1

Tenable

Tenable provides an exposure management platform that unifies vulnerability, cloud, identity, and OT/IoT security. It offers asset inventory, exposure analytics, prioritization, and threat investigation to help organizations gain visibility across their attack surface, focus efforts to prevent likely attacks, and communicate cyber risk.

unknown

United States

2

Synk Code

Snyk gives developers visibility, context, and control to reduce application risk, utilizing DeepCode AI for accurate vulnerability detection and integrations with popular IDEs and workflows.

freemium

United States

3

Fing

Fing is a comprehensive network monitoring tool designed for home and small offices, enabling users to securely catalog and control devices with ease. Features include device recognition, network security alerts, and internet access management.

freemium

Ireland

4

ArmorCode Zero

ArmorCode provides an agentic control plane for unified exposure management that consolidates security findings from hundreds of native integrations and prioritizes them by business impact. Its Anya Agents and Context Risk Graph help security teams correlate, triage, validate, and remediate vulnerabilities across infrastructure, cloud, applications, software supply chain, and AI. The platform is used by security and AppSec leaders at enterprises to manage risk-based vulnerability management, application security posture management, and AI exposure.

N/A

paid

United States

5

Blinkops

Blink offers a seamless solution for automating security workflows, enhancing speed and efficiency. Users can build, edit, and run workflows with an AI Copilot and a user-friendly interface, minimizing manual security operations.

-1

paid

United States

6

Fossa

FOSSA provides a software supply chain management platform that scans open source dependencies, containers, binaries, and code snippets to detect licenses and vulnerabilities. It serves development, legal, and security teams at organizations ranging from small teams to large enterprises, automating license compliance, SBOM generation, and vulnerability remediation. The platform integrates into CI/CD pipelines and development workflows to enforce policies and produce attribution notices and regulatory reports.

N/A

freemium

United States

7

GoSecure

GoSecure Titan offers a comprehensive cybersecurity platform integrating endpoint, network, and email threat detection into a Managed Extended Detection and Response (MXDR) service.

-2

unknown

United States

8

Promptfoo

Promptfoo offers a platform for robust LLM application security testing, enabling developers to run tailored vulnerability scans and receive actionable insights for software protection.

-1

freemium

United States

9

Detectify

Detectify is a web application security scanner that identifies vulnerabilities through automated testing and crowdsourced research. It provides continuous monitoring and actionable insights to help organizations secure their web applications.

-1

unknown

Sweden

10

GitLab

GitLab provides a comprehensive DevSecOps platform integrating AI throughout software development, ensuring efficient automation, security, and deployment. It enables accelerated coding, continuous integration, and streamlined operations.

-4

freemium

United States

11

Invicti

Invicti provides an application security platform that unifies DAST, SAST, SCA, API security, secrets scanning, container security, and infrastructure-as-code scanning in a single view for DevOps and security teams. Its proof-based scanning validates vulnerabilities at runtime to reduce false positives, and findings are correlated and prioritized by exploitability and business context. The platform integrates with CI/CD pipelines, issue trackers, and other security tools, and is offered in tiered packages including agentic pentesting.

N/A

paid

United States

12

Mend

Mend.io provides an AI-native application security platform for enterprise security and development teams. It covers AI security (AI red teaming, system prompt hardening, runtime guardrails, AI-BOM) and application security (SCA, SAST, DAST, API security, reachability analysis), plus automated dependency updates through Mend Renovate. It also supports compliance and reporting such as SBOM generation and mapping controls to CRA, EU AI Act, and NIST.

N/A

unknown

United States

13

Strike

Strike is a premium pentesting and compliance platform that connects businesses with world-class ethical hackers. It provides real-time visibility into findings, vulnerability management, retesting support, and certification-ready reports for SOC 2, HIPAA, and ISO 27001. With integrations to Jira and Slack, teams can manage triaged vulnerabilities, adjust scope on the fly, and accelerate remediation while earning international certification badges.

-2

paid

United States

14

Hey, GitHub!

GitHub Next explores the forefront of software development by prototyping advanced tools and technologies, enhancing productivity and collaboration among developers with AI-powered solutions and unique approaches.

-2

free

Unknown

15

ROUNDBOX

Roundbox offers cybersecurity, cloud, and data center solutions, providing strategic consulting and technology integration for businesses in North America and Puerto Rico.

-6

unknown

United States

16

Checkmarx One

Checkmarx provides an AI-powered application security platform, Checkmarx One, that scans source code, dependencies, containers, infrastructure-as-code, and AI components for vulnerabilities across the software development lifecycle. It serves security and development teams at enterprises and governments, offering SAST, SCA, DAST, API security, secrets detection, and ASPM capabilities. The platform includes AI agents for triage and remediation, a Model Context Protocol (MCP) server, and integrations with IDEs, CI/CD tools, and source repositories.

N/A

freemium

United States

17

Code Intelligence

CI Fuzz by Code Intelligence is an AI-guided white-box fuzz testing tool that automates security testing, uncovers vulnerabilities, and accelerates root cause analysis for C and C++ projects.

-7

unknown

Germany

18

StackHawk

StackHawk provides an application and API security testing platform that integrates dynamic application security testing (DAST) into developer workflows and CI/CD pipelines. It targets software development and security teams, offering runtime scanning of running applications and APIs (REST, GraphQL, gRPC, SOAP, WebSocket) to find exploitable vulnerabilities, with agent skills that let AI coding agents scan, fix, and verify issues before a pull request. The platform also includes source-code-based API discovery, OpenAPI spec generation, and sensitive data detection.

N/A

freemium

United States

19

Cycode

Cycode provides an agentic development security platform that secures software development and AI usage across the Agentic Development Life Cycle (ADLC). It is aimed at security and development teams at enterprises, combining AST, SSCS, and ASPM capabilities such as SAST, SCA, secrets detection, container and IaC security, and AI visibility and governance. Its key capability is the Context Intelligence Graph and Cycode Maestro, which orchestrate AI agents to correlate risk, confirm exploitability, and generate PR-ready fixes.

N/A

paid

United States

20

Simbian

Simbian provides autonomous AI SOC agents that enhance security operations by automating threat detection, response, and vulnerability management, ensuring 24/7 coverage and high efficiency.

-7

unknown

United States

21

Xygeni

Xygeni provides an AI-powered application security posture management (ASPM) platform that detects, prioritizes, and remediates vulnerabilities and malware across the software supply chain, covering code, dependencies, secrets, CI/CD pipelines, infrastructure as code, and cloud. It is built for developers, DevOps/DevSecOps teams, and CISOs, offering SAST, SCA, DAST, secrets detection, malware defense, build integrity, and AI security scanning for AI-generated code and MCP configurations. Key capabilities include zero-noise risk prioritization, automated AI-driven remediation, and real-time anomaly detection.

N/A

freemium

Spain

22

vRx

Vicarius provides vRx, an automated vulnerability remediation and exposure assessment platform that detects vulnerabilities across Windows, macOS, and Linux assets and remediates them through patch management, scripting, and patchless in-memory protection. It is aimed at security, IT operations, compliance, and MSP/MSSP teams, offering risk-based prioritization, 20,000+ third-party app and OS patching, and 100+ CIS benchmarks for compliance. The platform also includes agentic AI features such as AI-generated remediation scripts and AI-powered asset grouping.

N/A

paid

United States

23

Astra

Astra Security (getastra.com) provides a continuous penetration testing platform (PTaaS) that combines manual pentests with automated vulnerability scanning for web apps, APIs, cloud infrastructure, and mobile/network targets. Its products include a DAST vulnerability scanner, an API security platform for discovering and scanning shadow and undocumented APIs, and an agentless multi-cloud vulnerability scanner, with integrations for Jira, Slack, CI/CD, and AI assistants via MCP. It serves engineering and security teams at startups through enterprises, offering authenticated scanning, vulnerability management dashboards, and remediation guidance.

N/A

freemium

United States

24

Fuel iX

Fuel iX is an enterprise AI platform offering generative AI tools for efficiency, security, and integration, with ISO-certified privacy features and extensive model support.

-9

unknown

Canada

25

Zafran

Zafran provides an AI-native Continuous Threat Exposure Management (CTEM) platform for security teams managing vulnerabilities and manual remediation work. The platform unifies findings from existing scanners, assesses which vulnerabilities are actually exploitable using runtime presence, internet reachability, and existing controls, and then mitigates risk through compensating controls before patching. Its RemOps capability uses generative AI to consolidate overlapping CVEs into remediation plans routed to owners through existing ticketing platforms.

N/A

unknown

United States