Cybersecurity vendors

Fortinet's API security offering gets the job done, but we wouldn't recommend buying it as a standalone product. It's a good addition to their other offerings, but doesn't stand out on its own.

Like AWS, the GCP WAF offering is quite substantial. They also have an 8KB limit, but offer a great solution for GCP native applications.

Basic built in analysis for GCP policies and users. Also provides role recommendations. At a high level, GCP is the easiest of cloud providers to manage permissions in.

Ghost Security provides external API first DAST scanning combined with integrations for API discovery. They're leaning more into agentic AI for discovery and fixing.

InstaSecure uniquely flips the paradigm of identity management by helping you set robust IAM boundaries and SCPs instead of focusing on the endless tweaking of individual users and roles. The approach is a great way to get high impact low effort results.

Lineaje offers robust SCA scanning and attestation that can guarantee your dependencies map back to the source code that created them. A strong option for enterprise and governments that need the most in depth SBOMs.

Mindgard has taken a cool approach to LLM security by building an in depth testing library for your existing models. Given the rapidly changing nature of the field, it's a great way to learn about existing attacks and how to protect against them.

Pixee creates pull request ready fixes for SAST findings for enterprises. They've especially focused on developer workflows and using a mix of LLMs with static rules to create fixes.

Acquired by Ping Identity. Procyon provides JIT access for cloud workloads

Tracking third party data flows is a hot topic in security right now - most companies are tracking via OAuth or API flows. Riscosity is cutting through that to the sources of truth, namely the code and network layers. They scan your code for third party data flows, and then validate at runtime by proxying your egress.

Scribe has created a tool focused on SBOM management and software attestation as your application is being built.

Seezo turns design docs into security requirements.

Acquired by Armis. Silk Security offers some unique features like assigning ownership to domains, and provides the rare value of showing asset ownership and code to cloud asset tracking. Another unique feature is their leaderboard - something not enough products have leaned into as a motivator.

Splx focuses on attack testing for LLMs, but provides a helpful open source tester: https://github.com/splx-ai/agentic-radar

Does Synopsys technically do everything you'd need from an ASPM? Yes. Would you ever want to use it? No. They've focused heavily into the semiconductor industry, and their ASPM is heavily patched together from various acquisitions.