Security startups to watch for 2022

Security startups are often innovation leaders. These are some of the most interesting ones to watch as they tackle issues around cloud security, asset management and more.

The problems cybersecurity startups attempt to solve are often a bit ahead of the mainstream. They can move faster than most established companies to fill gaps or emerging needs. Startups can often innovative faster because they are unfettered by an installed base.

The downside, of course, is that startups often lack resources and maturity. It’s a risk for a company to commit to a startup’s product or platform, and it requires a different kind of customer/vendor relationship. The rewards, however, can be huge if it gives that company a competitive advantage or reduces stress on security resources.

The vendors below represent some of the most interesting startups (defined here as a company founded or emerging from stealth mode in the past two years).

[Editor's note: This article, originally published February 4, 2022, is periodically updated as new startups emerge.]

Canonic Security

Emerging from stealth this February, Canonic Security offers a third-party SaaS app governance platform that allows organizations to test third-party apps in a sandbox before they are put into a production environment. The Israel-based company claims its platform can identify over-privileging, what the app connects to, and whether it has been compromised. It can also test functionality to determine if it does what the vendor claims.

Cyera

Cyera offers a cloud-native data security platform that can discover data across all cloud instances and datastores to identify which of it is most sensitive. The goal is to help companies assess cloud security risk and better enable remediation efforts. It also offers advice for what actions to take to mitigate risks. Cyera emerged from stealth mode on March 29 and was founded in 2021.

Grip Security

As organizations use more software-as-a-service (SaaS) platforms, security teams can find it hard to monitor and guard against the risks they present. Grip Security’s product promises to provide greater visibility across all SaaS platforms used in an organization. According to the company, this allows for better enforce security policies and identify security blindspots. The Grip platform can work standalone or with a cloud access security broker (CASB).

JupiterOne

The cloud-native JupiterOne cyber asset attack surface management platform promises to bring more context to a range of security processes including vulnerability management, compliance, and identity and access management (IAM). The company also claims that its platform can better enable organizations to comply with security regulations. Enabling this are JupiterOne’s integration capabilities, which allow it to work within the existing security environment.

Laminar

Visibility into data assets across the cloud has been difficult for security teams. Laminar claims its Cloud Data Security Platform provides observability across the entire public cloud, and that it prevents data leakage from "everything that you build and run in the cloud." The agentless product can discover, classify and control data, as well as detect and remediate risks, according to Laminar. The company emerged from stealth mode in November 2021.

Lightspin

Lightspin offers a cloud-native application protection platform (CNAPP) that the company claims can identify, prioritize and remediate attack paths within the cloud stack. The platform will work in any cloud hosting environment including Amazon Web Services (AWS), Azure and Google Cloud Platform (GCP). The Lightspin platform works across all phases of DevOps. For example, it can perform IaC and API scanning during build, identify misconfigurations and exposed secrets during production, and provide malware and runtime protection during runtime.

Noetic Cyber

Noetic Cyber sells what it calls a “continuous cyber asset management and controls platform.” The company claims that this platform can provide greater visibility into the network, improved controls monitoring, and a better understanding of the relationship network entities. On the last point, Noetic’s platform can map relationships among assets to help identify security gaps. Noetic also offers integration with orchestration and automation workflows.

OneLayer

Israeli company OneLayer emerged from stealth mode on March 15. It offers a platform to provide security to LTE/5G cellular networks. The company claims its product can provide visibility into assets connected to the network, automate enforcement of corporate NAC policies, detect and respond to anomalous device behavior or traffic, and "zero trust" authentication while enabling new devices.

Polar Security

Tracking what Polar Security calls “shadow data” across the cloud can be a challenge. The company attempts to meet that challenge with its data security posture management (DSPM) solution, which it claims is the first automated data security and compliance platform. According to Polar Security, its platform will automatically map and follow data and data workflows of cloud-native data to better prevent vulnerabilities and meet regulatory compliance. Once the platform identifies data, an automated labeling feature allows for classifying sensitive data.

Revelstoke

Revelstoke offers what it claims is the first low-code security orchestration, automation and response (SOAR) platform. The company’s aim is to simplify the implementation and management of SOAR. It does so by offering low-code playbooks to automate security processes, pre-built integrations built on a unified data layer, case management though what it calls “guided investigations”, and a dashboard-based user interface.