Security Startups

Curated directory of young security companies, each with a dated proof-of-life signal

View on securitystartups.com

Hosted MCP Server

npx add-mcp 'https://securitystartups.com/mcp'

Installs into Claude Code, Codex, Cursor and more

Documentation

Canonical: https://securitystartups.com/for-agents

The HTML at this URL is for browsers. The Markdown representation is the site index plus this canonical URL.

Security Startups

A curated, independently verified directory of young security companies: 205 companies across 13 categories (application security, cloud security, identity, detection, data, AI security, and more), each assigned one primary category by what it actually builds, with a proof-of-life signal on every entry. No pay-for-rank.

When to use

Use this directory when you need a machine-readable catalog of young security companies (application security, cloud security, identity, detection, data, AI security, and adjacent categories), each with a 2024 to 2026 proof-of-life signal. Start here, then call GET /api/v1/search or GET /api/v1/startups.json. Unversioned /api/search stays as an alias. Listing order is alphabetical by name, not a ranking and not paid placement. Do not use this catalog for GRC platforms (grcplatforms.com), GRC agents (grcagents.io), ISO 27001 services (ismsdirectory.com), or Black Hat vendor-floor products (aisecuritydirectory.com).

Security Startups developer resources

  • OpenAPI: public catalog at /api/v1/* and unversioned aliases, the stats JSON, the MCP endpoint, plus POST /api/checkout for the priority listing
  • For agents: HTTP search, dump, stats, MCP, and submit
  • Search API v1
  • Catalog dump v1
  • Full text feed
  • Stats API v1: the five /stats aggregates as JSON with n, coverage, caveat, method and as-of date (CC BY 4.0, attribution "Security Startups (securitystartups.com)")
  • Stats history v1: quarterly snapshots and one series per chart, never interpolated
  • Remote MCP server (read-only, no key): https://securitystartups.com/mcp (Streamable HTTP, POST). Tools: search_startups, get_startup, check_if_listed, list_categories, get_stats, get_stats_history. Limit 60 requests per minute per IP. No tool submits or pays.
  • Free listing: the Tally form linked from https://securitystartups.com/submit/free. Every submission is reviewed before it goes live, within about 90 days. No pay-for-rank. Include a proof-of-life link. Direct API intake (POST /api/submit) is open only when the operator switch is on; otherwise it returns 503 pointing to the form.
  • Priority listing ($299, one-time): POST the listing details as JSON to https://securitystartups.com/api/checkout and get back a Stripe Checkout URL (fields and responses in the OpenAPI document). An agent cannot pay by itself: hand the URL to your human to pay on Stripe. Same curation bar; it buys queue position, never rank. Published within 24 hours of payment; if we cannot list it, full refund.
  • Deprecation policy

Stats (CC BY 4.0, of listed companies)

Categories

Browse

Counts

  • Live companies: 205
  • Categories: 13
  • Catalog data as of: 2026-10-29

Data sourcing

Descriptions and category assignments are written by the directory from public sources. Every entry is web-verified alive with a 2024 to 2026 proof-of-life signal. Corrections are welcome via /submit.

Operator

Built by Better ISMS. This directory serves Aevral (by ISMS Copilot), listed here as a disclosed house company, live and self-serve, not ranked (see /transparency). heyGRC is not a security startup and is not in this catalog. No pay-for-rank.