Cybersecurity pitches can blur together access controls, threat detection, and artificial intelligence (AI). This selective company/startup landscape connects products to likely buyers and questions worth investigating. At Angel Squad, our angel-investing community, we teach investing frameworks and learn alongside peers.
Evidence snapshot: October 19, 2026. The 22 examples span 11 categories. This is an educational landscape, not a ranking, live attack map, spending forecast, procurement endorsement, or investment offer.
Start with the asset or workflow being protected. Then separate three jobs a product might do: discover a problem, enforce a control, or investigate and respond. A product can do several jobs, but discovering an exposed asset doesn't establish that it can block an attack or repair the exposure.
The user, budget owner, and person approving deployment may also differ. A developer might use a code scanner while an application-security leader owns the budget. An industrial security team might identify a weakness while an operations manager controls whether production equipment can change.
Likely buyers below are our inferences, not verified purchasing committees. Product summaries describe vendor-stated functions, not independently tested security performance. A false positive means legitimate activity was incorrectly flagged as risky.
All 22 linked product pages had no visible publication date when read on October 19, 2026. The dated acquisition announcements document the specific events described. Ownership has not been comprehensively certified for this sample.
Identity controls govern who or what can reach a system and which actions they can take. Human users, service accounts used by software, and automated agents create different access problems. Privileged access includes permissions to administer systems. Likely buyers include identity-security teams and infrastructure engineers.
The Opal access platform governs access requests, permissions, reviews, and time-limited privileges across people, service accounts, applications, infrastructure, and AI agents. Its scope overlaps privileged access, non-human identities, and access reviews.
The Teleport identity platform provides passwordless, short-lived infrastructure access, machine identities, and identity-governance functions. Infrastructure and platform-engineering teams are relevant buyers alongside security teams.
Cloud security covers settings, permissions, vulnerabilities, and workloads, the applications running in cloud infrastructure. Runtime protection examines activity while those applications execute. Likely buyers include cloud-security teams, developer-security teams, and security leaders.
The Orca cloud platform combines assessment of cloud configurations and vulnerabilities with workload protection, code security, and cloud detection and response. It also reaches into data exposure, identity permissions, and security operations.
Sysdig Secure uses runtime telemetry, signals recorded from running systems, for workload protection and detection and response. It also uses those signals to prioritize configuration, permission, and vulnerability risks. Adjacent functions include protecting containerized applications and assessing data-security settings and exposure.
Application security addresses code and the process of building software. Software supply-chain security also examines external packages and dependencies that developers bring into a product. Likely buyers are application-security and engineering-platform teams working with developers.
Semgrep's application security (AppSec) product, the Semgrep AppSec Platform, scans code, open-source dependencies, and secrets such as embedded credentials. Findings and assisted remediation sit within developer workflows. Its scope overlaps dependency risk and cloud code security.
Socket for GitHub reviews dependency changes in proposed code updates and flags vulnerable or malicious packages. Other Socket products address blocking at installation and package research; these functions shouldn't be assumed to be identical across products.
Data-security products find sensitive information, classify it, map who can access it, and help reduce exposure or leakage. Likely buyers include data- and cloud-security leaders, with privacy, identity, and AI stakeholders involved.
The Cyera security platform discovers and classifies sensitive data, relates it to identities and access paths, and offers data-loss and AI-agent security controls. Its scope crosses data, identity, cloud, and AI security.
The Sentra data platform discovers and classifies data, maps access, and provides data hygiene, leakage prevention, and remediation functions in the customer's environment. Adjacent functions include AI data governance and data-access controls.
Security operations teams investigate alerts, connect evidence, and coordinate response. Investigating a signal and authorizing an action are separate responsibilities. Likely buyers include security operations, detection-engineering, and automation teams.
Panther's security operations center (SOC) product, the Panther AI SOC Agent, queries security data and connected tools to investigate alerts. It shows reasoning and proposes reviewable detection changes. Its functions overlap alert triage, data analysis, and detection engineering.
The Tines security platform connects tools so teams can build agents, applications, and response automations with audit trails and human-controlled autonomy. Its scope includes alert enrichment, case management, response coordination, and broader business workflows.
Asset discovery inventories systems a customer has. Exposure assessment identifies weaknesses. Penetration testing attempts to demonstrate exploitable paths. These functions answer different questions, even when sold within the same broad category.
Likely buyers include asset-management, vulnerability-management, security-validation, and penetration-testing teams.
The NodeZero testing platform runs autonomous penetration tests, chains discovered weaknesses into attack paths, prioritizes fixes, and retests remediation. Its scope overlaps exposure prioritization and security-control validation.
The runZero exposure platform combines active scanning, passive discovery, and integrations to inventory assets and prioritize exposures across business technology and operational environments. Discovery alone is distinct from penetration testing.
Email-security products address deceptive messages, account compromise, and the work of investigating reported mail. Likely buyers include email administrators, security analysts, detection engineers, and security operations teams.
Abnormal Email Security models people and vendor behavior to detect deceptive email, account takeover, and other message threats. It includes response and reported-mail triage, with overlap into social engineering, vendor impersonation, and email data loss.
The Sublime email platform provides adaptive message detections, threat hunting, campaign grouping, and remediation. Agents support triage and detection engineering. Its scope includes phishing and business email compromise, including impersonation intended to trick employees into sending money or information.
This category protects AI models, applications, agents, and their actions. A security product that uses AI to analyze email or alerts belongs in its underlying workflow category unless it also protects AI systems.
Likely buyers include AI-security, model-security, platform, application, and governance teams.
The HiddenLayer security platform offers AI asset discovery, supply-chain assessment, adversarial attack simulation, and runtime protection for models, applications, and agents. Model security and agent security can require different integrations.
The Noma security platform discovers AI models and agents, applies action and access policies, detects risky runtime behavior, and tests applications with adversarial campaigns. Its functions cross AI configuration risk, runtime protection, access governance, and supply-chain security.
Operational technology (OT) controls or monitors physical processes. Cyber-physical security also covers connected equipment. Safety, production uptime, and the constraints of older devices affect deployment and remediation.
Likely buyers include industrial-security and critical-infrastructure teams working with operations leaders.
The Claroty security platform combines asset discovery, exposure assessment, network protection, secure access, and threat detection across cloud and on-premises products. Its functions overlap asset exposure, networking, and security operations.
The Nozomi security platform includes Guardian, Arc, Guardian Air, and Vantage. Network, endpoint, and wireless sensors work with management tools for industrial and connected-device visibility, exposure assessment, and threat detection and response.
These products control connectivity, access sessions, or work performed in a browser. They are adjacent product layers with different deployment requirements. Likely buyers include enterprise networking, technology, and security teams, alongside application owners.
Secure access service edge (SASE) joins networking and cloud-delivered security controls in one architecture. The Cato SASE Platform combines enterprise networking, security inspection, and user and application access policies. Cato's scope also reaches data, security operations, and AI security.
The Island Enterprise Browser places application-access policies, device-security checks, data-use controls, and session telemetry in the browser. Its scope overlaps identity and access, data-loss prevention, AI-use controls, and network security.
Endpoints include employee computers and servers. An execution control decides which software may run. Endpoint detection and response (EDR) investigates device threats and supports response. A managed service adds people and operating responsibilities to the software.
Likely buyers include technology and security administrators, lean security teams, and managed service providers that support other organizations.
Huntress Managed EDR pairs endpoint software with a managed, human-led security operations team for investigation, containment, remediation, and guidance. The broader company's adjacent functions include identity protection and security-awareness training.
ThreatLocker Allowlisting uses an endpoint agent and approval workflow to enforce deny-by-default software execution. Allowlisting permits approved applications to run. This is a different control from managed detection and response; adjacent functions include privilege management and network or cloud access.
The category boundaries are editorial groupings, not an industry standard or separate, mutually exclusive markets. Each example has one primary placement. A data-security company can address agent access; a cloud platform can include code scanning; an industrial platform can include asset discovery and network detection.
For a new startup, compare the specific workflow and deployment path. A buyer may use two overlapping products together, buy one instead of the other, or receive part of the function inside an existing platform contract.
Consider a hypothetical startup that finds sensitive files an AI agent can access. Its diligence agenda spans data discovery, identity permissions, and AI-agent controls. The important distinction is whether it reports access, removes access, blocks an action, or feeds another response tool. Each answer changes the integration work and the person responsible for the outcome.
Our startup investment criteria start with evidence about the customer problem and business. A market-map placement adds context; it cannot establish customer demand, product effectiveness, or investment quality.
Use the company questions above alongside these business questions:
We selected two contrasting examples for each of 11 categories. Each needed an accessible first-party product page and a concrete relevant function. The aim is to explain product and buyer differences in a readable sample.
You can learn the business questions without becoming a specialist in every security layer. In our community, you can study investing frameworks and compare reasoning with peers. Apply to Angel Squad to build that practice.
This landscape is educational and is not an investment recommendation. Startup investments are speculative, illiquid, long-term, and can lose their entire value. Most bets in a startup portfolio may fail.
