CISO Tribune

Vendor comparison · 2 companies

Anchore vs Snyk

Anchore sells an SBOM-powered solution that enables continuous scanning of applications from cloud-native deployments to legacy on-prem installations for security and compliance issues. Snyk sells the AI Security Platform, which secures the code AI writes, the agents it runs, and the applications it builds. CISO Tribune files both under Software supply chain security and Software composition analysis. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Anchore
  • Snyk
Anchore vs Snyk: Products, Customers and Funding Compared
AnchoreAnchore sells an SBOM-powered solution that enables continuous scanning of applications from cloud-native deployments to legacy on-prem installations for security and compliance issues.anchore.comSnykSnyk sells the AI Security Platform, which secures the code AI writes, the agents it runs, and the applications it builds.snyk.io
What it sells
  • Anchore Enterprise[1][3][4][7][8][10]Anchore sells an SBOM-powered solution that enables continuous scanning of applications from cloud-native deployments to legacy on-prem installations for security and compliance issues.
  • Anchore SBOM[8]Anchore SBOM covers software components in both internally developed and third-party supplied software.
  • Anchore Enforce[8]Compliance checks run as part of the Anchore Enforce module.
  • Syft[7]Syft is an open source command line tool produced by Anchore that generates an SBOM from a filesystem such as a Git repo or a container image.
  • Grype[7]Grype is an open source command line tool produced by Anchore that takes a single SBOM and generates a list of vulnerabilities.
  • Container Image[7][12]A set of container images that can be installed via Helm on Kubernetes compatible platforms.
  • Snyk Code[12][14][19]Snyk Code provides SAST scanning.
  • Snyk Container[12][13]Container and Kubernetes security solutions for developers and DevOps.
  • Snyk Agent Fix[14]Snyk Agent Fix is an AI-driven tool that automatically fixes code vulnerabilities.
  • Snyk Studio[19]Snyk Studio is a solution for securing the AI-driven development lifecycle.
  • DeepCode AI[20]DeepCode AI powers the Snyk AI Security Platform.
  • Agentic AppSec[12][25]Security agents that find, fix, and verify vulnerabilities continuously.
  • AI-SPM[1][12][18][24]AI Security Posture Management for the AI assets in code.
Categories
Headquarters
Not stated on its pagesBoston, United States[2]
Founded
Not stated on its pages2015[2][17]
Ownership and funding
Privately held[3]Not stated on its pagesSeries G (USD 196.5 million round), December 13, 2022[3]
Named customers
Not stated on its pages
Recent news
Not stated on its pages
  • October 15, 2026Snyk announced Evo Agentic AppSec, a team of AI security agents that finds, fixes and blocks vulnerabilities in code.[25]
  • September 17, 2026Snyk said Evo by Snyk now accounts for 60% of its new deal volume and drove a 30% increase in average contract value.[26]
  • September 17, 2026Snyk said its Evo product line accounts for 60% of its new deal volume and has lifted average contract value by 30%.[9]
  • August 4, 2026Snyk made Evo Continuous Offensive Security generally available, offering automated AI pentesting and agent red teaming that runs continuously against applications.[10]
  • June 23, 2026Snyk released Evo Agentic Development Security, which governs the tools AI coding agents use, what they do, and the code they generate.[11]
G2 and Gartner Peer Insights
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, Anchore addresses organisations that release software products or host them as SaaS. Its home page copy also covers cloud-native and legacy applications across the development lifecycle. The site has a Public Sector section that lists Anchore Federal and DoD Software Factory. Its documentation includes a quickstart named Achieve Federal ATO. The site also lists EU CRA Compliance.Snyk speaks to organizations building with AI, and to security teams that lack an inventory of the models, workflows, or agents running in production. Snyk describes its SAST tool as built by and for developers. Snyk's platform integrates with IDEs, CI/CD pipelines, and AI coding assistants, which points to teams that work in those tools.
Last verified
October 16, 2026October 10, 2026

Where they overlap

  • Anchore and Snyk are both filed under Software supply chain security and Software composition analysis.

Where they differ, field by field

  • Anchore's primary category is Software supply chain security; Snyk's is Software composition analysis.
  • Anchore is also filed under Compliance automation and Vulnerability management. Snyk is also filed under Static application security testing and Secrets detection.
  • Anchore lists Anchore Enterprise, Anchore SBOM, Anchore Enforce, Syft, Grype and 1 more. Snyk lists Snyk Code, Snyk Container, Snyk Agent Fix, Snyk Studio, DeepCode AI and 2 more.
  • Snyk is headquartered in Boston, United States.
  • Snyk was founded in 2015.
  • Anchore is privately held.
  • Snyk's latest recorded funding is Series G (USD 196.5 million round), dated December 13, 2022.
  • Snyk publicly names MongoDB, Skyscanner, Auth0, DFDS and Helvetia.

What it sells: Anchore

What Anchore Enterprise does[1][3][4][7][8][10]
Anchore Enterprise generates SBOMs for containers as part of CI/CD, registry, or runtime scanning. Anchore SBOM is included in all Anchore Enterprise subscriptions. Anchore Enterprise provides NIST compliance tools to automate various standards and controls, including NIST 800-171, NIST 800-53, NIST 800-190, and NIST 800-218 Secure Software Development Framework.
What Anchore SBOM does[8]
Anchore allows users to upload SBOMs generated by non-Anchore tools, representing codebases under their control as well as third-party SBOMs provided by partners, contractors, and upstream suppliers. The Anchore Score is a computed composite security index that provides a numeric value for each vulnerability in the system.
What Anchore Enforce does[8]
Anchore Enterprise includes policy packs covering FedRAMP v5, NIST 800-53, 800-190, DISA, and Docker CIS. An Anchore Enterprise deployment allows users to comply with the NIST 800-218 attestation requirements. All Anchore policy rules are stored in a simple JSON format that can be edited by a human or managed programmatically via Git.

What it sells: Snyk

What Snyk Code does[12][14][19]
Snyk Code provides SAST scanning. Snyk's vulnerability scanner is compatible with most popular languages, IDEs, and CI/CD tools. Snyk maintains a database of over 35,000 real-world vulnerabilities and fixes written by Snyk security experts. The Snyk Agent delivers AI-generated fixes for Snyk Code issues directly within a pull request.
What Snyk Container does[12][13]
Snyk Container lets developers know the risks in each image and provides one-click upgrades and alternative image recommendations. Snyk Container has priority scoring based on risk signals such as exploit maturity and insecure workload configs. Snyk Container monitors images for newly discovered vulnerabilities and base image updates and sends alerts via Slack, Jira, email, or custom integration. Snyk Container is available to bundle with Snyk Open Source.
What Snyk Agent Fix does[14]
Snyk Agent Fix is an AI-driven tool that automatically fixes code vulnerabilities. Snyk Agent Fix uses an agentic architecture for AI-powered code fixes. Snyk Agent Fix provides automatic remediation for issues found by Snyk Code's SAST scanning.
What Snyk Studio does[19]
Snyk Studio is a solution for securing the AI-driven development lifecycle. Snyk Studio is used to prevent new AI-generated vulnerabilities and clear existing security debt. Snyk offers delta findings, a view focused on vulnerabilities introduced only in new code.
What DeepCode AI does[20]
DeepCode AI powers the Snyk AI Security Platform and uses frontier AI models fine-tuned with security-specific context. Snyk's DeepCode AI code analyzer was designed to find, autofix, and prioritize vulnerabilities, and manage tech debt. DeepCode AI supports Snyk's context-aware risk scoring, which assesses the popularity of the affected package and the reachability of vulnerable code.
What Agentic AppSec does[12][25]
Snyk's Agentic AppSec uses security agents to find, fix, and verify vulnerabilities continuously. Humans set the bar in Snyk's Agentic AppSec.
What AI-SPM does[1][12][18][24]
AI Security Posture Management (AI-SPM) gives visibility, governance, and security oversight of the AI assets in code. AI-SPM maps assets, scores their risk, and helps enforce governance. AI-SPM scans the repositories that are imported after Evo is enabled.

Questions about Anchore and Snyk

What do Anchore and Snyk sell?
Anchore sells Anchore Enterprise, Anchore SBOM, Anchore Enforce, Syft, Grype and 1 more. Snyk sells Snyk Code, Snyk Container, Snyk Agent Fix, Snyk Studio, DeepCode AI and 2 more.
Are Anchore and Snyk in the same category?
They share Software supply chain security and Software composition analysis. Anchore's primary category is Software supply chain security and Snyk's is Software composition analysis.
Where are Anchore and Snyk headquartered?
Snyk is headquartered in Boston, United States.
When were Anchore and Snyk founded?
Snyk was founded in 2015.
Who owns Anchore and Snyk?
Anchore is privately held. Snyk's latest recorded funding is Series G (USD 196.5 million round), dated December 13, 2022.
Which customers do Anchore and Snyk name?
Snyk publicly names MongoDB, Skyscanner, Auth0, DFDS and Helvetia.
Who are Anchore and Snyk sold to?
From its own pages, Anchore addresses organisations that release software products or host them as SaaS. Snyk speaks to organizations building with AI, and to security teams that lack an inventory of the models, workflows, or agents running in production.
What have Anchore and Snyk announced recently?
October 15, 2026: Snyk announced Evo Agentic AppSec, a team of AI security agents that finds, fixes and blocks vulnerabilities in code.

About Anchore

Anchore sells an SBOM-powered solution that enables continuous scanning of applications from cloud-native deployments to legacy on-prem installations for security and compliance issues. Anchore is headquartered in Santa Barbara, California, and its team works from across the United States and Europe. Saïd Ziouani and Daniel Nurmi opened Anchore in 2016. Anchore Enterprise is a solution for organizations with DevSecOps or compliance programs for software delivered in containers.[1][4][5][7]

Anchore SBOM covers software components in both internally developed and third-party supplied software. Anchore SBOM is included in all Anchore Enterprise subscriptions. Anchore Enterprise generates SBOMs for containers as part of CI/CD, registry, or runtime scanning. Anchore allows users to upload SBOMs generated by non-Anchore tools, representing codebases under their control as well as third-party SBOMs provided by partners, contractors, and upstream suppliers.[8]

The Anchore Score is a computed composite security index that provides a numeric value for each vulnerability in the system. The Anchore Score is derived from a combination of the CVSS score, vulnerability severity, EPSS percentile, and KEV status.[8]

Anchore Enterprise scans container images, generates an SBOM, identifies vulnerabilities and other security problems, and enables users to prioritize and remediate issues. By storing the SBOMs generated from a pipeline, Anchore can send alerts when a new vulnerability is announced without needing to rescan the original software. Anchore integrates at every stage of the software development process from source code to build to runtime. Anchore automatically generates and analyzes software bills of materials at each step of the software development lifecycle.[7][8][9]

Syft is an open source command line tool produced by Anchore that generates an SBOM from a filesystem such as a Git repo or a container image. Anchore Enterprise embeds Syft into its integrations and backend so it can generate the SBOMs for all artifacts in CI pipelines, registries, or runtime images. Grype is an open source command line tool produced by Anchore that takes a single SBOM and generates a list of vulnerabilities.[7]

Anchore says companies that sell software to governments or regulated industries need software security programs. Anchore Enterprise provides NIST compliance tools to automate various standards and controls, including NIST 800-171, NIST 800-53, NIST 800-190, and NIST 800-218 Secure Software Development Framework. Anchore Enterprise includes policy packs covering FedRAMP v5, NIST 800-53, 800-190, DISA, and Docker CIS. Compliance checks run as part of the Anchore Enforce module. All Anchore policy rules are stored in a simple JSON format that can be edited by a human or managed programmatically via Git.[1][8][10]

Anchore experts help support DevSecOps initiatives at the Department of Defense, U.S. Air Force, U.S. Space Force, U.S. Navy, DISA, and GSA. Pre-built policy packs automate compliance checks for United States government standards, including DoD, DISA STIG, FedRAMP, NIST, and CIS Benchmarks. Email, Slack, Jira, and GitHub can be used to notify developers and security teams of policy violations, secrets, and malware.[11]

Anchore can be deployed in an air-gapped environment for use in classified or restricted access environments. Anchore can be deployed on-premise with no internet connection to run in DoD IL-6 environments. Anchore offers a set of container images that can be installed via Helm on Kubernetes compatible platforms. Every feature and operation in Anchore can be instrumented using an API call.[1][2][4][5][7][10][11][12]

Anchore on the record

Sources

Anchore full record

  1. [1]anchore.comAnchore · anchore.com · undated page, accessed October 16, 2026 · Tier A
  2. [2]Anchore continues remarkable growth and business momentumAnchore · anchore.com · published January 14, 2021 · Tier A
  3. [3]SBOM-Powered Software Composition Analysis • AnchoreAnchore · undated page, accessed November 2, 2026 · Tier A
  4. [4]Compliance Management via Policy Enforcement | Anchore Enterprise Product DocumentationAnchore · undated page, accessed November 2, 2026 · Tier A
  5. [5]Software Supply Chain Management Platform | Anchore EnterpriseAnchore · undated page, accessed November 10, 2026 · Tier A
  6. [6]About AnchoreAnchore · undated page, accessed November 10, 2026 · Tier A
  7. [7]Anchore Secure: Container Security SolutionsAnchore · undated page, accessed November 10, 2026 · Tier A
  8. [8]Anchore SBOM: Enterprise SBOM Analysis & ComplianceAnchore · undated page, accessed November 10, 2026 · Tier A
  9. [9]Software Supply Chain Security Tools for Modern DevSecOpsAnchore · undated page, accessed November 10, 2026 · Tier A
  10. [10]Anchore Enforce: Compliance Automation & Continuous MonitoringAnchore · undated page, accessed November 10, 2026 · Tier A
  11. [11]Software supply chain security for the public sector | AnchoreAnchore · undated page, accessed November 10, 2026 · Tier A
  12. [12]Anchore Pricing for Enterprise and Public SectorAnchore · undated page, accessed November 10, 2026 · Tier A

Snyk full record

  1. [1]PlatformSnyk · snyk.io · undated page, accessed September 27, 2026 · Tier A
  2. [2]AboutSnyk · snyk.io · undated page, accessed September 27, 2026 · Tier A
  3. [3]Snyk closes 196 5 million series g funding at 7 4 billion valuationSnyk · snyk.io · published December 13, 2022 · Tier A
  4. [4]MongodbSnyk · snyk.io · undated page, accessed October 10, 2026 · Tier A
  5. [5]SkyscannerSnyk · snyk.io · undated page, accessed October 10, 2026 · Tier A
  6. [6]Auth0Snyk · snyk.io · undated page, accessed October 10, 2026 · Tier A
  7. [7]snyk.ioSnyk · snyk.io · undated page, accessed October 10, 2026 · Tier A
  8. [8]HelvetiaSnyk · snyk.io · undated page, accessed October 10, 2026 · Tier A
  9. [9]Agentic ai security moves into productionSnyk · snyk.io · published September 17, 2026 · Tier A
  10. [10]Snyk launches evo continuous offensive securitySnyk · snyk.io · published August 4, 2026 · Tier A
  11. [11]Snyk launches evo agentic development securitySnyk · snyk.io · published June 23, 2026 · Tier A
  12. [12]Snyk AI Security Platform | Secure Code, Agents & Apps | SnykSnyk · undated page, accessed October 28, 2026 · Tier A
  13. [13]Container vulnerability management | Container Security Tools | Kubernetes Security Solutions | SnykSnyk · undated page, accessed October 28, 2026 · Tier A
  14. [14]Snyk Code | SAST Code Scanning Tool | Code Security Analysis & Fixes | SnykSnyk · undated page, accessed October 28, 2026 · Tier A
  15. [15]Secure Coding with IDE Plugins | IDE Security Plugins | SnykSnyk · undated page, accessed October 28, 2026 · Tier A
  16. [16]Customer Case Studies | SnykSnyk · undated page, accessed October 28, 2026 · Tier A
  17. [17]Board | About us | SnykSnyk · undated page, accessed November 10, 2026 · Tier A
  18. [18]AI-SPM | Agent security | Snyk User DocsSnyk User Docs · undated page, accessed November 10, 2026 · Tier A
  19. [19]Snyk | Customer Product UpdatesSnyk · undated page, accessed November 10, 2026 · Tier A
  20. [20]DeepCode AI | AI Code Review | AI Security for SAST | Snyk AI | SnykSnyk · undated page, accessed November 10, 2026 · Tier A
  21. [21]How to Detect Tool Poisoning in MCP Server Security | Snyk LabsSnyk Labs · published August 19, 2025 · Tier A
  22. [22]Snyk StatusSnyk · undated page, accessed November 10, 2026 · Tier A
  23. [23]Snyk Unveils Evo Continuous Offensive Security to Bring AI-Native Pentesting to the Enterprise | SnykSnyk · published May 27, 2026 · Tier A
  24. [24]Snyk Launches Agent Security Solution to Protect the Full AI Lifecycle; Announces General Availability of Evo AI-SPM | SnykSnyk · published March 23, 2026 · Tier A
  25. [25]Snyk Launches Evo Agentic AppSec, Redefining Traditional AppSec With a Team of Security Agents | SnykSnyk · published October 15, 2026 · Tier A
  26. [26]As AI Risk Scales and Vulnerabilities Compound, Evo by Snyk Reaches 60% of New Deal Volume | SnykSnyk · published September 17, 2026 · Tier A

Spot a factual error? Request a correction.