Cybersecurity vendors

Stream Security provides real time cloud context for enterprise security operations teams. The solution fills in the missing configuration gaps with most existing EDR and SIEM approaches to cloud security by providing real time information about how the cloud environment is changing to detect and respond to threats faster.

Tamnoon is one of the first cloud focused MDR/MSSPs that helps you prioritize, fix, and respond to CNAPP, CSPM, and CDR alerts. The use a combination of humans and AI guidance to help fix your detection backlog.

Tenable offers a robust ecosystem of vulnerability scanning solutions, most recently consolidated with their Tenable One Exposure Management platform. Tenable offers scanning from cloud to DAST to network scanning, and is widely deployed across enterprises in order to consolidate different scanners. Their exposure management platform has done a great job bringing together their various data points, creating a more unified experience that the platform had been missing.

Of all the companies in this space, Tidelift is the only one I could describe as uniquely ethical. If you're tired of shoveling your CVE scanner results into open source backlogs, never to be fixed, working with Tidelift allows you to actually work with maintainers to get your issues fixed upstream - while checking the box on standard SCA feature sets (plus a few unique package health assessments).

Acquired by Harness. Traceable has built some amazing API security capabilities thanks to starting with tracing as their beginning. They do a great job patching information together in a way that makes it relevant for investigations

Acquired by Tenable. Vulcan offers the robust flexibility of the legacy offerings in this category, but with a much nicer UI/UX. A strong choice for enterprises looking to manage huge amounts of very diverse assets, but a lot of the setup will be manual tinkering (no worse than the incumbents).

VulnCheck provides well curated data on vulnerability exploitations - I can't see myself using them directly at smaller companies, but I'd hope all of my providers were using them for upstream data.

Wallarm is one of the most robust and mature of API security vendors. They offer a ton of features - from API like runtime protection, to secrets detection, to static security testing.

XBOW deploy AI agents that continuously map an application's attack surface, chain and execute exploits, and independently validate findings to eliminate false positives. Testing triggers on application changes, and its agents reached #1 on the US HackerOne leaderboard.

Zania is a really cool product. They ingest audit reports of various types and format them into controls with suggested feedback, confidence, and direct attestation of where the evidence came from. An extremely helpful tool, especially for third party risk assessments.

7AI started as an AI incident response tool but has quickly expanded to provide detection engineering, data storage, MDR services, and more. Their architecture supports advanced incident response automation especially for phishing and email security use cases, with specialized agents doing investigations within the context of your environment.

Aembit provides the most secure way I've seen of delivering machine to machines credentials to your workloads. They uniquely validate asset identity via contextual properties and integrations, and then inject the approved credentials into the workload.

Aisle provides AI native code security scanning covering SCA and SAST.

Aqua Security built a lot of the open source projects that power modern cloud security, and can go feature for feature with most other CNAPP platforms. The downside of the CNAPP has been the UI/UX, and the focus has always been on container protection more than holistic cloud security features.

Acquired by ZScaler. Avalor creates a platform for the vulnerability fixes you're probably coding yourself. They offer an elegant no/low code approach for uniting all of your vulnerability data in one place. Their approach heavily relies on the flexibility of their data standardization.