Cloud posture (CSPM/CNAPP)

Behavioral AI email threat detectionAPI-based cloud email protection+10

Behavioral AI that protects email, identity, and AI, and stops insider threats.

Acalvio Technologies

Deception Technology

Deploy dynamic enterprise decoys+10

Acalvio is the leader in autonomous cyber deception, defending against APTs, insider threats, and ransomware. Its AI-powered Preemptive Cybersecurity Platform, protected by 25 patents, delivers threat detection across IT, OT, and cloud environments and advances Identity Threat Detection and Response (ITDR) with Honeytoken-driven Zero Trust security.

Aikido Security

Real-time malware detection+10

All the security tools we used were slow, confusing, overpriced and noisy. So we built better ones.

AirMDR

Endpoint Detection & Response (EDR)

AI virtual analyst for MDR triage+11

We're passionate about delivering awesome detection and response to security teams of all sizes.

AlgoSec

Network Access Control (NAC)

Policy-based network access enforcement+11

AlgoSec provides a security policy management platform that automates the orchestration of connectivity and security policies across hybrid cloud and on-premise environments. It provides deep visibility into complex network topologies, enabling automated risk analysis and firewall rule changes without manual intervention. The platform replaces manual CLI-based firewall management and integrates with ITSM tools to streamline security operations.

Anchore

SBOM generation and analysisContinuous SBOM vulnerability monitoring+9

Anchore is creating a more secure software supply chain for priceless peace of mind.

AppOmni

SaaS Security Posture Management (SSPM)

Agentless SaaS configuration monitoring+11

AppOmni is positioned as a SaaS Security Posture Management (SSPM) platform, not a traditional multi-cloud CSPM vendor. The search results consistently clarify that AppOmni focuses on SaaS application security posture (Salesforce, Microsoft 365, ServiceNow, Google Workspace, Workday) rather than cloud infrastructure (AWS, Azure, GCP). While AppOmni uses CSPM terminology in legacy marketing, it does not compete in the infrastructure CSPM category. For cloud infrastructure posture management, AppOmni integrates with true CSPM solutions like Wiz. Organizations seeking multi-cloud IaC scanning, drift detection, and infrastructure misconfiguration remediation should evaluate dedicated CSPM vendors, not AppOmni.

Aqua Security

Real-time cloud risk prioritization+11

Aqua Security’s CSPM offering is a multi-cloud posture management product that uses cloud API access and agentless checks to inventory resources, detect misconfigurations, and map findings to compliance requirements. It is positioned for organizations operating AWS, Azure, Google Cloud, and Oracle Cloud that want continuous visibility into cloud configuration drift and prioritization of high-risk issues. Aqua also emphasizes real-time context and correlation of findings to reduce alert noise. The company sells a broader cloud security platform, but this profile is limited to its CSPM capabilities.

ARMO Kubescape

Kubernetes cluster misconfiguration scanning+8

Zero-day and every day protection for your cloud applications with the first runtime behavioral Cloud Application Detection and Response (CADR) solution. A fully explainable & traceable runtime security story spanning the entire cloud technology stack.

Aryon

Deployment-time policy enforcement+8

We're Making it Possible for Everyone to Proactively Secure Complex Cloud Environments.

AWS

Encryption & Key Management

16 products

AWS Key Management Service (AWS KMS) is AWS’s managed encryption key service for creating, storing, and controlling cryptographic keys used to protect data in AWS workloads and applications. It is positioned for organizations that want key lifecycle control without running their own HSM fleet, and it uses FIPS 140-3 Level 3 validated HSMs under the service boundary. Buyers typically use it for envelope encryption, application signing, and server-side encryption across AWS services. It is best suited to teams standardizing key governance inside AWS rather than managing separate on-premises key systems.

Create and control KMS keys+10

Bitdefender

Endpoint Detection & Response (EDR)

11 products

At Bitdefender, cybersecurity isn't just what we do, it's who we are. For over two decades, we've been at the forefront of protecting individuals, businesses, and governments against sophisticated cyber threats and attacks. Our AI-driven technologies and world class security expertise make us a trusted partner in safeguarding what matters most.

Automated cross-endpoint attack correlation+10

Blast

Agentless multi-cloud misconfiguration scanning+4

Blast is a preemptive cloud defense platform that shifts security from reactive monitoring to proactive prevention by leveraging native cloud infrastructure controls. It automates the implementation of guardrails that limit blast radius and enforce least-privileg access at the network and identity layers. By turning complex cloud configurations into preventive policies, it reduces the operational burden of manual remediation of misconfigurations.

Blast Security

Native multi-cloud guardrail enforcement+8

Blast Security is a cloud security posture management vendor that positions its product as a preemptive cloud defense platform. Within CSPM, it focuses on agentless, API-based assessment of cloud configurations and translating security intent into preventive guardrails across AWS, Azure, GCP, and Kubernetes. The company appears oriented toward enterprises and platform/security teams that want to reduce misconfigurations and enforce policy before changes reach production. Its public materials emphasize native cloud controls, continuous validation, and pre-enforcement simulation rather than runtime protection or adjacent cloud security categories.

Chainguard

Secure-by-default container images+11

Chainguard provides minimal, distroless container images rebuilt daily from source, achieving 97.6% fewer CVEs than open source alternatives, with SLSA provenance, cryptographic signing, and verification enforcement at registry promotion and cluster admission. Over 1,800 images include 400+ FIPS-validated and STIG-hardened variants for regulated environments, backed by 7-day SLA for critical CVE remediation. Positioned as a secure-by-default OSS provider for supply chain integrity, best suited for DevOps teams in Kubernetes environments prioritizing runtime verification, least-privilege containers, and compliance like CMMC.

Checkmarx

Dynamic application security testing for web apps and APIs

Checkmarx One is an application security software platform built to help enterprises secure every stage of the SDLC while reducing engineering costs and accelerating development. As a leader in agentic application security testing, Checkmarx scans trillions of lines of code each year, helping organizations cut vulnerability density by more than half. Its autonomous security agents detect, prioritize, and counter AI-driven threats across legacy, modern, and AI-generated code at enterprise scale.

Check Point

Multi-cloud posture management+11

Check Point Software Technologies is a global leader in cyber security solutions, dedicated to protecting corporate enterprises and governments worldwide.

Copperhelm

Autonomous threat investigation agents+5

Copperhelm builds an agentic cloud security platform for enterprise security teams that replaces manual cloud security workflows with purpose-built AI agents. The agents connect to live cloud workloads, inspect running processes, map network topology, and continuously monitor for threats. A proprietary component called the Context Lake structures and connects cloud telemetry across environments so the agents can ground their investigations in accurate context before acting. When a threat is confirmed, agents can execute remediation in real time, including deploying targeted protections such as WAF rules, without causing workload downtime. The company reports paying customers including Fortune 500 enterprises. Copperhelm emerged from stealth in April 2026 with 7 million dollars in seed funding led by TLV Partners.

Curricula

Security Awareness & Phishing Simulation

Threat-intel backed training episodes+9

Curricula, now part of Huntress Managed Security Awareness Training, provides security awareness training focused on employee behavior change through story-based lessons, phishing simulations, and reporting. In this category it is aimed at SMB and mid-market buyers that need recurring training without building a large internal program. The platform covers phishing, social engineering, password hygiene, and compliance-oriented awareness content, with assignments and tracking for administrators. It is positioned as a managed SAT product rather than a broad human-risk platform, with adjacent capabilities such as phishing simulation and reporting supporting the training workflow.

CybrHawk

Agentic SOC & Investigations

Natural-language SOC investigation+8

CybrHawk is a leading provider of cybersecurity solutions. Our offerings help organizations to get their cyber-defences attuned to stall, manage, mitigate and prevent breaches. Our solutions help detect real time suspicious activities and respond quickly to prevent breaches besides predicting possible threats. Our solutions are designed to get better off the problems.

Cynerio

IoT Security

Discover connected medical and IoT devices+11

Cynerio provides healthcare-focused IoT security for hospitals and other healthcare delivery organizations. Its platform discovers connected medical and IoT devices, classifies them, learns normal communication patterns, and identifies anomalous or malicious activity on the network. The product is strongest in clinical environments where device criticality, patient-care workflows, and uptime constraints matter. It is best suited for healthcare security teams that need device visibility, risk context, and policy enforcement for medical devices without relying on endpoint agents.

Cyngular

Cloud Investigation and Response Automation (CIRA)

The Agentic SOC of the AI era, a mesh of autonomous AI agents that detect, hunt, investigate, deceive, resolve and report, end-to-end.

Darktrace

Network Detection & Response (NDR)

Continuously monitors network traffic+11

Darktrace is a network detection and response vendor centered on self-learning behavioral analytics for north-south and east-west traffic. Its NDR product baselines normal activity for users, devices, and segments, then flags anomalous connections, command-and-control behavior, data transfer outliers, and other suspicious network patterns in on-premises, cloud, and hybrid environments. The platform is aimed at teams that need visibility beyond endpoint telemetry and want automated investigation and containment for network-level threats, including encrypted traffic and novel attack paths. Darktrace also sells adjacent security products, but this profile is limited to NDR capabilities.

Dawnguard

Validates cloud architectures against security and compliance requirements before deployment, reducing the chance of shipping insecure AWS, Azure, or GCP designs.Provides multi-cloud posture checks for misconfigurations and policy violations across cloud environments rather than a single-account or single-provider view.

Building the next-gen platform that makes security easy from day one

Echo

Automated vulnerability scanningIdentification of known vulnerabilities+7

Echo is creating the trusted source for agentic-ready software.

Edera

Runs each containerized workload in a separate lightweight micro-VM zone using a container-native Type-1 hypervisor to block escape-to-host and cross-pod breakout paths.

Edera is a container security vendor centered on hardened runtime isolation for Kubernetes workloads. Its core product uses a container-native Type-1 hypervisor to place each workload in its own lightweight zone, aiming to prevent container escapes, kernel-exploit breakout paths, and lateral movement while keeping Kubernetes compatibility. Within Container Security / CNAPP, Edera is best suited for teams that need strong runtime isolation for multi-tenant, regulated, or AI training and inference workloads. It is not primarily a CSPM or identity-management platform.

Elastic

SIEM

Centralized security event collection+8

Elastic Security provides an open-source SIEM platform built on the Elastic Stack (Elasticsearch, Logstash, Kibana, Beats) for collecting, indexing, and analyzing security logs from endpoints, networks, clouds (AWS, Azure, Google Cloud), and firewalls. It supports ECS-compliant index mappings, threat detection via KQL queries for brute force and lateral movement, correlation rules for multi-stage attacks, IOC matching with enrich policies, and Watcher-based alerting. Best for SOC teams needing scalable search analytics, real-time monitoring, and integration with EDR, XDR, SOAR in resource-constrained environments.

Endor Labs

OSS dependency governance+11

Endor Labs is a software supply chain security platform focused on open source governance and CI/CD risk detection. The platform targets DevSecOps teams seeking to reduce alert fatigue while maintaining security posture. Endor Labs distinguishes itself through reachability analysis that eliminates up to 95% of false positives in vulnerability scanning, enabling developers to focus on exploitable risks. The vendor positions itself against traditional SCA tools by providing contextual intelligence on code usage patterns and safe upgrade paths.

Fasoo

Data Security Posture Management (DSPM)

Discover sensitive data across hybrid environmentsClassify sensitive data and data locationsIdentify data security posture risks+5

Building Digital Trust, and More

Fencer

Continuous DAST scanningBlack-box runtime probingExact finding location+8

Fencer is the platform we wish we had.

Fluid Attacks

Static application security testing from source code

Since 2001, Fluid Attacks has been committed to growing as a team and developing its own technology to contribute to global cybersecurity.

Fortinet

Firewall / NGFW

Next-generation firewall inspection+10

Fortinet’s FortiGate line is the company’s Firewall/NGFW offering, covering stateful firewalling, application control, IPS, web filtering, SSL/TLS inspection, and threat-intelligence-backed blocking. It is widely deployed from branch and edge sites to enterprise perimeter and segmentation use cases, with hardware, virtual, and cloud form factors managed through the same Fortinet policy stack. Buyers typically choose it when they need firewall enforcement plus inline inspection and VPN capability in one appliance, especially in environments that already use FortiGuard threat feeds or the Fortinet Security Fabric. Adjacent products include SD-WAN and ZTNA, but those are not the core scope here.

Mesh Security

Agentless multi-cloud posture scanning+10

Mesh Security provides a Cybersecurity Mesh Architecture (CSMA) platform that serves as a horizontal execution layer across the security stack. It connects siloed security tools (IAM, SaaS, Cloud, Core) to provide visibility into cross-domain attack paths. The platform maps identities to sensitive assets to identify and eliminate high-risk lateral movement paths that point products often miss.

Microsoft

Agentless vulnerability scanning+21

15 products

Microsoft Defender for Cloud is a multicloud CSPM platform that provides continuous security posture assessment across Azure, AWS, and GCP. It delivers agentless vulnerability scanning, misconfiguration detection, and compliance monitoring against industry benchmarks (CIS, NIST, ISO, PCI-DSS). The platform generates hardening recommendations ranked by risk and includes attack path analysis to identify exploitable chains. Defender for Cloud serves enterprises managing hybrid and multicloud infrastructure seeking unified posture visibility and compliance reporting.

Minimus

Hardened container image delivery+7

We're a team of security nerds and passionate innovators, committed to our customers.

Mitiga

Panoramic AwarenessAttack Decoding+2

Mitiga is a cloud detection and response vendor focused on detecting, investigating, and containing active threats across cloud, SaaS, identity, and AI environments. Its CDR platform emphasizes zero-impact breach prevention, with cloud-native telemetry analysis, attack reconstruction, and guided response for SecOps teams that need visibility beyond CNAPP and posture tools. Mitiga positions itself for enterprises with distributed, multi-cloud and SaaS-heavy footprints that need forensic context and rapid triage without requiring deep cloud expertise.

NAKIVO

Backup & Disaster Recovery

Image-based incremental backup+10

NAKIVO provides Backup & Replication software focused on VM-centric data protection and disaster recovery orchestration for VMware vSphere, Microsoft Hyper-V, Nutanix AHV, Proxmox VE, and Amazon EC2 environments. It supports real-time replication with RPO up to 1 second, application-aware processing for Microsoft Exchange, Active Directory, and SQL Server, and Site Recovery workflows for automated failover and failback sequences. Key features include backup copy jobs for offsite storage, Grandfather-Father-Son retention up to 30 recovery points, screenshot verification of replicas, and immutability on Linux/cloud repositories. Best suited for mid-sized enterprises needing integrated backup, replication, and DR automation to meet NIST/NIS2 compliance.

Nullify

Cloud Workload Protection (CWPP)

Nullify is an application security platform centered on SAST and DAST workflows, with continuous code scanning and live endpoint testing aimed at finding exploitable issues before merge or release. Its code analysis covers 16 languages plus Terraform, CloudFormation, and Kubernetes manifests, while its dynamic testing API and CLI target running web apps and APIs. It is positioned for small security teams and developer-first organizations that want vulnerability discovery and remediation in one workflow rather than separate scanners and manual triage.

AI code security SAST+10

Oligo Security

Runtime workload protection+8

Oligo Security is primarily a runtime security vendor, not a native CSPM specialist. In cloud security evaluations, it is best understood as a platform for detecting and blocking active exploitation in cloud workloads, with emphasis on runtime context rather than posture scanning or misconfiguration management. Its cloud-security materials focus on protecting modern applications, cloud workloads, and AI systems at execution time, which makes it a fit for teams that want runtime threat detection and exploit prevention alongside other cloud security controls.

OPSWAT

Detect and report installed software vulnerabilities

OPSWAT prevents known, unknown, and AI-generated threats from reaching the systems the world depends on. The MetaDefender Platform, OPSWAT's AI-powered cybersecurity solution, secures every file, device, and data transfer across IT, OT, and cross-domain environments.

Orca Security

Agentless cloud misconfiguration detection+11

We're on a mission to provide the world's most comprehensive cloud security platform while adhering to what we believe in: frictionless security and contextual insights, so you can prioritize your most critical risks and operate in the cloud with confidence.

OX Security

Software supply chain attack reference framework

OX Security is an enterprise software supply chain security platform that focuses on securing code, dependencies, build pipelines, and container artifacts across the SDLC. It emphasizes end-to-end traceability from code to runtime, continuous verification of pipeline integrity, and consolidation of findings into a single dashboard for triage and response. OX appears strongest for teams that want software supply chain controls and visibility without sending source code to third-party services, and it also offers adjacent application security and ASPM capabilities.

Palo Alto Networks

Firewall / NGFW

21 products

Palo Alto Networks is a major vendor in the Firewall / NGFW market, best known for PAN-OS-based next-generation firewalls and Cloud NGFW. Its firewalls combine application-aware policy, user-based controls, and threat prevention to inspect traffic, including encrypted sessions, and block known and unknown threats. It fits enterprises that need granular segmentation, internet edge protection, and consistent policy across physical and cloud deployments. Adjacent offerings exist, but the core firewall line remains centered on network traffic control, inspection, and prevention.

Active-passive firewall high availability+22

Parameter

Penetration Testing & Red Team

Penetration testing services+8

Software is changing faster than ever. We're building security that evolves with it: continuous, autonomous, and always on.

Plerion

Code SecurityCloud Security Posture Management (CSPM)AI Security+1

We simplify cloud security

Proofpoint 365 Total Protection

Security Awareness & Phishing Simulation

Automated awareness benchmarking+10

Proofpoint 365 Total Protection is a Microsoft 365 security suite that includes built-in security awareness training and adaptive phishing simulations for user behavior testing. In the security awareness scope, it is positioned around realistic spear-phishing exercises, multilingual phishing tests, and reporting-focused training for Microsoft 365 customers, including MSP-managed environments. It fits buyers that want awareness content tied to Proofpoint threat intelligence and user-risk measurement without adopting a separate standalone awareness platform. Adjacent Microsoft 365 security functions exist in the broader bundle, but are outside this scope.

Prowler

Agentless multi-cloud security assessmentsContinuous cloud compliance monitoringCloud misconfiguration and exposure checks+9

Building a transparent, open, secure future.

Qualys

Continuous vulnerability scanningCloud-based asset discovery+9

Qualys provides Vulnerability Management, Detection and Response (VMDR), a cloud-based platform that automatically discovers assets across on-premises, cloud, and mobile environments, including unmanaged devices. It scans for vulnerabilities using over 20,000 checks from its Vulnerability KnowledgeBase, correlates findings with threat intelligence and machine learning to prioritize risks on critical assets, and detects indicators of compromise. VMDR supports hybrid IT scanning from a single console, generates role-based reports for compliance, and integrates with ticketing systems for automated remediation workflows. Best for enterprises needing continuous visibility and prioritization in complex, distributed networks.

Rapid7

Asset discovery and vulnerability scanning+11

11 products

Rapid7 is a global leader in AI-powered managed cybersecurity operations, trusted to advance organizations' cyber resilience. Open and extensible, the Rapid7 Command Platform integrates security data, enriching it with AI, threat intelligence, and 25 years of expertise and innovation to reduce risk and disrupt attackers.

Reco

AI Runtime & Agent Security

Runtime prompt and tool-call inspection+9

Reco is the leader in Agentic Ecosystem Security, securing everything around the agent, not just the prompt.

Resourcely

Continuously scans cloud misconfigurations+8

Resourcely enables platform, security, and DevOps engineering teams to offer simple self-service to their developers. Self-service allows developers to move at the speed of the cloud while ensuring that best practices are met. Resourcely guardrails ensure infrastructure is set up correctly the first time, reducing fix campaigns and vulnerability management toil.

Seceon

Agentic SOC & Investigations

Autonomous alert triage+11

Seceon is a cybersecurity platform vendor positioned for SOC operations, with its aiSOC/aiSIEM and SOC automation offerings used for alert triage, investigation, threat hunting, and response orchestration. In the Agentic SOC & Investigations scope, its pitch centers on correlating logs, flows, identities, cloud, endpoint, and application data to reduce manual analyst work and speed incident decisions. It is best suited for MSSPs, MDR providers, and enterprise SOCs that want multi-tenant operations and automated investigation workflows rather than an endpoint-only tool.

SecureVisio

SIEM

Risk-Based Prioritization+3

SecureVisio connects the dots between Incidents, Vulnerabilities, Assets, and Risks, empowering your team with AI-assisted guided response and risk-based prioritization. We give your teams the insight, automation, and context they need to act decisively.

SentinelOne

Endpoint Detection & Response (EDR)

Behavioral AI threat detection+11

At SentinelOne, we exist for those who protect what matters most. We believe security should be intelligent, unified, and always on.

Skyhawk Security

Continuously scan cloud resources for misconfigurations

Skyhawk Security offers a cloud-native platform focused on preemptive threat detection and automated incident response through its AI-based 'Purple Team' engine. It contextualizes cloud security events and CSPM alerts to eliminate alert fatigue and identify actual runtime threats before they lead to data breaches. The platform integrates with existing cloud logs and security tools to provide a unified view of exposure and active threats across Multi-cloud environments.

Skyhigh Security CASB

CASB (Cloud Access Security Broker)

Discover unsanctioned cloud services+11

Skyhigh Security CASB is a cloud-based, multi-tenant Cloud Access Security Broker that deploys via forward and reverse proxy modes for real-time control over sanctioned and unsanctioned cloud services. It leverages the Cloud Registry for 50+ attribute risk assessments across 20,000+ services, enabling discovery, classification, and remediation. Key capabilities include DLP policy enforcement synced with endpoint DLP, machine learning-based UEBA for insider threat detection, malware analysis, configuration auditing against benchmarks with automated remediation, and contextual access controls. Best suited for enterprises needing comprehensive visibility and governance across hybrid cloud environments with SharePoint integration.

Snyk

Static application security testing for source code

Snyk is an application security platform providing SAST (static code analysis), DAST (runtime testing), and SCA (software composition analysis) capabilities integrated into CI/CD pipelines. The vendor targets development teams seeking to embed security early in the SDLC, from first commit through production deployment. Snyk's AI-native approach uses machine learning to reduce false positives while detecting complex vulnerabilities across proprietary code, open-source dependencies, containers, and infrastructure.

Sophos

Data Loss Prevention (DLP)

12 products

Sophos defeats cyberattacks with an adaptive AI-native open platform and unmatched security expertise.

Monitor and restrict sensitive file transfersConfirm or block file transfers+10

Spyderbat

Kernel-level Runtime Visibility & Root Cause AnalysisBehavioral Threat DetectionAutomated Response & Control+1

Threat Detection, Investigation, and Response for Cloud, Kubernetes, and Linux

Stackrox by Red Hat (OpenShift Container Security)

Automated container image vulnerability scanning+8

We work alongside a global community of contributors, customers, and partners to bring the best ideas to life. This process delivers flexible hybrid cloud solutions, like Linux®, AI, virtualization, and automation, giving critical organizations the consistency, choice, and control to innovate with confidence.

Stream.Security

Real-time cloud threat and exposure modeling+8

StreamSecurity.com helps you spot risk, get matched with vetted security professionals, and harden what matters, without the jargon.

Strike48

Agentic SOC & Investigations

Autonomous AI agent triage and investigation+6

Strike48 is the Agentic Log Intelligence Platform built to give AI agents complete visibility into your environment and the autonomy to act on what they find.

SubImage

Cloud posture checksAttack path analysis+9

SubImage is an open-core cloud security graph product that maps infrastructure across cloud and on-prem environments and presents CSPM-style posture checks through a queryable graph. In the CSPM scope, it focuses on agentless discovery, misconfiguration detection, compliance mapping, and attack-path analysis so teams can see which issues create real exposure. It appears best suited for security teams that want graph-based context and precise remediation guidance rather than a standalone checklist scanner. The vendor also references CNAPP and PAM capabilities, but its core CSPM value is posture visibility and path-based prioritization.

Sumo Logic

SIEM

Cloud-native security analytics+8

Intelligent Operations for the AI era. Agentic AI-powered security and cloud analytics to automate, detect and investigate at the speed of now.

Sweet Security

Real-time posture change monitoring+9

Sweet Security is redefining enterprise cloud protection. As the leading provider of Runtime CNAPP and AI Security solutions, Sweet unifies runtime context with advanced AI intelligence to protect the modern enterprise.

Sysdig

Graph-based cloud risk correlationContinuous cloud posture monitoringAgentless cloud asset scanning+9

Cloud security with zero compromise.

Tigera Calico

Container image assurance scanningRuntime threat defense for workloads+10

Secure your Kubernetes workloads. Govern your AI agents.

Trend Micro

Data Loss Prevention (DLP)

11 products

Trend Micro offers integrated Data Loss Prevention (DLP) functionality embedded within its broader endpoint security and email security platforms. The iDLP module provides lightweight agent-based monitoring across endpoints, email, USB devices, and web channels without requiring dedicated hardware. Trend Micro positions DLP as a cost-effective alternative to standalone enterprise solutions, leveraging pre-built regional and industry-specific policy templates. Best suited for organizations already invested in Trend Micro's endpoint protection or email security infrastructure seeking consolidated data protection without additional management overhead.

Monitor data movements on user devices+11

Tromzo

Automated vulnerability triage and prioritization+10

Tromzo is a vulnerability management platform focused on triage, ownership assignment, prioritization, governance, and remediation reporting across software delivery environments. In this category, it correlates findings from existing scanners with application, asset, and business context so security teams can decide which issues are real, who owns them, and whether to fix or accept risk. It is best suited for application security and product security teams that need to reduce manual triage work and push actionable issues to engineering. Adjacent ASPM and code-to-cloud features are secondary to its vulnerability management use case.

Tufin

Unified cloud and network policy control+10

Tufin is best known for network security policy orchestration, but its cloud security offering extends that policy management model into public cloud environments. In the Cloud Security/CSPM scope, it provides visibility into cloud assets, security groups, firewalls, and access paths across AWS, Azure, and Google Cloud, with misconfiguration detection and compliance validation. It is a fit for teams that want cloud posture findings tied to network policy and change workflows, especially in hybrid environments where on-prem and cloud controls are managed together. Adjacent CIEM and DSPM content exists, but they are separate capabilities.

Turbot

Enforce cloud guardrails in real time+7

Turbot offers an automated cloud governance and remediation platform that enforces real-time guardrails across AWS, Azure, and GCP. It differentiates itself from traditional CSPMs by moving beyond simple alerting to active prevention and auto-remediation of misconfigurations. The platform manages cloud infrastructure drift and ensures compliance with frameworks like CIS, NIST, and HIPAA through programmable policy-as-code.

Uptycs

Real-time cloud discovery and inventory mapping+11

Uptycs offers CSPM as part of its broader cloud security platform, focused on continuously inventorying cloud assets, detecting misconfigurations, and mapping them to compliance requirements. In this category, it is aimed at teams operating AWS, Azure, and GCP environments that need posture monitoring, drift detection, and audit-ready evidence for standards such as CIS, PCI-DSS, SOC 2, HIPAA, and ISO 27001. Uptycs also exposes attack-path and exposure analysis to help prioritize cloud configuration issues, but its CSPM profile should be viewed as one component of a larger CNAPP portfolio rather than a standalone niche tool.

Upwind

eBPF-based runtime threat detection+11

Upwind is a runtime-powered Cloud Native Application Protection Platform (CNAPP) that consolidates vulnerability management, CSPM, DSPM, container security, CWPP, CDR, API security, and identity security into a unified platform. The vendor uses eBPF sensors and agentless deployment to provide real-time threat detection across VMs, containers, and serverless workloads. Upwind targets enterprises securing cloud-native infrastructure from development through production, emphasizing runtime context and application-layer behavior analysis for faster incident response.

Veracode

Binary static application security testing+11

Veracode is a cloud-native application security platform providing SAST, DAST, SCA, and runtime analysis capabilities. The vendor targets enterprise DevSecOps teams seeking to shift-left vulnerability detection into CI/CD pipelines. Veracode is positioned as the only native SaaS application security solution with industry-leading 1% false positive rates. Best suited for organizations requiring comprehensive code coverage across custom and third-party components with centralized policy management and developer-focused remediation workflows.

Veriti

Agentic Exposure Validation+3

Veriti is an exposure assessment and remediation vendor that sits near the vulnerability management market, but its focus is broader than traditional scanning. In vulnerability-management terms, it continuously identifies vulnerabilities, misconfigurations, and exploitability across on-prem and cloud environments, then helps teams prioritize and remediate them without disrupting operations. It is best suited for enterprises that already have multiple security tools and need to turn findings into safe, compensating controls rather than rely only on patch cycles. Veriti was founded in 2021 and is now part of Check Point.

WatchGuard Technologies

Firewall / NGFW

Application control and identification+11

For 30 years, WatchGuard has delivered real-world cybersecurity built for constantly evolving threats and limited IT resources. We partner with MSPs to simplify security and protect networks, endpoints, identities, and cloud environments with solutions that scale and last.

Wiz

Agentless multi-cloud inventory discoveryCloud misconfiguration and posture scanning+10

Wiz is a cloud security posture management (CSPM) platform that detects and remediates misconfigurations across multi-cloud environments (AWS, Azure, GCP) and infrastructure-as-code templates. The platform uses agentless API-based scanning to inventory cloud assets and correlate risks across network exposures, secrets, vulnerabilities, and identities via a graph-based engine. Wiz is positioned as a modern CSPM alternative to legacy point tools, ranked among top CSPM solutions for enterprises managing complex cloud deployments.

XM Cyber

Attack Surface Management

Continuous external asset discoveryInternet-facing attack surface monitoring+10

XM Cyber is a leader in exposure management that uses attack path modeling to show how attackers can navigate hybrid cloud and on-prem environments. By combining vulnerability data, misconfigurations, and identity exposures, it prioritizes remediation based on the actual risk to critical assets. It replaces static vulnerability scanners with continuous, graph-based security validation to identify the 'choke points' that matter most to an attacker.

ZEST Security