# GuardRank > The security and compliance tools directory built by practitioners, for practitioners. Independent shortlist for 20–500 person B2B software companies, organized by buying situation. Listings are based on public documentation; sponsored placements are always labeled. - Home: https://guardrank.ai/ - Data (JSON): https://guardrank.ai/data/tools.json - Sponsor: https://guardrank.ai/sponsor/ ## Compliance Readiness Page: https://guardrank.ai/category/compliance-readiness/ - [Vanta](https://www.vanta.com): Trust management platform that automates evidence collection for SOC 2, ISO 27001, HIPAA, GDPR and other frameworks. Fit: Startups to mid-market teams preparing for a first audit. Pricing: Contact sales. - [Drata](https://drata.com): Compliance automation with continuous control monitoring and integrations for SOC 2, ISO 27001 and more. Fit: Software companies running continuous compliance programs. Pricing: Contact sales. - [Secureframe](https://secureframe.com): Compliance automation platform covering SOC 2, ISO 27001, HIPAA, PCI DSS and other frameworks. Fit: Growing companies seeking guided audit readiness. Pricing: Contact sales. - [Sprinto](https://sprinto.com): Compliance automation for cloud-hosted companies, with control monitoring across multiple frameworks. Fit: Cloud-native SMBs and mid-market. Pricing: Contact sales. - [Thoropass](https://thoropass.com): Compliance platform combined with in-house audit services for SOC 2, ISO 27001, HITRUST and PCI. Fit: Teams wanting software and the audit from one provider. Pricing: Contact sales. ## Application Security Page: https://guardrank.ai/category/application-security/ - [Snyk](https://snyk.io): Developer security platform for open-source dependencies, code (SAST), containers and infrastructure as code. Fit: Engineering-led teams embedding security in the IDE and CI. Pricing: Public pricing. - [Semgrep](https://semgrep.dev): Static analysis with customizable rules, plus supply-chain and secrets scanning. Fit: Teams that want fast, rule-customizable SAST. Pricing: Public pricing. - [Aikido Security](https://www.aikido.dev): All-in-one code and cloud security platform combining SAST, SCA, secrets, IaC and container scanning. Fit: Small and mid-size dev teams wanting one consolidated tool. Pricing: Public pricing. - [Chainguard](https://www.chainguard.dev): Minimal, hardened container images and libraries built to reduce known vulnerabilities. Fit: Teams reducing container CVE noise and supply-chain risk. Pricing: Contact sales. - [Socket](https://socket.dev): Software supply-chain security that analyzes open-source package behavior to detect malicious dependencies. Fit: Teams heavily dependent on npm, PyPI and similar ecosystems. Pricing: Public pricing. - [GitGuardian](https://www.gitguardian.com): Secrets detection and remediation across source code, CI and developer tooling. Fit: Any team concerned about leaked credentials in repos. Pricing: Public pricing. ## Penetration Testing Page: https://guardrank.ai/category/penetration-testing/ - [Intruder](https://www.intruder.io): Cloud-based vulnerability scanner and attack-surface monitoring for external and internal infrastructure. Fit: Small security teams needing continuous scanning. Pricing: Public pricing. - [Cobalt](https://www.cobalt.io): Pentest as a service: on-demand manual testing by vetted testers, delivered through a platform. Fit: Companies needing recurring pentests for audits and customers. Pricing: Contact sales. - [HackerOne](https://www.hackerone.com): Bug bounty, vulnerability disclosure and pentest programs run with a researcher community. Fit: Companies ready to run bounty or disclosure programs. Pricing: Contact sales. - [Bugcrowd](https://www.bugcrowd.com): Crowdsourced security platform for bug bounty, pentesting and attack-surface management. Fit: Teams wanting crowdsourced testing coverage. Pricing: Contact sales. - [Detectify](https://detectify.com): External attack-surface management and application scanning informed by ethical-hacker research. Fit: Web-heavy companies monitoring internet-facing assets. Pricing: Public pricing. ## Identity & Access Page: https://guardrank.ai/category/identity-access/ - [Teleport](https://goteleport.com): Infrastructure access platform with identity-based, short-lived access to servers, Kubernetes, databases and more. Fit: Engineering teams replacing static keys and VPNs. Pricing: Contact sales. - [Opal](https://www.opal.dev): Access management for just-in-time and least-privilege access requests and reviews. Fit: Teams moving to just-in-time access and audit-ready reviews. Pricing: Contact sales. - [1Password](https://1password.com): Password and secrets management for teams, including developer secrets tooling. Fit: Any company standardizing credential management. Pricing: Public pricing. - [Okta](https://www.okta.com): Workforce and customer identity platform: SSO, MFA and lifecycle management. Fit: Companies centralizing SSO and user provisioning. Pricing: Public pricing. - [ConductorOne](https://www.conductorone.com): Identity governance and automated access reviews, including just-in-time access. Fit: Teams automating access reviews for compliance. Pricing: Contact sales. - [Aembit](https://aembit.io): Workload and non-human identity access management, including access for AI agents. Fit: Teams securing service-to-service and AI-agent access. Pricing: Contact sales. ## Vendor Replacement & Evaluation Page: https://guardrank.ai/category/vendor-evaluation/ - [Whistic](https://www.whistic.com): Third-party risk management and vendor assessment platform, including a trust center. Fit: Teams running vendor security reviews. Pricing: Contact sales. - [SecurityScorecard](https://securityscorecard.com): Security ratings and third-party risk management based on externally observable signals. Fit: Companies monitoring vendor and supplier risk. Pricing: Contact sales. - [UpGuard](https://www.upguard.com): Third-party risk and attack-surface management with vendor questionnaires and monitoring. Fit: Lean teams managing vendor risk at scale. Pricing: Public pricing. - [Conveyor](https://www.conveyor.com): Automates answering customer security questionnaires and hosts a trust center. Fit: Sales-led companies fielding many security reviews. Pricing: Contact sales.