AI security posture (AI-SPM)

Automated vulnerability detection+5

the pioneering GenAI bug bounty platform designed to safeguard the future of artificial intelligence

Abnormal AI

Real-threat phishing simulations+11

An AI-Native Company Dedicated to Cybersecurity. Built by AI insiders with an outsider's perspective: Behavior is the future of cyber defense.

Adaptive Security

AI-driven security awareness training+9

Unified security awareness training, email security, and AI governance built for the AI era.

AIBound

AI asset discovery and inventoryAI configuration and exposure scanningTraining data and model risk analysis+8

Your Control Plane for Secure AI

Aim Security (Cato Networks)

Continuously discover AI assets+9

Aim Security provides AI security posture management and runtime protection for enterprise GenAI deployments. Acquired by Cato Networks in 2025, Aim is being integrated into the Cato SASE Cloud platform to bring AI discovery, data protection and policy enforcement to network-delivered security. Best suited for organizations that want a single SASE-delivered control plane covering shadow AI discovery, GenAI DLP, prompt injection defence and governance over copilots and homegrown AI apps without standing up a separate AI security stack.

Airrived

AI Security Posture Management (AI-SPM)AI agent discovery across enterprise environments+7

The Agentic OS for the enterprise. Redefining how organizations run cybersecurity, IT, and business operations in the agentic era, by making intelligence native, not bolted on. Today’s enterprises are overwhelmed by fragmented point tools and shallow, bolt-on AI that can summarize information but can’t reason, decide, or act. Airrived was built to change that. Our platform enables enterprises to fine-tune models, compose deep-reasoning agents, and orchestrate intelligence across systems, without requiring AI expertise. I

AiStrike

AI asset discovery and inventory+10

The AI-native security operations platform built for enterprise. Preemptive, autonomous, and continuously self-improving.

Akto

Automated AI asset discoveryContinuous AI misconfiguration monitoring+4

The Enterprise Platform for AI Security & Governance

Alice

AI application risk testingRuntime guardrail enforcement+3

Keeping communicative tech safe, secure, and reliable.

AnyInsight.ai

Continuous discovery of AI assetsAI asset classification and risk scoring+5

AnyInsight.ai is a Zero Trust platform designed to secure the deployment of GenAI agents within the enterprise. It focuses on preventing shadow AI, data leakage (DLP for AI), and minimizing hallucinations through built-in security agents. This platform complements existing IAM and DLP solutions by extending their capabilities to the unique risks associated with autonomous AI agents and large language model interactions.

AppOmni

SaaS Security Posture Management (SSPM)

Agentless SaaS configuration monitoringMisconfiguration and access-risk detection+10

AppOmni is positioned as a SaaS Security Posture Management (SSPM) platform, not a traditional multi-cloud CSPM vendor. The search results consistently clarify that AppOmni focuses on SaaS application security posture (Salesforce, Microsoft 365, ServiceNow, Google Workspace, Workday) rather than cloud infrastructure (AWS, Azure, GCP). While AppOmni uses CSPM terminology in legacy marketing, it does not compete in the infrastructure CSPM category. For cloud infrastructure posture management, AppOmni integrates with true CSPM solutions like Wiz. Organizations seeking multi-cloud IaC scanning, drift detection, and infrastructure misconfiguration remediation should evaluate dedicated CSPM vendors, not AppOmni.

AQtive Guard by SandboxAQ

Discover shadow AI across enterprise systems+10

AQtive Guard by SandboxAQ is a specialized security platform focusing on cryptographic discovery and AI risk management in the face of quantum computing threats. It provides deep visibility into an organization's cryptographic footprint (Agile Cryptography) and enforces real-time guardrails for AI agents and LLM deployments. The tool is designed to help CISOs transition to Post-Quantum Cryptography (PQC) while managing the immediate risks of 'shadow AI' and non-compliant code.

Area 1 Security (Cloudflare)

Email Security

Pre-delivery phishing detection+10

Cloudflare started as a simple application to find the source of email spam. From there it grew into a service that protects websites from all manner of attacks, while simultaneously optimizing performance.

ArmorCode

Application Security Posture Management (ASPM)

Aggregate findings from security scannersCorrelate duplicate vulnerability findings+10

ArmorCode is redefining security governance in the AI era as the agentic control plane for Unified Exposure Management.

Artemis

AI inventory and bill of materialsAI misconfiguration and exposure scanning+4

Artemis is a specialized AI Security Posture Management (AI-SPM) platform focused on discovering, inventorying, and securing AI models, datasets, and notebooks across cloud environments. It provides continuous visibility into AI misconfigurations, exposure risks, and training-data classification, while mapping findings to OWASP LLM/ML Top 10. Artemis detects leaked AI credentials and assesses AI-BOM and supply-chain risks in ML pipelines. The vendor targets mid-to-large enterprises actively scaling AI adoption and needing operational governance without added headcount. Artemis also offers adjacent runtime security products, but its AI-SPM suite remains distinct for posture-focused buyers.

AuditBoard

Compliance & GRC

Audit management with continuous testing+11

Built by practitioners for practitioners, Optro is an AI-powered GRC system of action that unifies audit, risk, infosec, and compliance into a single, connected platform. We empower the world's leading organizations to turn intelligence into a competitive advantage.

Aurascape

Discover AI applications across the enterprise+9

To enable businesses to innovate fearlessly in the age of AI by transforming how they safeguard themselves with the world's most advanced AI security platform.

Aurva

Runtime monitoring for AI stack+9

Aurva provides a runtime security layer specifically designed for agentic AI architectures and LLM-driven workflows. It monitors granular data access patterns of AI agents, detects behavioral anomalies that signify prompt injection or agent hijacking, and enforces real-time compliance controls. The platform complements existing WAFs and API security tools by providing visibility into the internal logic and data orchestration of autonomous agents.

Backslash Security

Application Security Posture Management (ASPM)

Internet-reachable code vulnerability detectionReachable package vulnerability analysis+10

The Security Platform for The New Agentic AI Fabric.

Barndoor AI

AI asset discovery and inventoryAI misconfiguration and exposure scanning+7

Barndoor is one platform for AI access, safety, and control.

Beyond Guard

AI agent discovery and inventory+8

BeyondGuard is the control plane for enterprise AI security. Inspecting every prompt, enforcing every policy, and auditing every decision your AI makes. AI security you can prove.

Bifrost (by Maxim AI)

Unified multi-provider AI routing+11

At Maxim, we are building an enterprise-grade AI evaluation and observability platform to empower developers to ship their applications with quality, reliability, and speed.

Bishop Fox (CAST)

Attack Surface Management

Continuous external attack surface discovery+11

Staying ahead of attackers requires thinking like one. Our offensive security approach adapts to today's evolving threats, helping you find and fix vulnerabilities before they become incidents. From mission-critical systems to AI applications, we simulate real-world attacks across your apps, cloud, devices, and infrastructure.

BotCity

No verified AI-SPM capability found+5

BotCity Sentinel provides full visibility and governance for Python and AI running on endpoints. It monitors real Python executions, including scripts created with generative AI, and shows exactly how they interact with databases, internal APIs, files, credentials, and sensitive data. Security and GRC teams gain continuous evidence, audit-ready trails, and policy control over Python activity happening outside traditional tooling. This eliminates Shadow Python, reduces data leakage and compliance

CalypsoAI (F5)

Runtime prompt injection blocking+8

CalypsoAI, acquired by F5 in 2025 and rebranded as F5 AI Guardrails (formerly Inference Defend), delivers runtime security for AI models, agents, and applications. It combines agentic red-teaming with swarms generating 10,000+ new attack prompts monthly and real-time inference-layer protection against prompt injection, jailbreaks, data exfiltration, and denial-of-service. The platform includes the CalypsoAI Security Index and Agentic Warfare Resilience leaderboards for model benchmarking, plus policy enforcement for GDPR, HIPAA, and EU AI Act compliance. Best for enterprises deploying production AI copilots, RAG apps, and autonomous agents needing continuous vulnerability testing and defense integrated with F5 ADSP.

Capsule Security

Enterprise AI agent runtime security+10

Capsule Security provides runtime security for AI agents. Using patented fine-tuned small language models, Capsule monitors autonomous AI agents in real time, detecting and stopping risky behavior before damage is done. With lightweight hook/API integration (no proxies, gateways, or SDKs), Capsule deploys in minutes and works across any agentic framework, including Coding Agents such as Cursor/Claude Code, and SaaS Agents such as Copilot Studio

Coalfire

Security Operations

Managed security services+11

Coalfire's team of cyber legends who hunt, test, and neutralize vulnerabilities before they become headlines

Cranium

AI asset discovery and inventory+6

Born from KPMG Studio, Cranium gives enterprise teams one place to discover, observe, govern, secure and prove every AI and agentic system they build, buy or rely on, so innovation never outruns trust.

Curricula

Threat-intel backed training episodes+9

Curricula, now part of Huntress Managed Security Awareness Training, provides security awareness training focused on employee behavior change through story-based lessons, phishing simulations, and reporting. In this category it is aimed at SMB and mid-market buyers that need recurring training without building a large internal program. The platform covers phishing, social engineering, password hygiene, and compliance-oriented awareness content, with assignments and tracking for administrators. It is positioned as a managed SAT product rather than a broad human-risk platform, with adjacent capabilities such as phishing simulation and reporting supporting the training workflow.

Cycode

Supply Chain Security

End-to-end software supply chain visibilityPolicy enforcement across pipelines and toolingProprietary and third-party scanner ingestion+9

AI Writes The Code. We Secure And Govern It.

Cyera

Discover sensitive data across cloud and on-premClassify structured and unstructured data+9

Cyera is a pioneer in the data security space that empowers security leaders to discover their data attack surface, control the use of data, monitor, detect, and quickly remediate risk.

DataSunrise Data and AI Security

Protect databases across cloud and on-premises+11

DataSunrise provides a unified platform for database security, auditing, and vulnerability management across heterogeneous database environments. The solution includes a database firewall, dynamic data masking, and continuous activity monitoring (DAM) to defend against SQL injection and unauthorized access. It integrates DSPM capabilities to provide visibility into where sensitive PII/PHI resides across RDS, Redshift, Snowflake, and on-prem SQL servers.

DeepKeep

Discovers AI modelsnotebooksdatasets+21

DeepKeep is a model agnostic AI security platform

Dynamo Ai

Automated AI risk evaluation and red-teaming+5

Dynamo AI specializes in the governance and security of Large Language Models (LLMs) and Generative AI agents. The platform provides automated red-teaming to identify prompt injections and jailbreaks, alongside real-time guardrails to prevent data leakage and ensure model alignment. It serves CISOs and AI leaders who need to maintain auditable compliance and safety across enterprise AI deployments.

Ermetic

CIEM

10 products

Ermetic provides a CIEM platform that discovers and analyzes human and machine identities, entitlements, and access risks across AWS, Azure, and Google Cloud. Acquired by Tenable in 2023 and rebranded as Tenable CIEM, it combines CIEM with CSPM for contextual visibility into IAM policies, network configurations, storage, and secrets. It exposes overprivileged entitlements, toxic combinations, and enforces least privilege via automated remediation and anomaly detection. Best for multi-cloud enterprises needing unified CNAPP capabilities to manage complex entitlement sprawl without agents.

Discover cloud identities and entitlements+11

FireTail

Continuous AI Discovery and Inventory+8

3 products

One platform to discover, assess, and protect all AI usage across your organization. FireTail gives you complete coverage across every employee, browser, device, application, and agent. Get the visibility, security and control you need to enable AI innovation at scale.

Gray Swan

Automated adversarial testing+5

Gray Swan is an AI security vendor best known for adversarial red-teaming and continuous testing of AI applications, with a separate runtime protection product. Within AI Security Posture Management, its strongest fit is pre-deployment and continuous assessment of LLM and agent exposures: automated probing, jailbreak and prompt-injection testing, model-behavior analysis, and security validation of tool-connected deployments. It appears aimed at enterprises and frontier-model teams that need evidence of where their AI systems break before production, rather than only post-deployment blocking. Its market position is stronger in offensive testing than in classic AI inventory or cloud posture discovery.

Groovy Security

Whiteout AI: Shadow AI discovery+8

Groovy Security helps enterprises adopt AI without losing control of their data, an AI Security Posture Management (AI-SPM) and GenAI data-protection platform built for complete visibility and inline control. We build two products. Whiteout AI is an AI interaction interception platform that inspects and enforces policy on every AI interaction in real time, across desktop, browser, IDE, MCP agents, and cloud. Its full-LLM detection engine reads context to make decisions on compliant user AI usage. Whiteout AI surfaces shadow AI, stopping sensitive data exfiltration, enforcing security guardrails, and mapping AI-specific compliance across heterogeneous AI environments. Deployed via Groovy Security or hosted by the client organization to maximize data security. Maestro: our AI-driven penetration testing platform, automates security testing across your APIs, cloud, and AI/ML pipelines. Purpose-built for a world where AI is both the innovator and the risk.

Harmonic Security

Discover AI usage and assets+9

Harmonic provides the control layer for the AI-first workforce. We empower confident adoption that secures the business without slowing down employees.

Harness

Discover AI pipelines across the cloud estate+7

Harness aims to enable every software engineering team in the world to deliver code reliably, efficiently and quickly to their users.

Helmet Security

AI asset discovery and inventory+11

We are a team of security engineers and GRC experts dedicated to making agentic workflows safe for enterprise.

HiddenLayer

Agent runtime visibility+10

At HiddenLayer, we believe AI's success depends on security. Founded by security researchers who uncovered the first-ever AI-specific malware, we've built a company dedicated to protecting the next era of intelligent systems.

Kindo

AI application and agent inventory+6

Kindo offers an enterprise-grade AI governance and orchestration platform that provides a control plane for LLM usage and agentic workflows. It unifies context across disparate AI models and operations stacks, ensuring that internal and external LLMs adhere to organizational security and compliance policies. The platform provides a full toolchain for building governed AI automation while maintaining visibility into data and model lineage.

Knostic

AI agent and coding assistant discovery and inventory

Knostic discovers and secures AI agents and coding assistants, as well as associated supply chain risks, including MCP servers, skills, IDE extensions, and rules

Lasso Security

AI model and dataset discovery and inventory+5

Lasso Security provides an AI Security Platform focused on securing AI adoption at enterprise scale, offering visibility, control, and protection across AI models, agents, and applications. Their AI-SPM module maps AI environments against NIST frameworks and OWASP Top 10, conducts misconfiguration and policy gap analysis, and assesses supply chain risks. Additional capabilities include runtime enforcement with MITRE-aligned threat detection, AI-BOM generation for inventorying agents, models, prompts, tools, and guardrails, and automated red teaming tracking. Best suited for enterprises deploying agentic AI workflows needing comprehensive observability and real-time defense.

Matters.AI

Comprehensive data visibility for AI training sets and LLMs

Powering modern security teams with AI that understands context, models intent, and protects what matters: your data, your people, your reputation.

MATVIS

AI inventory managementFull-stack attack path analysis+4

Enterprise AI is moving fast. The security infrastructure isn't keeping up.

Mend.io

Application Security (DAST/SAST)

AI-generated code scanning in repository and IDE+9

Mend.io is the security platform built for every risk, across application security and AI security, securing the code layer, the AI layer, and the attack surface between them. Continuous protection across the full AI application lifecycle.

Metomic

Data Loss Prevention (DLP)

Sensitive data discovery across SaaS apps+9

Metomic is AI data security for enterprise SaaS, the control plane for sensitive data across every SaaS tool and every AI surface. We find it, fix it, and prove it. Content-level scanning inside Slack, Jira, Confluence, Drive, SharePoint, Salesforce, and more. Automated remediation that revokes sharing, redacts PII, notifies owners, and coaches users at the point of risk. Metomic Cleanser delivers a redacted copy of sensitive content that's safe for an LLM to consume.

Mindgard

Real-time AI threat detection and response+10

Mindgard gives organizations the visibility and protection to discover, assess, and defend their AI systems and agents.

Mirror Security

Discover AI assets across environments+9

Mirror Security provides a privacy-preserving AI inference platform utilizing Fully Homomorphic Encryption (FHE) to secure Large Language Model (LLM) operations. By enabling computation on encrypted data, it eliminates the need to decrypt sensitive information before processing, effectively closing the 'inference gap' in cloud-hosted AI environments. It complements existing AI-SPM tools by adding a cryptographic layer of data protection during the execution phase of generative AI applications.

NeuralTrust

Runtime agent protection+5

NeuralTrust is an AI security platform that discovers and protects autonomous AI agents, models, and tools across an enterprise. Its runtime layer inspects every request an agent makes to models, tools, MCP servers, and data before execution, blocking prompt injection, data leakage, and unauthorized API calls in real time. The platform combines an agent gateway that enforces unified policies across homegrown apps, SaaS tools, and platforms like ChatGPT, Gemini, and Copilot, an agent discovery and posture module that inventories deployed agents and workflows, and adversarial red teaming to surface model vulnerabilities before deployment. It is built for enterprise security and compliance teams and deploys as SaaS, on premises, or hybrid, keeping the data plane local for data sovereignty.

Oligo Security

Cloud Workload Protection (CWPP)

Runtime workload protection+8

Oligo Security is primarily a runtime security vendor, not a native CSPM specialist. In cloud security evaluations, it is best understood as a platform for detecting and blocking active exploitation in cloud workloads, with emphasis on runtime context rather than posture scanning or misconfiguration management. Its cloud-security materials focus on protecting modern applications, cloud workloads, and AI systems at execution time, which makes it a fit for teams that want runtime threat detection and exploit prevention alongside other cloud security controls.

OpenAI

AI asset discovery and inventory+3

OpenAI is an AI research and deployment company. Our mission is to ensure that artificial general intelligence benefits all of humanity.

Openlayer

Runtime prompt injection detection and blocking+9

Openlayer is the AI governance platform that helps enterprises discover, test, monitor, govern, and optimize AI systems across their entire lifecycle, from prototype to production.

Operant Networks

Comprehensive AI Security Index for model resilience

Operant is built by a world-class team with decades of experience in networking, machine communications, and cybersecurity. Our founders have a track record of commercializing next-generation technologies, often creating entirely new product categories. Today, we are applying that expertise to the next frontier: trust for machine and AI communications in dynamic, distributed environments. Recognized by the U.S. Department of Energy as building "game changing" technology, Operant is pioneering Zero Trust for machines and AI, proven in critical infrastructure, and built to extend as AI reaches further into the physical world.

Opsin, Inc.

Continuously discover AI agents across enterprise environments

Opsin provides a specialized security posture management platform for enterprise AI applications like Microsoft 365 Copilot and ChatGPT Enterprise. The platform focuses on preventing sensitive data leakage and oversharing caused by overly permissive AI agent configurations or user interactions. It complements existing DLP and IAM solutions by providing granular visibility into how AI models access and expose internal organizational data.

Orca Security

Cloud Security / CSPM

Agentless cloud misconfiguration detection+11

We're on a mission to provide the world's most comprehensive cloud security platform while adhering to what we believe in: frictionless security and contextual insights, so you can prioritize your most critical risks and operate in the cloud with confidence.

OX Security

Supply Chain Security

Software supply chain attack reference framework

OX Security is an enterprise software supply chain security platform that focuses on securing code, dependencies, build pipelines, and container artifacts across the SDLC. It emphasizes end-to-end traceability from code to runtime, continuous verification of pipeline integrity, and consolidation of findings into a single dashboard for triage and response. OX appears strongest for teams that want software supply chain controls and visibility without sending source code to third-party services, and it also offers adjacent application security and ASPM capabilities.

PhishFirewall

AI-generated phishing simulations customizable by tone, industry, and language to mimic real-world threats

PhishFirewall Analytics is a commercial phishing simulation tool designed to help security teams assess and reduce human cyber risk through realistic, AI-generated attack scenarios. It specializes in customizable simulations by tone, industry, and language, paired with real-time user behavior tracking during campaigns. The platform enables risk-based targeting, automated follow-up training, and detailed analytics tied to human risk reduction. Best suited for mid-to-large organizations seeking to strengthen security awareness without complex deployment, it operates within the broader Human Risk category. While adjacent products may exist, PhishFirewall Analytics is focused exclusively on phishing simulation capabilities.

Pillar Security

Pillar Security provides an AI security platform designed to discover, govern, and secure AI agents across an organization. It offers capabilities to map AI landscapes, assess risks, red team AI systems, enforce data policies, and apply adaptive runtime guardrails for AI applications, models, and agents. The platform aims to ensure compliance and provide real-time protection against AI-specific threats.

AI Discovery & Posture+3

Ploy

Automated AI model discovery and inventory+11

Ploy is an identity governance layer that sits on top of your IdP (Okta/ Entra etc.) to help you control access across the apps that matter - including the long tail outside SSO. We help customers understand who has access to what, automate JML changes, streamline access reviews and access requests, and keep audit evidence ready without relying on spreadsheets or ticket-chasing.

Polygraf

Real-time AI prompt inspection+11

We provide on-premise, zero-trust AI that detects deepfakes, prevents data leaks, and ensures compliance.

Privicore

AI asset discovery and inventoryAI configuration and exposure scanningTraining data and model classification+3

The Data Control Layer™ for the AI Era

Promptfoo

Automated red-teaming for AI applicationsDynamic adaptive scan generation+7

Promptfoo helps developers and enterprises build secure, reliable AI applications.

Protectt.ai Labs Pvt. Ltd.

Mobile Security

Runtime Application Self-Protection (RASP)+8

Protectt.ai is an AI-native mobile app security platform that provides comprehensive protection for mobile applications, devices, and financial transactions. It offers an integrated XDR-style approach for mobile, featuring Runtime Application Self-Protection (RASP), mobile threat defense (MTD), and advanced fraud control. The platform is designed to secure banking, insurance, and retail apps against sophisticated mobile malware and social engineering.

Push Security

AI asset discovery and inventory+7

Push is the most powerful AI-native security tool in the browser. Combining high-fidelity telemetry, real-time control, and autonomous security agents, Push stops advanced browser-native attacks, provides full visibility and control over AI usage, hardens identity attack surfaces, and enables deep investigations, all from your users’ existing browsers, no migration required.

Qevlar AI

Get full visibility into deployed AI models and tools+6

Our mission is to help security teams move beyond the endless cycle of alert triage and focus on what actually makes organizations safer.

Ray Security

Discover AI assets across environments+8

Ray Security provides the first remediation-focused data security platform that delivers visibility and real-time control over how data is accessed, by users, applications, LLMs, AI agents, and shadow AI, and automatically remediates risky or unnecessary exposure, reducing data risk and ensuring access remains aligned with actual usage.

Relyance AI

Continuous sensitive data discovery+10

To secure the future of data-driven enterprises by making every data journey visible, controlled, and compliant, from the first line of code to the final AI output.

Replica Cyber

AI model and dataset discovery+6

At Replica Cyber, we're driven by an unwavering commitment to protecting life in the digital world. We simplify complex isolated environments, fusing patented protection with counterintelligence tradecraft to enable high stakes activities at scale.

Resemble AI

Discover AI models and services+10

the only platform securing enterprise generative AI from creation through distribution, across every modality where synthetic media gets used to deceive.

Sangfor Technologies

Firewall / NGFW

AI-based malware detection+10

Sangfor Technologies’ Network Secure is its firewall/NGFW product, positioned around application-layer control, malware inspection, and integrated web application protection. In this category it combines traditional NGFW functions with malware detection, intrusion prevention, application control, and NG-WAF capabilities in a single appliance. It is best suited for enterprises that want perimeter enforcement plus web application and ransomware-focused controls without adding separate firewall and WAF stacks. Sangfor also pairs the firewall with its own endpoint and network security products for correlated response, but those adjacent capabilities are secondary in this profile.

SCANOSS

Vulnerability Management

Find vulnerabilities in source code and binaries+9

SCANOSS finds the cryptography in your source code, the part PKI tools and certificate managers can't see. Crypto Finder scans Java, Python, Go, and C across both proprietary and open source codebases, identifying cryptographic algorithms and producing a CycloneDX CBOM ready for post-quantum migration planning. The visibility your dependency scanners and certificate inventories miss. Built for CI/CD, developed in collaboration with IBM.

Seceon

Agentic SOC & Investigations

Autonomous alert triage+11

Seceon is a cybersecurity platform vendor positioned for SOC operations, with its aiSOC/aiSIEM and SOC automation offerings used for alert triage, investigation, threat hunting, and response orchestration. In the Agentic SOC & Investigations scope, its pitch centers on correlating logs, flows, identities, cloud, endpoint, and application data to reduce manual analyst work and speed incident decisions. It is best suited for MSSPs, MDR providers, and enterprise SOCs that want multi-tenant operations and automated investigation workflows rather than an endpoint-only tool.

Securiti

Privacy & Consent Management

9 products

At Securiti, our mission is to enable organizations to safely harness the incredible power of Data & AI.

Website cookie scanning and consent banner integration

SolidCore.ai

Real-time GenAI usage visibility+8

Every company should be able to innovate with AI as confidently as they build in the cloud. Generative AI adoption can be safe, accountable, and scalable -- when organizations have the visibility and control they need to manage risk, meet compliance standards, and build trust.

Sonatype

Supply Chain Security

Open source component scanning+11

Sonatype handles the complexity of managing open source software and AI behind the scenes so teams stay focused on innovation, not maintenance.

SplxAI

Real-time prompt injection and jailbreak detection+11

SPLX helps global enterprises secure AI systems end-to-end, with scalable red teaming, real-time threat protection, and automated AI compliance and governance.

Straiker

AI agent inventory discovery+6

Straiker is an agentic AI security vendor whose AI-SPM offering centers on discovery and posture management for AI agents rather than general cloud posture. Its Discover AI product inventories AI agents, MCP servers, tools, and integrations, then surfaces misconfigurations, risky permissions, and unsafe connections across builder platforms and coding agents. Straiker is best suited for security teams that need visibility into agent sprawl and exposure in environments using Bedrock AgentCore, Azure Foundry, Copilot Studio, Cursor, Claude Code, or GitHub Copilot. The company also sells adjacent runtime protection and red-team modules, but those are outside AI-SPM scope.

SurePath AI

Govern generative AI deployments+8

For continuous command over AI risks, F5 delivers the most adaptable platform for securing AI apps, models, agents, and the APIs connecting them.

Sweet Security

Container Security / CNAPP

Real-time posture change monitoring+9

Sweet Security is redefining enterprise cloud protection. As the leading provider of Runtime CNAPP and AI Security solutions, Sweet unifies runtime context with advanced AI intelligence to protect the modern enterprise.

ThreatLens

Agentic SOC & Investigations

AI-agent-driven autonomous investigation+10

ThreatLens builds AI-augmented security products that help organizations investigate threats, secure AI adoption, and make evidence-backed decisions across modern security operations.

TrendAI

AI stack discovery and inventory+6

TrendAI’s AI Security Posture Management (AI-SPM) capability is part of Trend Vision One and is positioned to give security teams visibility into the cloud assets used to build AI services, including threats, misconfigurations, and attack paths. Trend Micro describes it as helping organizations understand the AI-related cloud assets in use and the security status of those assets through interactive dashboards and tables. It is best suited for enterprises already using cloud-based AI services and wanting posture visibility across AI build environments rather than runtime enforcement. TrendAI also markets adjacent platform capabilities outside this scope.

TrojAI

AI asset discovery and inventory+4

TrojAI is a Canadian AI security vendor focused on securing AI models, applications, and agents across build-time and runtime, with a separate emphasis on AI model testing and policy enforcement. Within AI Security Posture Management, its Detect capability is the relevant fit: it red teams models before deployment to surface behavioral risks and remediation guidance. The vendor is a stronger fit for enterprises that need pre-deployment AI risk assessment and controls around model behavior rather than a pure inventory-only posture tool. Adjacent runtime defense products exist, but they are outside this AI-SPM scope.

UpGuard

Compliance & GRC

9 products

UpGuard is a cybersecurity vendor whose platform includes GRC-adjacent workflows, but it is primarily positioned around cyber risk posture and third-party risk rather than a full enterprise GRC suite. In a Compliance & GRC evaluation, it is best suited to teams that need continuous vendor risk monitoring, compliance tracking, and automated evidence-style workflows tied to security posture. UpGuard says it can track risk reduction against major compliance standards and support board-ready security ratings, making it useful for mid-market organizations and lean security teams that need ongoing assurance across suppliers and external exposure.

Vendor risk assessment workflows+11

Valence Security

SaaS Security Posture Management (SSPM)

SaaS application discovery and inventory+10

Valence Security offers a comprehensive SaaS Security Posture Management (SSPM) platform that extends into AI governance and identity threat detection. It provides deep visibility into SaaS-to-SaaS integrations, OAuth tokens, and AI agent permissions to reduce the surface area for supply chain attacks. The platform automates the remediation of misconfigurations and overly permissive shares in applications like Microsoft 365, Salesforce, and Slack.

Varonis

Discover and classify sensitive data+10

Varonis is a data security platform vendor positioned in DSPM for enterprises that need to find, classify, and control sensitive data across cloud, SaaS, and on-premises stores. Within DSPM, it emphasizes data discovery, permission and exposure analysis, sensitive data flow visibility, and automated remediation of risky access paths. Varonis is best suited for security teams managing large, mixed data estates in Microsoft 365, file shares, databases, and cloud object storage. Its broader platform also includes adjacent insider risk and threat detection capabilities, but the DSPM scope centers on data posture and exposure reduction.

Vega

Scan cloud estates for AI inventory+9

Vega delivers federated and AI-native search, detection, and investigation that strengthens coverage, speeds response, and gives SecOps unified access to all security data through its Security Analytics Mesh (SAM) platform. By analyzing data where it already lives, Vega eliminates blind spots, data silos, ingestion fees, migration headaches, and vendor lock-in. ]

Verno Labs

Adversarial testing for AI agents+4

We're building the offensive AI that the next decade of enterprise security will depend on, and putting it in the hands of the companies who can't afford to wait.

Versa Networks

Firewall / NGFW

9 products

Versa Networks, the leader in SASE, combines extensive security, advanced networking, full-featured SD-WAN, genuine multitenancy, and sophisticated analytics via the cloud, on-premises.

Stateful firewall traffic control+11

Vijil

Runtime prompt injection and jailbreak defense+4

Vijil is the trust infrastructure that enterprises need to use AI agents with reliability, security, and safety.

Votal AI

Continuous AI model discovery+6

Secure every AI interaction, from prompt to tool call, guardrails, identity, data policies, and tool authorization in real time.

Wiz

Cloud Security / CSPM

Agentless multi-cloud inventory discovery+11

Wiz is a cloud security posture management (CSPM) platform that detects and remediates misconfigurations across multi-cloud environments (AWS, Azure, GCP) and infrastructure-as-code templates. The platform uses agentless API-based scanning to inventory cloud assets and correlate risks across network exposures, secrets, vulnerabilities, and identities via a graph-based engine. Wiz is positioned as a modern CSPM alternative to legacy point tools, ranked among top CSPM solutions for enterprises managing complex cloud deployments.

XBOW

Autonomous offensive security testing+6

XBOW is best known as an autonomous offensive security platform, not a dedicated AI Security Posture Management vendor. Based on its public positioning, it focuses on finding exploitable weaknesses through automated testing rather than on inventorying AI models, datasets, notebooks, or AI supply-chain exposure. For buyers evaluating AI-SPM, XBOW would be relevant only if they want adversarial validation of AI-facing attack surfaces as part of a broader security program. It is better suited to security teams that want offensive verification of exposure than to teams seeking AI asset discovery and posture tracking.

XM Cyber

Attack Surface Management

Continuous external asset discovery+11

XM Cyber is a leader in exposure management that uses attack path modeling to show how attackers can navigate hybrid cloud and on-prem environments. By combining vulnerability data, misconfigurations, and identity exposures, it prioritizes remediation based on the actual risk to critical assets. It replaces static vulnerability scanners with continuous, graph-based security validation to identify the 'choke points' that matter most to an attacker.

Zenity