Cybersecurity vendors

Tromzo pulls in rich metadata from your various tools, and uses that metadata to create groupings and prioritizations of your vulnerabilities. They uniquely offer a yaml file for adding custom tools and pulling together data.

TrustOnCloud has created in depth threat models for cloud services. For example, they can show you every possible way someone could exploit an S3 bucket. Because they don't focus on scanning, they've created a library of potential exploits that goes far beyond what most CSPMs offer; however, that comes with the downside of being fundamentally a work generation tool. If you're operating at a scale where formal threat models need to be conducted before adopting new AWS services, their tool is undoubtedly useful.

Agentic SecOps platform that ingests findings from 150+ security tools into a security-mesh digital twin, then uses AI agents to find exploitable breach paths, prioritize reachable vulnerabilities, and automate triage.

Vorlon monitors connections between cloud and application environments for anomolous and malicious activity, enabling both posture and threat detection response outcomes. They've expanded into additional posture and AI capabilities.

Zafran has built a vulnerability management platform focused on risk prioritization and response/mitigation actions that can be taken while things are getting fixed. Their main differentiator is taking into account mitigating security controls that are in place.

Akitra has built an automation platform focused on in depth automation creation. They've done the hard work of building various cloud reports that can be attached to various frameworks, creating a more realistic automation approach for enterprises.

Acquired by Tenable, Apex offers visibility, configuration protection, and runtime detection and response for LLMs, both for corporate and application use cases. Everything from DLP to Injection detection, to LLM quarantining.

Brinqa is another incumbent to the vulnerability management that is a good fit for large organizations with complex mixed infrastructures. A lot of the setup will be manual, but a strong query language and customization comes as a result.

Clutch has a very strong NHI product with robust discovery and mapping of access from users to API tokens and roles. They also offer IP whitelisting to help and put some guardrails around the use of the tokens.

Vendor-agnostic telemetry pipeline that collects, reduces, enriches, and routes security and observability data from any source to any destination.

Acquired by Palo Alto Networks. Identity security platform applying privilege controls to every identity type - human, machine, and AI.

Cyclops provides a cloud focused remediation platform based on ingesting and maximizing the use of metadata from various tools.

Deepfence is a great no-frills CNAPP with a ton of optionality. Their Open Source ThreatMapper scans for malware, vulnerabilities, misconfigurations, and secrets. Their paid offering, ThreatStryker, adds eBPF runtime protection - including network and quarantine responses. Their open source is an unbelievable value for a free offering.

Acquired by Security Compass, Devici has created a collaboration tool specifically for threat modelling, allowing for unique opportunities for mapping resources with tagging, dataflows, and notes. As development teams get more directly involved with day to day security alerts, it seems that threat modelling will be a key value add for security teams, and I wouldn't be surprized to see more tools arise in this space.

Echo provides vulnerability-free container images including automatic patching, hardening, and FIPS-validation. Echo images are built on top of common distributions in order to make integration easier, and recognized by major vulnerability scanners.