Application Security
Securing web applications, mobile apps, and software throughout the development lifecycle.
ThreatLocker
CISO ReviewedZero Trust endpoint protection platform that blocks unknown applications by default through allowlisting, ringfencing, and storage control.
Endor Labs
Reachability-based software composition analysis that filters open-source dependency risk down to what code paths are actually exploitable.
JFrog
Public software supply chain security platform (Xray plus Advanced Security) that scans binaries and artifacts end-to-end from the…
Apiiro
Builds a continuous 'code risk graph' that maps code, developers, and cloud deployment to prioritize AppSec findings by…
Socket
A software supply chain security platform that combines automated dependency analysis with human verification to catch malicious and…
ArmorCode
Tool-agnostic ASPM layer that correlates findings from 300+ existing security tools into one prioritized backlog, without running its…
Snyk
Developer-first application security platform combining SAST, SCA, container, IaC, and API/DAST scanning inside the developer workflow.
HUMAN Security
Bot mitigation and digital fraud prevention platform, formerly White Ops, protecting ad, application, and enterprise traffic from automated…
Truffle Security
Truffle Security, maker of the widely used open-source TruffleHog scanner, finds and helps remediate leaked secrets and non-human…
Chainguard
Software supply chain security company providing minimal, continuously rebuilt container images and packages built from source.
Aikido Security
Aikido Security is a Ghent, Belgium-based unicorn ASPM platform that consolidates 15+ AppSec scanners into one developer-facing tool…
Blockaid
A Tel Aviv Web3 security vendor screening wallet and dapp transactions in real time before signing, with MetaMask…
Certora
A Tel Aviv formal-verification leader whose Certora Prover has mathematically verified smart contracts securing over $100B in total…
Kong
A San Francisco API infrastructure company, a five-time Gartner Magic Quadrant Leader, extending its API gateway into an…
Lineaje
Full-lifecycle software supply chain security platform generating trusted open-source packages, autonomously fixing vulnerabilities, and managing SBOMs/AIBOMs.
Appdome
No-code mobile app security and fraud prevention build system that lets developers add protection layers to iOS and…
Zimperium
AI-powered mobile threat defense and application protection guarding enterprise mobile devices and apps against phishing, malware, and zero-day…
Imperva
A veteran application and data security vendor — WAF, API security, bot management, and data protection — now…
PortSwigger
Maker of Burp Suite, the de facto standard toolkit for web-application penetration testing, bootstrapped and profitable for 15-plus…
Checkmarx
Unified 'Checkmarx One' application security platform spanning code, software supply chain, and cloud infrastructure scanning with SecOps integrations.
cside
Client-side web security platform that watches scripts, users, and AI agents live in the browser session to stop…
MedCrypt
MedCrypt builds embedded cybersecurity and FDA-compliance software that helps medical device manufacturers secure connected devices and pass premarket…
Halborn
A Miami blockchain security firm staffed by offensive-security professionals, auditing smart contracts and infrastructure for crypto-native and traditional…
Sonar
Code quality and security platform built around SonarQube's static analysis engine, widely adopted via a free Community Edition…
Contrast Security
Instruments applications from within using IAST and RASP to find and block vulnerabilities as code actually executes, rather…
Cycode
Unified ASPM platform with its own proprietary SAST, SCA, secrets, IaC, and container scanners covering the pipeline from…
Socket
Software supply chain security platform that analyzes open-source packages for malicious behavior before they enter codebases.
Bright Security
Developer-first dynamic application security testing (DAST) platform built to catch and auto-remediate vulnerabilities in CI/CD.
Oligo
Oligo uses eBPF-based runtime analysis to catch active exploits and prioritize only the vulnerabilities actually reachable during execution,…
ONEKEY
ONEKEY is a Germany-based product cybersecurity platform that automatically analyzes device firmware binaries for IoT, IIoT, and OT…
Cloudsmith
Cloudsmith is a cloud-native artifact management platform that adds SBOM inspection, dependency quarantine, and exploitability-based policy controls to…
Dynatrace
Publicly traded observability platform whose Application Security module uses runtime instrumentation, rather than standalone scanning, to detect and…
Crash Override
Engineering Relationship Management platform that auto-catalogs software builds for real-time supply-chain traceability.
C2A Security
C2A Security builds a risk-driven DevSecOps platform, EVSec, that automotive OEMs and Tier-1 suppliers use to secure connected-vehicle…
Mend.io
Software composition analysis platform, formerly WhiteSource, that uses reachability analysis to prioritize which open-source vulnerabilities are actually exploitable.
Semgrep
Open-source-led static analysis platform for code scanning, supply chain and secrets detection, powering GitLab's SAST engine.
ImmuniWeb
Swiss AI-powered application security testing and attack surface management platform offering continuous threat exposure management (CTEM).
Anchore
SBOM-powered software supply chain security platform generating and managing software bills of materials, scanning containers for vulnerabilities, secrets,…
Aptori
AI-native application security platform providing autonomous offensive testing to detect, prioritize, and remediate vulnerabilities across code, applications, and…
Sonatype
Software supply chain security vendor behind Nexus Repository, offering malicious package blocking, SCA and dependency governance.
DataDome
Real-time bot and fraud protection platform using machine learning to distinguish malicious automated traffic from legitimate users.
Miggo Security
Application Detection and Response (ADR) platform providing runtime visibility, exploitability proof, and one-click virtual patching for application vulnerabilities.
Clover Security
AI-agent platform that analyzes software architecture and design documents to catch security design flaws before code is written.
Styra
The creator of Open Policy Agent, Styra sells the commercial control plane and enterprise tooling for policy-as-code authorization…
Source Defense
A client-side web security platform that monitors and controls third-party JavaScript to prevent digital skimming, Magecart-style attacks, and…
Exein
Embedded runtime security platform that builds real-time threat detection directly into IoT and connected-device firmware.
Qodo
Tel Aviv company (formerly CodiumAI) building AI agents that review, test, and govern code quality across enterprise engineering…
GitGuardian
Secrets detection and non-human identity security platform that scans code, CI/CD, and collaboration tools for exposed credentials in…
OX Security
'Active ASPM' platform combining native SDLC scanning with attack-path analysis and a software bill-of-materials lineage (PBOM) to prioritize…
RunSafe Security
Hardens embedded and industrial software against memory-corruption exploits at build time using patented load-time function randomization, without source…
Jscrambler
Portuguese client-side security vendor providing JavaScript obfuscation and third-party tag monitoring to protect browser-side code from tampering and…
Endor Labs
Application security platform using function-level reachability analysis to prioritize open-source and supply chain risk.
Sonatype
Software supply chain security pioneer behind Nexus Repository and component intelligence, helping organizations vet and manage open-source dependencies…
Kodem Security
Kodem Security runs a dynamic software composition analysis platform that uses runtime memory forensics to determine which open-source…
Huskeys
AI-driven edge security management platform that orchestrates and tunes existing WAFs and CDNs across multi-cloud environments instead of…
Konvu
AI agents trace real code and runtime data flow to prove which flagged vulnerabilities are actually exploitable.
SCI Semiconductor
SCI Semiconductor builds memory-safe computer chips designed to eliminate the vulnerability class behind roughly 70% of cyberattacks.
Pangea
API-based security platform for application developers, now including AI guardrails, acquired by CrowdStrike in 2025.
Snyk
Developer-first application security platform that finds and fixes vulnerabilities in code, open source dependencies, containers and infrastructure as…
AdaCore
Safety-critical software toolmaker combining Ada/SPARK formal verification with the CodeSonar/CodeSentry static-analysis and binary SCA platform.
Legit Security
AI-native ASPM platform for discovering, prioritizing, and remediating risk across the software supply chain, with a separate module…
Harness (Application Security Testing)
Pipeline-native DevSecOps module from CI/CD platform Harness that unifies SAST, SCA, and vulnerability triage in the delivery pipeline.
Traceable AI (a Harness company)
API discovery, runtime protection, and API security testing built on distributed tracing, now integrated into Harness's software delivery…
Manifest
Software supply chain security startup founded by former CISA and DoD veterans, operationalizing SBOMs and AIBOMs to secure…
Nokod Security
Nokod Security governs and secures low-code/no-code applications, detecting vulnerabilities and malicious activity in a fast-growing app-development category traditional…
ForAllSecure
Pittsburgh-based creator of Mayhem, an autonomous fuzzing engine born from DARPA's Cyber Grand Challenge, now securing DoD and…
Checkmarx
Application security platform, Checkmarx One, offering SAST, SCA, API, container and supply chain security with AI-assisted remediation.
Xygeni Security S.L
An AI-powered application security posture management platform unifying SAST, SCA, secrets detection, and software supply chain protection with…
NowSecure
Automated mobile application security testing platform used across DevSecOps pipelines and by numerous US federal agencies for NIAP-compliant…
Cequence Security
Cequence Security provides unified API security and bot management, combining API discovery with runtime protection against credential stuffing,…
Security Compass
Toronto-based application security firm whose SD Elements platform automates secure development requirements and maps them directly into developer…
Feroot Security
Client-side web security platform that monitors browser JavaScript for skimming, script injection, and supply chain threats, aligned to…
Onapsis
Application security platform purpose-built for SAP and Oracle business-critical ERP applications, backed by a research team credited with…
Trail of Bits
Elite application security research and auditing firm known for deep code review, original vulnerability research, and widely used…
Semgrep
Application security platform built on an open-source static analysis engine, combining code scanning, supply chain and secrets detection…
Black Duck
Software composition analysis and static analysis platform (formerly Synopsys Software Integrity Group) focused on SBOM generation and open-source…
Salt Security
API security platform using machine learning to baseline normal API behavior and catch attacks that signature-based tools miss.
Wallarm
API security platform extending discovery and runtime enforcement to AI agents and Model Context Protocol servers.
Guardsquare
Leuven, Belgium-based mobile app security leader offering code hardening and runtime protection for Android and iOS, rooted in…
Backslash Security
Cloud-native application security platform unifying code and cloud risk context to prioritize exploitable vulnerabilities and reduce developer alert…
Qwiet AI (a Harness company)
Qwiet AI provides AI-powered application security testing — combining SAST, SCA, IaC, container, and secrets scanning in one…
wolfSSL
wolfSSL builds a lightweight, portable embedded TLS/SSL and cryptography library used to add encryption and secure communication into…
Green Hills Software
Real-time operating system vendor whose EAL 6+ NSA/NIAP-certified INTEGRITY RTOS provides hardware-enforced partitioning for safety- and security-critical embedded…
TestifySec
Open-source-rooted software supply chain security platform providing cryptographic build attestation, SBOM generation, and CI/CD policy enforcement.
TrustInSoft
Paris-based formal-methods static analysis vendor that mathematically proves the absence of specific critical bugs in C, C++, and…
YesWeHack
Paris-based crowdsourced security platform coordinating bug bounty, vulnerability disclosure, and pentest management programs for enterprises and public-sector agencies,…
Data Theorem
Palo Alto-based application security vendor combining mobile, API, and cloud testing into a single full-stack platform, ranked #1…
Impart Security
San Francisco API and application security vendor built by former CDN and WAF engineers, offering runtime enforcement across…
Autonomous Plane
Autonomous Plane was a cloud-native application security startup founded by Kyle Quest, creator of the widely used open-source…
Veracode
SaaS-delivered application security platform offering static, dynamic, and software composition analysis with an annual industry benchmark report.
Aikido Security
Unified developer-first security platform covering code, cloud and runtime, with automated AI pentesting.
CMD+CTRL Security
Application security training platform using hands-on labs and cyber ranges built from intentionally vulnerable software.
ThreatModeler
AI-assisted, DevSecOps-integrated threat modeling platform that recently combined with IriusRisk under Invictus Growth Partners ownership.
Mobb
Tel Aviv-based application security startup that automatically generates code fixes for vulnerabilities flagged by SAST tools like Snyk,…
Seal Security
Generates backported, drop-in security patches for open source vulnerabilities so teams can remediate CVEs without forced major-version upgrades.
Intigriti
A European crowdsourced security platform connecting organizations with vetted ethical hackers for bug bounty programs and continuous penetration…
Root
A Boston AI vulnerability-patching startup (originally Slim.AI) acquired by Aikido Security for an estimated $70M-$100M.
MindFort
Y Combinator-backed swarms of AI agents that continuously attack live applications and ship validated exploits instead of scanner…
Secure Code Warrior
Developer-first secure coding platform that builds security skills through hands-on training, aiming to prevent vulnerabilities before they ever…
Patchstack
Estonia-based application security vendor that runs a WordPress vulnerability database, coordinated disclosure program, and virtual patching to close…
Cleafy
Milan-based real-time banking fraud detection vendor protecting mobile and web banking sessions from malware, overlay attacks, and social-engineering…
Cytix
Manchester-based continuous offensive security testing platform that analyzes code changes in real time to predict and test for…
StackHawk
A CI/CD-embedded API and application security testing platform built on ZAP, designed to catch vulnerabilities as developers write…
OpenZeppelin
Widely used smart contract security firm providing audits, a standard open-source contracts library, and continuous monitoring for blockchain…
IriusRisk
IriusRisk, headquartered in Huesca, Spain, built an automated threat modeling platform used by application security teams to identify…
CHEQ
A Tel Aviv 'go-to-market security' vendor blocking bots and invalid traffic from corrupting ad spend, lead pipelines, and…
Protectt.ai
Mumbai-based mobile security vendor whose runtime app protection and fraud prevention tools serve Indian banks and fintechs under…
OpenText
A public information-management giant bundling Fortify, ArcSight, NetIQ, and Webroot under one security portfolio.
Seraphic (now part of CrowdStrike)
Browser-native security technology that blocks phishing, malware, and browser-based attacks across Chrome, Edge, Safari, and Firefox, acquired by…
Red Balloon Security
Red Balloon Security builds firmware reverse-engineering and embedded-device defense tools, including the OFRAK binary analysis platform, grown out…
Pixee
AI-powered application security platform that automatically triages vulnerability findings and generates production-ready code fixes directly into GitHub, GitLab,…
eShard
French security testing vendor whose esDynamic platform finds side-channel, fault-injection, and software vulnerabilities in chips, embedded systems, and…
Star Lab
Embedded-systems security software vendor, now part of Mercury Systems, providing secure boot, Linux hardening, and anti-tamper protection for…
Conviso Application Security
A Brazilian application security specialist, formed from Conviso's 2020 acquisition of DAST/WAF vendor N-Stalker, offering a unified platform…
CertiK
Large-scale Web3 security platform combining formal verification, smart contract audits and compliance tooling, reporting a $2 billion valuation…
Prime Security
A Series A New York startup using agentic AI to catch security design flaws before code is written.
Quantstamp
Y Combinator-backed blockchain security firm whose smart contract audits have covered protocols securing hundreds of billions in value.
DryRun Security
AI-native application security platform that reviews pull requests with full code context to catch logic-level vulnerabilities SAST tools…
build38
build38, based in Munich, Germany, builds mobile application shielding and in-app protection technology (App Shielding) that defends mobile…
Security Journey
Developer secure-coding training platform with 800+ hands-on lessons and an AI-guided coding assistant, used by companies including HackerOne…
Cycode
Application security posture management platform covering code, pipelines and supply chain, with SAST added through its Bearer acquisition.
Equixly
Florence, Italy-based startup using autonomous AI agents to continuously penetration-test APIs for business-logic and authorization vulnerabilities.
Arnica
Behavior-based application security platform that validates developer identity and activity to catch supply-chain compromises that code and dependency…
Indusface
Indusface is an India-based application security vendor whose AppTrana platform delivers fully managed web application and API protection…
CodeLock
A DevSecOps startup building automated software-supply-chain integrity tooling that links every code change to a verifiable developer chain…
Wabbi
Application security posture management (ASPM) platform that embeds continuous security testing and policy enforcement directly into the software…
Cybeats
Cybeats builds SBOM Studio, a software bill of materials management and software supply chain security platform focused on…
Arcjet
Developer-first application security library that embeds bot detection, rate limiting, and AI/prompt-injection defenses directly into JavaScript and TypeScript…
42Crunch
An API security platform that audits OpenAPI specifications for weaknesses and enforces those contracts at runtime to stop…
Pynt
API security testing platform that discovers documented and shadow APIs from live traffic and runs context-aware, business-logic-focused security…
APIsec
AI-powered, continuous API security testing platform that models an application's behavior and generates real attacker-style exploits to validate…
LayerX
A browser-security and AI-usage-control vendor acquired by Akamai for about $205M and rebranded Akamai Workforce Protector.
CodeIntegrity
Runtime guardrail platform for production AI agents, built by offensive-security researchers who publicly compromised the Notion app in…
Hacken
Tallinn-based blockchain security firm providing smart contract audits, penetration testing and proof-of-reserves services to web3 protocols and exchanges.
Grego AI
Miami startup using 'Deep Invariant Analysis' to hunt for software vulnerabilities that manual code review typically misses.
Kodem Security
Application security platform using runtime intelligence in dynamic software composition analysis to determine which vulnerabilities are actually exploitable.
Scribe Security
Software supply chain security platform that generates signed SBOMs and tamper-evident build evidence to enforce policy-as-code gates from…
ThreatX (an A10 Networks company)
Behavioral, risk-based API and web application protection with automated blocking and 24/7 managed monitoring, now integrated into A10…
F5 (Application Delivery and Security Platform)
Seattle-based ADC leader whose BIG-IP and distributed platform protect apps and APIs from zero-days, DDoS, bot attacks, and…
Emproof
Emproof protects embedded software at the binary level against reverse engineering and exploitation, without requiring source code access…
BitNinja
Hungarian server-security platform for web hosting providers and agencies, using a crowd-sourced defense network to block malware, brute…
Virsec
San Jose-based runtime workload-protection platform that maps and enforces expected application memory and control-flow behavior to block exploitation…
Ghost Security
Austin-based AI-native application and API security startup whose Exorcist agent automates API discovery and vulnerability remediation.
Codacy
Portuguese code quality and security platform combining static analysis, secret scanning and software composition analysis with newer AI…
DeepSource
Y Combinator-backed code review platform combining hybrid static analysis and AI to catch security vulnerabilities and code quality…
Promon
Norwegian application shielding company protecting mobile, desktop and web apps against tampering, reverse engineering and repackaging attacks.
Appknox
Mobile application security testing platform combining automated SAST/DAST binary analysis with manual penetration testing for enterprise and financial…
Cantina
Cantina is an agentic security platform, formerly Web3-audit firm Spearbit, that automates vulnerability triage and remediation for enterprises.
NightVision
NightVision is an application security startup providing AI-assisted dynamic testing that discovers and exploits API and web vulnerabilities…
Ossprey
Ossprey continuously scans open-source dependencies with an AI code analyzer to catch malicious packages before they reach production,…
Gitar
San Mateo startup deploying AI agents to review, validate, and secure AI-generated code inside CI/CD pipelines.
Dedge Security
Madrid-based application security posture platform designed specifically for Web3 smart contracts and decentralized applications.
Invicti Security
A DAST-first web and API application security platform, formed from the 2018 merger of Netsparker and Acunetix, now…
Guardrail
A runtime blockchain security engine that protected $30B+ in assets, acquired in-house by stablecoin platform Rain.
Chainloop
Open-source evidence store and policy platform for software supply chain attestations, SBOMs, and CI/CD compliance.
Zast AI
An AI agent platform that validates application vulnerabilities through active exploit generation rather than pattern matching, aiming to…
GeoEdge
Real-time ad security and malvertising protection for publishers and ad exchanges, scanning creatives at the impression level to…
Fastly
Public edge cloud platform whose Next-Gen WAF, born from the 2020 Signal Sciences acquisition, provides web application, API,…
Approov
Mobile app attestation and API-security platform (formerly CriticalBlue) that verifies genuine, untampered app instances at runtime to block…
Irdeto
Naspers-owned software security vendor whose Cloakware product line protects applications, credentials, and embedded/connected-device software from tampering and reverse…
Netacea
Server-side bot management platform that detects and blocks credential stuffing, scraping, and account-takeover automation across websites, apps, and…
Start Left Security
Start Left Security (formerly Tauruseer) is a Jacksonville, Florida ASPM company combining a patented behavioral analytics engine with…
Phoenix Security
Application Security Posture Management (ASPM) platform that aggregates SAST, SCA and cloud vulnerability findings and prioritizes them by…
Quokka
Mobile app and firmware security firm, formerly known as Kryptowire, providing binary-level analysis without source code and supply…
Ostorlab
Automated mobile and web application security testing platform combining attack surface discovery with AI-powered vulnerability scanning and remediation…
RevEng.ai
A London binary-analysis startup backed by the NATO Innovation Fund and In-Q-Tel that finds hidden vulnerabilities without source…
Oplane
A Malmö, Sweden startup that automates security threat modeling for engineering teams building software with AI coding assistants…
Heeler Security
Application security platform that unifies code, runtime behavior, and business context to prioritize which software risks actually matter.
Interlynk
A Menlo Park SaaS platform automating SBOM generation and software supply chain compliance for medical device makers and…
MONITORAPP
South Korean WAF and WAAP vendor whose AIONCLOUD service extends its appliance-based web application firewall business into cloud-delivered…
AppSealing
No-code mobile app shielding (RASP, anti-tampering, anti-piracy) for Android and iOS, a product line of Seoul-based INKA Entworks,…
Alma Security
A New York-based application security startup building runtime protection focused on business-logic and data-flow risks across APIs, microservices,…
CDNetworks
APAC-strong global CDN provider whose Cloud Security 2.0 platform bundles WAF, DDoS mitigation, bot management and API protection…
Ammune.ai
Ammune.ai (formerly L7 Defense) is an Israeli API and AI security vendor whose AMMUNE platform uses self-learning, air-gapped…
Syhunt
A veteran Brazilian application security vendor offering hybrid DAST, SAST, API, and mobile security scanning under the Syhunt…
FOSSA
San Francisco-based software composition analysis and SBOM platform helping engineering and security teams manage open-source license, vulnerability, and…
Astra Security
Continuous penetration testing and vulnerability scanning platform combining automated scanning with manual pentest expertise for web, mobile and…
Depthfirst
A San Francisco applied AI security lab training its own vulnerability-detection models, with two large rounds in 90…
echo
A secure-by-default container-image vendor led by Twistlock founder Ben Bernstein, which absorbed rival Minimus's assets in August 2026…
Rein Security
Israeli AppSec startup providing runtime, in-production visibility and protection for applications, including agentic AI and MCP-based systems.
OpenText Fortify
Long-established static, dynamic, and interactive application security testing suite, now an OpenText product line after passing through HP…
Avocado Systems
Application and API security vendor providing runtime threat modeling and process-level microsegmentation for cloud workloads via its Avocado…
Inspectiv
Unified application security testing platform combining crowdsourced bug bounty, penetration testing, DAST, and vulnerability disclosure management.
PreEmptive Solutions
A Cleveland-based application protection vendor, now operating within Idera's DevOps business unit, whose Dotfuscator and DashO products obfuscate…
Cycurion
Publicly traded (NASDAQ: CYCU) McLean, Virginia cybersecurity firm whose ARx platform bundles WAF, DDoS, bot mitigation, and API…
Fluid Attacks
Application security testing provider combining SAST, DAST, SCA, secret scanning and manual penetration testing into one continuous, all-in-one…
Symbiotic Security
A New York developer-security startup embedding scanning and secure-coding training in IDEs, backed by Hugging Face co-founder Thomas…
BlueFlag Security
A Sunnyvale identity-centric SDLC security vendor extending governance to AI coding agents.
Corridor
A San Francisco AI-coding security startup with Alex Stamos as CPO, reportedly valued at $200M on its Series…
Codesealer
Codesealer, founded in 2010 and based in Copenhagen, provides a specialized web and mobile application security solution built…
RiskFront Lab
New York startup that adds runtime tamper, root/jailbreak, and debugging defenses to finished mobile apps without an in-code…
Nullify
A San Francisco AI-agent product-security startup (about $16.9M raised) that ships merge-ready fixes.
Korbit.ai
A Montreal AI pull-request review startup integrated into Boost Security's SDLC platform.
Xygeni
Software supply chain security platform covering code, dependencies, CI/CD and malware detection in open-source packages.
Sucuri
Website security platform providing a WAF, malware scanning and removal, and DDoS mitigation, widely adopted in the WordPress…
STEALIEN
STEALIEN is a Seoul-based mobile application security company whose AppSuit runtime application self-protection (RASP) product holds Korea's top-level…
ESNC
Specialized SAP security vendor providing vulnerability scanning and real-time attack detection for SAP NetWeaver environments, a niche generalist…
Revenera
Revenera, Flexera’s software monetization and supply-chain division, provides Software Composition Analysis (SCA) tooling that scans codebases for open-source…
Parasoft
Long-established software testing and static analysis vendor whose SAST and code quality tools help enterprises catch security vulnerabilities…
Klocwork (Perforce)
Long-established static application security testing tool for safety-critical embedded software, originally a Nortel spinoff, now owned and developed…
SecureFlag
Hands-on secure coding training platform using virtualized, real-world development environments to teach developers, DevOps and QA engineers to…
Boost Security
A Montreal AppSec startup that acquired SecureIQx and Korbit.ai in May 2026 to prioritize reachable, exploitable vulnerabilities.
Jit
A Boston AI context-graph startup acquired by Torq for a reported $50M to underpin an Enterprise AI SOC…
SOOHO
SOOHO began as a Korean smart contract security auditor and has since expanded into broader stablecoin and digital-asset…
Dam Secure
AI-native AppSec platform built to catch logic-level security flaws in AI/LLM-generated code that traditional scanners miss.
Staris
AI-driven continuous penetration-testing platform using 'virtual security engineers' to find, prove, and patch exploitable application vulnerabilities.
Hacktron
An AI-native platform, built by competitive CTF hackers, that reviews pull requests and runs autonomous penetration tests on…
Tolmo
A Y Combinator- and Accel-backed San Francisco agentic AppSec startup built by the Sqreen team.
SecureIQx
An MIT-founded SCA reachability engine acquired alongside Korbit.ai by Boost Security.
Raven
A Palo Alto signature-less runtime defense startup from Javelin's founding team, backed by a well-subscribed seed round.
Waratek
Compiler-based RASP and IAST platform that virtually patches Java applications at the JVM level, including legacy runtimes, without…
SOOS
Flat-rate software composition analysis, container scanning, and SBOM management platform.
Quarkslab
A Paris reverse-engineering and offensive-security research firm (QShield) acquired by Airbus Defence and Space.
WhiteHawk
An ASX-listed Australian micro-cap pivoting into AI governance through its AUD 3.5M acquisition of Quixxi.
Pi
A 2025-founded agentic AppSec startup backed by CrowdStrike CEO George Kurtz and Armis's founders.
Rain
A stablecoin payments platform that internalized Guardrail's runtime on-chain monitoring technology, which protected $30B+ in assets.
Allegro Software
Embedded software vendor licensing the RomPager web server and TLS/certificate-management toolkits that device manufacturers build into routers and…
Digital.ai
DevOps platform whose Application Security line (formerly Arxan) provides build-time app shielding, anti-tampering, and white-box cryptography for mobile…
OnSystem Logic
Small application-hardening vendor building a non-bypassable, in-memory reference monitor for Windows endpoints to block trusted-tool abuse and memory-safety…
Minimus
Minimus built hardened, minimal container images from scratch directly from upstream open-source sources, aiming to eliminate more than…
Akto
Akto is a San Francisco API and AI-agent security platform that discovers APIs and MCP tools and continuously…
FortifyWP
A bootstrapped boutique offering flat-fee manual WordPress security audits and hacked-site recovery.
Secure Annex
A Kansas City browser and IDE extension-risk specialist acquired by Socket.
SafeStack
An Auckland developer secure-coding training specialist acquired by NINJIO in July 2026.
Verimatrix
Publicly-traded content protection and mobile app shielding vendor whose XTD suite hardens Android and iOS apps against reverse…
APPVISORY (mediaTest digital)
German SaaS provider of mobile app risk management, using static and dynamic analysis to screen mobile applications for…
AppSecAI
Los Altos-based early-stage startup from Contrast Security's founders, using AI to triage and auto-fix SAST vulnerability findings.
Pluribus One
An Italian University of Cagliari spin-off with a Made-in-Europe application detection and response product, now part of Alfa…
Quixxi
An Australian patented mobile-app security vendor acquired by ASX-listed WhiteHawk in a scrip-for-scrip deal.
GuardRails
Singapore-based DevSecOps platform that integrates static analysis, secret scanning and dependency checks directly into developers' existing CI/CD workflows.
VoidZero
The open-source company behind Vite and Vitest, acquired by Cloudflare in June 2026; tracked for software supply-chain relevance…
CodeAnt AI
AI-powered code review platform that flags security vulnerabilities and quality issues directly in pull requests across 30+ languages.
Alfa Group
An Italian IT firm building sovereign European application-security capability through a majority stake in university spin-off Pluribus One.
Kiuwan (Sembi)
Static application security testing and software composition analysis platform originating in Spain, now part of Idera's Sembi software…
Gitar
An early-stage AI code-review startup acquired by Sonar to combine agentic reasoning with code verification for AI-generated code.
Trusted Knight
Cloud-delivered, agentless malware and fraud prevention for web transactions via Protector AIR.
Yogosha
A decade-old French invite-only bug-bounty pioneer rescued from receivership by IT group Creative in 2026.