Young security companies, mapped
The security industry, mapped by companies that are actually alive.
Vendor floors mix booths, vaporware, and quietly dead startups with the companies still shipping. This is a curated, independently verified directory of young security companies, organized by what they build, with a proof-of-life signal on every entry. No pay-for-rank.
From the catalog, 205 verified companies across 13 categories
View allThe list in numbers
All five chartsCompanies by category, of listed companies
n = 205205 of 205 have a categoryAs of 2026-10-29
Curated, alive-only, not exhaustive. Funding stage, headquarters, founded year and disclosed funding are on the stats page, each with a CSV and a share image.
We compete here too
Better ISMS builds Aevral, listed here under the same rules.
Aevral: security review, handled. Your AI agents keep shipping; Aevral reviews their changes for security problems and suggests the fix, live and self-serve: review the pull request, scan the repo you already have. It never blocks a pull request: it comments, you decide.
Open-source models, processed in the US today; an EU-only option is announced. By ISMS Copilot. Alphabetical, no pin. Details on transparency, the Aevral listing, live at aevral.com.
By what they build
View allAI security
28Startups securing models, agents, and LLM applications: red teaming, runtime guards, and agent identity.
Offensive and exposure
27CTEM, attack-surface, pentest-platform, and continuous-exposure startups. Not a services firm with a PDF report.
Detection and response
25Independent XDR, MDR, and detection-engineering startups. Not the public mega-cap EDR floor.
Application security
20Startups that find and fix weaknesses in application code: SAST, ASPM, authz and business-logic scanners, not the PR-comment bots.
Cloud security
17CNAPP, CSPM, and workload startups that map cloud attack surface for companies that do not want another console from a network-security incumbent.
Identity and access
17Workforce, customer, and ITDR startups. Identity is the control plane; these companies treat it as the product.
Data security
12DSPM, data detection, and data-access startups that tell you where sensitive data actually lives.
Software supply chain
12SCA, SBOM, package, and pipeline-security startups that treat dependencies as the product surface.
Secrets and non-human identity
12Secrets, certificates, machine identity, and NHI startups. The credentials humans did not mean to ship.
Endpoint and browser
12Independent endpoint, browser-security, and device startups. Not CrowdStrike-class public mega-caps.
Email and collaboration
11Email security, browser isolation, and collaboration-security startups built after the last generation of secure email gateways.
API and runtime
8API security, runtime application protection, and service-mesh startups watching production, not just pull requests.
Third-party risk
4Supplier and vendor security startups: shared supplier assessments, security ratings, and continuous third-party monitoring. Full GRC suites stay on grcplatforms.com.
By stage: Seed · Series A · Series B · Series C · Late-stage
By region: United States · Europe · United Kingdom · France
New companies: added in the last 30 days
For the field
One primary category per company, assigned by what it actually ships. Compare application-security startups against cloud CNAPP companies without wading through Black Hat booth copy.
For companies
Not listed, or miscategorized? Free submission with review. Every entry needs a 2024 to 2026 proof-of-life signal. Nothing buys rank or a better category.
For AI agents
The whole catalog is machine-readable: search API, full JSON dump, llms.txt, and an MCP server. Built to be quoted by agents doing security-market research.