Cybersecurity vendors

42 Crunch has built a very OpenAPI focused API security solution. It can scan for endpoints, offer suggestions on basic WAF like protections, and enforce that runtime via sidecar. They have a pretty robust VSCode extension for building custom tests. They are more on the testing side of API security.

AppSOC has created a unique solution for LLM security that's focused on the governance and risk of using specific models over others - they've layered this on top of general SCA scanning.

Blueflag offers identity centric ASPM. They allow users to create policies for detection and enforcement of privileges, as well as JIT for repo access.

Acquired and subsequently shutdown by Cisco. Deep Factor differentiates their SCA tool with deep runtime insights on the open source package and its state of being loaded or not in the application - a good way to prioritize fixing.

GitLab relies entirely on open source tooling to do the actual scanning, and their reporting is hard to use. Only recommended for organizations that are already on Ultimate tier, and even then the results are very mixed.

Komo provides user access request flows for Okta and AWS SSO, allowing users to easily request and be assigned permissions. They uniquely allow the creation of attribute based rules, creating workflows around users as their attributes change.

Acquired by Invicti. Kondukto's strength is integrating with just about every tool you could want, including open source ones, to prioritize and remediate in a single platform. They provide a great Jira workflow for working through findings.

Kosli has created a way to attest to actions taken in cloud environments, most clearly CI/CD artifacts. Their core technology allows them to detect any change to any file, so there are a lot of potential use cases for this technology.

Defender for Cloud has a lot of comparative features to dedicated CNAPPs, but it's a beast to setup and maintain. It's a good starting point for larger companies who don't have an appetite for a more focused solution, and are addicted to collecting the highest E license as possible.

Mimic has created a unique ransomeware defense solution that focuses on protecting critical assets while using honeypot like deception techniques to buy response time.

I had not heard of unikernels before meeting with nanovms, but they're an elegant solution for simply hosting cloud applications at scale without adding the complexity of Kubernetes. If you're willing to make the architecture switch, there are many security benefits along the way.

Qwiet takes a unique approach to scanning that starts with a map of your application, and scans within that context. They have smart prioritization filters combined with the standard suite of SCA, container, SAST, Secrets, and IaC scanning. They don't offer "pipeline-less" scanning via webhooks if that's a requirement for you.

Rainforest combines all in one code vulnerable scanning with brand protection capabilities. They instrument via an on premise VM allowing you to scan everything in your own environment.

SecOps Solution has created a network based scanner for detecting and remediating vulnerabilities across hosts. It's an elegant solution that's great for non-containerized environments.

Veracode is a legacy SAST vendor that has done a good job expanding into other categories. They are a great choice for organizations using more legacy or waterfall type development methods, but still don't have an intuitive interface or workflows for modern dev teams.