Cybersecurity vendors

Tonic accelerates prioritization and remediation of vulnerabilities and threats, with a Context-Driven Unified Exposure Management platform. Powered by Agentic AI and a security Data Fabric, Tonic extracts meaningful and actionable context from unstructured organizational knowledge and threat intelligence, empowering security teams with superior visibility, dramatic reduction in false positives, and a sharp focus on findings that matter. Leading organizations, including Fortune 500 companies, rely on Tonic to slash remediation time and reduce risk to key business processes.

Uptycs biggest strength is its biggest weakness - it undoubtedly has the most features of any CNAPP platform, from ASPM to container runtime. However, that creates a corresponding UI bloat that's as bad as it gets for these platforms. As a certified Kubernetes enjoyer though, their cluster visibility with Kubequery is quite good.

Zimperium offers both MDM style enterprise protections for mobile and an SDK for developers to use to secure mobile devices.

Apona provides a combination SCA, SAST, and DAST features. Something unique about their SCA is providing a function level fix if one is available to avoid the patch.

Autonomous plane is the new product from the creator of Docker Slim, a fantastic open source project for minimizing your container images.

AWS Access Analyzer looks at your users and policies and suggests changes. It is a great built in tool, but doesn't offer easy organization level management.

Axiom provides standard scanning and remediation for least privileged access, but also grant least privileged roles on demand for just in time access. Their approach is to reduce permissions while providing temporary roles when major changes are needed.

Acquired by Cycode, Bearer is a newer SAST product that is built from an open source lens. They have done excellent analysis of the SAST market and are dialed in on the correct issues, namely false positives, and time to scan.

Blast provides preventative security controls to protect cloud environments based helping organizations deploy and manage different guardrails like SCP and IaC.

Codacy is a code quality and scanning toolbox similar to SonarQube for code scanning. They support many languages via open source scanning tools and have a developer focus.

Cremit does all of the expected secret scanning, but has great real time alerting on what api keys have done and if they're active by pulling their command history when available.

If you want to get your hands dirty with cutting edge ADR, Deepflow is an open source project that allows for agent based tracing, profiling, and more. It would be a lot of work to get it cooking for in house security, but it's an open source example for a lot of this technology.

Devo is a robust cloud SIEM with a lot of solutions. However, their lack of clear focus has made them less effective as they've tried to expand half-heartedly into numerous areas. They're a great option for organizations looking for a single pane of glass, but not the best option for any one area.

Entitle.io is focused on the specific use case of granting break glass permissions in AWS, and rolling back changes when they're not needed. They also support more general permission scanning.

Evren has a very cool solution for developer workstations involving a lightweight Linux distro that gives developers a lot of freedom while keeping essential management and visibility functionalities for security teams.