Cybersecurity vendors

Originally ZenGRC, they were the largest traditional GRC provider to build cloud evidence automation. They're the most automated of the traditional GRC providers, but still lack the depth of Vanta and Drata for getting everything automated.

SecureFrame is a great third choice to Vanta and Drata, but lacks the same depth and breadth of features.

It's great to see a company build a product around honey tokens. Honeypots provide a ton of security ROI but are difficult to setup and maintain, Seedata takes care of that for you so that you can focus on analyzing the results. I'd highly recommend this tooling for people with advanced security operations teams.

Sternum built some very cool IP around protecting IoT devices, preventing memory attacks to a degree that I haven't seen elsewhere. They've since brought that same technology to the cloud, and will continue to be an innovator here as they expand eBPF detection capabilities.

Tracebit is building very holistic deception technology that serves as honeypots for your cloud infrastructure. They deploy deceptive resources that match your existing ones, and monitor those resources for any suspicious activity.

Vicarius is just a straight up better version of most legacy vulnerability scanners. They have great agent based scanning, reporting, and prioritization for endpoints, but are not as advanced on the cloud or kubernetes side.

A-lign offers decent penetration testing alongside their audits. They are a good choice for organizations that are looking for a one stop shop for their compliance needs, but not if you're looking for a deep engagement.

Streaming-first composable SIEM combining security data pipelines, tiered storage, in-stream detection, and AI-assisted SecOps workflows.

Amplify security leverages multi-AI Agents to generate relevant and accurate fixes, alongside SAST scanning capabilities. This approach replicates the process of developers and security engineers working together to fix issues so both teams are happy. Amplify tries to make the code fixes look as if the developer themselves wrote the fix, emphasizing the contextual nature of the code.

Apono enables you define access policies to cloud and workload resources, creating JIT workflows for accessing different environments. One standout feature is kubernetes RBAC visualization, combined with JIT access roles.

Approov checks the integrity of the mobile app and device before fetching sensitive data from the server. This gives them a more runtime approach than other vendors.

AppSentinels is a robust runtime oriented API security platform that builds robust service mappings and has very good detection and response features. It's a very competitive offering to those like NoName, Salt, and Traceable.

Arcjet provides a simple RASP solution giving developers security features like bot protection, rate limiting, or sensitive data detection.

Argos offers a simple platform built for MSSP's to run cloud security tests on custom environments. They provide a combination of CSPM and Asset Mapping technologies to provide exactly the information a provider needs to generate a point in time report.

Preventive cloud security enforcement platform that blocks risky cloud configuration changes at deployment time (across IaC, CLI, and ClickOps) before they reach production.