Cybersecurity vendors

DevArmor provides automated threat modelling and design reviews, using AI to examine changes happening across your code and planning documents to continuous security reviews.

Doyensec offers whitebox application security testing with specialties on modern architectures like graphql, electron, and Javascript more broadly.

Like Huntress, Dragos has earned a positive reputation in the general security community. Their threat detection capabilities and analysis are top notch - they've chosen to focus on ICS/OT security.

Intent-aware workspace security platform that uses on-device AI reasoning to read human, AI, and app activity and intervene before risky actions complete.

Entro watches for API key generation and usage across tools, alerting you to both unused permissions, as well as potential malicious activity. An example use case is detecting when a secret is shared on Slack.

Fleet has built a very cool MDM on top of OSQuery that includes being able to run scripts and do more robust endpoint management - across platforms and with little complexity.

GCP Security Command Center is a supplemental cloud security offering provided natively in the GCP platform. It has great vulnerability and posture scanning capabilities, but lacks a runtime agent for real-time protection. That said, it can be a great extension of cloud security capabilities especially for SOCs.

HackerOne is the standard for bug bounty programs. It's questionable if you can use them to check the box for a pentest, so check with your auditor before doing so; however, a bug bounty program can be much more useful than a pentest in many cases. Keep in mind the heavy maintenance cost of auditing reports from people who want bounties for minor findings.

Hopper provides SCA and container scanning with the full suite of features you'd expect from a modern SCA tool - function level reachability, legal compliance, prioritization, and more. Their function level reachability uses a unique methodology to reduce false positives.

"Secretless" machine and AI agent access platform that replaces vaults and static secrets with just-in-time, policy-based credentials.

Inspectiv has built a bug bounty platform focused on the customer experience of managing the reports and payouts on your behalf, eliminating some of the mundane work of running a bug bounty program.

Intigriti is a bug bounty platform that differentiates with meaningful support from their internal teams to curating and prioritizing your bug reports, as well as finding the right testers for your needs.

Acquired by Cloudflare. Kivera is not strictly speaking a CSPM, but provides granular controls over what cloud API calls are permissible within your environment. This allows instant enforcement of custom rules and policies, giving the same outcomes as CSPMs without the alert explosion. The downside of using them as a sole CSPM would be missing out on more holistic CNAPP features and visibility, but they run well alongside other providers.

Kudelski is built on top of the huntress platform and offers MDR services for most enterprises. They have a strong backbone and history in various security sectors, and offer all of the standard MDR services.

Kulkan has an experienced engineering team for testing hybrid, web, mobile, and other environments. They take a grey box approach and work directly with your team to present findings and validate remediations without extra cost.