cspm
(8)
The Cloud Security Company That Actually Fixes the Alerts
Every cloud scanner is great at finding problems. Tamnoon built a business on the boring part nobody wanted: fixing them - and doing it without taking production down.
SubImage
SubImage is a San Francisco security startup building an open-core security graph that maps a company's cloud and SaaS infrastructure so teams can see who can access what, and why. Built by the original team behind Cartography, the open-source graph tool created at Lyft and now a CNCF project, SubImage sells a managed, agentless platform for attack path analysis, asset inventory, and misconfiguration detection. Backed by a $4.2M seed round, it positions itself as an open-core alternative to Wiz.
Aqua Security
Aqua Security is a cloud native security company founded in 2015 that helps enterprises protect containerized and cloud native applications from development to production. Its Aqua Platform is a Cloud Native Application Protection Platform (CNAPP) that combines agent and agentless technology to scan code and images, enforce policies, manage cloud posture, and stop attacks at runtime. Aqua is also the creator of Trivy, the widely adopted open source vulnerability and misconfiguration scanner. Headquartered in Boston and Ramat Gan, Israel, the company protects more than 500 large enterprises and has raised $325M in total funding at a valuation above $1 billion.
Sonrai Security
Sonrai Security is a New York-based enterprise cloud security company that helps large organizations lock down identity and access risk across AWS, Azure, Google Cloud and Kubernetes. Founded in 2017 by the team behind Q1 Labs, Sonrai built its reputation on a graph that maps every relationship between identities, permissions and data in the public cloud. Its flagship Cloud Permissions Firewall enforces least privilege by automatically blocking unused permissions with cloud-native, org-level policies, and its 2025 WALLy AI agent extends that to autonomously fix privilege risk across humans, machines and AI agents.
RAD Security
RAD Security is a San Francisco cloud-native security company that pairs runtime telemetry with agentic AI to help teams detect, investigate, and respond to threats across Kubernetes and cloud environments. Founded in 2021 as KSOC and rebranded RAD Security in 2024, it builds behavioral, eBPF-driven detection and a roster of AI 'RADBots' that triage alerts, generate compliance evidence, and automate security workflows. The company raised a $14M Series A in February 2025, bringing total funding to about $20M.
SecLogic
SecLogic is a Boston-based cybersecurity company building an AI-driven cyber risk orchestration platform for the cloud era. Its two flagship products - CyberQ Shield, an agentless Cloud Native Application Protection Platform (CNAPP) that finds and auto-remediates misconfigurations and vulnerabilities across AWS, Azure, GCP and beyond, and CyberQ ORO, an Organization Risk Orchestration tool that quantifies human risk through multi-vector phishing simulation and awareness training - aim to give security leaders a single pane of glass across both their machines and their people. Founded in 2021 and backed by pre-seed funding, SecLogic operates across the US, Europe and India.
Sachin Johar
Sachin Johar is the Co-Founder and CEO of SecLogic (SecLogic.ai), a Boston-based cloud security company that builds a cyber risk orchestration platform for multi-cloud environments. After roughly two decades inside the enterprise security and networking world - including a long run at Akamai Technologies and earlier strategy roles at Tata Communications and Intellisys - he co-founded SecLogic in late 2020 to attack a problem he watched companies struggle with from the inside: cloud sprawl creating invisible attack paths faster than security teams could close them. SecLogic's products, CyberQ SHIELD and CyberQ ORO, pair cloud security posture management with organization and human risk orchestration. The company raised a $300K pre-seed round in 2021 led by Spanache.vc with India Accelerator.
Upwind Security
Upwind is a runtime-first Cloud Native Application Protection Platform (CNAPP) that unifies cloud and AI security across the full lifecycle. Founded in 2022 by the team behind Spot.io, the company uses eBPF-based runtime telemetry to give security teams real-time context on what's actually exploitable in production - cutting noise, surfacing real threats, and protecting cloud-native and AI workloads at the speed they run.