Application security that survives contact with production

runtime protection, static analysis and access control

Security tooling has a adoption problem that is different from other categories: a tool that produces too many findings gets ignored, and a tool that produces too few gets distrusted. The useful tools are the ones that fit into the workflow closely enough that findings get acted on rather than triaged into a backlog.

This site profiles runtime protection, static analysis, dependency scanning and access control, with attention to the operational cost of each. An agent that instruments production has a latency budget. A scanner that runs on every commit has a false-positive budget. Exceed either and the tool stops being used regardless of how good its detection is.

Each profile covers what the product does, how pricing scales, where the approach breaks down, and what switching costs. Where a vendor's compliance claims are narrower than they appear, that is noted — a sourcing basis is not the same as a lawful basis for your own use.

Profiles

• 1Password secrets management

  secrets that never leave the client, plus a CLI for CI

• Cloudflare Zero Trust access control

  identity-aware access instead of a VPN

• CrowdSec collaborative defence

  collaborative blocking, and the false positives that come with it

• CrowdStrike endpoint security

  endpoint detection with the analysis in the cloud

• Datadog ASM runtime protection
• Falco runtime security

  syscall rules for containers, and the tuning they need

• Okta identity

  identity for workforce and customers, priced per head

• Semgrep static analysis
• Snyk dependency scanning
• Tailscale network access
• Teleport infrastructure access
• Tetragon runtime security

  eBPF tracing that can also enforce

• Vault secrets management
• Wiz cloud security

  an agentless graph of everything running in your cloud