Software supply chain security vendors

Elite security research firm specializing in source code review, blockchain auditing, and building industry-standard open-source security tools.

AISLE provides AI-native vulnerability management that finds, fixes, and verifies software vulnerabilities.

Aqua Security provides cloud native security covering containers, Kubernetes and serverless workloads from build through runtime.

Black Duck provides application security testing tools for software development.

Checkmarx provides application security testing software that scans code for vulnerabilities.

ConformOps sells software for preparing the technical file required by the EU Cyber Resilience Act.

CVETodo prioritises software vulnerabilities using exploitability, exposure and threat intelligence for security teams.

Software platform for building SBOMs, tracking vulnerabilities and producing ISO 21434 and R155 evidence for vehicle firmware.

Doppler provides a secrets management platform for developers, AI agents, and automated workflows.

Eclypsium provides continuous assurance of critical hardware, firmware, and software across enterprise infrastructure.

Bochum software firm hardening embedded and ECU firmware binaries against reverse engineering and exploitation, with ASIL-D certification.

Endor Labs provides an agentic application security platform for AI-generated and open source code.

Exein provides runtime cybersecurity for firmware and physical AI systems across connected devices.

GitHub is a software development platform where developers, agents, and code come together.

Harness provides an AI-native software delivery platform for DevOps, testing, security, and cost optimization.

Enterprise software maker selling AppScan for static, dynamic and interactive application security testing and software composition analysis, alongside BigFix, Domino and other products.

Jscrambler provides client-side security software that protects code and data in web browsers.

Legit Security provides application security for AI-generated code and software development.

Mend.io provides application security and AI security software for code and AI systems.

NowSecure provides mobile app security and AI governance.

Second Front Systems provides a DevSecOps suite that helps software providers and government agencies build, secure, and deploy software to government and regulated networks.

Sentrint is an automated source-code security scanner sold as a software-as-a-service product.

Sonar provides a platform that verifies code quality and security for developers.

Veracode provides a platform that identifies and fixes security flaws in software.

BlackBerry subsidiary providing cryptographic key management, managed PKI and code signing for vehicle supply chains and in-car networks.

Product security platform for vehicle makers covering TARA, SBOM-based vulnerability management and R155 and ISO 21434 compliance.

Runtime protection agent and binary SBOM scanner for vehicle and device firmware, plus TARA and penetration testing.

Keyfactor provides software for managing machine identities and cryptographic keys.

Semgrep provides a platform for scanning code and dependencies to find security issues.

Snyk provides a security platform that finds and fixes vulnerabilities in code, dependencies, containers, and cloud infrastructure.