Cybersecurity vendors

Mend was Snyk's main competitor early for quick open source scanning in pipeline, but did not expand as quickly as Snyk into other areas. Their open source Renovate tool is great for keeping your in-house dependencies up to date, but their UI and scanning engine were more difficult to deploy, maintain, and navigate. However, due to Renovate they have unique visibility into the expected challenge of a version upgrade. They've recently expanded most heavily into MLBOM capabilities.

Mondoo is ambitiously building an all in one vulnerability scanner and management tool - from endpoints to IaC. Currently they're strong at asset and vulnerability scanning, but weaker at the remediation workflows.

Netrise has created rich dependency analysis specializing in firmware on hardware devices like Cisco Switches. They also detect hard-coded credentials, and other vulnerabilities. They've expanded this technology into containers to provide in depth analysis.

Acquired by Orca Security, Opus focuses on providing root cause analysis - mostly with containers and IaC. Their foundation is building resources and ownership, and then enabling alerting and communication per group to be flexible to different workflows. They provide workflows upon vulnerability detection.

Pynt has created an elegant solution for running DAST type scanning against your APIs by running tests via a local proxy. This helps to bypass a lot of the pain with configuring DAST tools against your endpoints. They also do API discovery, drift detection, and testing via network integrations.

Seal backports security patches for open source libraries and container images, allowing you to auto-patch any vulnerabilities without doing major framework updates.

For what Snyk offers in usability across functions, SemGrep excels in customization. Their tool offers extensive customizations and rule sets, and their reachability analysis, a critical aspect of SCA, beat Snyk to market. Also, their open source tooling is powering many other tools on this list.

AI-powered no-code platform that lets security teams build and deploy custom security apps, dashboards, and automations on top of their existing stack.

SumoLogic's being cloud native has given them a lead in fast cloud queries and development. They're a great middle of the road between QRadar and Splunk, and similarly get the job done with both a query language and understandable dash-boarding. They provide a great cloud native offering.

Agentic security operations platform that uses AI agents over a unified context graph to find and remediate exposures like dormant accounts, expired certificates, and misconfigurations.

Tigera built the Calico network plugin for K8s and has since expanded into a larger cloud security offering focusing primarily on Kubernetes protection and observability. They remain the most robust on network protection, offering deep insights into what's traversing your network.

Turbot's Guardrails allow enforcement of cloud security controls, while Pipes enables querying across your cloud data.

Adaptive privileged access management (PAM) platform that helps companies correct over-permissioning and implement JIT artchitectures.

Xygeni offers a robust ASPM solution for managing and scanning for vulnerabilities, and mapping component reonenormanships in your software. They have strong coverage for looking for active attacks to your supply chain.

ARMO has all of the features of a CNAPP, but with a special emphasis on runtime security and Kubernetes. Their open source Kubescape is a great tool for scanning Kubernetes clusters, and their paid offering provides true CADR runtime protection and compliance features.