Vali Cyber
Vali Cyber’s ZeroLock is a runtime security solution for hypervisors, specifically VMware ESXi and Linux-based hypervisors like Proxmox and OpenShift. It’s the first hypervisor security product digitally signed and certified by VMware, deployed as a VIB (vSphere Installation Bundle) through vCenter like a standard ESXi update.
Horizon3
Horizon3’s NodeZero is an AI-driven autonomous penetration testing platform. Point it at an environment with zero prior knowledge or an assume-breached shell and it conducts recon, enumerates services, chains together vulnerabilities across multiple hosts, and demonstrates actual impact: domain admin, sensitive data exposure, cloud token theft.
Sandfly Security
Agentless Linux EDR that scans endpoints remotely over SSH rather than installing persistent agents. Deploys a temporary scanning binary on each host, runs detection modules, collects results, and cleans up, covering everything from rootkit detection to SSH credential auditing across x86, ARM, MIPS, and PowerPC architectures.
GreyNoise
GreyNoise runs a global network of honeypots that observe mass scanning and exploitation traffic across the internet. It tells defenders whether an IP hitting their network is part of widespread automated activity or something targeted, cutting alert noise in SOCs and providing early warning on vulnerability exploitation.
Permiso
Permiso is a cloud identity security platform that combines identity (who has what access provisioned) and activity (what those identities are actually doing at runtime). It builds an entity graph and an activity graph across IDPs, cloud infrastructure, and SaaS environments, then correlates all activity back to originating identities through session-based analysis rather than event-by-event alerting.
Persona
Persona is an identity verification platform that establishes whether someone is who they claim to be, then maintains that assurance over time through reverification at any point in time. It combines government ID verification, biometric liveness detection, database and watchlist checks, risk signal enrichment, and link analysis into configurable workflows for both customer onboarding and workforce security use cases across 200+ countries.
Socket
An estimated 90-95% of malicious open-source packages never receive a CVE. Registries silently remove them with no advisory and no notification. Socket is a supply chain security platform that clones every major package registry in real time and runs static analysis and LLM-based code inspection on every new package within seconds of publication, catching malware, backdoors, and protestware that traditional SCA tools miss entirely.
Cape
A US mobile carrier built from scratch around privacy and security. No SS7, no data sales, no ID required. IMSI rotation, signaling firewalls, and enterprise SIEM integration for organizations that need to protect workforce mobile communications.
Island
Most enterprise work happens in a browser that was built for consumers. Island is a Chromium-based enterprise browser that replaces it with one where identity-based policy, inline DLP, session recording, and last-mile data controls are native. Because the browser sits after TLS decryption but before screen rendering, it can enforce policy at the presentation layer without touching the applications themselves.
Corelight
Purpose-built hardware that runs Zeek sensors at massive line rates, from 2 to 200 Gbps. Corelight started as a way to operationalize Zeek at scale, then expanded into full NDR with Suricata, YARA, and ML detections on top.