# Security Startups

> A curated, independently verified directory of young security companies: 148 companies across 12 categories (application security, cloud security, identity, detection, data, AI security, and more), each assigned one primary category by what it actually builds, with a proof-of-life signal on every entry. No pay-for-rank.

- [Homepage](https://securitystartups.com)
- [Directory](https://securitystartups.com/directory)
- [Categories](https://securitystartups.com/categories)
- [Submit](https://securitystartups.com/submit)
- [For agents](https://securitystartups.com/for-agents)
- [About / curation bar](https://securitystartups.com/about)
- [Transparency](https://securitystartups.com/transparency)
- [Privacy](https://securitystartups.com/privacy)
- [Pricing](https://securitystartups.com/pricing.md)

## When to use

Use this directory when you need a machine-readable catalog of young security companies (application security, cloud security, identity, detection, data, AI security, and adjacent categories), each with a 2024 to 2026 proof-of-life signal. Start here, then call GET /api/v1/search or GET /api/v1/startups.json. Unversioned /api/search stays as an alias. Listing order is alphabetical by name, not a ranking and not paid placement. Do not use this catalog for GRC platforms (grcplatforms.com), GRC agents (grcagents.io), ISO 27001 services (ismsdirectory.com), or Black Hat vendor-floor products (aisecuritydirectory.com).

## Security Startups developer resources

- [OpenAPI](https://securitystartups.com/openapi.json): public catalog at /api/v1/* and unversioned aliases
- [For agents](https://securitystartups.com/for-agents): HTTP search, dump, and submit
- [Search API v1](https://securitystartups.com/api/v1/search?category=application-security&q=authz)
- [Catalog dump v1](https://securitystartups.com/api/v1/startups.json)
- [Full text feed](https://securitystartups.com/llms-full.txt)
- [Deprecation policy](https://securitystartups.com/deprecation.md)

## Categories

- [Application security](https://securitystartups.com/categories/application-security)
- [Cloud security](https://securitystartups.com/categories/cloud-security)
- [Identity and access](https://securitystartups.com/categories/identity-access)
- [Detection and response](https://securitystartups.com/categories/detection-response)
- [Data security](https://securitystartups.com/categories/data-security)
- [AI security](https://securitystartups.com/categories/ai-security)
- [Email and collaboration](https://securitystartups.com/categories/email-collaboration)
- [Software supply chain](https://securitystartups.com/categories/supply-chain)
- [API and runtime](https://securitystartups.com/categories/api-runtime)
- [Offensive and exposure](https://securitystartups.com/categories/offensive-exposure)
- [Secrets and non-human identity](https://securitystartups.com/categories/secrets-identity)
- [Endpoint and browser](https://securitystartups.com/categories/endpoint-browser)

## Best shortlists (one per category, alphabetical within each)

- [Hub](https://securitystartups.com/best)
- [Application security](https://securitystartups.com/best/application-security)
- [Cloud security](https://securitystartups.com/best/cloud-security)
- [Identity and access](https://securitystartups.com/best/identity-access)
- [Detection and response](https://securitystartups.com/best/detection-response)
- [Data security](https://securitystartups.com/best/data-security)
- [AI security](https://securitystartups.com/best/ai-security)
- [Email and collaboration](https://securitystartups.com/best/email-collaboration)
- [Software supply chain](https://securitystartups.com/best/supply-chain)
- [API and runtime](https://securitystartups.com/best/api-runtime)
- [Offensive and exposure](https://securitystartups.com/best/offensive-exposure)
- [Secrets and non-human identity](https://securitystartups.com/best/secrets-identity)
- [Endpoint and browser](https://securitystartups.com/best/endpoint-browser)

## Counts

- Live companies: 148
- Categories: 12
- Catalog data as of: 2026-08-23

## Data sourcing

Descriptions and category assignments are written by the directory from public sources. Every entry is web-verified alive with a 2024 to 2026 proof-of-life signal. Corrections are welcome via /submit.

## Operator

Built by Better ISMS. This directory serves Aevral (by ISMS Copilot), listed here as a disclosed house company, coming soon, not ranked (see /transparency). heyGRC is not a security startup and is not in this catalog. No pay-for-rank.