{
  "updated": "2026-10-16",
  "categories": [
    {
      "slug": "compliance-readiness",
      "name": "Compliance Readiness",
      "summary": "Getting audit-ready for SOC 2, ISO 27001, HIPAA and similar frameworks."
    },
    {
      "slug": "application-security",
      "name": "Application Security",
      "summary": "Finding and fixing vulnerabilities in code, dependencies, secrets and containers."
    },
    {
      "slug": "penetration-testing",
      "name": "Penetration Testing",
      "summary": "External attack-surface scanning, pentest-as-a-service and bug bounty."
    },
    {
      "slug": "identity-access",
      "name": "Identity & Access",
      "summary": "Workforce SSO, privileged and just-in-time access, secrets, and access for AI agents and workloads."
    },
    {
      "slug": "vendor-evaluation",
      "name": "Vendor Replacement & Evaluation",
      "summary": "Assessing third-party risk, answering security questionnaires and comparing vendors."
    }
  ],
  "newReleases": [],
  "tools": [
    {
      "name": "Vanta",
      "url": "https://www.vanta.com",
      "category": "compliance-readiness",
      "description": "Trust management platform that automates evidence collection for SOC 2, ISO 27001, HIPAA, GDPR and other frameworks.",
      "fit": "Startups to mid-market teams preparing for a first audit",
      "pricing": "Contact sales",
      "basis": "Based on public documentation"
    },
    {
      "name": "Drata",
      "url": "https://drata.com",
      "category": "compliance-readiness",
      "description": "Compliance automation with continuous control monitoring and integrations for SOC 2, ISO 27001 and more.",
      "fit": "Software companies running continuous compliance programs",
      "pricing": "Contact sales",
      "basis": "Based on public documentation"
    },
    {
      "name": "Secureframe",
      "url": "https://secureframe.com",
      "category": "compliance-readiness",
      "description": "Compliance automation platform covering SOC 2, ISO 27001, HIPAA, PCI DSS and other frameworks.",
      "fit": "Growing companies seeking guided audit readiness",
      "pricing": "Contact sales",
      "basis": "Based on public documentation"
    },
    {
      "name": "Sprinto",
      "url": "https://sprinto.com",
      "category": "compliance-readiness",
      "description": "Compliance automation for cloud-hosted companies, with control monitoring across multiple frameworks.",
      "fit": "Cloud-native SMBs and mid-market",
      "pricing": "Contact sales",
      "basis": "Based on public documentation"
    },
    {
      "name": "Thoropass",
      "url": "https://thoropass.com",
      "category": "compliance-readiness",
      "description": "Compliance platform combined with in-house audit services for SOC 2, ISO 27001, HITRUST and PCI.",
      "fit": "Teams wanting software and the audit from one provider",
      "pricing": "Contact sales",
      "basis": "Based on public documentation"
    },
    {
      "name": "Snyk",
      "url": "https://snyk.io",
      "category": "application-security",
      "description": "Developer security platform for open-source dependencies, code (SAST), containers and infrastructure as code.",
      "fit": "Engineering-led teams embedding security in the IDE and CI",
      "pricing": "Public pricing",
      "basis": "Based on public documentation"
    },
    {
      "name": "Semgrep",
      "url": "https://semgrep.dev",
      "category": "application-security",
      "description": "Static analysis with customizable rules, plus supply-chain and secrets scanning.",
      "fit": "Teams that want fast, rule-customizable SAST",
      "pricing": "Public pricing",
      "basis": "Based on public documentation"
    },
    {
      "name": "Aikido Security",
      "url": "https://www.aikido.dev",
      "category": "application-security",
      "description": "All-in-one code and cloud security platform combining SAST, SCA, secrets, IaC and container scanning.",
      "fit": "Small and mid-size dev teams wanting one consolidated tool",
      "pricing": "Public pricing",
      "basis": "Based on public documentation"
    },
    {
      "name": "Chainguard",
      "url": "https://www.chainguard.dev",
      "category": "application-security",
      "description": "Minimal, hardened container images and libraries built to reduce known vulnerabilities.",
      "fit": "Teams reducing container CVE noise and supply-chain risk",
      "pricing": "Contact sales",
      "basis": "Based on public documentation"
    },
    {
      "name": "Socket",
      "url": "https://socket.dev",
      "category": "application-security",
      "description": "Software supply-chain security that analyzes open-source package behavior to detect malicious dependencies.",
      "fit": "Teams heavily dependent on npm, PyPI and similar ecosystems",
      "pricing": "Public pricing",
      "basis": "Based on public documentation"
    },
    {
      "name": "GitGuardian",
      "url": "https://www.gitguardian.com",
      "category": "application-security",
      "description": "Secrets detection and remediation across source code, CI and developer tooling.",
      "fit": "Any team concerned about leaked credentials in repos",
      "pricing": "Public pricing",
      "basis": "Based on public documentation"
    },
    {
      "name": "Intruder",
      "url": "https://www.intruder.io",
      "category": "penetration-testing",
      "description": "Cloud-based vulnerability scanner and attack-surface monitoring for external and internal infrastructure.",
      "fit": "Small security teams needing continuous scanning",
      "pricing": "Public pricing",
      "basis": "Based on public documentation"
    },
    {
      "name": "Cobalt",
      "url": "https://www.cobalt.io",
      "category": "penetration-testing",
      "description": "Pentest as a service: on-demand manual testing by vetted testers, delivered through a platform.",
      "fit": "Companies needing recurring pentests for audits and customers",
      "pricing": "Contact sales",
      "basis": "Based on public documentation"
    },
    {
      "name": "HackerOne",
      "url": "https://www.hackerone.com",
      "category": "penetration-testing",
      "description": "Bug bounty, vulnerability disclosure and pentest programs run with a researcher community.",
      "fit": "Companies ready to run bounty or disclosure programs",
      "pricing": "Contact sales",
      "basis": "Based on public documentation"
    },
    {
      "name": "Bugcrowd",
      "url": "https://www.bugcrowd.com",
      "category": "penetration-testing",
      "description": "Crowdsourced security platform for bug bounty, pentesting and attack-surface management.",
      "fit": "Teams wanting crowdsourced testing coverage",
      "pricing": "Contact sales",
      "basis": "Based on public documentation"
    },
    {
      "name": "Detectify",
      "url": "https://detectify.com",
      "category": "penetration-testing",
      "description": "External attack-surface management and application scanning informed by ethical-hacker research.",
      "fit": "Web-heavy companies monitoring internet-facing assets",
      "pricing": "Public pricing",
      "basis": "Based on public documentation"
    },
    {
      "name": "Teleport",
      "url": "https://goteleport.com",
      "category": "identity-access",
      "description": "Infrastructure access platform with identity-based, short-lived access to servers, Kubernetes, databases and more.",
      "fit": "Engineering teams replacing static keys and VPNs",
      "pricing": "Contact sales",
      "basis": "Based on public documentation"
    },
    {
      "name": "Opal",
      "url": "https://www.opal.dev",
      "category": "identity-access",
      "description": "Access management for just-in-time and least-privilege access requests and reviews.",
      "fit": "Teams moving to just-in-time access and audit-ready reviews",
      "pricing": "Contact sales",
      "basis": "Based on public documentation"
    },
    {
      "name": "1Password",
      "url": "https://1password.com",
      "category": "identity-access",
      "description": "Password and secrets management for teams, including developer secrets tooling.",
      "fit": "Any company standardizing credential management",
      "pricing": "Public pricing",
      "basis": "Based on public documentation"
    },
    {
      "name": "Okta",
      "url": "https://www.okta.com",
      "category": "identity-access",
      "description": "Workforce and customer identity platform: SSO, MFA and lifecycle management.",
      "fit": "Companies centralizing SSO and user provisioning",
      "pricing": "Public pricing",
      "basis": "Based on public documentation"
    },
    {
      "name": "ConductorOne",
      "url": "https://www.conductorone.com",
      "category": "identity-access",
      "description": "Identity governance and automated access reviews, including just-in-time access.",
      "fit": "Teams automating access reviews for compliance",
      "pricing": "Contact sales",
      "basis": "Based on public documentation"
    },
    {
      "name": "Aembit",
      "url": "https://aembit.io",
      "category": "identity-access",
      "description": "Workload and non-human identity access management, including access for AI agents.",
      "fit": "Teams securing service-to-service and AI-agent access",
      "pricing": "Contact sales",
      "basis": "Based on public documentation"
    },
    {
      "name": "Whistic",
      "url": "https://www.whistic.com",
      "category": "vendor-evaluation",
      "description": "Third-party risk management and vendor assessment platform, including a trust center.",
      "fit": "Teams running vendor security reviews",
      "pricing": "Contact sales",
      "basis": "Based on public documentation"
    },
    {
      "name": "SecurityScorecard",
      "url": "https://securityscorecard.com",
      "category": "vendor-evaluation",
      "description": "Security ratings and third-party risk management based on externally observable signals.",
      "fit": "Companies monitoring vendor and supplier risk",
      "pricing": "Contact sales",
      "basis": "Based on public documentation"
    },
    {
      "name": "UpGuard",
      "url": "https://www.upguard.com",
      "category": "vendor-evaluation",
      "description": "Third-party risk and attack-surface management with vendor questionnaires and monitoring.",
      "fit": "Lean teams managing vendor risk at scale",
      "pricing": "Public pricing",
      "basis": "Based on public documentation"
    },
    {
      "name": "Conveyor",
      "url": "https://www.conveyor.com",
      "category": "vendor-evaluation",
      "description": "Automates answering customer security questionnaires and hosts a trust center.",
      "fit": "Sales-led companies fielding many security reviews",
      "pricing": "Contact sales",
      "basis": "Based on public documentation"
    }
  ]
}