Security categories

One primary category per company, assigned by what it actually builds rather than marketing language. Sorted by field size.

Application security

Startups that find and fix weaknesses in application code: SAST, ASPM, authz and business-logic scanners, not the PR-comment bots.

CNAPP, CSPM, and workload startups that map cloud attack surface for companies that do not want another console from a network-security incumbent.

Workforce, customer, and ITDR startups. Identity is the control plane; these companies treat it as the product.

Independent XDR, MDR, and detection-engineering startups. Not the public mega-cap EDR floor.

CTEM, attack-surface, pentest-platform, and continuous-exposure startups. Not a services firm with a PDF report.

DSPM, data detection, and data-access startups that tell you where sensitive data actually lives.

Startups securing models, agents, and LLM applications: red teaming, runtime guards, and agent identity.

SCA, SBOM, package, and pipeline-security startups that treat dependencies as the product surface.

Secrets, certificates, machine identity, and NHI startups. The credentials humans did not mean to ship.

Email security, browser isolation, and collaboration-security startups built after the last generation of secure email gateways.

Independent endpoint, browser-security, and device startups. Not CrowdStrike-class public mega-caps.

API security, runtime application protection, and service-mesh startups watching production, not just pull requests.