September 2026 added 45 listings to the directory, against 27 in August 2026, taking the running total to 262. The month is busier than the one before it, and the additions gather in two places: AI agent security and OSINT work.
AI agent security is the largest group, with Zenity, Lakera, Noma Security, Lasso Security, Pillar Security, Straiker, HiddenLayer, Prompt Security, HOL Guard and Harden. OSINT Tools follows, covering Maltego, Intelligence X, SpiderFoot, Sherlock, Maigret, WhatsMyName, OSINTLeak, SearchWebCode and OSINT Industries. Wire Transfer Verification brings 6 more, and 4 listings arrived without a category.
The month in numbers
- 45 listings added in September 2026, against 27 in August 2026. The directory held 262 tools and companies at the end of the month.
- Categories: 11, led by AI Agent Security (10), OSINT Tools (9), Wire Transfer Verification (6), Email Security (4). 4 listings sit outside any category guide.
- Pricing: 14 free tier plus paid plans, 14 published pricing, 10 not published, 7 open source. 35 of 45 let a buyer see a price or a free tier without asking.
- Deployment: 33 cloud-hosted, 14 with a self-hosted option, 7 open source.
- Founded: of the 32 with a sourced founding year, 8 were founded in 2024 or later; the oldest dates from 1998.
- Most common capabilities (fixed-vocabulary tags, 45 of 45 tagged): ai agent security (11), ai usage governance (9), osint investigation (9), red teaming (9), llm security (8), compliance automation (5).
What was added in September 2026
| Listing | Category | Pricing | What it does |
|---|---|---|---|
| AgentRidge | Uncategorised | Free tier plus paid plans | Local-first desktop app that runs autonomous, authorised pentest missions on macOS and Windows. |
| AISafe Labs | Application Security | Free tier plus paid plans | AI-driven source code audits and web application pentests, delivered as SaaS with a free tier. |
| Article 14 Ready | Cyber Resilience Act Compliance | Free tier plus paid plans | Free browser based compiler for preparing CRA Article 14 early warnings, notifications and final reports. |
| BioCatch | Wire Transfer Verification | Not published | Behavioural biometrics platform that helps banks detect scams, account takeover and mule accounts before money moves. |
| Codename Sonar | Vulnerability Management | Free tier plus paid plans | Web based network and web reconnaissance service for systems you own or are authorised to test. |
| ConformOps | Cyber Resilience Act Compliance | Free tier plus paid plans | Static repository analysis that produces EU Cyber Resilience Act evidence, SBOM inventory and draft technical documentation. |
| CRACI | SBOM Analysis | Published pricing | SBOM generation and Cyber Resilience Act reporting built into the CI build |
| CVETodo | Vulnerability Management | Free tier plus paid plans | Real-time CVE tracking with per-product alerts, CISA KEV status and remediation priority scoring. |
| DMARCSwiss | Email Security | Free tier plus paid plans | Swiss-hosted DMARC report monitoring with sending-source analysis, alerts and DNS record history |
| Eftsure | Wire Transfer Verification | Not published | Checks payee identity and bank details before payments are released, with analyst callbacks for unresolved cases. |
| Fendr | Data Security & Governance | Free tier plus paid plans | Browser-extension DLP that controls pastes and uploads into ChatGPT, Copilot, Claude and other AI tools. |
| Harden | AI Agent Security | Not published | Local guardrail that checks coding-agent tool calls before they run |
| HiddenLayer | AI Agent Security | Published pricing | AI security platform with runtime guardrails, agentic and MCP policy enforcement, red teaming and model scanning. |
| HOL Guard | AI Agent Security | Open source | Open-source local guard that vets an AI coding agent's shell, file, package and MCP actions before they run. |
| Intelligence X | OSINT Tools | Free tier plus paid plans | Search engine for leaks, pastes, stealer logs, darknet and WHOIS data, queried by email, domain, IP and other selectors |
| IronVest | Wire Transfer Verification | Published pricing | Binds a customer's biometric identity to the exact wire or payment details they approve, before funds are sent. |
| Kage DFIR Toolkit | Uncategorised | Open source | Open source Windows incident response triage console with timeline, YARA, enrichment and scoring. |
| Lakera | AI Agent Security | Not published | Check Point-owned runtime guardrails, agent tool governance and AI red teaming for LLM apps and agents. |
| Lasso Security | AI Agent Security | Published pricing | AI security platform with agent discovery, red teaming and runtime guardrails deployed via gateway, API or SDK. |
| Lorikeet Security | Penetration Testing Firms | Published pricing | Security firm pairing an AI pentester whose findings a human countersigns with testing, compliance and MDR services |
| Maigret | OSINT Tools | Open source | Open-source tool that builds a profile from a username across thousands of sites, with HTML and PDF reports |
| makeBIMI | Email Security | Not published | Free converter and validator that turns a logo into the SVG Tiny P/S file BIMI needs, with a DMARC check |
| Maltego | OSINT Tools | Free tier plus paid plans | OSINT and link analysis platform that maps people, organisations and infrastructure on an investigation graph |
| Noma Security | AI Agent Security | Published pricing | Independent platform for agent discovery, MCP and tool access control, runtime detection and red teaming. |
| Notice Labs | Uncategorised | Published pricing | Hosted trust center publishing a software company's security controls, documents and subprocessors |
| OSINT Industries | OSINT Tools | Published pricing | Real-time lookups by email, phone number, username, name or crypto wallet, with linked-account profiles |
| OSINTLeak | OSINT Tools | Free tier plus paid plans | Breach and stealer-log intelligence platform with multi-selector search, monitoring, API and a Python client. |
| PathSolutions TotalView | Uncategorised | Published pricing | Network monitoring and troubleshooting platform with a security operations module for SOAR and device checks |
| PCA Cervus | Product Threat Intelligence Providers, SBOM Analysis | Not published | Device-by-device vulnerability monitoring for embedded products, from supplier SBOMs to patch validation |
| Pillar Security | AI Agent Security | Not published | Platform to discover, red team, guard and govern AI agents, MCP servers and skills, deployable in your VPC. |
| Pindrop | Wire Transfer Verification | Published pricing | Caller authentication, call risk scoring and deepfake voice detection for contact centres and video meetings. |
| Prompt Security | AI Agent Security | Published pricing | SentinelOne-owned AI firewall, shadow AI discovery and agent/MCP scope control, plus open-source fuzzer. |
| SBS CyberSecurity | Penetration Testing Firms | Not published | US cybersecurity consulting, audit and testing firm founded in 2004, focused on community banks and credit unions, with penetration testing plus CMMC Level 1 and 2 readiness work for defense contractors. |
| SearchWebCode | OSINT Tools | Free tier plus paid plans | Search engine for website source code across about 131 million domains, for OSINT and technographics |
| SecLens.ONE | Email Security | Open source | Free, open-source score of a domain's public email security across seven protocols, with the DNS fixes |
| Sherlock | OSINT Tools | Open source | Open-source command-line tool that checks a username across 400+ social networks |
| SpiderFoot | OSINT Tools | Open source | Open-source OSINT automation tool with 200+ modules for threat intelligence and attack surface mapping |
| Straiker | AI Agent Security | Published pricing | Discovery, autonomous red teaming and runtime guardrails for AI agents, coding agents and MCP servers. |
| SurePay | Wire Transfer Verification | Published pricing | Name and account matching for EU Verification of Payee and UK Confirmation of Payee, via API or online portal. |
| Trustpair | Wire Transfer Verification | Not published | Validates supplier bank account ownership and monitors vendor data to stop fraudulent B2B payments before release. |
| VaultDB | Data Security & Governance | Not published | Proprietary Rust database engine with record level encryption, node scoped access and verifiable audit. |
| veriBIMI | Email Security | Published pricing | Swiss-jurisdiction DMARC audit and VMC/CMC certificate brokerage for brands implementing BIMI. |
| VibeCoden't | Application Security | Free tier plus paid plans | Website vulnerability scanner for sites built with AI coding tools, with fix prompts for your AI agent |
| WhatsMyName | OSINT Tools | Open source | Community-maintained list of 700+ sites for username checks, with a free browser tool |
| Zenity | AI Agent Security | Free tier plus paid plans | Independent agent discovery, posture and runtime enforcement for Copilot Studio, Agentforce and coding agents. |
What they have in common
Pricing is the clearest shared thread. 14 listings came with published pricing and 14 with a free tier plus paid plans, 7 are open source and 10 keep pricing unpublished, so 35 of the 45 show a buyer something before a sales conversation. 33 are cloud hosted and 14 offer a self hosted option.
Founding years are known for 32 of the 45, and 8 of those were founded from 2024 onwards, so most of the month is established vendors. The oldest is PathSolutions TotalView, founded in 1998. Among the tags, AI agent security appears 11 times, AI usage governance 9, OSINT investigation 9, red teaming 9, LLM security 8 and compliance automation 5.
How this is counted
Listings are counted by the date they were added to the directory, which is not a launch date: some were founded years earlier and some were listed within weeks of appearing. Every listing cites its sources on its own page, and free listings are placed in the one category guide that genuinely fits, so the category counts reflect editorial placement rather than vendor self-description. Pricing is read from each listing's published pricing: a listing counts as published if a figure or a free tier is visible without contacting sales. Capability tags are assigned from a fixed vocabulary of 60 terms and checked by an editor; the figures above come from the directory database and none are estimated.
All editions
Every month's additions are listed at New cybersecurity tools, month by month. Vendors can submit a tool for a free listing; Featured listings are the paid product.