Cybersecurity vendors

Depthfirst offers AI native application security functionality from threat modeling to scanning tools.

Act maps attack paths across identities (AI, NHI, and human), applications, network and cloud resources and enables teams to properly scope access and isolate resources.

Apiiro has built an all-in-one application security management solution that is especially strong at managing application security results at enterprise scale. They focus on building robust reonenormanships between code assets to manage application security programs at scale.

AppOmni has created a platform for discovering and managing the posture and security of your SaaS applications.

Backslash offers a unique approach to reachability across SCA and SAST, as well as a suite of vibe-coding security features such as MCP risk assessments and cursor rules.

Organizations looking for a high level of technical sophistication in their engagement should go to Black Hills Information Security for testing. This group has a well earned and stellar reputation for their work as well as great training.

CloudQuery is a great open source tool to check your cloud environment for compliance issues. You can also use it to build compliance automation in house.

Corgea provides a robust bundling of AI first scanning tools - from AI SAST to SCA and Secrets scanning. Corgea's especially strong at discovering vulnerabilities via AI scanning, and AI based prioritization for false positive analysis.

AI-driven SIEM and security analytics built on the open Elastic (Elasticsearch) stack, unifying detection, investigation, and response across endpoints and clouds.

Kodem offers runtime first code security solutions - from runtime function execution SCA to runtime detection for prioritizing SAST findings. They're also one of the few to offer ADR solutions.

Lumos is fascinating for the breadth of use cases they cover - general SaaS contract management, user audit logs, and request flows for Okta apps - all from a single platform. From what I've seen, Lumos seems like a dream come true for most corporate IT teams, where managing Okta has turned into a team sized job.

Raven has built a comprehensive runtime oriented ADR solution that can detect function executions from packages being exploited. This empowers them to detect application layer attacks, create prioritization based on what functions are being used, as well as virtual patching to prevent vulnerability exploitation.

Scanner provides a simpler SIEM data architecture to provide maximum flexibility for AI. They enable rapid querying of new and historical data in S3 through inventive compression and indexing techniques. They also enable flexible compute usage via a serverless architecture, allowing you to only pay for the exact compute you use.

Vanta was first to market and heavily relied on automating endpoint evidence. They have since rapidly expanded and deserve to be considered right next to Drata as a leader in the space.

An AI-native application security platform that unifies various scanning and enforcement tools, identifies real vulnerabilities, reduces false positives, and generates contextual fixes integrated into developer workflows.