromised behavior patterns.

User Activity Monitoring

Extended Detection & Response (XDR)

Behavioral intelligence platform designed to monitor user activity proportionate to risk levels and identify early risk indicators to detect insider threats.

User & Entity Behavior Analytics

Extended Detection & Response (XDR)

Behavioral intelligence platform that baselines behavior and compares patterns to identify activities that can lead to a security incident, differentiating between malicious, careless, and compromised behavior.

DYNANIC

Network Detection & Response (NDR)

DYNANIC is not identifiable from the provided sources as a distinct NDR vendor or product, so there is no reliable evidence to describe a specific Network Detection & Response offering. Based on the NDR category definition, an evaluator would expect east-west and north-south traffic analysis, packet or flow inspection, behavioral anomaly detection, and encrypted traffic analysis, but none of those capabilities are explicitly attributable to DYNANIC in the available results. Market position, target customer, pricing, and company stage could not be verified from the evidence provided.

SmartNIC

Network Detection & Response (NDR)

Universal FPGA packet processing solution that transforms any FPGA-based networking card into a high-performance SmartNIC without requiring specialized FPGA coding knowledge

EclecticIQ Platform

Threat Intelligence

EclecticIQ is a global provider of threat intelligence technology and services. Guided by our values, being curious, bold, accountable, and collaborative, we help security teams make smarter, faster decisions with dynamic solutions that reduce complexity and streamline threat detection and response.

Intelligence Center

Threat Intelligence

AI-embedded platform designed to manage the complete threat intelligence lifecycle, enabling organizations to collect, process, analyze, and disseminate threat data from multiple sources in a unified system.

Threat Intelligence Feeds

Threat Intelligence

Curated intelligence service offering both open-source and commercial threat data feeds designed to supplement existing security operations with actionable threat indicators and contextual intelligence.

Threat Scout

Threat Intelligence

Browser extension that instantly transforms web content into actionable STIX 2.1-compliant threat intelligence by automatically extracting threat indicators and entities from online sources.

Defend

Extended Detection & Response (XDR)

World-class endpoint protection and threat response integrated without per-endpoint costs. Included XDR solution without added fees.

Elastic Endpoint Security

Endpoint Detection & Response (EDR)

Elastic Endpoint Security is the endpoint protection component of the Elastic Security platform, combining EDR with SIEM capabilities in a unified open platform. Built on the Elastic Stack, it offers full endpoint visibility, malware prevention, and behavioural detection alongside log analytics in a single data model. It is particularly popular with engineering-led security teams who want flexibility, open data access, and the option to self-host or run in Elastic Cloud without per-endpoint pricing surprises.

Elastic Security

SIEM

Elastic Security provides an open-source SIEM platform built on the Elastic Stack (Elasticsearch, Logstash, Kibana, Beats) for collecting, indexing, and analyzing security logs from endpoints, networks, clouds (AWS, Azure, Google Cloud), and firewalls. It supports ECS-compliant index mappings, threat detection via KQL queries for brute force and lateral movement, correlation rules for multi-stage attacks, IOC matching with enrich policies, and Watcher-based alerting. Best for SOC teams needing scalable search analytics, real-time monitoring, and integration with EDR, XDR, SOAR in resource-constrained environments.

Endace

Network Detection & Response (NDR)

Endace specializes in high-speed, always-on packet capture and network recording solutions that provide the 'ground truth' for forensic investigations. Their EndaceProbe technology allows security teams to travel back in time to analyze high-fidelity network traffic associated with a specific alert, integrating seamlessly with SIEM and NDR tools. This solution is critical for definitive root-cause analysis and meeting regulatory requirements for data retention.

Enea

Network Detection & Response (NDR)

Enea (via its Qosmos division) provides the underlying Deep Packet Inspection (DPI) technology and Threat Detection SDKs used by many of the world's leading cybersecurity vendors. The platform offers Granular Traffic Analysis and Protocol Classification capabilities, which are essential for identifying anomalous behavior in encrypted and complex network environments. It is a foundational component for OEMs and service providers building modern NDR, XDR, and Firewall solutions.

Ent

Endpoint Detection & Response (EDR)

Ent is an intent-aware endpoint security vendor focused on detecting and stopping risky user and AI-agent actions on endpoints before they complete. In the EDR scope, its value is less about traditional malware hunting and more about high-fidelity endpoint telemetry, behavioral analysis, and real-time intervention against insider risk, AI misuse, and data exfiltration. It is best suited for enterprise security teams that need endpoint-level control over human and autonomous workflow activity, especially in environments adopting generative AI and handling sensitive data. The company also describes adjacent workspace-security capabilities, but its endpoint agent is the core EDR entry point.

Identity Exposure

Identity Threat Detection & Response (ITDR)

Provides visibility into identity hygiene and unifies Active Directory and Entra ID security by identifying and neutralizing attack paths before exploitation occurs.

Endpoint Antivirus for Linux

Endpoint Detection & Response (EDR)

Linux-compatible antivirus protection for server and endpoint environments

Endpoint Antivirus for macOS

Endpoint Detection & Response (EDR)

Antivirus-focused solution for macOS systems

Endpoint Antivirus for Windows

Endpoint Detection & Response (EDR)

Antivirus protection for Windows systems

Endpoint Security for macOS

Endpoint Detection & Response (EDR)

Protection designed specifically for Apple computers

Endpoint Security for Windows

Endpoint Detection & Response (EDR)

Comprehensive protection for Windows endpoints with advanced threat detection capabilities

ESET PROTECT Enterprise

Endpoint Detection & Response (EDR)

ESET PROTECT Enterprise is a unified cybersecurity platform providing endpoint protection, XDR, and EDR capabilities through ESET Inspect for enterprise environments. It delivers multilayered prevention via behavioral analysis, machine learning, and ESET LiveGrid reputation system from over 110 million endpoints. Key components include cloud sandboxing with ESET Dynamic Threat Defense for zero-day threats, native Full Disk Encryption for Windows and macOS managed via the PROTECT console, and real-time threat hunting. Best suited for organizations needing comprehensive visibility, incident response, and compliance with data regulations. Independent tests like AV-Comparatives CERTIFIED ATP and SE Labs AAA confirm high detection accuracy with low system impact.

PROTECT Platform

Extended Detection & Response (XDR)

Unified cybersecurity platform combining prevention, detection and response

Server Security for Linux

Endpoint Detection & Response (EDR)

Security solution tailored for Linux server deployments

Server Security for Microsoft Windows Server

Endpoint Detection & Response (EDR)

Specialized protection for Windows Server environments

Threat Intelligence

Threat Intelligence

Threat intelligence service included in ESET PROTECT platform

EventTracker (Netsurion)

SIEM

One platform for 24/7 detection, investigation, and response, run by our elite SOC.

Log & Event Management (LEM)

SIEM

Security Information and Event Management (SIEM) platform for centralized log collection, analysis, and threat detection.

Exabeam

SIEM

Exabeam is the leader in behavior intelligence for the agentic enterprise.

LogRhythm SIEM

SIEM

On-premises security information and event management system for ingesting and analyzing security data at scale

NetMon

Network Detection & Response (NDR)

Network monitoring solution available on both cloud-native and self-hosted platforms for visibility into network activity

New-Scale Analytics

Extended Detection & Response (XDR)

Behavioral analytics engine providing dynamic risk scoring and threat detection for human and non-human entities

New-Scale Fusion

SIEM

Combines cloud-native SIEM and behavioral analytics in a unified platform to detect, investigate, and respond to threats faster

New-Scale SIEM

SIEM

Cloud-native security information and event management platform delivering fast search, advanced correlation, and centralized case management

Data Platform

SIEM

Security data operations platform built to replace your SIEM, ingesting and normalizing security data at scale to eliminate tradeoffs between coverage, speed, and cost.

Managed SIEM

SIEM

Detection engineering and management service for existing SIEM platforms with centralized log analysis and threat detection.

Security Data Lake

Security Data Pipeline

Centralized data aggregation and storage solution that enables organizations to detect, investigate, and respond to threats while reducing storage costs.

ExtraHop

Network Detection & Response (NDR)

ExtraHop is an NDR vendor focused on inspecting east-west and north-south network traffic to detect suspicious activity, encrypted threats, and lateral movement. Its RevealX platform uses packet-level visibility, protocol decoding, and behavioral analytics to help SOC teams investigate incidents down to individual transactions without agents on endpoints. ExtraHop is well suited for enterprises that need forensic depth across hybrid and multi-cloud networks, especially where packet evidence and decrypted traffic are important for breach analysis and threat hunting. The vendor also offers adjacent network performance and IDS capabilities, but its NDR product is the core security use case.

AirDefense

Network Detection & Response (NDR)

A Comprehensive Wireless Intrusion Prevention System that simplifies the protection, monitoring, and compliance of your Wireless LAN networks while continuously safeguarding the network from external threats.

F

Security Monitoring

SIEM

Real-time security monitoring with pre-built detection rules, configurable alerts, and a log explorer for threat hunting designed to work in minutes rather than months.

F

Filigran

Threat Intelligence

Filigran is a cybertech company specializing in open-source-centric threat intelligence and cybersecurity simulation platforms. Its core offerings, including OpenCTI and OpenBAS, allow organizations to manage complex cyber threat intelligence (CTI) and validate their security posture through automated breach and attack simulations. The platform helps SOC teams structure raw threat data into actionable insights and operationalize threat hunting within existing security stacks.

F

Flare

Threat Intelligence

the Flare identity-first cyber threat intelligence SaaS platform combines proprietary world-class collection from across the dark and clear web with radical ease-of-use, empowering organizations to proactively detect, prioritize, and respond to external threats, ultimately reducing risk exposure and enhancing overall cyber resilience.

F

Cyber Threat Intelligence Platform

Threat Intelligence

Monitors the dark web, stealer log markets, Telegram, and millions of threat indicators to detect cybersecurity risks and automatically remediate exposures through integration with existing security tools.

F

Dark Web Fraud and Abuse Monitoring

Threat Intelligence

Automatically collects, analyzes, and contextualizes dark web data from sources like Telegram, Tor forums, and I2P to surface identity exposures, leaked secrets, and brand threats specific to organizations so security teams can remediate before adversaries act.

F

Executive and VIP Monitoring

Digital Risk & Executive Protection

Provides targeted threat detection for organizational leaders by monitoring for leaked credentials, personally identifiable information, and dark web activity that could compromise executive safety.

F

Identity Exposure Management

Identity Threat Detection & Response (ITDR)

Continuously monitors for compromised credentials and stolen session tokens across the dark web and other sources, then automates validation and remediation to prevent account takeovers before attackers can exploit them.

F

Investigations and Reporting

Threat Intelligence

Enables security teams to conduct investigations and monitor dark web, clear web, and Telegram data at scale to identify and respond to cybercrime threats.

F

Lookalike Domain Monitoring

Threat Intelligence

Continuously monitors for domains that impersonate your brand through typosquats, homoglyphs, and combosquats, alerting teams at both registration and weaponization stages to prevent credential harvesting and identity compromise.

Flashpoint

Threat Intelligence

Harness the power of data, human expertise, and automated analysis with Flashpoint's threat intelligence platform. Identify and remediate risk and take rapid, decisive action against cyber threats, fraud, vulnerability, physical, and national security threats.

Cyber Threat Intelligence

Threat Intelligence

Combines primary-source data collection, AI-powered analysis, and human expert validation to help security analysts detect emerging threats and accelerate investigations.

FortiEDR

Endpoint Detection & Response (EDR)

Fortinet FortiEDR is an endpoint detection and response (EDR) solution that provides real-time threat detection, automated response, and remediation across workstations, servers, and cloud workloads. It integrates with the Fortinet Security Fabric, including FortiAnalyzer and SIEM platforms via APIs, for centralized visibility. FortiEDR employs machine learning and behavioral analytics to identify threats, trigger customizable playbooks for actions like process termination, network isolation, and rollback of malicious changes. Proven in MITRE evaluations, it reduces false positives and dwell time, suiting SOC teams in enterprises leveraging Fortinet ecosystems for streamlined threat hunting and incident response.

FortiSIEM

SIEM

FortiSIEM is Fortinet's SIEM platform that unifies log management, performance monitoring, and threat detection across on-premises, hybrid, and multi-cloud environments. It collects and normalizes data from logs, flows, SNMP traps, cloud services, and third-party tools, correlating them via a distributed event correlation engine with in-memory computation across Supervisor and Worker nodes. Features include UEBA via machine learning, MITRE ATT&CK mapping, FortiGuard threat intelligence integration, and automated response through FortiSOAR and Security Fabric. Best suited for enterprises and MSSPs needing integrated NOC-SOC operations and scalable deployments.

FortiXDR

Extended Detection & Response (XDR)

Fortinet FortiXDR is an Extended Detection and Response (XDR) platform that integrates telemetry from the Fortinet Security Fabric and third-party tools to automate incident detection, investigation, and response. Built on FortiEDR, it correlates alerts for threats like lateral movement, brute force, phishing, and data exfiltration. Its AI engine performs automated triage via static/dynamic file analysis, baseline behavior comparison, and threat intelligence integration. Predefined response actions include device isolation and credential revocation across endpoints, networks, and cloud. Best for Fortinet-centric enterprises seeking unified SOC automation and optional MxDR managed services.

Fortra (ExaGrid, Digital Guardian, Tripwire, Alert Logic)

Network Detection & Response (NDR)

Fortra brings an AI-powered cybersecurity platform to enable safe AI usage and protect against AI-driven threats.

F

Forward Networks

Network Detection & Response (NDR)

Transforming networks to be more reliable, agile, and secure

F

F-Secure (now WithSecure Elements)

Deception Technology

WithSecure (formerly F-Secure) Elements is a cloud-native endpoint protection platform (EPP) focused on defending endpoints across Windows, macOS, Linux, Citrix, iOS, and Android against ransomware, exploits, fileless attacks, and zero-day threats. It integrates vulnerability management, automated patch management, DeepGuard behavioral analysis, and security cloud threat intelligence within a unified Elements console. Best suited for mid-sized enterprises seeking modular XDR capabilities with single-agent deployment for comprehensive endpoint visibility and response, without deception technology features.

G

Gigamon

Network Detection & Response (NDR)

The Gigamon AI-powered Deep Observability Pipeline efficiently delivers network-derived telemetry to cloud, security, and observability tools. Enriched with AI-driven insights, this telemetry helps organizations uncover previously hidden threats, identify and resolve performance issues, and close compliance gaps by validating ongoing adherence.

G

Gravwell, Inc

SIEM

Gravwell is an unstructured data fusion platform designed for security teams needing flexible, high-speed ingestion and analysis without the overhead of rigid schemas. It utilizes a piped query language similar to Unix pipes or Splunk, allowing for retroactive analysis of any data type, including binaries, logs, and netflow. The platform complements traditional SIEMs by providing a 'data lake' approach for forensic investigations and real-time threat hunting where formal ingestion pipelines are too slow.

G

Graylog

SIEM

Graylog is the AI-powered SIEM and log management platform built for security and IT operations. The platform centralizes and analyzes event data from across complex environments to help teams detect threats faster, investigate smarter, and control data costs, without compromise.

G

GreyNoise

Threat Intelligence

Our mission is to collect the most diverse primary scanning and exploitation data, and transform it into the most actionable intelligence for defenders, so that no attack works twice.

G

Group-IB

Threat Intelligence

Group-IB is a leading creator of predictive cybersecurity technologies to investigate, prevent and fight digital crime globally

G

Guardare

Endpoint Detection & Response (EDR)

Guardare simplifies risk management for all sizes of organizations and strengthens security across users, devices, and applications.

G

Gurucul

SIEM

Gurucul sells a cloud-native SIEM platform built around log ingestion, normalization, behavioral analytics, and risk-based alerting. In the SIEM category, it is aimed at security operations teams that need to consolidate security and non-security telemetry, retain logs for compliance, and reduce noisy detections with custom machine-learning content and correlation logic. Gurucul also markets adjacent UEBA, SOAR, and identity analytics modules, but its SIEM offering is the core entry point for SOC monitoring, investigation, and reporting.

H

HackNotice

Threat Intelligence

HackNotice is a service that notices trends and patterns in publically available data so as to identify possible data breaches, leaks, hacks, and other data incidents on behalf of our clients.

H

HAProxy Technologies

Network Detection & Response (NDR)

We are the company behind HAProxy One, the world's fastest application delivery and security platform, and HAProxy, the most widely used software load balancer.

H

Harden

Endpoint Detection & Response (EDR)

Harden is the security control plane for AI agents. It secures agent actions before execution, controlling tool use, API access, data movement, secrets and network access while providing build-time scanning, runtime enforcement and auditability across coding agents.

Hillstone Networks

Network Detection & Response (NDR)

Hillstone Networks offers Network Detection and Response under its Breach Detection System (BDS) line for monitoring enterprise network traffic and identifying post-breach activity. In scope, it analyzes raw traffic, flow records, and packet data to detect anomalous east-west and north-south behavior using machine learning, rule matching, and threat-intelligence inputs. It is best suited for SOC teams that want network-centric detection with forensics and response tied to network infrastructure. Hillstone also sells adjacent XDR and firewall products, but those are separate from the NDR use case.

Hunters

SIEM

Hunters is a cloud-native, AI-powered SIEM built for modern SOC teams who have outgrown legacy SIEM platforms. It ingests data from across the security stack, normalises it automatically using the Open Cybersecurity Schema Framework (OCSF), and uses AI to surface prioritised incidents rather than raw alerts. Designed to reduce analyst workload and time-to-detection, it is a common evaluation target for organisations looking to replace or augment Splunk or QRadar with a more automated, scalable SOC platform.

Huntress

Endpoint Detection & Response (EDR)

Huntress is a managed EDR and threat hunting platform built specifically for small and mid-market businesses and the MSPs that serve them. Unlike traditional enterprise EDR tools, Huntress pairs its lightweight agent technology with a 24/7 human Security Operations Centre that reviews, validates, and remediates threats on behalf of customers. It is particularly strong for organisations without a dedicated security team that still need credible detection and response coverage.

IBM QRadar

SIEM

IBM Security QRadar SIEM is a security information and event management platform that collects, normalizes, and correlates log and network flow data from thousands of on-premises, hybrid, and cloud sources. It uses the Sense Analytics Engine for real-time threat detection via correlation rules, behavioral anomaly identification, and integration with over 700 pre-built device connectors. Complementary modules include Risk Manager, Vulnerability Manager, and Incident Forensics. Available as cloud-native SaaS with Sigma community rules and machine learning-based risk scoring. Best suited for large enterprises requiring scalable SOC operations and compliance reporting.

I

Infrawatch

Threat Intelligence

Infrawatch is the intelligence layer for internet infrastructure. We combine real-time, multi-source data with behavioural analysis to give security teams deep visibility into malicious infrastructure before it’s operationalised. Replace fragmented tools with a single platform to investigate threats faster, reduce noise, and act with confidence. From fraud to intrusion detection, Infrawatch helps teams stay ahead of modern threats.

I

Intel 471

Threat Intelligence

Intel 471 delivers cyber threat intelligence via human-led HUMINT and proprietary technology, sourcing data from underground marketplaces and closed adversary forums. Their Verity471 platform structures intelligence for threat hunting, exposure management, and retroactive threat detection across existing security stacks. HUNTER deploys TTP-based hunt content for behavioral analysis. Positioned as a high-fidelity provider for enterprises and government, they target ransomware, intrusions, fraud, and sophisticated actors, enabling rapid compromise confirmation and attack surface remediation.

I

IPinfo

Threat Intelligence

IPinfo is primarily an IP data provider, but in threat intelligence it surfaces IP reputation and proxy-related context that security teams use for enrichment, fraud screening, and incident triage. Its security-relevant data includes VPN/proxy detection, named anonymizers, residential proxy signals, abuse-contact lookups, and change tracking tied to IP behavior. It is best suited for SOC teams, fraud operations, and platform engineers that need lightweight IP-centric intelligence rather than a full multi-source threat feed. The vendor also offers adjacent IP data products and delivery methods, but the threat-intelligence use case centers on API, database, and warehouse access to IP context.

I

IronNet

Network Detection & Response (NDR)

IronNet sells IronDefense, a network detection and response platform focused on detecting suspicious behavior in east-west and north-south traffic across cloud, virtual, and on-premises environments. Its published materials emphasize behavioral analytics, machine learning, packet and metadata analysis, and encrypted-traffic anomaly detection to find threats missed by signature-based tools. The vendor is positioned for security teams that want network-centric detection, threat hunting, and incident investigation rather than endpoint telemetry. IronNet also references its Collective Defense intelligence-sharing model, but its NDR scope remains centered on network visibility and response.

I

Iru, Inc.

Endpoint Detection & Response (EDR)

Iru is a unified security and IT operations platform that converges identity management, endpoint security, and compliance automation into a single interface. It targets the "ITDR and EDR" overlap, providing visibility into user identities and device health to enforce policy-based access. The platform is designed to collapse the security stack for mid-market enterprises, reducing technical debt from siloed tools. Micah offers capabilities similar to a combined UEM, EDR, and IAM solution.

I

iZOOlogic

Digital Risk & Executive Protection

iZOOlogic provides an integrated suite focused on External Attack Surface Management (EASM), Digital Risk Protection (DRPS), and brand protection. The platform monitors the internet, including the dark web, for phishing domains, rogue mobile apps, and leaked credentials that could impact corporate reputation. It serves as a specialized intelligence layer for organizations needing to combat external fraud and unauthorized brand usage.

J

Joe Security

Threat Intelligence

Joe Security delivers deep malware and phishing analysis as a threat intelligence provider, leveraging reasoning-capable generative AI for automated reverse engineering and dynamic/static file inspection. The platform excels in identifying attack types, extracting IOCs, and analyzing offline phishing URLs for domain anomalies. It serves CERT, CIRT, SOC, and IR teams requiring automated, analyst-driven insights into malicious files, emails, and URLs across Windows, macOS, and Linux. While Joe Security also offers sandbox cloud services, its core threat intelligence value lies in AI-driven behavior signatures and comprehensive reporting. The vendor holds a strong market position for technical intelligence focused on malware and phishing detection.

Kaseya Datto EDR

Endpoint Detection & Response (EDR)

At Datto, we believe there is no limit to what businesses can achieve with the right technology. With that in mind, we deliver robust, scalable, and intelligent backup solutions alongside endpoint management, professional services automation, networking and cybersecurity solutions.

K

knocknoc.io

Network Detection & Response (NDR)

Knocknoc is a just-in-time network access control platform that reduces exposed attack surface by dynamically adding and removing IP addresses from allowlists after authentication. In the narrow NDR sense, it is not a packet-capture or anomaly-detection engine; instead, it sits adjacent to network defense by controlling north-south exposure through firewall and cloud security-group rule changes. It is best for organizations that want temporary, identity-linked access to internal services, administrative interfaces, or web applications without leaving services permanently reachable.

LimaCharlie

SIEM

LimaCharlie provides a 'SecOps Cloud Platform' that delivers an API-first approach to security infrastructure, allowing teams to mix and match security capabilities. It features a cross-platform EDR agent, real-time log ingestion, and a detection-as-code engine that simplifies the creation of custom response playbooks. The platform is designed to replace fragmented security toolsets with a unified infrastructure-as-a-service model for MSSPs and sophisticated enterprise SOCs.

L

Linx Security

Identity Threat Detection & Response (ITDR)

Linx Security provides unified visibility and governance across the entire identity lifecycle, focusing on both human and non-human identities (NHI). The platform maps the relationship between users, permissions, and accounts across SaaS, cloud, and on-premises environments to identify security gaps. It proactively remediates excessive permissions and identifies orphan accounts that could be exploited in identity-based attacks.

L

Logpoint

SIEM

European cybersecurity ally

L

Lumu Technologies

Network Detection & Response (NDR)

Lumu is a continuous compromise assessment platform that uses network traffic analysis as the primary indicator of security health. By ingestion of metadata from DNS, NetFlow, Proxies, and Firewall logs, Lumu identifies confirmed instances of compromise that often bypass perimeter defenses. It automates the correlation of internal network patterns with global threat intelligence to provide high-fidelity alerts and trigger automated responses.

L

Lunar, powered by Webz.io

Threat Intelligence

Lunar is a specialized threat intelligence platform that focuses on monitoring the deep and dark web to detect stolen credentials and hijacked session tokens. By providing real-time data on leaked authentication data, it allows security teams to proactively invalidate compromised sessions before they are used for account takeover (ATO). It complements traditional identity providers by adding an external layer of credential risk visibility.

M

Magnet Forensics

Threat Intelligence

Magnet Forensics is primarily a digital investigations vendor, but in the Threat Intelligence context it supports incident responders by turning endpoint, cloud, and device artifacts into actionable TTP-level intelligence. Its Axiom Cyber and related workflow tools help teams map activity to MITRE ATT&CK, correlate evidence, and accelerate early case assessment during cyber incidents. It is best suited for enterprise and public-sector DFIR teams that need forensic-grade analysis rather than a standalone CTI feed. The company also sells adjacent evidence collection and case-management products.

M

Mallory

Threat Intelligence

Mallory unifies live adversary activity with your attack surface to prioritize the exposures real threat actors are targeting right now.

M

Malwarebytes

Endpoint Detection & Response (EDR)

Malwarebytes delivers Endpoint Detection & Response (EDR) through its EDR Extra Strength solution, available via Malwarebytes for Business Advanced. It focuses on endpoint agent telemetry, behavioral detections, on-host containment, and automated remediation using its patented Linking Engine to remove malware artifacts and process changes. The platform includes a 72-hour ransomware rollback feature for rapid recovery. Malwarebytes EDR is best suited for small to mid-sized businesses with limited cybersecurity staff, offering simplified incident handling and low alert volume. While it also offers adjacent products like patch management and vulnerability assessments, its EDR capabilities prioritize operational efficiency over deep analyst investigation.

M

ManageEngine Log360

SIEM

ManageEngine Log360 is a SIEM solution that aggregates logs from Windows/Unix/Linux servers, Active Directory, Exchange Online, Microsoft 365, AWS, Azure, firewalls, IDS/IPS, and databases for real-time correlation and threat detection. It integrates EventLog Analyzer, ADAudit Plus, and Cloud Security Plus for unified monitoring of on-premises and cloud environments. The correlation engine matches events against attack patterns and STIX/TAXII threat feeds, enabling proactive hunting and automated incident response workflows. Best suited for mid-sized enterprises seeking affordable SIEM alternatives to monolithic platforms, with strong Active Directory and hybrid IT visibility.

M

Mandiant (Google Cloud)

Threat Intelligence

Mandiant Threat Intelligence, now part of Google Cloud Security, is a SaaS threat intelligence platform combining Google's detection telemetry, Mandiant's frontline incident response intelligence, and VirusTotal's malware database. It delivers unified threat scoring, vulnerability tracking, and threat actor attribution to mid-market and enterprise security teams. Best for organizations requiring operationalized threat intelligence with low false-positive rates and integration into existing SOC workflows.

M

Mars Security

Threat Intelligence

MARS Security is a threat hunting and detection engineering platform that transforms threat intelligence into active detections. It continuously analyzes global threat intelligence, extracts attacker TTPs, maps them to MITRE ATT&CK, and automatically generates validated detection rules for deployment into existing SIEM environments. Through federated search, automated attack simulations, continuous threat hunting, and detection gap analysis, MARS helps organizations operationalize intelligence, expand detection coverage, reduce attacker dwell time, and proactively identify threats without requiring additional infrastructure or security personnel.

M

MARS

Threat Intelligence

Continuously converts threat intelligence into executable hunts and detections across your existing security stack. No data ingestion. No tool replacement.

M

Account Security

Identity Threat Detection & Response (ITDR)

Identifies account takeovers and contains their impact through deep integration with cloud office infrastructure to prevent lateral movement and data theft.

M

Memcyco

Digital Risk & Executive Protection

Memcyco provides real-time protection against customer-facing digital impersonation, phishing, and account takeover attempts by identifying fake websites and spoofed portals as they go live. In a Data Protection context, it helps limit exposure of credentials, personal data, and session details by detecting victims, compromised sessions, and attacker infrastructure early in the attack lifecycle. The product is aimed at organizations with consumer-facing web properties that need to reduce credential theft and fraud without adding endpoint agents or user friction. It also exposes high-granularity attack telemetry that can feed downstream security and fraud systems.

M

File Security

Threat Intelligence

Content Disarm and Reconstruction technology that removes malicious code and macros from over 220 file types while preserving functionality.

Defender

Extended Detection & Response (XDR)

Comprehensive AI-powered threat protection that detects and responds to attacks across devices, identities, apps, email, cloud, and SaaS environments.

Microsoft Defender for Endpoint

Endpoint Detection & Response (EDR)

Microsoft Defender for Endpoint is the EDR component of Microsoft Defender XDR, delivering endpoint prevention, detection, investigation, and response across Windows, macOS, Linux, Android, and iOS. It combines next-generation antivirus, attack surface reduction rules, automated investigation and remediation, threat and vulnerability management, and behavioral sensors that stream telemetry to the Microsoft cloud for correlation with identity, email, and cloud signals. Best fit for organizations standardized on Microsoft 365 E5 or with strong Azure AD / Intune deployments, where the included licensing and native integration with Sentinel and Defender XDR materially reduce tool sprawl and analyst pivot time.

Defender XDR

Extended Detection & Response (XDR)

Extended detection and response platform that automatically disrupts cyberattacks and accelerates incident response.

M

Microsoft Sentinel

SIEM

Microsoft Sentinel is a cloud-native SIEM and SOAR platform deployed on Azure that centralizes threat detection, investigation, and response across multicloud and hybrid environments. It combines machine learning analytics, threat intelligence integration, and automated playbook orchestration to reduce alert noise and accelerate incident handling. Best suited for organizations with existing Microsoft security investments (Microsoft 365 Defender, Azure Defender for Cloud) seeking unified cloud-based security operations without on-premises infrastructure.

M

Defender for Endpoint

Extended Detection & Response (XDR)

A comprehensive, cloud-native endpoint security solution that delivers visibility and AI-powered cyberthreat protection with endpoint detection and response (EDR) functionality across multiple platforms.

M

Sentinel

SIEM

Cloud-native SIEM built for AI that enables organizations to detect threats across their entire environment, investigate incidents in minutes, and cut SIEM costs.

Miru Labs

Identity Threat Detection & Response (ITDR)

Miru is an AI-native insider threat detection and prevention platform that protects organizations from data loss, Shadow AI risks, and malicious insider activity across SaaS environments and endpoints. Founded by cybersecurity veterans with deep expertise in counterintelligence and nation-state threat detection, Miru replaces legacy UEBA and SIEM tools with an identity-anchored architecture that automates investigation workflows and eliminates alert fatigue. The platform combines browser-based telemetry with integrations to identity providers, development platforms, and productivity suites to deliver real-time behavioral analytics and automated response capabilities. Miru enables security teams at high-growth technology companies and enterprises to detect anomalous access patterns, unauthorized data exfiltration, and policy violations without adding headcount, providing the investigation intelligence and endpoint protection modern distributed workforces require.

M

MISP

Threat Intelligence

MISP is an open-source threat intelligence platform for collecting, storing, correlating, and sharing indicators of compromise, malware attributes, threat actor information, and related context. It is widely used by CERTs, security teams, researchers, and trusted sharing communities to structure threat data for analysis and distribution. MISP supports collaborative intelligence exchange and can generate detection content such as NIDS rules from stored attributes. It is best suited for organizations that need a standards-based repository for operational threat sharing rather than a closed proprietary feed service.

M

MokN

Threat Intelligence

MokN offers a novel defensive phishing solution that intercepts stolen credentials by deploying 'defensive' phishing pages that spoof attacker infrastructure. By phishing back the attackers, the platform captures compromised credentials in real-time, allowing security teams to invalidate sessions or reset passwords before the initial attacker can utilize them. This approach turns reactive incident response into proactive credential reclamation and actionable threat intelligence.

M

Morado

Threat Intelligence

Morado delivers an integrated Threat Management Platform that unifies finished intelligence, dark web monitoring, and brand protection into a centralized workspace. Built on the STIX standard, the platform correlates attack surface intelligence with third-party risk data to provide a holistic view of the threat landscape. It replaces disparate point solutions for digital risk protection (DRPS) and brand monitoring with a single operational intelligence hub.

M

Threatnote

Threat Intelligence

A unified threat management platform that consolidates threat intelligence operations, digital risk monitoring, and dark web surveillance to streamline the complete intelligence lifecycle.

M

myrro.io

Endpoint Detection & Response (EDR)

Leave your phone behind. Access it anywhere. Myrro is a secure hardware solution and end-to-end encrypted platform that allows full remote access and control of your mobile device through the web browser. Use it to keep your team's devices secure during travel, improve employee compliance to restrictive device policies, protect company IP during high risk travel, contain your global digital footprint, or manage device fleets remotely.

N

Adlumin

Extended Detection & Response (XDR)

AI-powered XDR platform and expert-led MDR service that detects threats across every layer from endpoints to DNS to Shadow AI activity.

N

Endpoint Detection and Response

Endpoint Detection & Response (EDR)

AI-powered endpoint security solution that detects threats early, automatically contains threats and neutralizes malware, and rolls back infected devices to a clean state.

N

Threat Hunting

Threat Intelligence

Proactive cybersecurity platform with AI-driven tools and long-term data retention to detect and respond to hidden threats.

N

NetBrain

SIEM

NetBrain delivers no-code network automation that enhances cybersecurity by reducing manual tasks, accelerating incident response, and ensuring consistent enforcement of network policies. By continuously assessing and visualising hybrid network environments, NetBrain helps security teams detect anomalies faster, validate configurations, and close attack surfaces, all while reducing operational risk and downtime.

N

Netcraft

Digital Risk & Executive Protection

Netcraft provides automated digital risk protection and cybercrime takedown services, focusing on the discovery and removal of phishing, malware, and brand impersonation sites. It leverages a massive global proxy network to identify malicious infrastructure and automates the takedown process through established relationships with registrars and hosting providers. This service complements email security and brand protection programs by neutralizing threats at the source rather than just blocking them at the perimeter.

N

Omnis Cyber Intelligence

Network Detection & Response (NDR)

Leverage packet-level insights to reduce the time between threat detection and response with threat investigation.

N

Omnis CyberStream

Network Detection & Response (NDR)

Detect, investigate, and respond to cyberthreats in real-time by leveraging packet-level insights.

N

NetWitness

SIEM

NetWitness is a comprehensive threat detection and response platform that integrates SIEM, network forensics, endpoint data, and user entity behavior analytics (UEBA). It provides security analysts with deep visibility across the entire attack lifecycle by capturing and analyzing packet-level data alongside logs and endpoint telemetry. The platform is designed for high-scale enterprise environments, replacing fragmented point solutions with a unified workbench for incident investigation and response orchestration.

N

Endpoint Detection and Response

Endpoint Detection & Response (EDR)

Proactive threat hunting tool that detects, investigates, and responds to advanced and non-malware threats at the endpoint level.

N

Network Detection and Response

Network Detection & Response (NDR)

Full-packet capture and metadata collection across on-premises, cloud, and virtual environments to identify and respond to threats across enterprise networks.

N

Security Information and Event Management

SIEM

Centralized log aggregation from 350+ sources with dynamic parsing, metadata enrichment, and automated threat detection for enterprise security operations.

N

Threat Manager

Identity Threat Detection & Response (ITDR)

Real-time threat detection and response solution across identity and file systems to stop ransomware, identity attacks, and insider threats before escalation.

N

ASGARD Management Center

Endpoint Detection & Response (EDR)

Enterprise-wide THOR malware scanning, IOC management, live forensics, and automated response playbooks across up to 25,000 endpoints per instance.

N

AURORA

Endpoint Detection & Response (EDR)

A lightweight and customizable endpoint agent based on Sigma that uses Event Tracing for Windows to detect suspicious activity on Windows systems.

N

THOR

Endpoint Detection & Response (EDR)

THOR detects hacking traces others overlook. It closes forensic blind spots with YARA, Sigma, and custom IOCs.

N

VALHALLA

Threat Intelligence

A commercial rule feed service providing 22,000+ YARA rules and 4,000+ Sigma rules for file, memory, log and event-based detection.

N

Nightfall AI

Identity Threat Detection & Response (ITDR)

AI-native data loss prevention and insider threat detection platform that discovers, classifies and protects sensitive data across SaaS, GenAI, endpoint and email. Detects unauthorized uploads, shadow AI usage, exfiltration and policy violations in real-time using ML-based classifiers, replacing legacy DLP and UEBA with autonomous behavioral monitoring and prevention before data loss happens.

N

Intelligence

Threat Intelligence

Detect your external exposure before attackers exploit it.

N

Threat Prevention

Network Detection & Response (NDR)

Neutralize cyber risks before they reach you, and act efficiently if they do.

N

NowSecure

Endpoint Detection & Response (EDR)

NowSecure is primarily a mobile app security platform, not a native EDR vendor; within an EDR context, it contributes app risk intelligence for mobile devices rather than endpoint agent telemetry or on-host containment. NowSecure and its partner materials position it as complementary to mobile EDR by analyzing iOS and Android apps for vulnerabilities, risky SDKs, data exposure, and behavioral risk, which can help security teams prioritize device-level alerts. It is best suited for organizations that need visibility into the security posture of the mobile apps used on managed and BYOD devices.

N

Threat Intelligence

Threat Intelligence

Subscription service delivering continuous insights into attack techniques and vulnerabilities specific to operational technology and Internet of Things environments with actionable threat data.

N

NSFOCUS

Extended Detection & Response (XDR)

NSFOCUS offers a broad portfolio of security products including DDoS protection, Web Application and API Protection (WAAP), and an Integrated Security Operations Platform. The company serves large enterprises and telcos with high-capacity mitigation hardware and cloud-based threat intelligence. It provides massive-scale DDoS scrubbing and continuous threat exposure management (CTEM) capabilities.

N

Nucleus Insights

Threat Intelligence

An agentic threat intelligence platform powered by the Nucleus Helix AI engine that delivers real-time exploitation and remediation intelligence integrated directly into exposure management workflows.

N

Nucleus Vulnerability Intelligence Platform

Threat Intelligence

A centralized platform that aggregates and enriches vulnerability data from multiple sources, enabling teams to search across 230,000+ CVEs and receive real-time alerts on exploitability and threat actor activity.

O

Device and Malware Risk Detection

Endpoint Detection & Response (EDR)

Identifies and responds to account takeover, device takeover, remote attacks, and social engineering threats throughout user sessions.

O

Mobile Threat Insights and Response

Endpoint Detection & Response (EDR)

Delivers real-time visibility into mobile threats and enables automated security responses through integration with fraud or SOC systems.

O

Mobile Threat Intelligence

Threat Intelligence

Provides intelligence on over 80% of all known mobile banking malware and active campaigns to support proactive security strategies.

C

Oort

Identity Threat Detection & Response (ITDR)

Cisco delivers the critical infrastructure to help organizations thrive in the AI era. By fusing networking, security, observability, and collaboration, we power how people and technology work together.

O

OpenCTI

Threat Intelligence

Filigran provides open-source cybersecurity solutions covering threat intelligence management, breach and attack simulation, and cyber risk management.

O

OpenText

Endpoint Detection & Response (EDR)

OpenText Core EDR provides endpoint detection and response integrated with SIEM, SOAR, and vulnerability assessment in a single cloud platform. It deploys a lightweight agent for telemetry collection on endpoints including laptops, servers, and mobile devices, capturing process execution, file changes, network connections, and registry modifications. Built for MSPs managing SMB clients, it uses pre-configured policies, automated playbooks for containment like device isolation and process termination, and CVE-based vulnerability scanning. Global threat intelligence and syslog/API integrations with IT, security, and PSA systems enable multi-client visibility and response without additional vendors.

O

Total Protection

Endpoint Detection & Response (EDR)

Comprehensive security solution providing multi-device protection covering antivirus, identity theft prevention, privacy features, and data backup in a single subscription

O

OpenVPN

Network Detection & Response (NDR)

Secure your network. Connect your team. OpenVPN is a global leader in cybersecurity that enables organizations to truly safeguard their assets through secure network connections.

O

MetaDefender Aether

Threat Intelligence

Unified zero-day detection solution combining threat reputation, predictive AI, adaptive sandbox, threat scoring, and ML-powered threat hunting to detect known and unknown malware

O

MetaDefender NDR

Network Detection & Response (NDR)

Network Detection and Response platform providing comprehensive visibility into network traffic and detecting advanced threats across IT and OT environments

O

Intel X

Threat Intelligence

AI-Driven Threat Intelligence Platform for rapid threat response and situational awareness

P

PacketViper

Deception Technology

PacketViper is a preemptive network security platform combining inline enforcement, Automated Moving Target Defense (AMTD), and active deception for converged OT/IT environments. The vendor deploys agentless deception artifacts and deceptive responders across network segments to prevent, detect, and contain threats at first contact without SIEM or SOAR dependencies. Positioned for enterprises requiring both threat prevention and lateral movement blocking in industrial control systems and IT infrastructure.

P

Cortex

SIEM

The #1 AI-driven SecOps platform purpose-built for SOC transformation with the Cortex Extended Data Lake.

P

Cortex ITDR

Identity Threat Detection & Response (ITDR)

Identity threat detection and response paired with unified XDR data for comprehensive identity security.

P

Cortex XDR

Endpoint Detection & Response (EDR)

Palo Alto Networks Cortex XDR is an extended detection and response platform that ingests and correlates endpoint, network, cloud, and identity telemetry for threat prevention, detection, investigation, and response. It employs machine learning models for behavioral analytics, root cause analysis reconstructing full attack chains, and automated responses via XSOAR playbooks. Proven in MITRE ATT&CK evaluations with top technique detections and 100% block rate in AV-Comparatives EPR tests, it leads in multi-vector attack visibility. Best for enterprises needing unified security operations across Palo Alto ecosystems like Prisma Cloud and NGFW.

P

Unit 42

Threat Intelligence

Unit 42 is Palo Alto Networks' threat research organization delivering threat intelligence, incident response, and consulting services. It leverages telemetry from Palo Alto Networks' security platform to identify emerging threats like malware variants and cybercriminals. The team of over 200 experts provides incident scoping, containment, response, and security posture recommendations. Services include Cortex XSOAR integrations for real-time indicator enrichment (IP, domains, URLs, SHA256 hashes), threat object associations (actors, malware, campaigns), and feeds for automated ingestion. Best for enterprises needing integrated threat intel with Palo Alto ecosystems and rapid IR support.

P

WildFire

Threat Intelligence

Advanced malware analysis engine using machine learning to identify unknown file-based threats.

P

Data Pipeline

Security Data Pipeline

Centralizes and normalizes security logs from across infrastructure into a queryable data lake with native connectors for AWS, Okta, CrowdStrike, and dozens of other security tools.

P

Detection Engine

SIEM

Enables teams to build, manage, and scale security detections using AI-powered detection creation and detection-as-code workflows with full CI/CD integration.

CVE Insights

Threat Intelligence

Real-time vulnerability alerting and awareness tool that delivers tailored alerts, threat scoring, and executive summaries to help security and IT teams respond faster to threats.

P

Penlink

Threat Intelligence

A Next generation Intelligence Platform for Better Decision-Making

P

Tangles

Threat Intelligence

AI-driven platform to automate search and analysis of data from open, deep, and dark web sources

Permiso Security

Identity Threat Detection & Response (ITDR)

Permiso Security provides a unified platform combining Identity Security Posture Management (ISPM) and Identity Threat Detection and Response (ITDR) for human, non-human, and AI identities across AWS, Azure, Okta, M365, GitHub, Jira, Salesforce, and Snowflake. It continuously monitors identity activities, performs behavioral analysis to detect anomalies like credential compromise, account takeover, and insider threats, and executes automated responses such as account lockdown and adaptive authentication. Permiso excels in runtime tracking across IaaS, SaaS, and IdPs, reducing MTTD and MTTR for organizations with hybrid cloud environments managing diverse identity types.

Defend

Identity Threat Detection & Response (ITDR)

Monitors identity behavior in real-time to detect suspicious and malicious activity across human, non-human, and AI identities.

P

Pistachio

Identity Threat Detection & Response (ITDR)

We make cybersecurity a seamless part of everyday work.

P

Network Security

Network Detection & Response (NDR)

A network security platform that replaces traditional network detection and response tools by fusing network traffic data with identity, endpoint, and cloud signals.

P

Mobile Threat Intelligence

Threat Intelligence

Platform providing unmatched visibility into the security posture of public mobile applications with millions of continuously updated reports.

P

PRE Security

Extended Detection & Response (XDR)

PRE Security is an AI-native Predictive SecOps platform designed to help organizations detect, prevent, and respond to cyber threats before they become incidents. The platform combines parserless data ingestion, AI-powered SIEM, Generative XDR, predictive analytics, and agentic automation in a unified security operations environment. PRE Security's AI Data Fabric ingests and correlates data from virtually any security tool without complex integrations, enabling real-time threat detection, investigation, and response. Through natural language interactions and autonomous workflows, security teams can accelerate operations, reduce alert fatigue, and proactively identify emerging risks across their environment.

Identity Threat Defense

Identity Threat Detection & Response (ITDR)

Illusive Networks, acquired by Proofpoint in 2024, is an identity threat detection and response (ITDR) platform that combines deception technology with identity risk management. The platform deploys decoy credentials, systems, and data artifacts to detect lateral movement and privilege escalation within compromised networks. Illusive serves enterprise organizations seeking to operationalize zero trust by protecting identity pathways to critical assets and enabling early breach detection through active engagement with threat actors.

P

AI Threat Hunter

Threat Intelligence

Proactive threat hunter that surfaces hidden adversaries across your environment by finding threats that traditional detections miss.

P

PuppyGraph

SIEM

The Only Graph Analytic Engine That Enables Users To Query One Or More Relational Data Stores As A Unified Graph Model.

Q

Quest Change Auditor

Identity Threat Detection & Response (ITDR)

At Quest Software, we create technology and solutions that build the foundation for enterprise AI. By focusing on data management and governance, cybersecurity, and platform modernization, we help organizations solve their most pressing challenges and turn the promise of AI into reality.

R

Radiant Logic

Identity Threat Detection & Response (ITDR)

RadiantOne is an identity security platform that unifies identity data from across an organization to provide real-time visibility, risk analysis, and automated remediation. The platform combines identity data management, analytics, and observability to improve identity hygiene, detect security risks, support compliance, and strengthen IAM programs. By creating a trusted, unified identity foundation, RadiantOne helps organizations reduce identity-related threats, streamline governance, and make data-driven security decisions.

R

InsightIDR

SIEM

Rapid7 is a global leader in AI-powered managed cybersecurity operations, trusted to advance organizations' cyber resilience. Open and extensible, the Rapid7 Command Platform integrates security data, enriching it with AI, threat intelligence, and 25 years of expertise and innovation to reduce risk and disrupt attackers.

R

Threat Command

Threat Intelligence

Eliminate external threats to your organization through proactive monitoring of clear, deep, and dark web threats, enabling rapid response and informed security decisions.

R

RapidIdentity ITDR

Identity Threat Detection & Response (ITDR)

Delivers flexible, institution-ready identity threat detection and response protection that integrates smoothly with existing technology.

R

Runtime ADR

Endpoint Detection & Response (EDR)

Detects and responds to application-layer attacks by observing actual code execution inside running applications.

Recorded Future

Threat Intelligence

Recorded Future secures the world by empowering businesses, governments, and other organizations to stay one step ahead of today's relentless threat actors.

Cyber Operations

Threat Intelligence

Autonomously hunt and stop the threats being weaponized against you, before attackers can act.

Digital Risk Protection

Digital Risk & Executive Protection

Detect, prioritize, and take down external threats before they reach your customers or your brand.

R

Network Detection & Response (NDR)

Network Detection & Response (NDR)

Intelligent monitoring system that learns your network's rhythm and identifies anomalous behavior to detect threats that bypass perimeter defenses

R

Network Performance Monitoring (NPM)

Network Detection & Response (NDR)

Uses flow telemetry, SNMP and packet-level analysis to monitor network behavior, detect performance anomalies, and predict bottlenecks proactively

R

Security Info & Event Management (SIEM)

SIEM

Collects, normalizes, enriches, correlates, and stores logs at scale for threat detection and incident response automation

R

Dark Web and Digital Risk Protection

Threat Intelligence

Continuously monitor the open, deep, and dark web for external threats including brand impersonation and data leaks with automated response automation.

R

Detect At Source

SIEM

Deploy detection rules directly at endpoints and cloud platforms to detect threats in as low as 3 minutes while reducing SIEM costs.

R

Email Phishing Defense

Threat Intelligence

AI-powered phishing detection and analysis that automatically identifies threats in seconds with cross-platform remediation capabilities.

Spectra Analyze

Threat Intelligence

A comprehensive malware analysis workbench that empowers SOC teams with AI-driven binary analysis technology to detect advanced and hidden malware at the deepest levels.

Spectra Core

Threat Intelligence

A cloud-native threat analysis platform that leverages AI-powered complex binary analysis to examine sophisticated files and software packages in real-time.

Spectra Detect

Threat Intelligence

The only malware analysis solution to process millions of files at speed per day, delivering enterprise-scale file inspection with rapid processing of massive file volumes.

Spectra Intelligence

Threat Intelligence

Expertly curated, always up-to-date threat intelligence that delivers prescriptive file and network intelligence and verified threat classification.

R

Breaches

Threat Intelligence

Real-time data breach detection that gathers all data leaks impacting your employees and alerts them to protective actions.

R

RSA NetWitness

SIEM

RSA provides an AI-powered Unified Identity Platform to protect the world's most secure organizations. RSA provides automated identity intelligence, authentication, access, governance, and lifecycle capabilities to reduce risks, secure authentication, maintain compliance, and automate processes.

R

RunReveal

SIEM

One platform for security data. Ingest, detect, respond.

S

Sandfly Security

Endpoint Detection & Response (EDR)

Sandfly creates a dedicated and reliable Linux security solution that works across all systems without endpoint agents or drama. Our company focuses on Linux security that is high performance, high stability, high compatibility, and low risk.

S

Drift Detection

Endpoint Detection & Response (EDR)

Agentless monitoring of unauthorized changes to Linux systems including processes, files, configurations, malware, and persistence mechanisms across cloud and embedded environments.

S

Incident Response

Endpoint Detection & Response (EDR)

Agentless Linux incident response platform enabling instant deployment with immediate compromise detection, forensic collection, and active threat containment.

S

Threat Detection

Endpoint Detection & Response (EDR)

Agentless Linux threat detection using 1,100+ pre-built detection modules to identify known and unknown attacks including rootkits, malware, webshells, cryptominers, and privilege escalation.

S

Endpoint Security Management System

Endpoint Detection & Response (EDR)

Comprehensive endpoint detection and response solution for threat detection and response

S

Network Behavior Management

Network Detection & Response (NDR)

Network behavior analysis and management for detecting malicious activities across the network

S

Identity Security Posture Management

Identity Threat Detection & Response (ITDR)

Continuously discover and remediate identity risks, misconfigurations, and excessive access before they become threats.

S

Scanner

SIEM

Making years of security logs searchable in seconds.

S

Collect & Enrich

SIEM

Schemaless indexing for object storage across all clouds, SaaS tools, and data streams with 30+ pre-built integrations.

S

Detection & Response

SIEM

Streaming query engine that continuously evaluates security rules and generates alerts in minutes.

S

Search & Investigate

SIEM

Lightning-fast full-text search across petabytes of logs, 100x faster than traditional SIEMs, enabling rapid security investigations.

S

aiSIEM

SIEM

AI-powered visibility and automated response to protect your business from emerging threats with 95% reduction in mean time to detect

S

aiXDR

Extended Detection & Response (XDR)

Extended detection and response across endpoints, networks, and cloud environments with real-time visibility and automated response

S

SOC

Extended Detection & Response (XDR)

AI-Powered SIEM, XDR & SOC Platform with 6,000+ detection rules and five-tier lateral-movement detection

S

Assurance Authority

Identity Threat Detection & Response (ITDR)

Continuous risk monitoring utilizing intelligence-powered assessment that evaluates trustworthiness and modifies security responses dynamically.

S

Presence Authority

Identity Threat Detection & Response (ITDR)

User behavior assurance incorporating behavioral analytics to identify irregularities and maintain legitimate access validation throughout sessions.

S

SecureVisio

SIEM

SecureVisio connects the dots between Incidents, Vulnerabilities, Assets, and Risks, empowering your team with AI-assisted guided response and risk-based prioritization. We give your teams the insight, automation, and context they need to act decisively.

S

SIEM

SIEM

AI-powered SIEM platform for security teams seeking intelligent threat detection and prioritization through integrated asset intelligence and risk-based alert correlation.

S

UEBA

Endpoint Detection & Response (EDR)

Behavioral analytics platform for security analysts to detect and investigate user and host anomalies through unified monitoring and interactive investigation tools.

S

Secureworks Taegis XDR

Extended Detection & Response (XDR)

Secureworks Taegis XDR is a cloud-native extended detection and response platform that correlates telemetry from endpoints, networks, cloud environments, and identity systems. Built on 20+ years of MSSP operations and threat intelligence from the Secureworks Counter Threat Unit (tracking 300+ threat groups), it applies behavioral detection models and MITRE ATT&CK-mapped rules to identify threats across the full attack surface. Available as self-service platform or managed service (Taegis ManagedXDR) with 24/7 SOC support.

S

STRIKE

Threat Intelligence

Cyber threat intelligence platform that turns live threat signals into instant action so your SOC can hunt, track, and shut down attacks before they take flight.

S

Securonix

SIEM

Securonix is a cloud-native SIEM vendor offering unified detection and response across SIEM, UEBA, SOAR, and threat intelligence capabilities in a single platform. The company positions itself as analytics-driven with integrated machine learning for threat detection and automated incident response. Securonix targets mid-to-large enterprises seeking to consolidate security tools and reduce alert fatigue through behavioral analytics and threat chain modeling rather than signature-based detection alone.

S

Autonomous Threat Sweeper

Extended Detection & Response (XDR)

Automated threat detection and response solution that leverages threat research to proactively monitor emerging threats and automate incident response using IOC and TTP-based detection.

S

ThreatQ

Threat Intelligence

Unified threat intelligence platform that integrates threat data, detection, investigation, and response into a single operational workflow with 560+ integrations.

S

UEBA

SIEM

User and Entity Behavior Analytics solution that uses advanced AI and machine learning to detect insider threats, compromised accounts, and anomalous user activity.

S

Unified Defense SIEM

SIEM

Cloud-native SIEM powered by agentic AI that consolidates SIEM, UEBA, SOAR, and threat intelligence capabilities into a single platform.

S

Sekoia

Extended Detection & Response (XDR)

Sekoia Defend is Sekoia’s SaaS-based XDR platform, positioned as a security control tower that collects, correlates, and analyzes telemetry from endpoints, networks, cloud environments, applications, and other enterprise sources in real time. It is aimed at SOC teams that want unified detection and response across multiple control points rather than endpoint-only coverage. Sekoia also pairs the XDR product with separate CTI and SIEM/SOAR capabilities in its broader SOC platform, but Defend is the XDR component.

S

Semperis

Identity Threat Detection & Response (ITDR)

As cybersecurity leaders and Active Directory (AD) experts, we know that identity-first security is the key to operational resilience.

S

Directory Services Protector

Identity Threat Detection & Response (ITDR)

Hybrid AD threat prevention, detection, and response with continuous monitoring and automatic rollback of malicious changes.