Workload &amp; container security

AI virtual analyst for MDR triage+11

We're passionate about delivering awesome detection and response to security teams of all sizes.

Anchore

Supply Chain Security

SBOM generation and analysisContinuous SBOM vulnerability monitoring+9

Anchore is creating a more secure software supply chain for priceless peace of mind.

AppOmni

SaaS Security Posture Management (SSPM)

Agentless SaaS configuration monitoring+11

AppOmni is positioned as a SaaS Security Posture Management (SSPM) platform, not a traditional multi-cloud CSPM vendor. The search results consistently clarify that AppOmni focuses on SaaS application security posture (Salesforce, Microsoft 365, ServiceNow, Google Workspace, Workday) rather than cloud infrastructure (AWS, Azure, GCP). While AppOmni uses CSPM terminology in legacy marketing, it does not compete in the infrastructure CSPM category. For cloud infrastructure posture management, AppOmni integrates with true CSPM solutions like Wiz. Organizations seeking multi-cloud IaC scanning, drift detection, and infrastructure misconfiguration remediation should evaluate dedicated CSPM vendors, not AppOmni.

Aqua Security

Real-time cloud risk prioritization+11

Aqua Security’s CSPM offering is a multi-cloud posture management product that uses cloud API access and agentless checks to inventory resources, detect misconfigurations, and map findings to compliance requirements. It is positioned for organizations operating AWS, Azure, Google Cloud, and Oracle Cloud that want continuous visibility into cloud configuration drift and prioritization of high-risk issues. Aqua also emphasizes real-time context and correlation of findings to reduce alert noise. The company sells a broader cloud security platform, but this profile is limited to its CSPM capabilities.

ARMO Kubescape

Kubernetes cluster misconfiguration scanning+8

Zero-day and every day protection for your cloud applications with the first runtime behavioral Cloud Application Detection and Response (CADR) solution. A fully explainable & traceable runtime security story spanning the entire cloud technology stack.

AWS

Encryption & Key Management

16 products

AWS Key Management Service (AWS KMS) is AWS’s managed encryption key service for creating, storing, and controlling cryptographic keys used to protect data in AWS workloads and applications. It is positioned for organizations that want key lifecycle control without running their own HSM fleet, and it uses FIPS 140-3 Level 3 validated HSMs under the service boundary. Buyers typically use it for envelope encryption, application signing, and server-side encryption across AWS services. It is best suited to teams standardizing key governance inside AWS rather than managing separate on-premises key systems.

Create and control KMS keysDefine key policies and access+9

Bitdefender

Endpoint Detection & Response (EDR)

11 products

At Bitdefender, cybersecurity isn't just what we do, it's who we are. For over two decades, we've been at the forefront of protecting individuals, businesses, and governments against sophisticated cyber threats and attacks. Our AI-driven technologies and world class security expertise make us a trusted partner in safeguarding what matters most.

Automated cross-endpoint attack correlationReal-time attack chain visualization+9

Center for Internet Security (CIS)

Compliance & GRC

CIS Hardened Images for cloud workloads+5

The Center for Internet Security (CIS) provides Hardened Images and configuration benchmarks that serve as the industry standard for securing cloud operating systems and infrastructure. Their virtual machine images are pre-configured to meet CIS Benchmark standards, providing a secure baseline for AWS, Azure, and GCP environments out of the box. They complement CSPM tools by providing the gold-standard configurations used for compliance auditing and system hardening.

Chainguard

Supply Chain Security

Secure-by-default container images+11

Chainguard provides minimal, distroless container images rebuilt daily from source, achieving 97.6% fewer CVEs than open source alternatives, with SLSA provenance, cryptographic signing, and verification enforcement at registry promotion and cluster admission. Over 1,800 images include 400+ FIPS-validated and STIG-hardened variants for regulated environments, backed by 7-day SLA for critical CVE remediation. Positioned as a secure-by-default OSS provider for supply chain integrity, best suited for DevOps teams in Kubernetes environments prioritizing runtime verification, least-privilege containers, and compliance like CMMC.

Checkmarx

Application Security (DAST/SAST)

Dynamic application security testing for web apps and APIs

Checkmarx One is an application security software platform built to help enterprises secure every stage of the SDLC while reducing engineering costs and accelerating development. As a leader in agentic application security testing, Checkmarx scans trillions of lines of code each year, helping organizations cut vulnerability density by more than half. Its autonomous security agents detect, prioritize, and counter AI-driven threats across legacy, modern, and AI-generated code at enterprise scale.

Check Point

Multi-cloud posture management+11

Check Point Software Technologies is a global leader in cyber security solutions, dedicated to protecting corporate enterprises and governments worldwide.

Copperhelm

Autonomous threat investigation agents+5

3 products

Copperhelm builds an agentic cloud security platform for enterprise security teams that replaces manual cloud security workflows with purpose-built AI agents. The agents connect to live cloud workloads, inspect running processes, map network topology, and continuously monitor for threats. A proprietary component called the Context Lake structures and connects cloud telemetry across environments so the agents can ground their investigations in accurate context before acting. When a threat is confirmed, agents can execute remediation in real time, including deploying targeted protections such as WAF rules, without causing workload downtime. The company reports paying customers including Fortune 500 enterprises. Copperhelm emerged from stealth in April 2026 with 7 million dollars in seed funding led by TLV Partners.

CrowdStrike

Endpoint Detection & Response (EDR)

12 products

CrowdStrike secures the most critical areas of risk – endpoints and cloud workloads, identity, and data – to keep customers ahead of today's adversaries and stop breaches.

Adversary intelligence profiles+14

CybrHawk

Agentic SOC & Investigations

Natural-language SOC investigation+8

CybrHawk is a leading provider of cybersecurity solutions. Our offerings help organizations to get their cyber-defences attuned to stall, manage, mitigate and prevent breaches. Our solutions help detect real time suspicious activities and respond quickly to prevent breaches besides predicting possible threats. Our solutions are designed to get better off the problems.

Cyngular

Cloud Investigation and Response Automation (CIRA)

The Agentic SOC of the AI era, a mesh of autonomous AI agents that detect, hunt, investigate, deceive, resolve and report, end-to-end.

Darktrace

Network Detection & Response (NDR)

Continuously monitors network traffic+11

Darktrace is a network detection and response vendor centered on self-learning behavioral analytics for north-south and east-west traffic. Its NDR product baselines normal activity for users, devices, and segments, then flags anomalous connections, command-and-control behavior, data transfer outliers, and other suspicious network patterns in on-premises, cloud, and hybrid environments. The platform is aimed at teams that need visibility beyond endpoint telemetry and want automated investigation and containment for network-level threats, including encrypted traffic and novel attack paths. Darktrace also sells adjacent security products, but this profile is limited to NDR capabilities.

Data Theorem

API Security

Continuous API discoveryAPI health analysis+9

Data Theorem is a leading provider in modern application security. Its core mission is to analyze and secure any modern application anytime, anywhere.

Echo

Automated vulnerability scanningIdentification of known vulnerabilities+7

Echo is creating the trusted source for agentic-ready software.

Edera

Runs each containerized workload in a separate lightweight micro-VM zone using a container-native Type-1 hypervisor to block escape-to-host and cross-pod breakout paths.

Edera is a container security vendor centered on hardened runtime isolation for Kubernetes workloads. Its core product uses a container-native Type-1 hypervisor to place each workload in its own lightweight zone, aiming to prevent container escapes, kernel-exploit breakout paths, and lateral movement while keeping Kubernetes compatibility. Within Container Security / CNAPP, Edera is best suited for teams that need strong runtime isolation for multi-tenant, regulated, or AI training and inference workloads. It is not primarily a CSPM or identity-management platform.

Elastic

SIEM

Centralized security event collection+8

Elastic Security provides an open-source SIEM platform built on the Elastic Stack (Elasticsearch, Logstash, Kibana, Beats) for collecting, indexing, and analyzing security logs from endpoints, networks, clouds (AWS, Azure, Google Cloud), and firewalls. It supports ECS-compliant index mappings, threat detection via KQL queries for brute force and lateral movement, correlation rules for multi-stage attacks, IOC matching with enrich policies, and Watcher-based alerting. Best for SOC teams needing scalable search analytics, real-time monitoring, and integration with EDR, XDR, SOAR in resource-constrained environments.

Endor Labs

Supply Chain Security

OSS dependency governance+11

Endor Labs is a software supply chain security platform focused on open source governance and CI/CD risk detection. The platform targets DevSecOps teams seeking to reduce alert fatigue while maintaining security posture. Endor Labs distinguishes itself through reachability analysis that eliminates up to 95% of false positives in vulnerability scanning, enabling developers to focus on exploitable risks. The vendor positions itself against traditional SCA tools by providing contextual intelligence on code usage patterns and safe upgrade paths.

Ermetic

CIEM

10 products

Ermetic provides a CIEM platform that discovers and analyzes human and machine identities, entitlements, and access risks across AWS, Azure, and Google Cloud. Acquired by Tenable in 2023 and rebranded as Tenable CIEM, it combines CIEM with CSPM for contextual visibility into IAM policies, network configurations, storage, and secrets. It exposes overprivileged entitlements, toxic combinations, and enforces least privilege via automated remediation and anomaly detection. Best for multi-cloud enterprises needing unified CNAPP capabilities to manage complex entitlement sprawl without agents.

Discover cloud identities and entitlements+11

ESET

Email Security

14 products

ESET Mail Security provides multilayered protection for Microsoft Exchange servers, scanning mailboxes, public folders, and hybrid Microsoft 365 environments. It uses proprietary anti-spam engines with SPF/DKIM validation, backscatter protection, and SMTP safeguards, alongside anti-malware scanning for attachments including corrupted or password-protected archives. A 64-bit architecture supports clustering for high-performance mail processing. Optional modules include Advanced Threat Defense and LiveGuard for suspicious emails. Best suited for organizations prioritizing on-premises Exchange security with remote management via ESET PROTECT console and comprehensive rule-based filtering.

Spam filtering for inbound mail+10

Minimus

Hardened container image delivery+7

We're a team of security nerds and passionate innovators, committed to our customers.

Mitiga

Panoramic AwarenessAttack Decoding+2

3 products

Mitiga is a cloud detection and response vendor focused on detecting, investigating, and containing active threats across cloud, SaaS, identity, and AI environments. Its CDR platform emphasizes zero-impact breach prevention, with cloud-native telemetry analysis, attack reconstruction, and guided response for SecOps teams that need visibility beyond CNAPP and posture tools. Mitiga positions itself for enterprises with distributed, multi-cloud and SaaS-heavy footprints that need forensic context and rapid triage without requiring deep cloud expertise.

Oligo Security

Cloud Workload Protection (CWPP)

Runtime workload protection+8

Oligo Security is primarily a runtime security vendor, not a native CSPM specialist. In cloud security evaluations, it is best understood as a platform for detecting and blocking active exploitation in cloud workloads, with emphasis on runtime context rather than posture scanning or misconfiguration management. Its cloud-security materials focus on protecting modern applications, cloud workloads, and AI systems at execution time, which makes it a fit for teams that want runtime threat detection and exploit prevention alongside other cloud security controls.

Orca Security

Agentless cloud misconfiguration detection+11

We're on a mission to provide the world's most comprehensive cloud security platform while adhering to what we believe in: frictionless security and contextual insights, so you can prioritize your most critical risks and operate in the cloud with confidence.

Plerion

Code SecurityCloud Security Posture Management (CSPM)AI Security+1

We simplify cloud security

Qualys

Continuous vulnerability scanning+10

Qualys provides Vulnerability Management, Detection and Response (VMDR), a cloud-based platform that automatically discovers assets across on-premises, cloud, and mobile environments, including unmanaged devices. It scans for vulnerabilities using over 20,000 checks from its Vulnerability KnowledgeBase, correlates findings with threat intelligence and machine learning to prioritize risks on critical assets, and detects indicators of compromise. VMDR supports hybrid IT scanning from a single console, generates role-based reports for compliance, and integrates with ticketing systems for automated remediation workflows. Best for enterprises needing continuous visibility and prioritization in complex, distributed networks.

Reco

AI Runtime & Agent Security

Runtime prompt and tool-call inspection+9

Reco is the leader in Agentic Ecosystem Security, securing everything around the agent, not just the prompt.

Seceon

Agentic SOC & Investigations

Autonomous alert triage+11

Seceon is a cybersecurity platform vendor positioned for SOC operations, with its aiSOC/aiSIEM and SOC automation offerings used for alert triage, investigation, threat hunting, and response orchestration. In the Agentic SOC & Investigations scope, its pitch centers on correlating logs, flows, identities, cloud, endpoint, and application data to reduce manual analyst work and speed incident decisions. It is best suited for MSSPs, MDR providers, and enterprise SOCs that want multi-tenant operations and automated investigation workflows rather than an endpoint-only tool.

SecPod SanerNow

Continuous vulnerability scanning and detection+10

SecPod was founded on a clear belief cyberattacks should be prevented, not chased after the damage is done.

Skyhawk Security

Continuously scan cloud resources for misconfigurations

Skyhawk Security offers a cloud-native platform focused on preemptive threat detection and automated incident response through its AI-based 'Purple Team' engine. It contextualizes cloud security events and CSPM alerts to eliminate alert fatigue and identify actual runtime threats before they lead to data breaches. The platform integrates with existing cloud logs and security tools to provide a unified view of exposure and active threats across Multi-cloud environments.

Skyhigh Security CASB

CASB (Cloud Access Security Broker)

Discover unsanctioned cloud services+11

Skyhigh Security CASB is a cloud-based, multi-tenant Cloud Access Security Broker that deploys via forward and reverse proxy modes for real-time control over sanctioned and unsanctioned cloud services. It leverages the Cloud Registry for 50+ attribute risk assessments across 20,000+ services, enabling discovery, classification, and remediation. Key capabilities include DLP policy enforcement synced with endpoint DLP, machine learning-based UEBA for insider threat detection, malware analysis, configuration auditing against benchmarks with automated remediation, and contextual access controls. Best suited for enterprises needing comprehensive visibility and governance across hybrid cloud environments with SharePoint integration.

Snyk

Application Security (DAST/SAST)

Static application security testing for source code

Snyk is an application security platform providing SAST (static code analysis), DAST (runtime testing), and SCA (software composition analysis) capabilities integrated into CI/CD pipelines. The vendor targets development teams seeking to embed security early in the SDLC, from first commit through production deployment. Snyk's AI-native approach uses machine learning to reduce false positives while detecting complex vulnerabilities across proprietary code, open-source dependencies, containers, and infrastructure.

Sophos

Data Loss Prevention (DLP)

12 products

Sophos defeats cyberattacks with an adaptive AI-native open platform and unmatched security expertise.

Monitor and restrict sensitive file transfersConfirm or block file transfers+10

Spyderbat

Kernel-level Runtime Visibility & Root Cause AnalysisBehavioral Threat DetectionAutomated Response & Control+1

Threat Detection, Investigation, and Response for Cloud, Kubernetes, and Linux

Stackrox by Red Hat (OpenShift Container Security)

Automated container image vulnerability scanning+8

We work alongside a global community of contributors, customers, and partners to bring the best ideas to life. This process delivers flexible hybrid cloud solutions, like Linux®, AI, virtualization, and automation, giving critical organizations the consistency, choice, and control to innovate with confidence.

Stream.Security

Real-time cloud threat and exposure modeling+8

StreamSecurity.com helps you spot risk, get matched with vetted security professionals, and harden what matters, without the jargon.

Strike48

Agentic SOC & Investigations

Autonomous AI agent triage and investigation+6

Strike48 is the Agentic Log Intelligence Platform built to give AI agents complete visibility into your environment and the autonomy to act on what they find.

SubImage

Cloud posture checksAttack path analysis+9

5 products

SubImage is an open-core cloud security graph product that maps infrastructure across cloud and on-prem environments and presents CSPM-style posture checks through a queryable graph. In the CSPM scope, it focuses on agentless discovery, misconfiguration detection, compliance mapping, and attack-path analysis so teams can see which issues create real exposure. It appears best suited for security teams that want graph-based context and precise remediation guidance rather than a standalone checklist scanner. The vendor also references CNAPP and PAM capabilities, but its core CSPM value is posture visibility and path-based prioritization.

Sweet Security

Real-time posture change monitoring+9

Sweet Security is redefining enterprise cloud protection. As the leading provider of Runtime CNAPP and AI Security solutions, Sweet unifies runtime context with advanced AI intelligence to protect the modern enterprise.

Sysdig

Graph-based cloud risk correlationContinuous cloud posture monitoringAgentless cloud asset scanning+9

Cloud security with zero compromise.

Tigera Calico

Container image assurance scanningRuntime threat defense for workloads+10

5 products

Secure your Kubernetes workloads. Govern your AI agents.

Trend Micro

Data Loss Prevention (DLP)

11 products

Trend Micro offers integrated Data Loss Prevention (DLP) functionality embedded within its broader endpoint security and email security platforms. The iDLP module provides lightweight agent-based monitoring across endpoints, email, USB devices, and web channels without requiring dedicated hardware. Trend Micro positions DLP as a cost-effective alternative to standalone enterprise solutions, leveraging pre-built regional and industry-specific policy templates. Best suited for organizations already invested in Trend Micro's endpoint protection or email security infrastructure seeking consolidated data protection without additional management overhead.

Monitor data movements on user devices+11

Tromzo

Automated vulnerability triage and prioritization+10

Tromzo is a vulnerability management platform focused on triage, ownership assignment, prioritization, governance, and remediation reporting across software delivery environments. In this category, it correlates findings from existing scanners with application, asset, and business context so security teams can decide which issues are real, who owns them, and whether to fix or accept risk. It is best suited for application security and product security teams that need to reduce manual triage work and push actionable issues to engineering. Adjacent ASPM and code-to-cloud features are secondary to its vulnerability management use case.

Uptycs

Real-time cloud discovery and inventory mapping+11

Uptycs offers CSPM as part of its broader cloud security platform, focused on continuously inventorying cloud assets, detecting misconfigurations, and mapping them to compliance requirements. In this category, it is aimed at teams operating AWS, Azure, and GCP environments that need posture monitoring, drift detection, and audit-ready evidence for standards such as CIS, PCI-DSS, SOC 2, HIPAA, and ISO 27001. Uptycs also exposes attack-path and exposure analysis to help prioritize cloud configuration issues, but its CSPM profile should be viewed as one component of a larger CNAPP portfolio rather than a standalone niche tool.

Upwind

eBPF-based runtime threat detectionGraph-based container topology mapping+10

Upwind is a runtime-powered Cloud Native Application Protection Platform (CNAPP) that consolidates vulnerability management, CSPM, DSPM, container security, CWPP, CDR, API security, and identity security into a unified platform. The vendor uses eBPF sensors and agentless deployment to provide real-time threat detection across VMs, containers, and serverless workloads. Upwind targets enterprises securing cloud-native infrastructure from development through production, emphasizing runtime context and application-layer behavior analysis for faster incident response.

Veracode

Application Security (DAST/SAST)

Binary static application security testingDynamic web application security testing+10

Veracode is a cloud-native application security platform providing SAST, DAST, SCA, and runtime analysis capabilities. The vendor targets enterprise DevSecOps teams seeking to shift-left vulnerability detection into CI/CD pipelines. Veracode is positioned as the only native SaaS application security solution with industry-leading 1% false positive rates. Best suited for organizations requiring comprehensive code coverage across custom and third-party components with centralized policy management and developer-focused remediation workflows.

WatchGuard Technologies

Firewall / NGFW

Application control and identification+11

For 30 years, WatchGuard has delivered real-world cybersecurity built for constantly evolving threats and limited IT resources. We partner with MSPs to simplify security and protect networks, endpoints, identities, and cloud environments with solutions that scale and last.

Wiz