Security vendors

Products that inspect, filter and control traffic moving across corporate networks and between users and the internet.

Guide: Network security vendors: who they are and how CISOs compare them

• Firewalls and NGFWHardware, virtual and cloud firewalls that enforce traffic policy by port, application, user and content.18
• SASE and SSECloud-delivered bundles of secure web gateway, cloud access security broker and private access services, with or without SD-WAN networking.19
• Zero trust network accessStandalone services that grant users access to specific private applications after checking identity and device, in place of a network-level VPN.16
• Network detection and responseTools that analyse network traffic and metadata to detect threats and support investigation and response.11
• MicrosegmentationSoftware that limits which workloads, devices and users can talk to each other inside a network to contain lateral movement.7
• Network access controlSystems that identify devices as they connect to wired and wireless networks and decide what each may reach.5
• DDoS protectionServices and appliances that absorb or filter distributed denial-of-service traffic before it overwhelms a target.13
• DNS securityProtective DNS resolvers and DNS infrastructure products that block malicious domains and protect name resolution.6
• Network visibility and traffic brokeringTaps, packet brokers and observability fabrics that deliver copies of network traffic to security and monitoring tools.10

Products that protect laptops, servers, phones and the firmware underneath them.

• EDR and XDRAgents and platforms that record endpoint activity to detect, investigate and respond to attacks, extended in XDR to other telemetry sources.34
• Endpoint protection platformsAntivirus and prevention-focused agents that block known and unknown malware on endpoints.12
• Mobile securityThreat defence for smartphones and tablets, covering malicious apps, phishing, network attacks and device compromise.16
• Endpoint management and application controlTools that inventory, configure and patch endpoints, or restrict which applications and privileges may run on them.13
• Firmware and device supply chain securityProducts that verify and monitor firmware, hardware components and device integrity below the operating system.8

Products that establish who or what is requesting access and govern what each identity may do.

• Workforce IAM and SSODirectories, single sign-on, multi-factor authentication and access policy for employees and contractors.25
• Privileged access managementVaulting, brokering and recording of administrator and other high-privilege access to systems.20
• Identity governance and administrationProvisioning, access requests, role management and periodic access reviews across applications.12
• Customer identity and access managementSign-up, login, consent and profile management for an organization's own customers.6
• Identity threat detection and responseMonitoring of identity systems such as Active Directory and identity providers to detect and stop identity-based attacks.27
• Passwordless authentication and authenticatorsHardware keys, device-bound credentials and phishing-resistant authenticators that replace or strengthen passwords.15
• Password and secrets vaults for peoplePassword managers that store and share credentials for individuals and teams.7
• Non-human identity securityDiscovery, governance and protection of service accounts, API keys, tokens and workload or AI agent identities.41
• Machine identity and PKICertificate authorities and certificate lifecycle management for TLS, code signing and device identity.12

Products that secure infrastructure, workloads and software-as-a-service applications running in public clouds.

• Cloud-native application protection (CNAPP)Platforms that combine posture, workload, identity and code-to-cloud risk analysis for cloud environments in one product.23
• Cloud security posture managementContinuous checks of cloud account configuration against security policy and compliance frameworks.8
• Cloud workload protectionRuntime protection for virtual machines, containers, Kubernetes and serverless functions.14
• Cloud identity entitlements (CIEM)Analysis and reduction of the permissions granted to human and machine identities in cloud platforms.5
• Cloud detection and responseDetection, investigation and response built on cloud control-plane logs and runtime signals.15
• SaaS security postureMonitoring of configuration, integrations, users and data exposure inside third-party SaaS applications.13 · guide

Products that find and fix weaknesses in software an organization builds, and protect that software in production.

• Static application security testingAnalysis of source code, bytecode and infrastructure-as-code for security flaws without running the application.24
• Dynamic application security testingTesting of running web applications and APIs by sending crafted requests and observing responses.18
• Software composition analysisIdentification of open-source and third-party components in software, with their known vulnerabilities and licences.21
• Application security posture managementAggregation, correlation and prioritisation of findings from many application security tools across the software lifecycle.9
• API securityDiscovery, testing and runtime protection of application programming interfaces.26
• Software supply chain securityProtection of build pipelines, artifacts, container images and package ecosystems against tampering and malicious components.26 · guide
• Secrets detectionScanning of code, repositories and collaboration tools for exposed credentials, keys and tokens.11
• WAF and WAAPWeb application firewalls and web application and API protection services that filter malicious requests to web properties.14
• Application shielding and RASPObfuscation and anti-tampering for mobile and desktop apps, and runtime self-protection instrumented into running applications.7

Products that find, classify, protect and govern sensitive data, and manage privacy obligations about it.

• Data loss preventionControls that detect and block sensitive data leaving through endpoints, email, web and cloud channels.30
• Data security posture managementDiscovery and classification of sensitive data across cloud and on-premises stores, with analysis of who can reach it.21
• Encryption, tokenization and key managementEncryption and tokenization of data, hardware security modules and systems that manage cryptographic keys.20
• Post-quantum cryptographyProducts that inventory cryptography and migrate it to algorithms designed to resist attack by quantum computers.14
• Privacy managementSoftware for consent, data subject requests, records of processing and other privacy-law obligations.11

Products that protect email and workplace messaging from phishing, impersonation and malicious content.

• Email securityGateways and API-based services that filter phishing, malware, spam and business email compromise.23
• Email authentication and DMARCServices that deploy and monitor SPF, DKIM, DMARC and BIMI to stop others sending mail as an organization's domains.8
• Collaboration app securityThreat and data protection for messaging and file-sharing tools such as Slack, Teams and shared drives.4

Products and services that collect security telemetry, detect threats, and run investigation and response.

• SIEMPlatforms that collect and correlate logs and events to detect threats and support investigation and compliance reporting.33
• SOAR and security automationWorkflow and playbook engines that automate security operations tasks across tools.16
• AI SOC analystsSoftware agents that triage, investigate and document security alerts with limited human input.32
• Security data lakes and pipelinesProducts that route, reduce and store security telemetry, often separately from where detection runs.14
• Threat intelligenceFeeds, platforms and research services about threat actors, infrastructure, malware and vulnerabilities being exploited.48
• MDR and managed SOCServices in which a provider's analysts monitor a customer's environment around the clock and respond to threats.65
• Incident response and forensicsBreach investigation and containment services, digital forensics tools, and platforms that coordinate incident response.38 · guide
• Deception technologyDecoys, honeypots and canary tokens that alert when an attacker touches them.6

Products and services that find, test and prioritise the weaknesses an attacker could use.

• Vulnerability managementScanning and assessment of systems for known vulnerabilities and misconfigurations, with tracking of remediation.54
• External attack surface managementContinuous discovery and monitoring of an organization's internet-facing assets from an outside-in view.36
• Cyber asset inventory (CAASM)Aggregation of asset data from existing tools to build an inventory and find coverage gaps.6
• Breach simulation and automated pen-testingPlatforms that safely emulate attacker techniques against live environments to validate whether controls work.27
• Exposure prioritisation and CTEMPlatforms that unify findings across scanners and apply context to decide which exposures to fix first, as part of a continuous programme.27 · guide
• Bug bounty and crowdsourced testingPlatforms that connect organizations with outside researchers who find and report vulnerabilities.6
• Digital risk protectionMonitoring of the open, deep and dark web and social platforms for brand abuse, leaked data and impersonation, with takedown services.24

Products that secure industrial control systems, medical devices and other connected equipment that cannot run standard agents.

• OT and ICS securityAsset visibility, threat detection and secure access for industrial control systems and operational technology networks.30
• IoT and medical device securityDiscovery, risk assessment and protection of connected devices such as medical, building and enterprise IoT equipment.11
• Unidirectional gateways and secure transferHardware and software that move data or files into and out of isolated networks under strict control.5

Products that document controls, measure risk and prove compliance to auditors, regulators and customers.

• GRC and integrated risk platformsSystems of record for policies, risks, controls, audits and issues across an enterprise.17
• Compliance automationTools that connect to company systems to collect evidence and track readiness for frameworks such as SOC 2, ISO 27001 and FedRAMP.28
• Third-party risk and security ratingsAssessment and monitoring of suppliers' security, including questionnaires and outside-in security ratings.39
• Cyber risk quantificationModels that express cyber risk in financial terms for boards, insurers and investment decisions.6

Products that train people and measure and reduce the risk that comes from human behaviour.

• Security awareness trainingTraining content and phishing simulations that teach employees to recognise and report attacks.25
• Human risk managementPlatforms that combine behaviour data from security tools to measure each person's risk and intervene in real time.15
• Insider risk managementMonitoring of user activity to detect data theft, sabotage or policy violations by trusted insiders.11

Products that confirm people are who they claim to be and detect fraud and automated abuse.

• Identity verificationDocument, biometric and data checks that verify a person's identity at onboarding or account recovery.19
• Fraud preventionRisk scoring of transactions, accounts and sessions to detect payment fraud, account takeover and scams.26
• Bot and abuse managementDetection and blocking of automated traffic such as scrapers, credential stuffing and fake account creation.11

Products that secure the web browser as the place where work and data access happen.

• Enterprise browsersBrowsers built for organizations, with security and management controls inside the browser itself.2
• Browser protection extensionsExtensions and agents that add threat, data and policy controls to existing consumer browsers.4
• Remote browser isolationServices that run web content away from the user's device and send only a safe rendering.5

Products that secure AI models, applications and agents, and govern how an organization uses AI.

• AI model and agent securityScanning, red-teaming and runtime monitoring of models, AI applications and autonomous agents for attacks and unsafe behaviour.65
• AI firewalls and guardrailsInline filters that inspect prompts, responses and tool calls of AI applications an organization builds.20
• Workforce AI usage securityDiscovery and control of employees' use of third-party AI tools, including data sent to them.28
• AI governanceInventory, policy, risk assessment and regulatory compliance tracking for AI systems.36

Products that preserve data and systems so an organization can recover after an attack.

• Backup and cyber recoveryBackup, immutable storage and recovery of data and workloads, including recovery after ransomware.15
• Directory backup and recoveryBackup and forest recovery for directory services such as Active Directory and Entra ID.4

Firms that sell security expertise and operations as a service rather than as software.

• Managed security service providersProviders that run security technology for customers, such as firewalls, identity or monitoring, under a managed contract.37 · guide
• Security consulting and advisoryAssessment, architecture, programme and compliance advisory services, excluding incident response and penetration testing.56
• Penetration testing and red team servicesHuman-led testing engagements in which consultants attack an organization's systems to find weaknesses.47
• Security resellers and integratorsFirms that select, resell, deploy and integrate other vendors' security products.11