DevSecOps &amp; supply chain

Discover open source across environments+11

ActiveState is a DevSecOps vendor focused on securing open source dependencies and language runtimes used in software delivery pipelines. Its platform scans code repositories, containers, and build inputs to identify vulnerable components, then supports remediation by rebuilding packages from source and managing dependency changes. The company is positioned around automated vulnerability management and software supply chain security rather than broad application security testing. It is best suited for engineering and security teams that need governed open source usage, deterministic builds, and faster patching without relying only on upstream package updates.

Agentic Fabriq

AI Runtime & Agent Security

Agent identity binding+10

The secure hub for agent identity, governance, and visibility. Control what your agents can access and do, for every user.

Aikido Security

Real-time malware detection+10

All the security tools we used were slow, confusing, overpriced and noisy. So we built better ones.

Akeyless

Vaultless secrets management+11

Cloud-Native SaaS platform built to secure and manage every identity through a single pane of glass.

Anchore

SBOM generation and analysisContinuous SBOM vulnerability monitoring+9

Anchore is creating a more secure software supply chain for priceless peace of mind.

Anecdotes.ai

AI agents automate GRC workflows+10

We're Anecdotes, and we're transforming how enterprise teams manage governance, risk, and compliance. We built the world's first enterprise agentic GRC platform to fundamentally change what's possible in GRC, and empower teams to focus on what matters.

Anvilogic

SIEM

Multi-SIEM detection deployment and correlation+7

Anvilogic is a threat detection and hunting platform that works alongside existing data platforms (Snowflake, Databricks, Splunk) rather than replacing them. It provides a library of pre-built detection rules, a detection-as-code workflow, and multi-platform hunt capabilities. Popular with teams who want to improve detection quality without migrating their data infrastructure, Anvilogic helps detection engineers measure and close MITRE ATT&CK coverage gaps while standardising rules across heterogeneous data lakes and SIEM stacks.

Apiiro

Native SCM and CI/CD visibility+11

Apiiro provides supply chain security capabilities as part of its application security platform, with a focus on inventorying software components, tracing code-to-runtime relationships, and detecting supply chain risk across SCM repositories and CI/CD pipelines. It is positioned for AppSec and platform security teams that need continuous visibility into dependencies, build activity, commit changes, and artifact provenance, rather than point-in-time scans. Apiiro also ties supply chain findings to code owners and policy workflows, and it offers adjacent ASPM and application inventory features, which are not the focus of this profile.

Appdome

Mobile Security

Mobile app runtime protection+11

Appdome provides no-code mobile app security for Android and iOS, delivered as build-time and runtime protections inside the mobile CI/CD pipeline. In the Mobile Security category, it focuses on app shielding, communication protection, anti-tampering controls, and device-integrity checks such as root and jailbreak detection. It is suited for mobile teams in banking, healthcare, government, and consumer apps that need to add protections without embedding and maintaining security SDK code. Appdome also offers adjacent fraud and mobile threat defense capabilities, but the core mobile security scope centers on protecting the app binary, runtime, and network sessions.

AppViewX

Encryption & Key Management

Certificate lifecycle management automation+10

AppViewX is an automated Certificate Lifecycle Management (CLM) and Public Key Infrastructure (PKI) platform designed to prevent service outages caused by expired certificates. It provides centralized visibility and control over machine identities across multi-cloud and on-premises environments, enabling crypto-agility and rapid modernization of cryptographic standards. The solution complements existing HSMs and CAs by orchestrating the end-to-end process of certificate issuance, renewal, and installation.

Aqua Security

Cloud Security / CSPM

Real-time cloud risk prioritization+11

Aqua Security’s CSPM offering is a multi-cloud posture management product that uses cloud API access and agentless checks to inventory resources, detect misconfigurations, and map findings to compliance requirements. It is positioned for organizations operating AWS, Azure, Google Cloud, and Oracle Cloud that want continuous visibility into cloud configuration drift and prioritization of high-risk issues. Aqua also emphasizes real-time context and correlation of findings to reduce alert noise. The company sells a broader cloud security platform, but this profile is limited to its CSPM capabilities.

ARCON

Privileged Access Management (PAM)

11 products

ARCON PAM is an enterprise-class privileged access management solution designed for hybrid, multi-cloud, and distributed datacenter environments. The platform centralizes control of privileged accounts across heterogeneous IT infrastructure through a unified admin console and secure gateway server. ARCON PAM targets IT security, risk, and compliance teams managing complex privilege lifecycles in organizations with DevOps and cloud-native workloads requiring fine-grained access controls and comprehensive audit trails.

Discovery and onboarding of privileged accounts+11

ArmorCode

Application Security Posture Management (ASPM)

Aggregate findings from security scanners+11

ArmorCode is redefining security governance in the AI era as the agentic control plane for Unified Exposure Management.

Arnica

Behavior-based developer activity monitoringReal-time code change scanning+9

Arnica powers the most effective application security programs in the world.

Authomize

Identity Governance & Administration (IGA)

Access governance policy enforcement+7

Authomize provides an AI-native Identity Governance and Administration (IGA) platform focused on continuous discovery, mapping, and governance of human and machine identities across cloud and on-premises environments. It delivers real-time visibility into permissions, entitlements, and access risks, automating remediation through policy enforcement and self-service workflows. Best suited for enterprises with complex multi-cloud infrastructures seeking to mitigate identity-based threats without disrupting operations. Authomize positions itself as a modern alternative to legacy IGA, emphasizing agentless integration and ML-driven risk prioritization for mid-to-large organizations.

AWS

Encryption & Key Management

16 products

AWS Key Management Service (AWS KMS) is AWS’s managed encryption key service for creating, storing, and controlling cryptographic keys used to protect data in AWS workloads and applications. It is positioned for organizations that want key lifecycle control without running their own HSM fleet, and it uses FIPS 140-3 Level 3 validated HSMs under the service boundary. Buyers typically use it for envelope encryption, application signing, and server-side encryption across AWS services. It is best suited to teams standardizing key governance inside AWS rather than managing separate on-premises key systems.

Create and control KMS keys+10

Beazley Security

Security Operations

Managed extended detection and response+10

Beazley Security is a cyber risk management vendor whose Security Operations offering centers on managed detection and response plus exposure management. Its MXDR service provides always-on monitoring, threat identification, and containment across endpoints, networks, cloud services, identity, and email, while exposure management continuously inventories external assets and prioritizes known-exploited vulnerabilities. The company is positioned for organizations that want operational security support from a team that combines incident response, forensics, and risk intelligence with insurance heritage. It is best suited for buyers seeking a managed SOC-style service rather than a standalone software tool.

Binarly

Binary-level supply chain analysis+11

Binarly is a software and firmware supply chain security vendor focused on binary-level analysis of compiled artifacts, including UEFI, BMC, embedded Linux, and other firmware components. In this category, it is used to generate and validate SBOMs and CBOMs, assess third-party software before deployment, and surface vulnerabilities, secrets, and crypto issues without source code. Its position is strongest for hardware vendors, OEMs, embedded product teams, and enterprise security groups that need defensible evidence about what is actually inside shipped binaries. The company also offers adjacent firmware security and risk intelligence capabilities, but its supply-chain value centers on binary transparency and post-build verification.

BitSight

Third-party risk monitoring and onboarding+10

12 products

Risk now moves across enterprises, supply chains, cloud environments, and digital identities, and AI is accelerating how quickly vulnerabilities can be exploited. Bitsight continuously maps assets and vulnerabilities, prioritizing them with real-time threat intelligence so teams can see where risk is building, focus on what matters, and act before exposure becomes disruption.

Bitwarden

Password Management

Generate strong unique passwords+10

Bitwarden is a trusted security leader for millions of users worldwide, empowering enterprises, developers, and individuals to securely manage and share sensitive information anywhere.

Black Duck

Static application security testingDynamic application security testing+8

10 products

Black Duck (formerly Synopsys Software Integrity Group) provides a comprehensive application security platform focusing on Software Composition Analysis (SCA) and static/dynamic testing. It enables organizations to manage open-source risks, identify vulnerabilities in proprietary code, and ensure license compliance across the SDLC. The platform complements DevSecOps workflows by integrating security gates into CI/CD pipelines and providing deep visibility into software supply chain risks.

Black Kite

Vendor compliance managementAutomated compliance correlationStandards-based cyber risk ratings+8

We're building a world where cyber risk is no longer a barrier to business performance.

Bridgecrew (Palo Alto Networks)

Infrastructure as Code security scanning+10

Bridgecrew, acquired by Palo Alto Networks in 2021 for $156 million, is a developer-first infrastructure-as-code (IaC) security platform integrated into Prisma Cloud. It enables shift-left security by embedding infrastructure security checks into CI/CD pipelines and code repositories. Bridgecrew serves DevOps teams and developers seeking to enforce security standards during the build phase, preventing misconfigurations from reaching production. The platform is best suited for organizations prioritizing early vulnerability detection and automated remediation within development workflows.

Britive

CIEM

Dynamic just-in-time cloud access+11

Britive provides dynamic Cloud Privileged Access Management (CPAM) and Cloud Infrastructure Entitlement Management (CIEM) with patented just-in-time (JIT) ephemeral access across AWS, multi-cloud, SaaS, hybrid, and on-prem environments. It enforces runtime identity access for human, agentic AI, and machine identities via a unified control plane, minting permissions only at execution and auto-destroying them post-task. Recognized by Gartner as a CIEM leader, Britive offers entitlement governance, anomaly detection, and SCIM-based synchronization with IdPs like Okta and Azure AD. Best for organizations needing granular, zero-standing-privilege controls in dynamic cloud ecosystems.

Bugcrowd

Penetration Testing & Red Team

Crowdsourced red team engagements+10

Bugcrowd provides penetration testing and red-team services through a managed crowdsourced platform that matches customers with vetted ethical hackers and curated tester teams. In the penetration-testing scope, it supports standard and customized tests with real-time visibility into progress and prioritized findings; in the red-team scope, it offers RTaaS that simulates attacker kill chains and produces debrief reports for validation and remediation. It is best suited for security teams that need external testers, fast engagement start, and evidence for compliance or control-effectiveness review. Bugcrowd also has adjacent bug bounty and vulnerability disclosure offerings, but those are outside this profile.

Chainguard

Secure-by-default container images+11

Chainguard provides minimal, distroless container images rebuilt daily from source, achieving 97.6% fewer CVEs than open source alternatives, with SLSA provenance, cryptographic signing, and verification enforcement at registry promotion and cluster admission. Over 1,800 images include 400+ FIPS-validated and STIG-hardened variants for regulated environments, backed by 7-day SLA for critical CVE remediation. Positioned as a secure-by-default OSS provider for supply chain integrity, best suited for DevOps teams in Kubernetes environments prioritizing runtime verification, least-privilege containers, and compliance like CMMC.

Chainloop

Software supply chain evidence storeAttestation collection and storage+10

We help enterprises build and deliver secure and compliant software faster. Our mission is to automate trust for Software Supply Chain, helping enterprises make faster decisions, reduce security risks, achieve compliance, and save time and money.

Checkmarx

Dynamic application security testing for web apps and APIsUnified reporting with SAST and SCA findings

Checkmarx One is an application security software platform built to help enterprises secure every stage of the SDLC while reducing engineering costs and accelerating development. As a leader in agentic application security testing, Checkmarx scans trillions of lines of code each year, helping organizations cut vulnerability density by more than half. Its autonomous security agents detect, prioritize, and counter AI-driven threats across legacy, modern, and AI-generated code at enterprise scale.

CloudSEK Research Pte. Ltd.

Threat Intelligence

Real-time threat intelligence monitoring+8

CloudSEK is a digital risk protection platform (DRPP) that utilizes AI to monitor the deep, dark, and open web for external threats. It provides automated detection of leaked credentials, brand impersonation, and exposed infrastructure to quantify digital risk. The platform complements internal SOC operations by providing an external-facing view of an organization's attack surface and supply chain vulnerabilities.

Clover Security

Design security review automationContinuous threat modeling+9

Product security agents that work with your team.

Clutch

In-memory caching for secrets+6

Clutch is an identity security platform that discovers, maps, and governs non-human identities across cloud, SaaS, and AI environments. Using its Identity Lineage® graph, it connects AI agents, service accounts, API keys, OAuth applications, tokens, and secrets to the people, systems, and resources they interact with. This enables security teams to identify excessive privileges, detect identity-based risks, secure machine identities, and enforce governance across human and non-human access, helping organizations safely adopt AI at enterprise scale.

Codacy

Static application security testing+11

Founded in 2012 by developers Jaime Jorge and João Caxaria to help engineering teams raise the bar for code quality and security.

Commugen

Inherent risk evaluationResidual risk calculation+5

Commugen is a market leader in GRC management solutions

Contrast Security

Agent-based runtime vulnerability detection+9

Contrast Security provides an IAST platform that embeds agents into running applications, instrumenting code with sensors for real-time vulnerability detection and attack telemetry. Unlike external DAST scans or static SAST analysis, it analyzes data flows, application logic, and runtime behavior across development, CI/CD pipelines, and production. This reduces false positives by validating vulnerabilities in context, supports DevSecOps integration, and offers continuous monitoring for web apps, APIs, and microservices. Best for organizations prioritizing accurate, low-noise AppSec in agile environments over traditional black-box or white-box tools.

ControlMonkey

Backup & Disaster Recovery

Continuously back up cloud and SaaS configurations

ControlMonkey helps cloud teams strengthen disaster recovery and resilience by backing up and restoring cloud and SaaS configuration across AWS, Azure, GCP, Terraform, identity, networking, and observability platforms. We provide continuous snapshots, drift remediation, and recovery automation so teams can quickly restore infrastructure state after outages, ransomware, or human error, with full visibility into unmanaged resources and configuration gaps

Crash Override

Build-time provenance captureArtifact traceability to production+10

3 products

We are Crash Override. Software Observability for the AI era, the data plane for software, from prompt to production.

CyberArk (Palo Alto Networks)

Privileged Access Management (PAM)

Privileged password and key vaulting+10

the next-generation identity security platform that discovers, controls and governs your human and agentic workforce

Cycode

End-to-end software supply chain visibilityPolicy enforcement across pipelines and toolingProprietary and third-party scanner ingestion+9

AI Writes The Code. We Secure And Govern It.

DeepKeep

AI Model Security

Discovers AI modelsnotebooksdatasets+21

DeepKeep is a model agnostic AI security platform

depthfirst

Business-logic vulnerability detection+8

depthfirst is an applied AI lab pioneering the future to secure software, and we're just getting started.

DigiCert

Identity & Access Management (IAM)

10 products

Trust built for the AI age

Device certificate authentication policiesAuthentication method controlCertificate issuance protocol support+5

Digital.ai

Endpoint Detection & Response (EDR)

Endpoint telemetry collection+7

Digital.ai is an industry-leading technology company dedicated to helping Global 5000 enterprises achieve digital transformation goals.

Diligent

Unified board and GRC platform+11

At Diligent, we believe in a world where transformational leaders can build more successful, equitable and sustainable organizations.

Doppel

Digital Risk & Executive Protection

Multi-channel phishing simulations+11

The Doppel Platform elevates your social engineering defense from reactive to strategic, combining AI precision, human expertise, and real-time intel to protect what matters most.

DuploCloud

Automatically check Azure security posture+9

At DuploCloud, we empower developers to focus on innovation and growth, rather than tedious and time-consuming tasks. By streamlining well-known operational workflows and compliance standards, we provide a powerful platform that consolidates DevOps and cloud security, making it accessible and efficient for all.

Echo

Automated vulnerability scanningIdentification of known vulnerabilities+7

Echo is creating the trusted source for agentic-ready software.

Eclypsium

Verify device authenticity at procurement+9

Hardware security is at the core of what we do and who we are. It's our specialized expertise and our passion, and we're on a mission to help enterprises address the largest blindspot they can't see.

Endor Labs

OSS dependency governance+11

Endor Labs is a software supply chain security platform focused on open source governance and CI/CD risk detection. The platform targets DevSecOps teams seeking to reduce alert fatigue while maintaining security posture. Endor Labs distinguishes itself through reachability analysis that eliminates up to 95% of false positives in vulnerability scanning, enabling developers to focus on exploitable risks. The vendor positions itself against traditional SCA tools by providing contextual intelligence on code usage patterns and safe upgrade paths.

Fluid Attacks

Static application security testing from source code

Since 2001, Fluid Attacks has been committed to growing as a team and developing its own technology to contribute to global cybersecurity.

Fossa

Open source license compliance automation+11

For a decade, FOSSA has been protecting businesses from the security, license compliance, and code quality risks associated with modern software development, while giving developers back valuable time. Our mission is centered on eliminating the sacrifice between speed, compliance, and security in today's software-driven world.

GitHub CodeQL

Semantic code analysis queries+10

GitHub CodeQL is a semantic code analysis engine that performs static application security testing (SAST) by building a queryable database of code facts and running predetermined vulnerability detection queries. Available as part of GitHub Advanced Security, CodeQL integrates into CI/CD workflows to scan pull requests and source code for security flaws before deployment. It correlates with dynamic testing tools like StackHawk and supports autofix suggestions via GitHub Copilot. CodeQL is the most prevalent SAST tool in open-source software pipelines.

GitLab

Automated SAST in CI/CD pipelines+10

We're the company behind GitLab, the intelligent orchestration platform where teams and their AI agents ship secure software faster.

GuardDog AI

Package metadata analysis for malicious intent+7

GUARDDOG AI revolutionizes cybersecurity incident response with its cutting-edge DCX Vulnerability + Isolation platform boasting exploit or attack detection times in milliseconds and isolation/containment within seconds, all without the need for network or device interaction. Additionally, the company provides a vulnerability management analytics solution that simplifies communication and understanding of attack surfaces. This enables individuals with minimal cybersecurity expertise to take action, bridging the gap between non-specialists and cybersecurity engineers.

HashiCorp, an IBM Company

Store and access secrets centrally+10

HashiCorp Vault is the industry standard for secrets management, providing a centralized system for storing and controlling access to tokens, passwords, certificates, and encryption keys. It enables Infrastructure as Code (IaC) security by allowing developers to pull secrets dynamically rather than hardcoding them in configuration files. Vault complements cloud-native security by offering a unified workflow across hybrid and multi-cloud environments, often replacing fragmented, cloud-specific key management services.

Hush Security

Short-lived machine access credentialsSecretless machine identity access+10

Hush Security provides a machine identity and access platform designed for cloud-native environments and AI agents. It focuses on eliminating static long-lived secrets by implementing just-in-time (JIT) policy-based access for machine-to-machine interactions. The platform addresses the security risks of credential sprawl in CI/CD pipelines and microservices by replacing hardcoded credentials with ephemeral tokens.

Infisical

Centralized secrets storage and distributionSecret versioning and point-in-time recovery+10

Infisical is an open-source platform for managing secrets, certificates, configurations, and privileged access across development, CI/CD, and cloud infrastructure. It provides end-to-end encrypted storage with AES-GCM-256, secrets versioning, point-in-time recovery, audit logging, and automatic rotation. Key components include secrets scanning in GitHub/GitLab, X.509 certificate issuance via EST, and Infisical KMS for policy-enforced encryption. Delivery occurs via CLI, SDKs (Go, Node.js, Python), HTTP API, Kubernetes Operator, and External Secrets Operator. Best for developer-centric teams replacing scattered .env files and long-lived credentials with centralized, auditable workflows.

InvisiRisk

Build-time application firewall+10

InvisiRisk is a software supply chain security vendor focused on the CI/CD pipeline, where it inspects build-time behavior instead of relying only on pre- or post-build scanning. Its core product is an inline Build Application Firewall that enforces policy during builds, blocks suspicious traffic and unauthorized actions, and reconstructs a build-time SBOM from observed activity. It is best suited for CISOs and engineering/security teams that need control over artifact integrity, secret exposure, and dependency activity in modern build systems.

JFrog

Software supply chain visibility and control+11

JFrog provides the JFrog Software Supply Chain Platform, a unified solution for artifact management, security scanning, and release automation across the SDLC. It integrates JFrog Artifactory for universal binary repositories supporting 50+ package types including ML models, with native security via Xray for SCA, SAST, container scanning, and CVE prioritization. Advanced Security adds contextual vulnerability analysis and supply chain exposure scanning. JFrog holds a strong market position in DevSecOps and MLOps, ideal for enterprises managing complex software pipelines, hybrid clouds, and IoT fleets requiring end-to-end traceability and policy enforcement.

Legit Security

Automated SDLC discovery and analysis+11

Legit is an AI-native ASPM platform that automates AppSec issue discovery, prioritization, and remediation.

Lineaje

Full-lifecycle software supply chain security+9

Lineaje is a software supply chain security vendor focused on discovering, analyzing, and continuously securing software artifacts across source code, open source dependencies, containers, and third-party software. In this category, it stands out for combining SBOM-driven inventory, software composition analysis, integrity validation, and autonomous remediation workflows. Its platform is aimed at organizations that build, buy, or distribute critical software and need to track provenance, vulnerability exposure, tampering, and compliance obligations across the full lifecycle. Adjacent AI security capabilities exist, but buyers evaluating supply chain security would mainly use Lineaje for dependency risk control, build hardening, and vendor software assurance.

Mend.io

AI-generated code scanning in repository and IDE+9

Mend.io is the security platform built for every risk, across application security and AI security, securing the code layer, the AI layer, and the attack surface between them. Continuous protection across the full AI application lifecycle.

NetRise

Binary software visibility+10

NetRise specializes in the security analysis of compiled binary code, providing visibility into the 'black box' of firmware, IoT devices, and third-party software components. Unlike traditional SCA tools that rely on source code or package manifests, NetRise analyzes the actual executable binaries to identify vulnerabilities, hardcoded secrets, and compliance violations. This approach is critical for securing the software supply chain where source code access is unavailable, helping organizations validate Software Bill of Materials (SBOM) accuracy.

Novee

AI Runtime & Agent Security

3 products

Novee is primarily an AI penetration-testing vendor, not a pure AI runtime control plane. For AI Runtime & Agent Security, it is best understood as an attack-simulation and validation product that probes LLM apps, copilots, and agents for prompt injection, jailbreaks, tool abuse, and workflow manipulation, then validates exploit paths and remediation. It is most suitable for teams that want adversarial testing of agent behavior across OpenAI, Anthropic, and open-source stacks before deployment or during continuous security validation.

Autonomous AI red teaming+8

Nullify

Cloud Workload Protection (CWPP)

Nullify is an application security platform centered on SAST and DAST workflows, with continuous code scanning and live endpoint testing aimed at finding exploitable issues before merge or release. Its code analysis covers 16 languages plus Terraform, CloudFormation, and Kubernetes manifests, while its dynamic testing API and CLI target running web apps and APIs. It is positioned for small security teams and developer-first organizations that want vulnerability discovery and remediation in one workflow rather than separate scanners and manual triage.

AI code security SAST+10

Oligo Security

Runtime workload protection+8

Oligo Security is primarily a runtime security vendor, not a native CSPM specialist. In cloud security evaluations, it is best understood as a platform for detecting and blocking active exploitation in cloud workloads, with emphasis on runtime context rather than posture scanning or misconfiguration management. Its cloud-security materials focus on protecting modern applications, cloud workloads, and AI systems at execution time, which makes it a fit for teams that want runtime threat detection and exploit prevention alongside other cloud security controls.

OPSWAT

Detect and report installed software vulnerabilities

OPSWAT prevents known, unknown, and AI-generated threats from reaching the systems the world depends on. The MetaDefender Platform, OPSWAT's AI-powered cybersecurity solution, secures every file, device, and data transfer across IT, OT, and cross-domain environments.

OX Security

Software supply chain attack reference framework

OX Security is an enterprise software supply chain security platform that focuses on securing code, dependencies, build pipelines, and container artifacts across the SDLC. It emphasizes end-to-end traceability from code to runtime, continuous verification of pipeline integrity, and consolidation of findings into a single dashboard for triage and response. OX appears strongest for teams that want software supply chain controls and visibility without sending source code to third-party services, and it also offers adjacent application security and ASPM capabilities.

Parameter

Penetration Testing & Red Team

Penetration testing services+8

Software is changing faster than ever. We're building security that evolves with it: continuous, autonomous, and always on.

Phoenix Security

Application Security Posture Management (ASPM)

Static application security testing for source code and compiled artifacts to identify issues such as injection flaws, unsafe input handling, and other OWASP Top 10-style defects before deployment.

Phoenix Security is an application security platform focused on finding and triaging code-level and runtime vulnerabilities across the software delivery lifecycle. In the DAST/SAST scope, it normalizes findings from source-code analysis, dynamic testing, and related appsec scanners into a single model, then uses runtime context to help prioritize remediation. Public materials also indicate support for air-gapped deployments and broader AppSec workflows, but the core value for buyers in this category is combining static and dynamic findings with remediation guidance. It is best suited for security teams and developers that need one place to correlate application vulnerability signals from multiple testing methods.

Phylum

Real-time malicious package detectionPackage management firewall+9

Empower you to build, buy, and run secure software.

PrimeSec Inc.

Static application security testing+3

Agentic development has made shipping secure products harder than ever. We built Prime to be the trusted advisor that knows your architecture.

Promptfoo

AI Security Posture (AI-SPM)

Automated red-teaming for AI applicationsDynamic adaptive scan generation+7

Promptfoo helps developers and enterprises build secure, reliable AI applications.

Prophet Security

Agentic SOC & Investigations

Autonomous AI agent alert triage and investigation

Prophet Security is building an AI SOC platform that empowers teams to move faster and make better decisions.

QCoreSecure

Encryption & Key Management

QRNG-powered encryption+5

Replace every algorithmically generated random number in critical infrastructure with quantum-sourced entropy that is provably, physically, and absolutely unpredictable.

RapidFort

Near-zero CVE container images+10

RapidFort is a software supply chain security platform that focuses on reducing the attack surface of containerized applications by removing unused code and packages. It provides runtime profiling to identify which parts of an image are actually necessary, enabling automated remediation and the creation of 'slim' images with near-zero CVEs. This approach complements traditional vulnerability scanners by eliminating vulnerabilities that aren't reachable or execution-active.

Raven

Application Security Posture Management (ASPM)

Runtime exploit prevention+5

Raven.io provides a runtime application security platform that runs inside cloud-deployed applications to detect and block malicious code execution as it happens, independent of whether a CVE exists. The platform includes application detection and response for forensic visibility down to libraries, functions and call paths, a runtime software composition analysis capability that uses reachability data to de-prioritize vulnerabilities, and a module for discovering and controlling AI agents operating inside application environments. It is aimed at enterprises running internet-facing applications on Kubernetes, containers and compute instances across AWS, GCP and Azure, supporting languages including Java, Python, JavaScript, Go, Ruby, PHP, C++ and .NET. Customers include organizations in regulated industries such as insurance and financial services.

Recorded Future

Threat Intelligence

Real-time threat intelligence+11

Recorded Future secures the world by empowering businesses, governments, and other organizations to stay one step ahead of today's relentless threat actors.

ReversingLabs

Binary artifact security analysis+9

ReversingLabs provides software supply chain security through Spectra Assure, leveraging a 40 billion file threat repository for binary analysis of OSS packages and commercial binaries. It detects novel malware via proprietary RL engines, supply chain attacks through differential analysis, secrets exposure with liveness verification, and vulnerabilities from NVD, OSV, GitHub, and KEV sources plus proprietary exploitation intelligence. Trusted by Fortune 500 for vetting compiled software against tampering and compromise. Best for enterprises and developers securing build pipelines, third-party software, and cryptocurrency infrastructure against sophisticated attacks.

SCANOSS

Find vulnerabilities in source code and binaries+9

SCANOSS finds the cryptography in your source code, the part PKI tools and certificate managers can't see. Crypto Finder scans Java, Python, Go, and C across both proprietary and open source codebases, identifying cryptographic algorithms and producing a CycloneDX CBOM ready for post-quantum migration planning. The visibility your dependency scanners and certificate inventories miss. Built for CI/CD, developed in collaboration with IBM.

Scribe Security

SBOM generation and management across builds+11

Scribe Security is a commercial software supply chain security platform focused on evidence-based assurance for software producers and consumers. It centers on SBOM generation, artifact provenance, code signing, attestations, and policy enforcement across the SDLC to help teams verify what was built, how it was built, and whether it meets supply chain controls. The platform is positioned for organizations that need continuous software trust, especially teams shipping software through CI/CD pipelines and those needing audit-ready evidence for SLSA and SSDF. It also includes adjacent DevSecOps and posture-management capabilities, but its core value is supply chain trust and provenance.

SecurityScorecard

Attack Surface Management

Continuously rates external-facing vendor security posture using an A-F score derived from ten risk-factor groups, helping GRC teams maintain an always-current control view for third-party due diligence.

A swarm of agents. An army of risk engineers. One threat-informed TPRM platform to stop risk before it spreads across your supply chain.

Segura

Identity & Access Management (IAM)

Centralized multi-cloud identity provisioning+10

Segura is a leader in Privileged Access Management (PAM), delivering security that's fast, simple, and powerful, without the complexity.

Segura (senhasegura)

Privileged Access Management (PAM)

Privileged credential discovery+11

Segura is a leader in Privileged Access Management (PAM), delivering security that's fast, simple, and powerful, without the complexity.

Semgrep

Static application security testing+11

Semgrep is a developer-focused SAST platform that combines static analysis with multimodal AI reasoning to detect vulnerabilities in source code. The platform unifies SAST, SCA, and secrets scanning, emphasizing reduction of false positives through code context and prior decision patterns. Semgrep integrates with CI/CD pipelines for continuous scanning and correlates findings with dynamic testing via StackHawk's DAST to validate exploitability. Best suited for development teams prioritizing early vulnerability detection with minimal alert noise.

Snyk

Static application security testing for source code

Snyk is an application security platform providing SAST (static code analysis), DAST (runtime testing), and SCA (software composition analysis) capabilities integrated into CI/CD pipelines. The vendor targets development teams seeking to embed security early in the SDLC, from first commit through production deployment. Snyk's AI-native approach uses machine learning to reduce false positives while detecting complex vulnerabilities across proprietary code, open-source dependencies, containers, and infrastructure.

Socket

Block malicious open source dependencies+10

Socket is a developer-first supply chain security platform that detects and blocks malicious open source dependencies across JavaScript, Python, and Go ecosystems. Unlike traditional SCA tools focused solely on CVEs, Socket analyzes package behavior and code content to identify 70+ risk signals including malware, obfuscated code, install scripts, typosquatting, and suspicious capabilities (network access, filesystem, shell). The platform integrates into GitHub workflows, CI/CD pipelines, and local development environments to prevent malicious packages at install time.

Sonar

Source code vulnerability scanning+8

Sonar helps developers deliver high quality and secure software by analyzing code they write, AI-generated code, and code leveraged from third parties (like open source libraries). Sonar's integrated approach to improving code quality and code security catches these issues before they make it into production, helping developers reduce technical debt and code complexity over time.

Sonatype

Open source component scanning+11

Sonatype handles the complexity of managing open source software and AI behind the scenes so teams stay focused on innovation, not maintenance.

SpyCloud

Threat Intelligence

Recaptured darknet identity intelligence+9

SpyCloud pioneered the category of identity threat protection: transforming stolen identity data like breached credentials, malware-exfiltrated data, and phishing intelligence into automated action that prevents account takeover, fraud, ransomware, and session hijacking.

Sqreen (DataDog)

API Security

Runtime application protection in the application code

Datadog is the leading observability and security platform for the AI era, providing businesses with unified visibility across the technology stack to manage complexity at scale.

StackHawk

Automatic attack surface discovery from source code

3 products

We built StackHawk out of a need for a more agile, developer-friendly approach to software security. Recognizing that traditional, periodic security checks were falling short in a world of rapid software updates, we aimed to integrate security seamlessly into the daily workflow of developers.

Stacklok

We're a team of AI maximalists on a mission to ensure all knowledge workers can simply and safely lean into AI agents to increase their productivity. Our efforts have started with Model Context Protocol (MCP) servers , including our popular open source project, ToolHive.

MCP Server Registry+3

Synopsys

Static application security testing for source code

11 products

Synopsys is the leader in engineering solutions from silicon to systems, enabling customers to rapidly innovate AI-powered products.

TestifySec

Automated evidence collection and management+10

TestifySec is an evidence-driven security and compliance platform that turns every software build into cryptographic proof, letting teams ship secure, audit-ready software at the speed of development.

ThreatModeler

Automated threat modeling workflowsIntelligent threat modeling for applications+9

ThreatModeler is a leader in agentic threat modeling and secure design.

Trivy

Scans container images for OS package vulnerabilities (CVEs) and application dependency issues across Docker, Podman, and OCI formats

Trivy is an open-source vulnerability scanner developed by Aqua Security, designed to identify security issues in container images, Kubernetes clusters, file systems, code repositories, and Infrastructure as Code (IaC) configurations within DevSecOps pipelines. It supports scanning for vulnerabilities (CVEs), misconfigurations, secrets, and Software Bill of Materials (SBOM), making it a versatile solution for modern cloud-native environments. Known for its simplicity, speed, and comprehensive scanning capabilities without database dependencies, Trivy is a cornerstone tool for DevSecOps teams aiming to integrate shift-left security into development workflows. It is best suited for DevOps and security practitioners managing containerized and cloud-native infrastructure. While Aqua Security offers adjacent enterprise products, Trivy itself remains a standalone open-source scanner.

Truffle Security Co.

Secrets scanning across SDLC sources+11

Truffle Security Co. is best known for TruffleHog, an open-source and enterprise secrets-scanning product that fits software supply chain security by finding exposed credentials before they are committed, shared, or deployed. In this category, it focuses on secret leakage across source control, CI/CD, collaboration tools, cloud storage, and other SDLC systems, then verifying whether findings are live to reduce false positives. It is best suited for AppSec, DevSecOps, and security teams that need continuous detection and remediation workflows for secrets sprawl across the software development pipeline.

TuxCare

Linux vulnerability scanning+9

TuxCare’s vulnerability management offering centers on Linux and open-source environments, combining TuxCare Radar for CVE discovery and risk-based prioritization with patch-aware validation and adjacent remediation workflows. Radar is positioned to reduce scan noise by identifying which findings are actually relevant after in-memory or rebootless patching, then ranking issues using CVSS, patch availability, and threat intelligence. It is best suited for enterprises running Linux fleets, containers, and open-source stacks that need continuous vulnerability identification and remediation without relying on heavyweight scanners or disruptive maintenance windows.

UpGuard

Vendor risk assessment workflows+11

UpGuard is a cybersecurity vendor whose platform includes GRC-adjacent workflows, but it is primarily positioned around cyber risk posture and third-party risk rather than a full enterprise GRC suite. In a Compliance & GRC evaluation, it is best suited to teams that need continuous vendor risk monitoring, compliance tracking, and automated evidence-style workflows tied to security posture. UpGuard says it can track risk reduction against major compliance standards and support board-ready security ratings, making it useful for mid-market organizations and lean security teams that need ongoing assurance across suppliers and external exposure.

Veracode

Binary static application security testing+11

Veracode is a cloud-native application security platform providing SAST, DAST, SCA, and runtime analysis capabilities. The vendor targets enterprise DevSecOps teams seeking to shift-left vulnerability detection into CI/CD pipelines. Veracode is positioned as the only native SaaS application security solution with industry-leading 1% false positive rates. Best suited for organizations requiring comprehensive code coverage across custom and third-party components with centralized policy management and developer-focused remediation workflows.

ZeroFox

Digital Risk & Executive Protection

Threat intelligence search portal+11

ZeroFox is an external cyber threat intelligence vendor that focuses on collecting, correlating, and validating threat data from the surface web, deep web, dark web, social media, and criminal channels. Its CTI offering is centered on actor tracking, leak detection, campaign monitoring, and vulnerability intelligence, with analyst validation and an Intelligence Evidence Graph used to turn raw signals into finished intelligence. It is best suited for CTI and InfoSec teams that need operationally actionable intelligence rather than uncorrelated feeds. ZeroFox also sells adjacent digital risk and disruption capabilities, but its threat intelligence product is the core here.

ZeroPath