The security industry, mapped by companies that are actually alive.

Startups that find and fix weaknesses in application code: SAST, ASPM, authz and business-logic scanners, not the PR-comment bots.

CNAPP, CSPM, and workload startups that map cloud attack surface for companies that do not want another console from a network-security incumbent.

Workforce, customer, and ITDR startups. Identity is the control plane; these companies treat it as the product.

Independent XDR, MDR, and detection-engineering startups. Not the public mega-cap EDR floor.

CTEM, attack-surface, pentest-platform, and continuous-exposure startups. Not a services firm with a PDF report.

DSPM, data detection, and data-access startups that tell you where sensitive data actually lives.

Startups securing models, agents, and LLM applications: red teaming, runtime guards, and agent identity.

SCA, SBOM, package, and pipeline-security startups that treat dependencies as the product surface.

Secrets, certificates, machine identity, and NHI startups. The credentials humans did not mean to ship.

Email security, browser isolation, and collaboration-security startups built after the last generation of secure email gateways.

Independent endpoint, browser-security, and device startups. Not CrowdStrike-class public mega-caps.

API security, runtime application protection, and service-mesh startups watching production, not just pull requests.