“The 10 Hottest Cybersecurity Startups of 2025 So Far” refers to the first six months of 2025—not a current 2026 ranking. CRN’s midyear list selected startups that had raised a significant Series A or Series B round since the beginning of 2025 and had launched products in fast-growing segments or made major channel moves. The result is best read as a snapshot of market momentum, not proof that these were the ten best, safest, or most proven vendors.
The companies stood out because they combined fresh funding with urgent problems involving AI, identity, cloud infrastructure, application security, data exposure, ransomware, browsers, segmentation, and the shortage of skilled security professionals.
As an Amazon Associate I earn from qualifying purchases.
What “hottest” means in this list
Funding is an important signal, but it is not a product validation. A large round may reflect investor conviction, founder reputation, market timing, or competitive fundraising conditions. It does not establish technical superiority, customer retention, production scale, low false-positive rates, or financial durability.
Free tools Windows power users keep installed
One-click scans. No signup required.
A more useful evaluation considers:
- Funding momentum: Did the company raise a meaningful round in 2025?
- Problem urgency: Does it address ransomware, cloud risk, identity sprawl, AI risk, software supply-chain risk, or another pressing problem?
- Technical differentiation: Does it have a distinctive data source, runtime view, automation model, or workflow?
- Buyer and channel relevance: Who owns the budget, and can the product work through MSPs, MSSPs, marketplaces, or strategic partners?
- Evidence of traction: Are there production deployments, named customers, integrations, measurable outcomes, or only announcements?
- Commercial maturity: Is the product generally available, in preview, invite-only, or still primarily a fundraising story?
- Incumbent pressure: Could Microsoft, Palo Alto Networks, CrowdStrike, Google, Cisco, or another platform absorb the feature?
CRN’s original midyear list contained Cynomi, Endor Labs, Mimic, Mitiga, Oligo Security, Orchid Security, Sentra, Seraphic Security, SpecterOps, and Zero Networks.
#1 Best Overall
- Standard OATH compliant TOTP token (time based)
- 6-digit OTP code with countdown time bar
- Zero footprint: no need for the end user to install any software
- Secure, sturdy, and long-life hardware design
- Easy to use - Portable key chain design. These tokens will only work with Symantec VIP Access. These tokens will not work for any other Multi-Factor Authentication services, besides Symantec VIP Access.
At a glance
| Startup | Primary category | 2025 signal | Best fit | Main caution |
|---|---|---|---|---|
| Cynomi | Automated vCISO | $37 million Series B | MSPs, MSSPs, SMB-focused providers | May overlap with mature GRC programs |
| Endor Labs | Application and software supply-chain security | $93 million Series B | AppSec and development teams | Crowded competitive market |
| Mimic | Ransomware resilience | $50 million Series A | Organizations focused on containment and recovery | Must complement EDR and backup |
| Mitiga | Cloud and SaaS detection and response | $30 million Series B | Cloud-heavy enterprises and lean SOCs | Potential SIEM, MDR, and CNAPP overlap |
| Oligo Security | Runtime application security | $50 million Series B | Teams needing exploitability context | Telemetry and instrumentation burden |
| Orchid Security | Identity orchestration | $36 million seed round | Enterprises with fragmented identity systems | Automated identity changes can cause outages |
| Sentra | Data security posture management | $50 million Series B | Organizations mapping sensitive and AI-exposed data | Discovery requires ownership and remediation |
| Seraphic Security | Enterprise browser security | $29 million Series A | SaaS-centric and remote-work environments | Browser support and user friction |
| SpecterOps | Identity attack-path management | $75 million Series B | Active Directory and hybrid-identity teams | Commercial and open-source offerings differ |
| Zero Networks | Network microsegmentation | $55 million Series C | Enterprises and MSPs limiting lateral movement | Policy errors can disrupt legacy systems |
The 10 cybersecurity startups
1. Cynomi: automated vCISO work for service providers
Cynomi provides an automated vCISO platform for activities such as gap analysis, policy creation, and prioritized remediation planning. Its clearest market fit is MSPs, MSSPs, consultancies, and SMB-focused providers that need to deliver repeatable security governance without assigning a senior security leader to every customer.
Cynomi raised $37 million in Series B funding co-led by Insight Partners and Entrée Capital. The funding is a strong signal that investors saw demand for scalable security expertise, particularly as smaller organizations face compliance, insurance, and customer-security requirements.
Evaluate it if: you need standardized vCISO services across multiple customers or lack internal governance capacity.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Ask during a pilot: How much work is evidence-based automation versus document generation? Which compliance frameworks are supported? Does it integrate with PSA, RMM, ticketing, and security tools? How much consultant review is required?
Main caution: A mature enterprise with an established GRC platform and internal governance team may gain less value. Pricing and packaging should be confirmed directly with the vendor.
2. Endor Labs: prioritizing open-source and AI-generated code risk
Endor Labs focuses on software supply-chain security, including open-source and AI-generated code. Its capabilities include Upgrade Impact Analysis and Magic Patches, intended to help teams prioritize vulnerabilities and remediate them with less disruption.
The company raised $93 million in Series B funding led by DFJ Growth. Its timing was notable: AI-assisted development was increasing the speed and volume of code production while making dependency analysis, reachability, and remediation more important.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsEvaluate it if: your developers manage large open-source dependency trees or need better context than a raw vulnerability list provides.
Ask during a pilot: Does the platform analyze transitive dependencies and reachability? Which repositories, CI/CD systems, package ecosystems, and IDEs are supported? How does it handle AI-generated code? Can developers apply fixes without breaking releases?
Main caution: Compare it with existing software composition analysis, code-scanning, ASPM, and developer-security products before adding another tool.
3. Mimic: ransomware detection and recovery resilience
Mimic offers SaaS-based ransomware defense centered on early detection, attack deflection, and recovery. Its Signal Generator was designed to let customers safely observe what ransomware behavior could look like inside their networks.
Mimic raised $50 million in Series A funding led by GV and Menlo Ventures. The company attracted attention because ransomware programs increasingly need to demonstrate resilience and recovery—not merely deploy endpoint detection.
Evaluate it if: your organization wants to test containment and recovery assumptions alongside EDR and backup controls.
Ask during a pilot: How does it detect encryption before material damage? Can it contain malicious behavior without disrupting legitimate operations? How are recovery points protected? What is the performance impact? How is testing isolated from production risk?
Rank #2
- OTP token that provides secure remote access with strong authentication
- Easy to use and easy to carry
- Expected battery life is approximately 7 years
Main caution: It should be tested as part of the existing EDR, identity, backup, disaster-recovery, and incident-response plan rather than treated as a replacement for them.
Recommended Free Tools
4. Mitiga: cloud and SaaS detection, investigation, and response
Mitiga provides cloud and SaaS threat detection, investigation, and response. Cloud incidents frequently involve identities, APIs, SaaS configuration, and fragmented telemetry, making them difficult to investigate with traditional workflows alone.
Mitiga closed a $30 million Series B led by Syn Ventures and appointed Charlie Thomas, formerly CEO of Deepwatch, as CEO. CRN also reported a company claim that its technology could enable response more than 90% faster than traditional approaches. That performance claim should be treated as vendor-reported, not independently verified.
Evaluate it if: your SOC investigates incidents across multiple cloud providers and SaaS applications but lacks deep cloud-specific expertise.
Ask during a pilot: Which cloud and SaaS services are supported? Are agents or infrastructure changes required? How much investigation is automated? Does it integrate with your SIEM, SOAR, and case-management systems?
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchMain caution: Determine whether it supplements or overlaps with your SIEM, CNAPP, MDR, or cloud-native detection capabilities.
5. Oligo Security: runtime context for application risk
Oligo Security uses runtime visibility to inspect applications, libraries, and function-level activity. The goal is to show which vulnerabilities are actually active, loaded, reachable, and exposed rather than treating every scanner finding as equally urgent.
Oligo raised $50 million in Series B funding led by Greenfield Partners. Runtime context was attractive because security teams face more vulnerability findings than they can reasonably remediate.
Evaluate it if: your application teams need exploitability and runtime context to prioritize remediation.
Ask during a pilot: What telemetry is collected? Which languages, runtimes, clouds, and deployment models are supported? Does it use eBPF or other instrumentation? What is the performance overhead? Does it remediate findings or primarily prioritize and detect them?
Main caution: Runtime visibility may require deeper deployment access and raise questions about sensitive telemetry, retention, privacy, and coverage of ephemeral workloads.
6. Orchid Security: identity orchestration across fragmented systems
Orchid Security aims to unify complex identity environments and accelerate identity-security control deployment through orchestration, including large-language-model capabilities.
Orchid raised $36 million in seed funding led by Team8 and Intel Capital and hired Trish Cagliostro, formerly a channel and alliances executive at Wiz, as chief revenue officer. The company’s appeal came from a common enterprise problem: human, machine, application, privileged, and service identities often span disconnected systems.
Evaluate it if: your identity program has too many point products and manual integration tasks.
Rank #3
- Works with authentication systems that support TOTP tokens: Google, Facebook, Coinbase, GDAX, Dropbox, GitHub, Kickstarter, Microsoft, TeamViewer, etc.
- Programmable an unlimited number of times. Features syncable clock to prevent issues with drift
- About half the size of a credit card and just as thick-easily keep multiple cards in wallet
- Works with "Token2 Token Burner" or "Protectimus TOTP Burner", both available in the Google Play Store. Now also iOS compatible (iPhone 7 and later)
- More secure than software token as your codes cannot be intercepted by malware on your phone.
Ask during a pilot: Which identity systems can it orchestrate? What actions can run automatically? Are LLM recommendations reviewed before execution? How are changes audited, versioned, and rolled back? Is break-glass access preserved?
Main caution: Identity automation is high impact. Use approval gates, staged deployment, test environments, policy versioning, and rollback before permitting changes in production.
7. Sentra: discovering cloud data and AI exposure
Sentra provides cloud-native data discovery, classification, privacy, and risk detection. It later introduced capabilities aimed at protecting data used by AI agents and agentic models.
Sentra raised $50 million in Series B funding led by Key1 Capital and introduced its AI-agent data-security offering at RSAC 2025. The timing reflected concern that organizations were adopting AI before they had a complete inventory of sensitive data, permissions, and downstream use.
Evaluate it if: you need to identify sensitive data across cloud stores and understand whether AI systems can reach it.
Ask during a pilot: Which structured and unstructured stores are scanned? How accurate is classification? Does the platform monitor permissions, movement, and usage or only inventory data? How does it integrate with DLP, DSPM, data-governance, and cloud-security tools?
Main caution: Discovery can reveal more problems than a security team can immediately fix. Assign data owners and remediation priorities before deployment.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →8. Seraphic Security: securing the enterprise browser
Seraphic Security targets enterprise browser use with capabilities spanning secure web gateway, zero-trust network access, cloud access security, and access to SaaS and private applications. It also launched BrowserTotal to assess enterprise browser security posture.
Seraphic raised $29 million in Series A funding led by GreatPoint Ventures. The browser became a more important control point as employees worked through SaaS applications, remote devices, and unmanaged endpoints.
Evaluate it if: browser-based work is central to your business and traditional network controls leave gaps around sessions, uploads, downloads, or unmanaged devices.
Ask during a pilot: Is a proprietary browser or extension required? Which browsers and operating systems are supported? Can it control copy and paste, printing, downloads, uploads, and sessions? How does it handle personal browsing, privacy, and offline work?
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Main caution: Excessive browser restrictions can drive workarounds and shadow IT. Test user experience as carefully as technical coverage.
9. SpecterOps: mapping identity attack paths
SpecterOps offers BloodHound Enterprise and open-source tools for mapping identity-based attack paths. The platform helps security teams find relationships that could enable lateral movement or privilege escalation, particularly in Active Directory and hybrid identity environments.
SpecterOps raised $75 million in Series B funding led by Insight Partners, with participation from Cisco Investments and Microsoft’s M12. It also introduced Privilege Zones.
Rank #4
- Credentials are tamper-resistant and cannot be duplicated.
- Event-Based HOTP, press the button to generate a new 6-digit one-time passcode.
- Adds a layer of security with Multi-Factor Authentication.
- Symantec VIP Cards are to be used with Symantec VIP Access. Two-factor authentication is easy to enable and prevents attacks. With just a swipe of a finger, or use of a security code, your information is secure.
- Slim and portable credit card size for portability.
Evaluate it if: you need to understand hidden paths to privileged resources rather than relying on a basic directory audit.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallAsk during a pilot: Which permissions and relationships can it map? How actionable are remediation recommendations? Can it monitor changes continuously? Does it cover cloud identity systems? How will permission changes be tested and approved?
Main caution: BloodHound Enterprise and the open-source BloodHound project are distinct offerings. Remediation also requires careful change control because identity relationships may support legitimate business processes.
10. Zero Networks: simplifying microsegmentation
Zero Networks provides automated network microsegmentation, emphasizing policy and rule creation that can simplify deployment for enterprises and MSPs. The company also promotes an approach that avoids conventional software agents.
Zero Networks raised $55 million in Series C funding led by Highland Europe. Microsegmentation remained attractive because limiting lateral movement is valuable, while traditional implementations can be difficult to model and maintain.
Evaluate it if: you need to contain lateral movement across users, workloads, or customer environments.
Ask during a pilot: How are policies learned and validated? What happens to unknown traffic? Is enforcement host-, network-, identity-, or combination-based? How are legacy applications supported? Can MSPs manage multiple environments? What is the rollback process?
Main caution: “Agentless” does not mean deployment-free. Verify enforcement coverage, integrations, network dependencies, legacy-system support, and behavior during outages.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.The market themes behind the list
AI security was three different markets
AI and agentic systems were prominent because they created new assets and new attack paths while also changing how defenders worked. The risks include excessive permissions for non-human identities, undocumented models and applications, insecure model-to-tool connections, AI-generated code, unclear accountability, and autonomous actions that are difficult to audit.
But “AI security” is not one category:
- Security for AI: protecting models, agents, prompts, data, and AI workflows.
- AI for security: using AI for detection, investigation, triage, remediation, and security engineering.
- Security of AI-generated software: analyzing code, dependencies, designs, and runtime behavior produced or modified with AI.
Buyers should ask what is actually automated, what confidence thresholds apply, whether human approval is required, what data reaches external models, and what happens when an AI action is wrong.
Identity, cloud, data, and application security increasingly overlap
Orchid and SpecterOps address different identity problems: orchestration across fragmented systems versus attack-path analysis. Mitiga and Oligo also occupy adjacent but distinct layers: cloud and SaaS investigation versus runtime application visibility. Sentra focuses on the data layer, while Endor Labs focuses on software and dependencies.
These products may be replacements, supplements, or specialized layers depending on the buyer’s existing SIEM, IAM, PAM, CNAPP, DLP, SCA, ASPM, and GRC tools. A category label alone is not enough to determine overlap.
What enterprise buyers should verify
- Production evidence: Request references, deployment scope, measurable outcomes, and details about false positives and operational workload.
- Integration effort: Map required permissions, agents, APIs, data connectors, SIEM/SOAR links, ticketing workflows, and cloud access.
- Automation controls: Require approval gates, audit trails, confidence thresholds, staged rollout, and rollback for identity, segmentation, and response actions.
- Data handling: Review collection scope, retention, residency, encryption, subprocessors, model use, and access controls.
- Operational impact: Measure performance overhead, user friction, alert volume, remediation time, and effects on legacy systems.
- Commercial maturity: Confirm general availability, support coverage, service-level commitments, incident obligations, roadmap stability, and financial runway.
- Exit risk: Ensure policies, findings, data, and configurations can be exported if the startup is acquired, changes direction, or fails.
What MSPs and MSSPs should prioritize
Service providers should look beyond product features. Multi-tenancy, delegated administration, partner margins, co-branding, PSA and RMM integrations, standardized reporting, customer onboarding time, billing flexibility, and repeatable delivery often determine whether a startup can become a profitable service component.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Cynomi, Mitiga, Orchid Security, and Zero Networks had especially clear channel angles in the original coverage. However, channel messaging should be tested against actual partner enablement, support response, deployment ownership, and margin structure.
How the list changed by year-end
This midyear list should not be silently merged with CRN’s later full-year coverage. The later article highlighted a different group, including 7AI, Clover Security, Descope, Noma Security, Seemplicity, and Sweet Security. That change does not mean the original ten failed; it shows how quickly attention moved during 2025 as new funding rounds, launches, and AI-security themes emerged.
For that reason, this article is a historical assessment of the first half of 2025, based on CRN’s midyear selection criteria and list. It is not a current ranking of startup quality or an investment recommendation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors
