Aqua Security
Burlington, United States
Code-to-runtime CNAPP that ranks CVEs by live workload behavior and can stop an exploit without waiting for a patch.
Raised $60M at a $1B-plus valuation, January 2024
← All shortlistsSeries E Series A Series A Series C Series A Series B Series C Series A Series A Series C Series B Series B Series G Series A Series B Series B
Best Cloud security companies
Live directory shortlist for primary category cloud-security. Full category slice, alphabetical, not quality-ranked. No paid order.
Catalog last reviewed 2026-08-23. Page copy reviewed 2026-08-23. Next editorial review by 2026-09-23. Alphabetical order, no paid placement. 16 matched live listings.
This page is a live catalog slice for primary category cloud security. Readers often land here when comparing independent CNAPP, CSPM, and workload companies rather than another console from a network-security incumbent. Public mega-caps are out of this directory. Every entry carries a 2024 to 2026 proof-of-life signal. Category membership is taxonomy from the directory research pass. The word Best in the shortlist title is the hub name, not a scored ranking.
Who this is for. Cloud security engineers, CISOs, and investors shortlisting companies whose main focus is cloud attack surface rather than application scanners or identity platforms.
Eligibility. Included only when a live company has primary category cloud-security. Application scanners, identity products, and public mega-cap CNAPP suites live in their own categories or off this directory. Inclusion is category-based and verification-gated, not paid placement.
How order works. Matched companies are the full live catalog slice for this primary category, sorted alphabetically by name. This is not a scored quality ranking. When listing fees open, they are intended to affect publish timing or review-queue position only, not alphabetical order or praise on this page (payments are currently closed). Aevral is a disclosed house listing under the same rules (coming soon, no pin). See /transparency.
Target query: best cloud security startups. Category index: /categories/cloud-security. Parent hub: /best. Full catalog: /directory.
ARMO
Tel Aviv, Israel
Kubernetes-rooted CNAPP and CADR, built on CNCF Kubescape, that uses eBPF runtime to decide which CVEs and misconfigs matter.
Kubescape 4.0 released with runtime threat detection GA, March 2026
Aryon Security
Tel Aviv, Israel
Cloud policy enforcement that blocks misconfigs and over-privilege at deploy time, before CSPM has anything to scan.
Raised $29M Series A, June 2026
CyCognito
Palo Alto, United States
Seedless external attack-surface discovery that finds cloud, subsidiary, and third-party assets attackers can actually reach.
Named a Leader and Outperformer in the 2026 GigaOm Radar for Attack Surface Management
IONIX
Tel Aviv, Israel
External attack-surface platform that discovers cloud, subsidiary, and supply-chain assets, then validates which exposures are actually exploitable.
Added $15M to Series A, bringing total funding to $50.3M, February 2024
Mitiga
New York, United States
Cloud, SaaS, identity, and AI detection and response with a forensic lake built for attacks that never touch an endpoint agent.
Raised $30M Series B led by SYN Ventures, January 2025
Orca Security
Portland, United States
Agentless CNAPP that SideScans cloud disks and APIs for the full estate without installing a workload agent.
Named a Strong Performer in The Forrester Wave: Cloud Native Application Protection Solutions, Q1 2026
RAD Security
San Francisco, United States
Behavioral runtime CDR for Kubernetes and AI workloads, fingerprinting what a cluster should do so zero-days show up as drift.
Raised $14M Series A, February 2025
Skyhawk Security
Tel Aviv, Israel
AI purple team that replays CNAPP and SIEM findings against a digital twin to prove which cloud CVEs are actually weaponizable.
Named a CRN 2025 Stellar Startup for the third consecutive year, November 2025
Sonrai Security
New York, United States
Cloud permissions firewall that enforces least privilege on humans, machines, and AI identities using native AWS, Azure, and GCP controls.
Reported 4x ARR growth as Cloud Permissions Firewall adoption surged, January 2026
Stream Security
Tel Aviv, Israel
Cloud detection and response on a live CloudTwin of every workload, identity, and network path.
Raised $30M Series B, October 2024
Sweet Security
Tel Aviv, Israel
Runtime CNAPP that watches cloud and AI agents as they act, then turns the finding into a guardrail.
Raised $75M Series B, November 2025
Sysdig
San Francisco, United States
Runtime CNAPP built on kernel-level system calls, Falco detections, and AI agents that act inside the tools you already run.
Named a Leader in The Forrester Wave: Cloud Native Application Protection Solutions, Q1 2026
Tamnoon
Sammamish, United States
Human-plus-AI cloud remediation that closes CNAPP findings without breaking the workload that owns them.
Raised $12M Series A, September 2024
Tigera
San Francisco, United States
Calico-powered Kubernetes network security and microsegmentation, plus Lynx for governing AI agent calls on the cluster.
Shipped the Winter 2026 Calico Cloud release with an AI assistant and multi-cluster traffic observability, March 2026
Upwind
San Francisco, United States
Runtime-first CNAPP that ranks cloud risk from what is actually running, not from a static CVE dump.
Raised $250M Series B at a $1.5B valuation, January 2026