Cybersecurity vendors

AWS WAF offers amazing out of the box protection with numerous rule packs, and integrates with more advanced rules if necessary. The only essential consideration and downside is their 16KB limit on request size which can be a breaking downside for some applications.

Azure Sentinel will get the job done for organizations looking specifically for a SIEM for their Azure environment. They're less robust in their support for other cloud providers, but are a great option for organizations looking to keep things simple and consolidated.

Boost Security has a shared vision for all in one configuration scanning out to runtime. They have smart kubernetes & Istio integrations for runtime context, alongside the standard suite of SCA, SDLC, SAST, IaC, Secrets, and Containers based on a combination of open source and in house built tools. I appreciate the openness of their rule set in their documentation.

Conveyor is a platform for managing vendor questionnaires and trust center workflows

Cortex Cloud is a security operations platform that integrates cloud and application security capabilities into their larger security operations offerings. This provides a single hub for managing first and third party findings across vulnerabilities and runtime events.

Cyscale checks all the boxes for a CNAPP, but their tracking of user identities stands out in the space. They have great visualizations, and have an agent for K8s support. A strong entry in the CNAPP market.

Datadog offers a complete suite a security offerings that are a great fit for developer focused teams not looking for the most mature details in each area. They offer most scanning types, runtime detections, and a full SIEM, and you're probably already sending them your logs. It's a great runtime choice to meet developers where they work, but the UX is built primarily for developers.

Doppler provides tools for sharing, managing, and securing application secrets across local, dev, staging, and production environments.

DryRun provides a flexible platform for AI code analysis, covering custom and out of the box use cases for in depth code analysis.

Fig provides teams visibility into their detection and log source health across their existing tools. It gives teams insights into what detections would never fire, what log enrichments can be done, and helps consolidate and manage the overall health of your program.

Fossa has really focused on SCA and SBOM for the enterprise. They have mature SBOM offerings such as a sharing portal, evolving reachability capabilities, internal dependency tracking, and good quality insights on repos.

GitGuardian is the best paid provider for this tool and is a great solution for deploying secret detection at scale. On the one hand, secret scanning is a very narrow function, but on the other, a leak is extremely costly. While Arnica does the workflow, GitGuardian has more robust detection.

Grit provides pre-baked playbooks for everything from framework migrations to major security patches. The most time consuming part of patching is figuring out the changes, and Grit does that part for you, even updating tests. Them and Moderne are providing amazing value for actually getting things patched. Grit uses GenAI to help create playbooks for major upgrades.

JIT built a holistic ASPM scanning solution, and has sense heavily invested in AI workflows. They consolidate scanners and create workflows and prioritization for developers. The JIT scanner is unique in that it's a wrapper for other scanners that you run in your own pipelines - an approach with pros and cons.

Acquired by Checkpoint. Lakera offers a simple way to protect LLM's by importing their SDK into your code. Their approach is simple and elegant, and their Gandalf tool allows you to better understand how LLM prompt injections work.