Best of

Best-of shortlists

One shortlist per category: the full live catalog slice for that primary category, every company verified alive. Not pay-to-play; ordering is alphabetical, not a quality score. Prefer a specific shortlist over this hub when you know the job.

• Best Application security companies

  Live directory shortlist for primary category application-security. Full category slice, alphabetical, not quality-ranked. No paid order.

  16 live listings. Page substance reviewed 2026-08-23.

• Best Cloud security companies

  Live directory shortlist for primary category cloud-security. Full category slice, alphabetical, not quality-ranked. No paid order.

  16 live listings. Page substance reviewed 2026-08-23.

• Best Identity and access companies

  Workforce, customer, and ITDR startups. Identity is the control plane; these companies treat it as the product.

  15 live listings.

• Best Detection and response companies

  Independent XDR, MDR, and detection-engineering startups. Not the public mega-cap EDR floor.

  14 live listings.

• Best Offensive and exposure companies

  CTEM, attack-surface, pentest-platform, and continuous-exposure startups. Not a services firm with a PDF report.

  13 live listings.

• Best Data security companies

  DSPM, data detection, and data-access startups that tell you where sensitive data actually lives.

  12 live listings.

• Best AI security companies

  Live directory shortlist for primary category ai-security. Full category slice, alphabetical, not quality-ranked. No paid order.

  12 live listings. Page substance reviewed 2026-08-23.

• Best Software supply chain companies

  SCA, SBOM, package, and pipeline-security startups that treat dependencies as the product surface.

  12 live listings.

• Best Secrets and non-human identity companies

  Secrets, certificates, machine identity, and NHI startups. The credentials humans did not mean to ship.

  11 live listings.

• Best Email and collaboration companies

  Email security, browser isolation, and collaboration-security startups built after the last generation of secure email gateways.

  10 live listings.

• Best Endpoint and browser companies

  Independent endpoint, browser-security, and device startups. Not CrowdStrike-class public mega-caps.

  9 live listings.

• Best API and runtime companies

  API security, runtime application protection, and service-mesh startups watching production, not just pull requests.

  8 live listings.

Full catalog: /directory. Machine feeds: /for-agents.