Cybersecurity vendors

Acquired by F5. LeakSignal is a promising product offering for achieving the dreaded network microservice protection and data flow mapping. They use an intelligent agent based approach to map data flows, types of data, and policy building. Very cool stuff!

Metahub is a uniquely open source context provider for working through your CSPM findings. It provides a lot of valuable context to CSPM findings to help you prioritize based on actual exposure.

MindPoint Group offers a robust number of services, primarily differentiated by being able to assist with larger security engineering efforts like implementing secure terraform or active directory.

Cloud security control plane that translates policy intent into enforced, secure-by-design architecture using each provider's built-in native security controls across AWS, Azure, GCP, and OCI.

Ophion gets the closest I've seen to a realistic automated pentest, and are essentially offering ongoing recon as a service. They aren't just running DAST scanners against your endpoints, but are instead doing a very realistic reacon of your public facing assets. One small example illustrating the difference is looking at the public commit history of your company employees on public GitHub repos.

Acquired by Crowdstrike. Pangea provides an API and SDK to easily implement security features into your application - such as checking a user's password against a breach database, or checking a user's email against a spam database. They've expanded the capabilities of the SDK to focus on runtime AI protection.

Pi is an agentic product security platform that builds an institutional security memory to autonomously triage, remediate, and prevent recurring vulnerability classes across the SDLC.

Automated security design reviews and threat models across the SDLC.

Push Security created a browser plugin that monitors SaaS applications being used by employees, and can alert on risky identity controls such as re-using weak passwords or lack of MFA. They've since focused on broader browser security and phishing prevention.

Raito gets the details of database access right - they've managed to standardize controlling access to databases across different architectures and providers. Data owners can be assigned and manage who has access to what data, and risk assessments can be done for access. They have an amazing foundation for the future of managing DB access.

Reco provides a holistic SaaS security platform, from shadow discovery via email scraping, to threat detection and posture management.

Rhino Security Labs offers better than average penetration testing that's focused more heavily on SaaS and DevOps vulnerabilities over traditional infrastructure scanning. They are a great choice for organizations that are looking for a meaningful engagement.

Governance capabilities for MCP servers, skills, and AI agents with threat detection, fine-grained permissions, and full observability.

I've requested a couple demos from Salt and they never replied ¯\_(ツ)_/¯. Based on an article from a couple years ago it seems like they mirror all your network traffic into their environment to model your APIs, but their marketing does say AI a few more times. It's funny that their marketing image has 1699 total events and 1696 of them were suspicious.

Sysdig created the first runtime cloud protection tool with the open source project Falco, and has since built a trusted, enterprise ready, runtime oriented CNAPP platform. The tool is strongest at runtime protection, but offers the standard suite of CNAPP features, and is especially a good choice for regulated industries.