Application Security
Securing web applications, mobile apps, and software throughout the development lifecycle.
Hacktron
An AI-native platform, built by competitive CTF hackers, that reviews pull requests and runs autonomous penetration tests on…
Klocwork (Perforce)
Long-established static application security testing tool for safety-critical embedded software, originally a Nortel spinoff, now owned and developed…
Jit
A Boston AI context-graph startup acquired by Torq for a reported $50M to underpin an Enterprise AI SOC…
Revenera
Revenera, Flexera’s software monetization and supply-chain division, provides Software Composition Analysis (SCA) tooling that scans codebases for open-source…
Dam Secure
AI-native AppSec platform built to catch logic-level security flaws in AI/LLM-generated code that traditional scanners miss.
Nullify
A San Francisco AI-agent product-security startup (about $16.9M raised) that ships merge-ready fixes.
SecureFlag
Hands-on secure coding training platform using virtualized, real-world development environments to teach developers, DevOps and QA engineers to…
Staris
AI-driven continuous penetration-testing platform using 'virtual security engineers' to find, prove, and patch exploitable application vulnerabilities.
SOOHO
SOOHO began as a Korean smart contract security auditor and has since expanded into broader stablecoin and digital-asset…
ESNC
Specialized SAP security vendor providing vulnerability scanning and real-time attack detection for SAP NetWeaver environments, a niche generalist…
Xygeni
Software supply chain security platform covering code, dependencies, CI/CD and malware detection in open-source packages.
Korbit.ai
A Montreal AI pull-request review startup integrated into Boost Security's SDLC platform.
Boost Security
A Montreal AppSec startup that acquired SecureIQx and Korbit.ai in May 2026 to prioritize reachable, exploitable vulnerabilities.
Sucuri
Website security platform providing a WAF, malware scanning and removal, and DDoS mitigation, widely adopted in the WordPress…
Parasoft
Long-established software testing and static analysis vendor whose SAST and code quality tools help enterprises catch security vulnerabilities…
Tolmo
A Y Combinator- and Accel-backed San Francisco agentic AppSec startup built by the Sqreen team.
SOOS
Flat-rate software composition analysis, container scanning, and SBOM management platform.
SecureIQx
An MIT-founded SCA reachability engine acquired alongside Korbit.ai by Boost Security.
Raven
A Palo Alto signature-less runtime defense startup from Javelin's founding team, backed by a well-subscribed seed round.
Waratek
Compiler-based RASP and IAST platform that virtually patches Java applications at the JVM level, including legacy runtimes, without…
Quarkslab
A Paris reverse-engineering and offensive-security research firm (QShield) acquired by Airbus Defence and Space.
Minimus
Minimus built hardened, minimal container images from scratch directly from upstream open-source sources, aiming to eliminate more than…
Digital.ai
DevOps platform whose Application Security line (formerly Arxan) provides build-time app shielding, anti-tampering, and white-box cryptography for mobile…
Pi
A 2025-founded agentic AppSec startup backed by CrowdStrike CEO George Kurtz and Armis's founders.