software-supply-chain
(21)
Defense Unicorns makes software work off the grid
A fighter jet can carry modern software and still be hard to update. Defense Unicorns is building the delivery system for the places the internet cannot follow.
Anaconda made Python easy. Now it sells peace of mind.
The company that helped millions get started with Python found its paying customer in a different room: the enterprise worried about what all that free software might bring through the door.
Flox wants your setup guide to become one command
PostHog had 16 setup steps and 14 caveats. Flox helped replace them with a shared environment - and is betting that the same discipline can travel from a developer’s laptop to an AI agent and into production.
Seal Security fixes the flaw. You keep the software.
A vulnerable dependency can turn a tiny security fix into a sprawling migration. Seal Security sells a way to patch the code you already run, while leaving the grand renovation for another day.
Oligo Security asks which vulnerabilities actually wake up
A library can sit quietly in an application for years. Oligo watches what happens when it starts working - and gives security teams a better reason to interrupt an engineer.
ArmorCode and the Trouble with Finding Everything
Security tools are excellent at finding trouble. ArmorCode has built a business around the awkward next question: who is going to fix it?
Apiiro and the Case of the Missing Context
The scanner found the flaw. The hard part was finding the person, the production path and the reason to act. Apiiro built its business around that missing context.
Exiger Put the Supply Chain Under an X-Ray - Now It Wants to Tell You What Breaks Next
The company began by helping banks survive regulatory scrutiny. A decade, several acquisitions and one decisive divestiture later, it is selling a more ambitious promise: see every hidden dependency before it becomes an expensive surprise.
HeroDevs Sells Enterprises the One Thing a Rushed Rewrite Can’t: More Time
When open-source support expires but the application still runs the business, HeroDevs patches the old code in place. The bet is simple: a clean security scan today is worth more than a panicked rewrite tomorrow.
Black Duck Came Back From a $2.1 Billion Detour - Now It Wants to Police the AI Code Rush
The open source scanner sold for $565 million, disappeared inside Synopsys, then returned as the name of a $2.1 billion security business. Its next test is harder: checking code that machines can write faster than humans can review.
Checkmarx Built the Scanner. Now It Wants to Kill the Security Backlog.
The 20-year-old AppSec company made its name finding vulnerable code. Its harder second act is making the findings useful before AI-assisted development turns every security queue into a landfill.
Buildkite Put the Cloud in Charge - Then Refused to Put Your Code There
The Australian developer-tools company won demanding engineering teams with a split-the-stack model: Buildkite coordinates the work, while customers choose where it runs. Now it is trying to turn that architectural compromise into a broader software-delivery platform.
Root Raised $37.6 Million to Shrink Containers - Then Found the Bigger Business Was Fixing Them
The Boston startup began by trimming Docker images. Its sharper insight was that security teams did not need another list of vulnerabilities - they needed tested fixes that could arrive without an upgrade, a rebuild marathon or a ruined sprint.
Cloudsmith
Cloudsmith is a Belfast-founded, cloud-native artifact management platform that gives engineering teams a single place to store, secure, and distribute software packages and containers across 30+ formats. It acts as a private, fully managed registry with built-in supply chain controls - vulnerability and malware scanning, policy enforcement, quarantine, and global distribution - increasingly positioned around governing the flood of code produced by AI coding agents.
FOSSA
FOSSA is a San Francisco software company that helps engineering, security, and legal teams manage the open source code inside their software. Its platform automates software composition analysis (SCA), open source license compliance, vulnerability management, and Software Bill of Materials (SBOM) generation - scanning packages, containers, binaries, and code snippets on a continuous basis. Founded in 2015 and used by companies such as Uber, Zendesk, Twitter, Verizon, and UiPath, FOSSA aims to let teams ship fast without sacrificing compliance or security.
BlueFlag Security
BlueFlag Security is a Sunnyvale, California cybersecurity company building an identity-centric security and governance platform for the software development lifecycle (SDLC). Rather than scanning code for vulnerabilities, BlueFlag watches the identities and tools behind the code - developers, service accounts, bots, and increasingly the AI coding assistants and autonomous agents that now write, test, and deploy software. Founded in 2024 by former CloudKnox and Symantec operators Raj Mallempati and Ken Schneider, the company applies AI/ML-based 'Identity Intelligence' to detect risky behavior, enforce least privilege, and govern AI agents across CI/CD pipelines. In March 2026 it announced a $28 million Series A and 300% year-over-year revenue growth.
depthfirst
depthfirst is a San Francisco applied AI lab building an AI-native security platform that detects, triages and remediates software vulnerabilities before attackers can exploit them. Its 'General Security Intelligence' uses custom AI agents and purpose-trained security models to read a company's code, business logic and infrastructure, surfacing more true-positive vulnerabilities while cutting false positives and delivering developer-ready fixes. Founded in 2024 by leaders from Databricks, Google DeepMind and Faire, the company raised $120M across Series A and B within a few months of leaving stealth.
Binarly
Binarly is a firmware and software supply chain security company that reads the code no one else looks at - the layer below the operating system. Its AI-powered Transparency Platform analyzes firmware binaries to surface known and unknown vulnerabilities, malicious implants, misconfigurations and cryptographic weaknesses, then builds a genuine software bill of materials by reconstructing dependencies from the binary itself rather than trusting a manifest. Founded in 2021 by veteran reverse engineers Alex Matrosov and Claudiu Teodorescu, the company has disclosed hundreds of high-impact firmware vulnerabilities, including the widely covered PKfail Secure Boot flaw.
JFrog
JFrog is the company behind the universal software supply chain platform anchored by Artifactory, the binary repository that lets engineering teams store, secure, and ship every artifact - packages, containers, and now AI models - from a single source of truth. Founded in Israel in 2008 and headquartered in Sunnyvale, California, JFrog (NASDAQ: FROG) serves thousands of enterprises and crossed $531.8 million in revenue in 2025 while pushing its 'Liquid Software' vision of continuous, secure software flow.
Sonatype
Sonatype is the software supply chain management company behind Nexus Repository and the maintainer of Maven Central, the world's largest repository of open source Java components. Founded in 2008 by core contributors to Apache Maven, it helps developers and enterprises find, manage, and secure the open source code that powers modern software - blocking malicious packages, enforcing policy, and generating software bills of materials (SBOMs) across the development lifecycle.
RapidFort
RapidFort is a Sunnyvale-based software supply chain security company that automatically hardens container images, strips unused components, and ships a library of curated near-zero-CVE images so engineering teams can ship secure software without rewriting it.