SOAR &amp; automation

AI asset discovery and inventory+10

The AI-native security operations platform built for enterprise. Preemptive, autonomous, and continuously self-improving.

Alpha Level

Threat Intelligence

Automated alert triage and classification+7

Alpha Level is a next-generation cybersecurity company transforming how Security Operations Centers (SOCs) detect and respond to threats. Alpha Level combines statistical modeling, anomaly detection, and agentic AI to filter out non-actionable alerts, surface rare and high-risk behaviors, and provide contextualized evidence for investigation. The result is a data-driven, behavior-based detection system that improves signal quality while reducing cost.

AppOmni

SaaS Security Posture Management (SSPM)

Agentless SaaS configuration monitoring+11

AppOmni is positioned as a SaaS Security Posture Management (SSPM) platform, not a traditional multi-cloud CSPM vendor. The search results consistently clarify that AppOmni focuses on SaaS application security posture (Salesforce, Microsoft 365, ServiceNow, Google Workspace, Workday) rather than cloud infrastructure (AWS, Azure, GCP). While AppOmni uses CSPM terminology in legacy marketing, it does not compete in the infrastructure CSPM category. For cloud infrastructure posture management, AppOmni integrates with true CSPM solutions like Wiz. Organizations seeking multi-cloud IaC scanning, drift detection, and infrastructure misconfiguration remediation should evaluate dedicated CSPM vendors, not AppOmni.

ArmorPoint

24x7x365 professional SOC team performing continuous monitoring, alert investigation, validation, and escalation to incident with SANS-based incident response protocols

ArmorPoint is a cloud-native managed security operations platform built for midsize enterprises and the partners who serve them. The platform brings detection, response, risk, and compliance together within a shared operations environment where customers, partners, and ArmorPoint's 24/7 U.S.-based SOC work side by side.

AttackIQ

Penetration Testing & Red Team

Automate adversary emulation tests+11

The leading platform for Adversarial Exposure Validation (AEV) We help security teams make better decisions by continuously measuring how adversaries can exploit gaps across people, processes, and technology.

AT&T Business

Security operations center management+11

AT&T Business offers **Security Operations Center (SOC)** services that combine managed monitoring, correlation, alerting, and incident response for enterprise networks and applications. In this category, it is positioned as a telecom-scale managed security provider that operationalizes security processes around AT&T network visibility and service management. The offering is best suited to organizations that want outsourced 24x7 security operations, alarm validation, and response support without building a full internal SOC. AT&T also sells adjacent cybersecurity products, but the core Security Operations scope here is its managed SOC/MDR services.

Beazley Security

Managed extended detection and response+10

Beazley Security is a cyber risk management vendor whose Security Operations offering centers on managed detection and response plus exposure management. Its MXDR service provides always-on monitoring, threat identification, and containment across endpoints, networks, cloud services, identity, and email, while exposure management continuously inventories external assets and prioritizes known-exploited vulnerabilities. The company is positioned for organizations that want operational security support from a team that combines incident response, forensics, and risk intelligence with insurance heritage. It is best suited for buyers seeking a managed SOC-style service rather than a standalone software tool.

Binary Defense

24x7x365 SOC monitoring of endpoints, servers, and cloud resources using behavioral-based detections to identify anomalies, lateral movement, privilege escalation, and PowerShell injection

Binary Defense delivers a human-led, 24x7x365 Managed Detection & Response (MDR) service that detects and isolates threats early in the attack lifecycle using behavioral-based detections and an attacker’s mindset. Their Security Operations Center analysts triage, disposition, and prioritize events, conduct full kill chain analysis, and provide tactical and strategic mitigation recommendations. Best suited for organizations needing an extension of their security team, whether they have an existing team or none, Binary Defense MDR operates as a cloud-based, tool-agnostic service integrated via their BD Platform. The vendor also offers adjacent capabilities like MDR Plus with managed deception and malware disruption, but core MDR focuses on analyst-driven monitoring and response.

BlinkOps

AI agents investigate incoming alerts+8

BlinkOps is an agentic security automation platform that utilizes AI-driven agents to handle end-to-end security operations tasks including alert triage, investigation, and incident containment. It replaces traditional, manual SOAR playbooks with LLM-powered agents that can interpret natural language instructions to execute complex workflows across disparate security tools. The platform provides a low-code/no-code interface for building scalable security automations that reduce Mean Time to Respond (MTTR).

Blumira

Pre-built threat detection rules maintained by SecOps team

Blumira is a cloud-native SIEM and XDR platform designed for mid-market organizations and MSPs. It combines log ingestion from 75+ integrations with pre-built threat detection rules maintained by an in-house SecOps team, automated response capabilities including host isolation, and 24/7 managed security operations support. The platform provides one year of searchable log retention, compliance reporting for frameworks including HIPAA, PCI DSS, CMMC 2.0, and NIST, targeting organizations seeking detection and response without dedicated security staff.

Booli

Identity-centric log correlation+7

Booli is an identity-centric SIEM vendor that focuses on log ingestion, event correlation, and investigation context built around user identity. Its platform is positioned for SOCs and MSSPs that want cloud-native log management with reduced alert noise, long-term retention options, and compliance-oriented reporting. Public materials emphasize stitching security events back to identities, custom correlation pipelines, and high-context alerts rather than broad XDR or endpoint telemetry coverage.

Booz Allen Hamilton

Cyber security operations center+11

Booz Allen Hamilton is a public-sector-heavy cybersecurity services vendor that delivers **managed detection and response, SOC operations, threat hunting, incident response, and cyber defense operations** rather than a standalone software platform. In Security Operations, it is best known for mission-focused engagements with U.S. federal, defense, intelligence, and critical infrastructure customers, including environments that need classified handling and federal compliance alignment. Its offerings are strongest for buyers that want outsourced operational security, threat-informed detection engineering, and incident handling backed by consulting and engineering depth.

Brinqa

Vulnerability Management

Unify vulnerability and risk data+11

Brinqa helps exposure management teams reduce risk faster by unifying data across IT, security, cloud, identity, and application security through 240+ pre-built connectors and the Cyber Risk Graph™, creating a single source of truth. AI agents improve data quality by identifying owners, deduplicating findings, and assessing real exploitability. SmartFlows automate remediation across teams without custom code.

CDW

Managed security operations support+11

With full-stack expertise, CDW helps you design, orchestrate and manage technologies that drive business success.

Censys

Attack Surface Management

Continuous internet exposure discovery+11

Censys provides Attack Surface Management focused on external internet visibility: it continuously scans the public Internet, attributes discovered assets to an organization, and tracks changes in hosts, ports, certificates, services, and exposures. In this category it is known for its Internet-scale dataset, near-real-time exposure monitoring, and evidence-based prioritization of externally reachable risks. It is best suited for security teams that need to discover unknown internet-facing assets, confirm what attackers can actually reach, and route remediation into existing workflows. Censys also sells adjacent products, but this profile is limited to ASM capabilities.

Cloudian (via integrations)

Backup & Disaster Recovery

S3-compatible object storage backend+11

Cloudian is revolutionizing enterprise storage with its exabyte-scalable data platform software, designed to meet the demands of today's data-intensive AI and analytics workloads.

Coalfire

Managed security servicesThreat hunting and incident response+10

Coalfire's team of cyber legends who hunt, test, and neutralize vulnerabilities before they become headlines

Confidencial

Encryption & Key Management

Protect sensitive data in useSupport compliant AI readiness+3

Confidencial is a data-centric security platform focused on protecting unstructured information such as documents and emails across multi-cloud and internal environments. It utilizes patented selective encryption and granular access controls to ensure data remains secure even if storage or transport layers are compromised. The platform integrates with AI workflows to prevent sensitive data leakage while maintaining document usability for authorized users.

CriticalStart

24x7x365 human-led monitoring of alerts from EDR/EPP, XDR, identity, and SIEM tools with contractual SLAs for response time

Managed detection and response that backs every commitment with contractual SLAs. US-based SOC. 24/7/365 coverage.

Cybaverse

Managed Detection and Response+10

The all-in-one cyber security platform that grows with you. Cybaverse combines AI, automation, and expert-led services in a unified platform, giving every organisation, from MSPs to global teams, the power to protect, detect, and respond at pace. CybaOps brings together Managed Detection and Response (MDR), Penetration Testing, Cyber Compliance, Incident Response modules and more designed to proactively protect your digital assets.

Cyberbit SOC 3D

Incident workflow automation+7

We help organizations build attack-ready defensive teams with simple, risk-focused exercising cycles that respect SOC time and budget.

CyberProof

24/7 security alert monitoring with automated enrichment and human-led triage to reduce false positives and accelerate incident validation

CyberProof is a cloud first security operations company, enabled through key cloud partners, to help deliver the most cutting edge security services to help protect your enterprise.

Cycode

Supply Chain Security

End-to-end software supply chain visibilityPolicy enforcement across pipelines and toolingProprietary and third-party scanner ingestion+9

AI Writes The Code. We Secure And Govern It.

Cydarm

Incident Case Management+3

Cydarm is a cybersecurity incident response management platform focused on security operations and SOC workflows. In this scope, it helps teams manage incidents from triage through reporting, with controls for collaboration, need-to-know access, and stakeholder communication. The company positions the product for organizations that need structured incident response, evidence handling, and audit-ready reporting, including enterprise environments and regulated industries. It is best suited to security operations teams that want to coordinate analysts, incident responders, and non-SOC stakeholders in one workflow rather than across disconnected tools.

Cylerian

Automated incident triage and response orchestrationReal-time threat detection and response

11 products

By consolidating visibility and control across your organization and providing everything you need out of the box, Cylerian makes IT simpler and safer.

Cynet 360 AutoXDR with MDR

24/7 threat monitoring and response+9

10 products

At Cynet, we imagine a world where any company can have full cybersecurity protections. At Cynet, we are making enterprise-grade cybersecurity accessible, simple and affordable to organizations that don't have the same resources as the Fortune 1000.

Cyware

Threat Intelligence

Automated threat feed ingestion and enrichmentAgentic AI-driven threat lifecycle automation+7

Cyware enables security teams at leading global organizations to operationalize threat intelligence data and execute real-time actions by integrating intelligence management, automating workflows, and promoting secure collaboration for a stronger, unified defense.

D3 Security

Autonomous alert investigation+10

D3 Security provides Morpheus AI, an autonomous AI SOC platform that investigates and triages 100% of security alerts in under three minutes using a purpose-built cybersecurity triage LLM and Attack Path Discovery. This traces full attack paths horizontally across email, endpoints, identity, cloud, and network tools, and vertically through historical telemetry, delivering L2+ depth with structured reports including MITRE ATT&CK mapping, entity graphs, and response recommendations. Best for enterprises with high alert volumes seeking to automate L1/L2 SOC tasks while augmenting L3 analysts. Developed over 24 months by 60 specialists.

DeepTempo

Triage agents automatically score incoming alerts and separate likely noise from items that need investigation, reducing manual Level 1 review work.

Machine speed intelligence for your SOC. LogLM finds today's attacks. Vigil turns findings into action.

DeepWatch

AI-powered Threat Detection and Response+3

Deepwatch® is the leader in Precision MDR powered by AI and humans. We amplify human expertise with AI insights to reduce the risks that matter most to your business.

Devo

Cloud-native SIEM data platform+7

Devo's integrated platform includes data-powered SIEM, SOAR, and UEBA. AI and intelligent automation help your SOC make the right decisions in real time.

Dispel

Secure Remote AccessZero Trust Engine+2

Dispel provides secure remote access and threat monitoring for Operational Technology (OT) and IT environments. The platform offers a Zero Trust Engine to connect vendors, OEMs, and operators to critical industrial systems and data, aiming to eliminate the complexities of traditional remote access methods. It includes integrated threat monitoring capabilities for 24/7 SOC protection.

Elastic

Centralized security event collection+8

Elastic Security provides an open-source SIEM platform built on the Elastic Stack (Elasticsearch, Logstash, Kibana, Beats) for collecting, indexing, and analyzing security logs from endpoints, networks, clouds (AWS, Azure, Google Cloud), and firewalls. It supports ECS-compliant index mappings, threat detection via KQL queries for brute force and lateral movement, correlation rules for multi-stage attacks, IOC matching with enrich policies, and Watcher-based alerting. Best for SOC teams needing scalable search analytics, real-time monitoring, and integration with EDR, XDR, SOAR in resource-constrained environments.

eSentire Managed Detection and Response

24/7 SOC analyst monitoring+9

eSentire Managed Detection & Response (MDR) is a staffed security service that combines 24/7 monitoring, analyst triage, threat hunting, and containment across endpoint, network, cloud, identity, and SaaS telemetry. The service is built around multi-signal ingestion and human-led response, with eSentire claiming a mean time to contain of under 15 minutes. It is aimed at organizations that need outsourced SOC coverage and rapid incident handling without running the detection and response workflow internally. Adjacent platform components include Atlas and Microsoft-specific MDR coverage, but the core offering is the managed service.

Expel

24×7 human-led monitoring and alert triage across endpoints (Windows, Mac, Linux), networks, SIEMs, AWS/Azure/GCP control planes, and SaaS apps like Okta and Microsoft 365, detecting threats via EDR agent telemetry and cloud configuration logsActive response authority enabling analysts to isolate hosts, block malicious IPs/domains at firewalls, disable compromised accounts, terminate processes, and quarantine files without waiting for customer approval on every action+6

Does MDR have to be so bad? (Turns out, no.)

Fig

Autonomous detection and response flow mappingReal-time drift detection for security flowsChange modeling and fix simulation+2

We've modernized the world's largest and most complex SOCs.

Forescout

IoT Security

Real-time device visibility+11

Forescout’s IoT Security offering is an agentless device visibility and control platform for unmanaged IoT, OT, and IoMT environments. It identifies devices as they connect, classifies them by type and function, detects weak or factory-default credentials, monitors communications for anomalous behavior, and automates policy actions such as segmentation, quarantine, and least-privilege network access. The product is best suited for enterprises that need passive discovery and enforcement across mixed IT/OT networks, including healthcare, manufacturing, building automation, and critical infrastructure. Forescout also offers adjacent OT and network access control capabilities, but the IoT Security scope centers on device visibility, classification, and containment.

Fortinet

Firewall / NGFW

Next-generation firewall inspection+10

Fortinet’s FortiGate line is the company’s Firewall/NGFW offering, covering stateful firewalling, application control, IPS, web filtering, SSL/TLS inspection, and threat-intelligence-backed blocking. It is widely deployed from branch and edge sites to enterprise perimeter and segmentation use cases, with hardware, virtual, and cloud form factors managed through the same Fortinet policy stack. Buyers typically choose it when they need firewall enforcement plus inline inspection and VPN capability in one appliance, especially in environments that already use FortiGuard threat feeds or the Fortinet Security Fabric. Adjacent products include SD-WAN and ZTNA, but those are not the core scope here.

Glow

Endpoint software visibility+10

Control everything that runs on your endpoint - and get the fundamentals right so your team can adopt AI safely.

Google Cloud Security

Data Security Posture Management (DSPM)

Automatic sensitive data discovery+10

Google Cloud DLP (now Sensitive Data Protection) is a fully managed service for discovering, classifying, and protecting sensitive data across Google Cloud Platform resources including BigQuery, Cloud Storage, and Datastore. It scans structured/unstructured data, text streams, and images via OCR, using over 200 built-in infoType detectors for PII like credit card numbers and phone numbers. De-identification methods include masking, redaction, tokenization, format-preserving encryption, and date-shifting. Best for enterprises with heavy GCP usage needing automated, scalable scanning of data at rest and in transit via API or console.

GuidePoint Security

Security operations center services+11

GuidePoint Security brings together strategic partnerships, deep expertise and smart technology to protect what matters most.

HPE

Managed security operations+9

HPE’s Security Operations scope centers on managed detection, monitoring, and security operations modernization rather than a standalone, widely marketed SIEM or SOAR suite. Its HPE Managed Security and security consulting services are aimed at enterprises that want SOC support, operational visibility, and guidance for improving incident detection and response across hybrid and multi-cloud environments. HPE appears best suited for large organizations that already run complex infrastructure and want security operations delivered alongside broader IT and infrastructure services.

Insight

24/7 threat detection and response+7

Insight is a managed security operations provider built around its Security Operations Centre, offering 24/7 threat detection, investigation, and response for organizations that want a SOC without standing up their own team. In this category, Insight positions itself as a services-led SecOps partner rather than a standalone software vendor, with offerings such as Managed Security Operations, Managed Endpoint Detection and Response, and Managed Extended Detection and Response. It is best suited for buyers that want analyst-led monitoring, incident triage, and response coverage across endpoints and broader environments.

Introw

Partner portal management+10

Introw is a CRM-connected partner relationship management platform, not a Security Operations product. In the Security Operations category, it has no documented capabilities for threat detection, incident response, SIEM/SOAR workflows, or security case management. Its documented use case is helping B2B vendors manage partner portals, deal collaboration, content sharing, and partner engagement through Salesforce or HubSpot. It is best suited for revenue teams and partner managers rather than security operations teams.

Lockheed Martin

Cyber hardening for weapons systems+9

Lockheed Martin is a public defense contractor that offers security operations capabilities mainly as part of government and enterprise mission support rather than as a standalone commercial SOC platform. Its relevant footprint in this category centers on 24/7 monitoring, intrusion detection, vulnerability assessment, and incident response for large federal environments, including a DHS security operations center contract. It is best suited for public-sector buyers that need cleared personnel, operational security services, and support for regulated networks and critical infrastructure.

LogicMonitor

Unified detection and governed action+6

Our observability platform proactively delivers the insights and automation CIOs need to accelerate innovation.

Lucid Software

Security and compliance controlsAutomatic content inspectionIntelligent data classification+7

Lucid is the leader in work acceleration

Menlo Security

Browser & Web Isolation

10 products

As a pioneer of browser security, Menlo Security delivers a solution with a comprehensive approach to enterprise browser security, protecting users where they work and securing applications from internet-borne attacks.

Cloud-based remote browser isolation+11

Microsoft

Cloud Security / CSPM

15 products

Microsoft Defender for Cloud is a multicloud CSPM platform that provides continuous security posture assessment across Azure, AWS, and GCP. It delivers agentless vulnerability scanning, misconfiguration detection, and compliance monitoring against industry benchmarks (CIS, NIST, ISO, PCI-DSS). The platform generates hardening recommendations ranked by risk and includes attack path analysis to identify exploitable chains. Defender for Cloud serves enterprises managing hybrid and multicloud infrastructure seeking unified posture visibility and compliance reporting.

Agentless vulnerability scanning+21

NetWitness

Enriched log data analysis+10

NetWitness is a comprehensive threat detection and response platform that integrates SIEM, network forensics, endpoint data, and user entity behavior analytics (UEBA). It provides security analysts with deep visibility across the entire attack lifecycle by capturing and analyzing packet-level data alongside logs and endpoint telemetry. The platform is designed for high-scale enterprise environments, replacing fragmented point solutions with a unified workbench for incident investigation and response orchestration.

Optiv

Managed detection and response+10

Optiv is the partner organizations trust to advise, deploy and operate cybersecurity programs built for real-world complexity, reducing risk and delivering real results.

Palo Alto Networks

Firewall / NGFW

21 products

Palo Alto Networks is a major vendor in the Firewall / NGFW market, best known for PAN-OS-based next-generation firewalls and Cloud NGFW. Its firewalls combine application-aware policy, user-based controls, and threat prevention to inspect traffic, including encrypted sessions, and block known and unknown threats. It fits enterprises that need granular segmentation, internet edge protection, and consistent policy across physical and cloud deployments. Adjacent offerings exist, but the core firewall line remains centered on network traffic control, inspection, and prevention.

Active-passive firewall high availability+22

Panther

Detection-as-code in PythonCloud-native SIEM data lake+8

Our mission is to make security teams smarter and faster than attackers.

Phriendly Phishing

Security Awareness & Phishing Simulation

Customizable phishing simulations with email attachments to test employee handling of malicious file downloads

Phriendly Phishing's mission is to transform how organisations manage human cyber risk and build resilient cyber cultures grounded in empathy, education, and measurable impact.

Port0

Identity & Access Management (IAM)

Identity and network context analysis+8

Port0 is a network security platform with an integrations hub and connector framework, but the available public material does not show a dedicated Identity & Access Management (IAM) product. For an IAM buyer, it appears best fit only where identity data, access signals, or directory-related context need to be connected into a broader security graph. Its published content emphasizes integrations, live querying, and data fusion rather than core IAM functions such as SSO, provisioning, or MFA.

Rapid7

Vulnerability Management

11 products

Rapid7 is a global leader in AI-powered managed cybersecurity operations, trusted to advance organizations' cyber resilience. Open and extensible, the Rapid7 Command Platform integrates security data, enriching it with AI, threat intelligence, and 25 years of expertise and innovation to reduce risk and disrupt attackers.

Asset discovery and vulnerability scanning+11

Raxis

Penetration Testing & Red Team

Point-in-time penetration testing+11

Raxis is a U.S.-based offensive security provider focused on human-led penetration testing, red teaming, and PTaaS. In the Penetration Testing & Red Team category, it is positioned as a services-led vendor that combines manual exploitation with a web portal for scoping, live findings, retesting, and reporting. It is best suited for buyers that want recurring or full-scope assessments across web, API, network, cloud, mobile, wireless, and physical attack paths, rather than only automated scanning. Adjacent offerings include social engineering and purple team engagements.

ReliaQuest

Autonomous alert investigation and triage+10

10 products

ReliaQuest delivers an Agentic AI Security Operations platform, GreyMatter, that unifies detection, investigation, and response across SIEM, EDR, and Cloud environments. It utilizes AI agents to automate data collection and the standard diagnostic workflows typically handled by Tier 1 and Tier 2 analysts. The platform provides a centralized console to orchestrate response actions without the need for constant data migration to a single lake.

SecsphereSoC

Continuous security monitoring+9

SecsphereSoC is an AI-powered Security Operations Center platform that provides end-to-end threat detection and response across the full attack lifecycle. It continuously monitors and correlates activity from reconnaissance through exfiltration, using a large library of detection rules and real-time analytics to identify malicious behavior. The platform automates incident response, helping security teams quickly contain and remediate threats while reducing manual effort and response times.

SecureVisio

Risk-Based Prioritization+3

SecureVisio connects the dots between Incidents, Vulnerabilities, Assets, and Risks, empowering your team with AI-assisted guided response and risk-based prioritization. We give your teams the insight, automation, and context they need to act decisively.

Securonix

Cloud-native SIEM data collection+8

Securonix is a cloud-native SIEM vendor offering unified detection and response across SIEM, UEBA, SOAR, and threat intelligence capabilities in a single platform. The company positions itself as analytics-driven with integrated machine learning for threat detection and automated incident response. Securonix targets mid-to-large enterprises seeking to consolidate security tools and reduce alert fatigue through behavioral analytics and threat chain modeling rather than signature-based detection alone.

SenseOn

Network Detection & Response (NDR)

Monitor east-west and north-south traffic+10

SenseOn unifies security telemetry, analysts, and AI agents into one governed investigation plane for faster, evidence-led response.

Shuffle Security

Workflow-based playbook automation for security response

Shuffle is a Security Orchestration, Automation and Response (SOAR) platform designed to streamline and scale cybersecurity operations through flexible workflow automation. It enables security teams to connect existing tools, orchestrate multi-step processes, and automate incident response across cloud, on-prem, and hybrid environments. Built on a modular, “do one thing well” philosophy, Shuffle focuses purely on automation rather than bundling unrelated security functions like ticketing or threat intelligence. Originating from real-world CERT/SIRT challenges, it provides a lightweight but powerful engine for building and executing security workflows that reduce manual effort and accelerate response times.

SIRP

Autonomous SOC Platform+3

We started SIRP because security teams were drowning in alerts and tools that promised automation but still needed a human to babysit every step. OmniSense is what we built instead.

SmishAlert

Security Awareness & Phishing Simulation

Learn from real messaging attacks+6

SmishAlert is a mobile-first security awareness platform that specializes in defending against SMS-based phishing (smishing), QR code scams (quishing), and mobile social engineering. It provides real-time analysis of incoming messages and reinforces secure user behavior within native mobile workflows. The platform complements traditional email-centric security awareness programs by addressing the growing threat of mobile-based corporate credential theft.

Sola Security

Autonomous triage and investigation+9

Sola is the enterprise security brain. It connects the security and business tools you already run and maintains a living understanding of every identity, host, cloud resource, SaaS app, and AI agent – and the security context around them – so any question, from a person or an agent, gets an evidenced answer in minutes.

Splunk

Collect and normalize security data+11

8 products

Our purpose is simple and unwavering: to build a safer and more resilient digital world. Every day, we help SecOps, ITOps, and engineering teams secure their systems, resolve issues quickly, and keep their organizations running without interruption.

Sumo Logic

Cloud-native security analytics+8

Intelligent Operations for the AI era. Agentic AI-powered security and cloud analytics to automate, detect and investigate at the speed of now.

Swimlane

Autonomous AI investigation agents+7

Swimlane provides Swimlane Turbine, an agentic AI automation platform for AI SOCs, integrating AI agents, low-code playbooks, case management, dashboards, and reporting with infinite integrations. It automates triage, investigation, and response through governed workflows, delivering 60,000 SOC analyst equivalents daily across customers. The Investigation Agent synthesizes threat intelligence, past investigations, and knowledge bases to generate NIST-aligned, four-phase response plans (containment, eradication, recovery, hardening) with actionable steps. Best for enterprise SOCs and MSSPs seeking transparent, auditable AI execution to reduce context switching and MTTR by up to 75%. Leader in GenAI SOC platforms, #1 on Gartner Peer Insights.

Sygnia

Managed detection and response+11

Sygnia combines global reach with a boutique, highly engaged approach, bringing over a decade of frontline incident response experience in the world's most complex cyber incidents. We help leaders like you contain attacks quickly, understand business impact clearly, and build lasting cyber resilience.

Sysdig

Container Security / CNAPP

Graph-based cloud risk correlationContinuous cloud posture monitoringAgentless cloud asset scanning+9

Cloud security with zero compromise.

ThreatAware

Vulnerability Management

Discover devices and users accessing data+9

ThreatAware transforms the way organisations secure their cyber assets globally.

ThreatDefence

SIEM with log management and data retention+8

ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.

TierPoint

Managed SOC monitoring+11

We are security-focused, cloud-forward, and data center-strong, a champion for untangling the hybrid complexity of modern IT, so you can free up resources to innovate, exceed customer expectations, and drive revenue.

Tines

No-code security workflow automation+10

We believe that by combining AI, automation, and integration with human ingenuity organizations are more efficient, secure, and will have more engaged, happier teams.

T-Mobile

24/7/365 security monitoring+9

T-Mobile’s Security Operations Center (SOC) is a managed security operations service for Polish business customers that focuses on continuous monitoring, incident detection, triage, and response support for IT security events. The service combines 24/7/365 event investigation with SIEM-based log collection, correlation, and alerting, and it provides mitigation guidance and SLA-driven incident handling. It is aimed at organizations that want an outsourced SOC function and access to security specialists without building an in-house monitoring team. T-Mobile also offers lighter variants such as SOC Lite and SOC na start.

Torq

Agentic AI triage and response+10

The AI SOC Platform that helps security teams triage, investigate, and respond to threats faster.

TraceCat

AI Agents and Automation+3

Tracecat is an open-source AI-native Security Orchestration, Automation, and Response (SOAR) platform. It enables security teams to build custom AI agents and automate security operations workflows using prompts and deterministic runbooks. The platform focuses on scaling security workforce capabilities through automation and provides tools for case management and integration with existing security stacks.

Trellix Helix

Next-generation SIEM with advanced search+11

Trellix Helix is a SaaS security operations platform that unifies SIEM, SOAR, and threat intelligence, integrating over 600 Trellix and third-party tools for multi-vector threat detection and response. It augments existing SIEMs with analytics, behavioral analysis, and workflow automation, enabling correlated investigations across endpoints, networks, and cloud environments. Best suited for enterprises seeking XDR capabilities without replacing legacy SIEMs, it leverages Trellix's global threat intelligence for contextual IOCs and TTP-based rules, streamlining alert triage and containment.

TrendAI

AI stack discovery and inventory+6

TrendAI’s AI Security Posture Management (AI-SPM) capability is part of Trend Vision One and is positioned to give security teams visibility into the cloud assets used to build AI services, including threats, misconfigurations, and attack paths. Trend Micro describes it as helping organizations understand the AI-related cloud assets in use and the security status of those assets through interactive dashboards and tables. It is best suited for enterprises already using cloud-based AI services and wanting posture visibility across AI build environments rather than runtime enforcement. TrendAI also markets adjacent platform capabilities outside this scope.

Tufin

Cloud Security / CSPM

Unified cloud and network policy control+10

Tufin is best known for network security policy orchestration, but its cloud security offering extends that policy management model into public cloud environments. In the Cloud Security/CSPM scope, it provides visibility into cloud assets, security groups, firewalls, and access paths across AWS, Azure, and Google Cloud, with misconfiguration detection and compliance validation. It is a fit for teams that want cloud posture findings tied to network policy and change workflows, especially in hybrid environments where on-prem and cloud controls are managed together. Adjacent CIEM and DSPM content exists, but they are separate capabilities.

UpGuard

Compliance & GRC

Vendor risk assessment workflows+11

UpGuard is a cybersecurity vendor whose platform includes GRC-adjacent workflows, but it is primarily positioned around cyber risk posture and third-party risk rather than a full enterprise GRC suite. In a Compliance & GRC evaluation, it is best suited to teams that need continuous vendor risk monitoring, compliance tracking, and automated evidence-style workflows tied to security posture. UpGuard says it can track risk reduction against major compliance standards and support board-ready security ratings, making it useful for mid-market organizations and lean security teams that need ongoing assurance across suppliers and external exposure.

Vega

Scan cloud estates for AI inventory+9

Vega delivers federated and AI-native search, detection, and investigation that strengthens coverage, speeds response, and gives SecOps unified access to all security data through its Security Analytics Mesh (SAM) platform. By analyzing data where it already lives, Vega eliminates blind spots, data silos, ingestion fees, migration headaches, and vendor lock-in. ]

Verno Labs

Adversarial testing for AI agents+4

We're building the offensive AI that the next decade of enterprise security will depend on, and putting it in the hands of the companies who can't afford to wait.

VMware Workspace ONE

Mobile Security

Mobile device management+10

VMware Workspace ONE Mobile Threat Defense (MTD) is a UEM-integrated mobile endpoint security solution for Android, iOS, and Chrome OS, powered by Lookout technology. Delivered through Workspace ONE Intelligent Hub, it provides threat detection and automated remediation without requiring separate application installation. The solution addresses phishing, malware, device vulnerabilities, jailbreak/root detection, rogue Wi-Fi, and SSL stripping attacks. Best suited for enterprises managing heterogeneous mobile device environments seeking consolidated endpoint protection with Zero Trust Network Access capabilities.

WatchGuard Technologies

Firewall / NGFW

Application control and identification+11

For 30 years, WatchGuard has delivered real-world cybersecurity built for constantly evolving threats and limited IT resources. We partner with MSPs to simplify security and protect networks, endpoints, identities, and cloud environments with solutions that scale and last.

Wider Security

Security engineeringCloud securityInformation risk management+7

Wider Security is a veteran-owned cybersecurity services firm founded in 2019 that provides security operations-related support through engineering, integration, cloud security, and risk management work. In the Security Operations category, it appears to be a services-led provider rather than a software platform, with emphasis on securing government and defense environments and supporting DoD IT networks. It is best suited for organizations that need hands-on security operations support, systems integration, and technically skilled staffing rather than a standalone SOC product.

Wraithwatch

Attack Surface Management

Wraithwatch is a next-generation cyber defense data fabric and control plane that unifies security telemetry across tools and environments. It ingests, normalizes, and correlates data from diverse sources to give security teams a single operational layer for detection, investigation, and response. The platform enables real-time visibility, automated workflows, and scalable security operations across enterprise environments, helping organizations reduce complexity and improve decision speed across their security stack.

Agentic Threat Hunting+9

XM Cyber

Continuous external asset discovery+11

XM Cyber is a leader in exposure management that uses attack path modeling to show how attackers can navigate hybrid cloud and on-prem environments. By combining vulnerability data, misconfigurations, and identity exposures, it prioritizes remediation based on the actual risk to critical assets. It replaces static vulnerability scanners with continuous, graph-based security validation to identify the 'choke points' that matter most to an attacker.

Zeronsec