Cybersecurity vendors

FluidAttacks offers a combined SAST, SCA, and DAST alongside service offerings for pentesting and code review.

At their core, Garantir offers a solution for public and private key storage, but that description sells them short of numerous use cases they support with elegance. They can be used as a PAM, for SSH management, to accomplish HSM with ease, and can run just about anywhere a private key is needed with their agent on user endpoints.

Include Security focuses on in depth pentests based on both code and the website, and offers reasonably priced engagements to thoroughly test your application.

Lumeus offers a powerful combination of developer access with session monitoring, SaaS access control, AI based JIT privilege escaonenorman, and runtime detection capabilities.

Nirmata is a platform built for enforcing policies in your cloud environnment (but mostly Kubernetes). It functions as an admission controller and policy engine, allowing you to enforce checks for all your Kubernetes changes.

Nullify is also starting with SAST use cases, but has expanded their AI agent functionality to be more holistic with their slack app and creating rudimentary threat models of code changes. Their vision is more holistic - focusing on creating an AI based product security engineer.

Acquired by Gitlab, Oxeye was a complete ASPM scanner that emphasized runtime context and API discovery

Acquired by Okta. Permiso is creating incident response for identities. They bridge the gap between "SaaS Security" and "IAM security" by tracking identities across IaaS and SaaS, while baselining and firing alerts for suspected misbehavior, along with session tracking.

Plerion has built a competitive CNAPP offering for smaller teams who don't need all of the features, primarily on the posture side. Alongside CSPM, they provide attack maps, IaC scanning, Secret scanning, and vulnerability scanning. They link findings to assets in a clean and intuitive way. Currently there is no agent based runtime protection.

Reversing Labs has very robust malware detection capabilities when picking apart binaries. They're expanding this binary analysis into also creating SBOMs and SCA results. Some platform strengths are supporting traditional Windows packages and having robust approval workflows for stringent enterprise support. I wouldn't say developer workflows or ease of integrations are as good as other tools.

Acquired by Aikido. Root provides backported patches for major linux distros enabling security teams to remove CVEs without changing their infrastructure. They also provide automatic image updaters, and minimal container images.

Sonrai has built a simple deployment for securing numerous cloud identities with as little complexity as possible by focusing on deploying permissions boundaries through SCPs and removing unused resources.

Staris built a platform for open box pentesting powered by GenAI. They look at your code and your application, build a PoC exploit of findings as a code test, and give you the fixed code. The workflow is wrapped as a pentest - which offers a glimpse into what the future of pentesting will undoubtedly look like. Staris uses GenAI to help find exploits from SAST to runtime.

Start Left brings SAST, SCA, Container, and IaC scanning in a single platform. They also have AI code remediation recommendations, and provide a docker image for running local scans.

Token connects into your cloud and SaaS identities, with some support for workloads like Postgres and K8s, and looks for identity issues like over-permissioned accounts or a lack of rotation or MFA.