Identity threat detection (ITDR)

Behavioral AI email threat detectionAPI-based cloud email protection+10

Behavioral AI that protects email, identity, and AI, and stops insider threats.

AirMDR

Endpoint Detection & Response (EDR)

9 products

We're passionate about delivering awesome detection and response to security teams of all sizes.

AI virtual analyst for MDR triage+11

Aurigin

Identity attack detection and response+4

Aurigin.ai enables proof of ownership and authenticity for all sensitive communication devices and digital content.

Authomize

Access governance policy enforcement+7

Authomize provides an AI-native Identity Governance and Administration (IGA) platform focused on continuous discovery, mapping, and governance of human and machine identities across cloud and on-premises environments. It delivers real-time visibility into permissions, entitlements, and access risks, automating remediation through policy enforcement and self-service workflows. Best suited for enterprises with complex multi-cloud infrastructures seeking to mitigate identity-based threats without disrupting operations. Authomize positions itself as a modern alternative to legacy IGA, emphasizing agentless integration and ML-driven risk prioritization for mid-to-large organizations.

Cisco

Zero Trust / SASE / SSE

14 products

Cisco Umbrella is a cloud-delivered Security Service Edge (SSE) solution that enforces zero trust by continuously verifying identity, device posture, and context before granting access to applications. It converges multiple security functions, secure web gateway, firewall-as-a-service, cloud access security broker, and zero trust network access, into a unified cloud platform. Cisco Umbrella serves enterprises requiring distributed security across remote workers, branch offices, and on-premises infrastructure without complete network architecture overhauls.

CASBCisco SD-WAN integration+16

CrowdStrike

Endpoint Detection & Response (EDR)

12 products

CrowdStrike secures the most critical areas of risk – endpoints and cloud workloads, identity, and data – to keep customers ahead of today's adversaries and stop breaches.

Adversary intelligence profiles+14

Curity

Identity & Access Management (IAM)

4 products

Curity was founded by identity specialists who had spent years working with identity and access management in large organizations. During that time, we saw a consistent challenge. Traditional IAM systems were designed for login portals and monolithic applications, while modern digital services were increasingly built on APIs, distributed systems and open identity standards. Organizations needed a different approach.

Flexible authentication methods+11

Curricula

Security Awareness & Phishing Simulation

Threat-intel backed training episodes+9

Curricula, now part of Huntress Managed Security Awareness Training, provides security awareness training focused on employee behavior change through story-based lessons, phishing simulations, and reporting. In this category it is aimed at SMB and mid-market buyers that need recurring training without building a large internal program. The platform covers phishing, social engineering, password hygiene, and compliance-oriented awareness content, with assignments and tracking for administrators. It is positioned as a managed SAT product rather than a broad human-risk platform, with adjacent capabilities such as phishing simulation and reporting supporting the training workflow.

CybrHawk

Agentic SOC & Investigations

Natural-language SOC investigationAI-assisted alert triage+7

CybrHawk is a leading provider of cybersecurity solutions. Our offerings help organizations to get their cyber-defences attuned to stall, manage, mitigate and prevent breaches. Our solutions help detect real time suspicious activities and respond quickly to prevent breaches besides predicting possible threats. Our solutions are designed to get better off the problems.

Cynet 360 AutoXDR with MDR

Managed Detection & Response (MDR)

10 products

At Cynet, we imagine a world where any company can have full cybersecurity protections. At Cynet, we are making enterprise-grade cybersecurity accessible, simple and affordable to organizations that don't have the same resources as the Fortune 1000.

24/7 threat monitoring and response+9

Darktrace

Network Detection & Response (NDR)

Continuously monitors network trafficDetects anomalous network behavior+10

Darktrace is a network detection and response vendor centered on self-learning behavioral analytics for north-south and east-west traffic. Its NDR product baselines normal activity for users, devices, and segments, then flags anomalous connections, command-and-control behavior, data transfer outliers, and other suspicious network patterns in on-premises, cloud, and hybrid environments. The platform is aimed at teams that need visibility beyond endpoint telemetry and want automated investigation and containment for network-level threats, including encrypted traffic and novel attack paths. Darktrace also sells adjacent security products, but this profile is limited to NDR capabilities.

Delinea (formerly ThycoticCentrify)

Privileged Access Management (PAM)

Privileged account discovery and governance+10

Delinea, formed in 2021 from the merger of Thycotic and Centrify and backed by TPG Capital, provides privileged access management (PAM) solutions for securing privileged accounts, credentials, and access to servers, applications, databases, and cloud infrastructure. Available as cloud-native or on-premises deployments via a centralized dashboard, it supports hybrid enterprises with products including Secret Server for credential vaulting, Privilege Manager for endpoint controls, and Privileged Behavior Analytics for threat detection. Serves over half of Fortune 100 companies, financial institutions, and critical infrastructure, focusing on password rotation, session monitoring, and just-in-time access.

Devo

SIEM

Cloud-native SIEM data platformReal-time security data analysis+6

Devo's integrated platform includes data-powered SIEM, SOAR, and UEBA. AI and intelligent automation help your SOC make the right decisions in real time.

Ermetic

CIEM

10 products

Ermetic provides a CIEM platform that discovers and analyzes human and machine identities, entitlements, and access risks across AWS, Azure, and Google Cloud. Acquired by Tenable in 2023 and rebranded as Tenable CIEM, it combines CIEM with CSPM for contextual visibility into IAM policies, network configurations, storage, and secrets. It exposes overprivileged entitlements, toxic combinations, and enforces least privilege via automated remediation and anomaly detection. Best for multi-cloud enterprises needing unified CNAPP capabilities to manage complex entitlement sprawl without agents.

Discover cloud identities and entitlementsAnalyze excessive and risky permissions+10

Flare

Threat Intelligence

Identity-first threat intelligence detection+8

the Flare identity-first cyber threat intelligence SaaS platform combines proprietary world-class collection from across the dark and clear web with radical ease-of-use, empowering organizations to proactively detect, prioritize, and respond to external threats, ultimately reducing risk exposure and enhancing overall cyber resilience.

Linx Security

Managed Microsoft 365 identity monitoring+10

Linx Security provides unified visibility and governance across the entire identity lifecycle, focusing on both human and non-human identities (NHI). The platform maps the relationship between users, permissions, and accounts across SaaS, cloud, and on-premises environments to identify security gaps. It proactively remediates excessive permissions and identifies orphan accounts that could be exploited in identity-based attacks.

Material Security

Email Security

Email SecurityFile Security+2

Material Security secures the productivity suite by stopping attacks and reducing risk across Microsoft 365 and Google Workspace with unified cloud email and file security, data loss prevention and posture management.

Miru Labs

## Key Features **Browser-Based Endpoint Protection** Lightweight browser extension captures real-time user activity across SaaS applications

2 products

Miru is an AI-native insider threat detection and prevention platform that protects organizations from data loss, Shadow AI risks, and malicious insider activity across SaaS environments and endpoints. Founded by cybersecurity veterans with deep expertise in counterintelligence and nation-state threat detection, Miru replaces legacy UEBA and SIEM tools with an identity-anchored architecture that automates investigation workflows and eliminates alert fatigue. The platform combines browser-based telemetry with integrations to identity providers, development platforms, and productivity suites to deliver real-time behavioral analytics and automated response capabilities. Miru enables security teams at high-growth technology companies and enterprises to detect anomalous access patterns, unauthorized data exfiltration, and policy violations without adding headcount, providing the investigation intelligence and endpoint protection modern distributed workforces require.

Netwrix

Automate joiner mover leaver workflows+11

Netwrix provides a SaaS-based Identity Governance and Administration (IGA) platform, primarily through Netwrix Identity Manager (formerly Usercube), automating identity lifecycle management across hybrid IT environments. It handles provisioning, deprovisioning, access reviews, and policy enforcement for joiner-mover-leaver processes. The solution builds role catalogs mapping technical entitlements to business roles, detects toxic role combinations and Segregation of Duties (SoD) conflicts, and generates compliance reports. Best suited for mid-to-large enterprises needing scalable IGA for Active Directory, Azure AD, and multi-system access governance to enforce least privilege and support audits.

Nightfall AI

Monitor identity activity across providers+7

AI-native data loss prevention and insider threat detection platform that discovers, classifies and protects sensitive data across SaaS, GenAI, endpoint and email. Detects unauthorized uploads, shadow AI usage, exfiltration and policy violations in real-time using ML-based classifiers, replacing legacy DLP and UEBA with autonomous behavioral monitoring and prevention before data loss happens.

Palo Alto Networks

Firewall / NGFW

21 products

Palo Alto Networks is a major vendor in the Firewall / NGFW market, best known for PAN-OS-based next-generation firewalls and Cloud NGFW. Its firewalls combine application-aware policy, user-based controls, and threat prevention to inspect traffic, including encrypted sessions, and block known and unknown threats. It fits enterprises that need granular segmentation, internet edge protection, and consistent policy across physical and cloud deployments. Adjacent offerings exist, but the core firewall line remains centered on network traffic control, inspection, and prevention.

Active-passive firewall high availability+22

Permiso Security

Continuously monitor identity activity+8

4 products

Permiso Security provides a unified platform combining Identity Security Posture Management (ISPM) and Identity Threat Detection and Response (ITDR) for human, non-human, and AI identities across AWS, Azure, Okta, M365, GitHub, Jira, Salesforce, and Snowflake. It continuously monitors identity activities, performs behavioral analysis to detect anomalies like credential compromise, account takeover, and insider threats, and executes automated responses such as account lockdown and adaptive authentication. Permiso excels in runtime tracking across IaaS, SaaS, and IdPs, reducing MTTD and MTTR for organizations with hybrid cloud environments managing diverse identity types.

Pistachio

Identity attack detection and responseActive Directory and Entra ID protection+4

3 products

We make cybersecurity a seamless part of everyday work.

Proofpoint

Email Security

9 products

Proofpoint is a human-centric cybersecurity platform focused on protecting organizations from email-based and identity-driven attacks such as phishing, business email compromise (BEC), and social engineering. It secures inbound and outbound communications using advanced threat detection, AI-driven impersonation analysis, URL and attachment sandboxing, and behavioral risk signals. Beyond email protection, it extends into data loss prevention (DLP), insider threat detection, and security awareness training to reduce human risk across the organization. The platform integrates across email, cloud applications, and collaboration tools to protect sensitive data and stop attacks targeting users.

Detect AI-augmented email threats+11

Quest Change Auditor

Continuously monitor identity indicators of compromise

At Quest Software, we create technology and solutions that build the foundation for enterprise AI. By focusing on data management and governance, cybersecurity, and platform modernization, we help organizations solve their most pressing challenges and turn the promise of AI into reality.

Radiant Logic

Real-time identity data lake visibility+8

2 products

RadiantOne is an identity security platform that unifies identity data from across an organization to provide real-time visibility, risk analysis, and automated remediation. The platform combines identity data management, analytics, and observability to improve identity hygiene, detect security risks, support compliance, and strengthen IAM programs. By creating a trusted, unified identity foundation, RadiantOne helps organizations reduce identity-related threats, streamline governance, and make data-driven security decisions.

RapidIdentity (by Identity Automation)

Automated user lifecycle provisioning+11

RapidIdentity by Identity Automation is a cloud-based Identity and Access Management (IAM) platform specialized for K-12 education, managing the full digital identity lifecycle from account creation to deprovisioning for students, staff, partners, and vendors. It automates provisioning, deprovisioning, access governance, and credential monitoring across on-premises, SaaS, and cloud endpoints. Tailored for educational institutions, it integrates with systems like Jamf Connect for Apple device authentication and Clever for SSO, enabling role-specific access policies while supporting certifications like 1EdTech standards.

Saviynt

Automated identity lifecycle managementAccess request and approval workflows+10

Saviynt is on a mission to safeguard enterprises through intelligent, cloud-first identity governance & access management solutions.

SecureAuth

Multi-Factor Authentication (MFA)

Push-based login approvalOne-time passcode generation+9

We envision a world where more security doesn't equal more obstacles, where protection and experience work together.

Semperis

Security posture assessment and monitoring+9

As cybersecurity leaders and Active Directory (AD) experts, we know that identity-first security is the key to operational resilience.

Sharelock

Behavioral analysis of identity-centric threats+6

Unmatched visibility. Unwavering protection. Break down silos and unify identity security. Protect every digital identity, everywhere, against all threats.

Silverfort

Monitor authentication across hybrid environments

10 products

Silverfort secures every dimension of identity. We break down the silos of identity infrastructure and point solutions to eliminate security gaps and blind spots once and for all. The result? Identity security without limits, that doesn't slow down the business.

SpecterOps

Detects identity attack paths in Active Directory+10

2 products

SpecterOps provides BloodHound Enterprise, a platform dedicated to identifying and remediating Attack Path Management (APM) risks within Active Directory and Azure workloads. It focuses on the 'Identity Gap' by mapping complex relationship chains that attackers use to escalate privileges and move laterally. The platform replaces manual red-team discovery of identity misconfigurations with continuous, automated visibility into privilege escalation paths.

Splunk

SIEM

Collect and normalize security data+11

Our purpose is simple and unwavering: to build a safer and more resilient digital world. Every day, we help SecOps, ITOps, and engineering teams secure their systems, resolve issues quickly, and keep their organizations running without interruption.

SpyCloud

Threat Intelligence

9 products

SpyCloud pioneered the category of identity threat protection: transforming stolen identity data like breached credentials, malware-exfiltrated data, and phishing intelligence into automated action that prevents account takeover, fraud, ransomware, and session hijacking.

Recaptured darknet identity intelligence+9

Stellar Cyber

Network Detection & Response (NDR)

12 products

Build the platform that makes it easy for everyone to see what's coming – and act fast with confidence.

Deep packet inspection collects L2–L7 metadata and files for over 4,000 network applications from raw packets to enable behavioral anomaly detection and threat identification.

Teleport

Identity & Access Management (IAM)

Zero trust access to infrastructureRole-based access control+10

We deliver trusted computing to modern infrastructure

ThreatDown

Endpoint Detection & Response (EDR)

Advanced behavioral threat detection+5

ThreatDown is redefining cybersecurity for businesses of all sizes. We strip away the bloat, the cost, and the confusion, replacing it with powerful, intuitive security that protects thousands of organizations worldwide from the most advanced threats.

Valence Security

SaaS Security Posture Management (SSPM)

SaaS application discovery and inventory+10

Valence Security offers a comprehensive SaaS Security Posture Management (SSPM) platform that extends into AI governance and identity threat detection. It provides deep visibility into SaaS-to-SaaS integrations, OAuth tokens, and AI agent permissions to reduce the surface area for supply chain attacks. The platform automates the remediation of misconfigurations and overly permissive shares in applications like Microsoft 365, Salesforce, and Slack.

Veza from ServiceNow

Identity security across all identity types+7

Veza is the authorization platform for data. Built for hybrid, multi-cloud environments, Veza enables organizations to easily understand, manage and control who can and should take what action on what data.

Vorlon

AI Runtime & Agent Security

Maps live data flows across agents+11

The Agentic Ecosystem Security Platform. Powered by DataMatrix™, Vorlon's patented intelligent simulation engine, the platform monitors every agent action, detects threats across the full integration layer, and enforces data security in real time across every system AI agents touch.

WideField Security

Identity discovery for human and non-human accounts

WideField Security provides automated visibility and real-time response capabilities for Non-Human Identities (NHIs) and AI agents across hybrid environments. The platform focuses on detecting session-based threats and unauthorized identity-driven movements that traditional IAM tools miss. It complements IAM and PAM solutions by providing a layer of detection and response specifically for automated and machine-based identities.

Wraithwatch

Security Operations

Attack Surface Management

Wraithwatch is a next-generation cyber defense data fabric and control plane that unifies security telemetry across tools and environments. It ingests, normalizes, and correlates data from diverse sources to give security teams a single operational layer for detection, investigation, and response. The platform enables real-time visibility, automated workflows, and scalable security operations across enterprise environments, helping organizations reduce complexity and improve decision speed across their security stack.

Agentic Threat Hunting+9

XM Cyber