The platforms and tools behind the responders
These companies provide the cybersecurity platforms, tools, and managed services that operate across the specializations VendorQuals documents. They are not incident response firms. They do not answer the 2 AM call. The responder directories list the firms that do.
This page is their avenue to be part of VendorQuals. If your platform or product belongs here, request inclusion through the same public process every listed firm went through.
Kubernetes governance, security, and cost management platform (Polaris, Goldilocks).
Managed Kubernetes and internal developer platform engineering.
Cloud-native engineering consultancy specialising in digital transformation and platform architecture.
Cloud-native application protection platform for containers and Kubernetes. Stewards of Falco.
Cloud security posture management (CSPM), now part of Google Cloud.
Hardened container images and supply chain security for cloud-native environments.
Cloud security platform with Kubernetes and container runtime monitoring.
AI-powered data security posture management (DSPM) for cloud environments.
Global cybersecurity platform spanning network, cloud, and security operations. Their IR arm (Unit 42) is documented in our cloud-IR directory.
Cloud-native endpoint security platform. Their IR arm (CrowdStrike Services) is documented in our cloud-IR directory on eight carrier panels.
Zero-trust network and cloud security platform (SSE).
Data protection, backup, and cyber resilience platform.
Cloud-based vulnerability management and compliance platform.
Cloud security and networking platform (SSE/CASB).
AI-native data security and threat detection platform.
AI-driven network detection and response platform (NDR).
Crowdsourced penetration testing and vulnerability discovery platform.
Virtual cyber range platform for cybersecurity training and incident response simulation.
Web application firewall and DDoS protection, part of Thales.
Data loss prevention and secure web gateway platform.
Email, network, and application security for SMBs.
Network visibility and traffic intelligence for hybrid cloud.
Network security and UTM appliances for SMBs and MSSPs.
Password management and privileged access management.
Application delivery and DDoS protection for hybrid cloud.
Data discovery, privacy, and AI governance platform.
Virtualization and cloud infrastructure software.
ISO 17025 accredited compliance testing lab. Medical device electrical safety (IEC 60601), EMC/wireless, environmental, and cybersecurity compliance testing.
OT, IoT, and CPS security platform for monitoring and protecting critical infrastructure.
General network security vendor with a dedicated OT security portfolio (fortinet.com/OT).
Enterprise microsegmentation platform with OT/ICS deployment offerings.
Zero trust remote access for industrial control system environments.
Network visibility and access security modeling for industrial control systems.
OT cybersecurity software for identifying, prioritizing, and remediating vulnerabilities in critical infrastructure.
Real-time cyber resilience and recovery platform for OT and ICS environments.
Resilion, an OT cybersecurity execution platform for critical infrastructure operators.
OT cybersecurity engineering firm: assessments, network segmentation, and incident response drills. Houston, TX.
Risk and reliability services firm running an Industrial Security Operations Center (ISOC).
OT cybersecurity consultancy for SCADA and DCS environments across the Middle East, Europe, and South Asia.
Mission assurance and industrial cybersecurity services for federal and commercial critical infrastructure.
Engineering consultancy with a dedicated cyber security practice for industrial clients.
Industrial IT services brand (VINCI Energies) covering digitisation and cyber security for industry.
Engineering, consulting, and construction firm for critical infrastructure, with OT cyber advisory.
Secure-by-design engineering consultancy for critical infrastructure.
Boutique penetration testing firm with an OT/ICS line and IEC 62443 assessments. Brookline, MA.
Secure remote access (SRA) appliance for industrial networks and OT equipment.
IoT, OT, IT, and 5G cybersecurity and threat intelligence platform.
Identity and access security for industrial control systems: secure remote access and privileged access management.
OT/industrial cybersecurity services (Securing Things practice): OT security, pen tests, purple teams, managed services.
Industrial cybersecurity and digital safety: visibility programs, continuous monitoring, managed service tiers. Joined BW Design Group.
ICS and OT systems integrator (40+ years) with an OT cybersecurity practice, including pipeline-specific applications.
Critical Infrastructure Defense Center, Siemens' customer-facing cybersecurity competency for critical infrastructure in Canada.
SaaS platform helping organizations prioritize cybersecurity resources and improvements.
Asset risk management platform based on asset existence and physical layer visibility.
Cyber-physical system (CPS) cybersecurity solutions for critical infrastructure.
Installation Resilience Platform for mission operators on defense installations.
Zero-trust identity and access management platform purpose-built for OT/ICS.
Cybersecurity for automation and control systems, led by experienced practitioners.
Secure OT connectivity: connect, visualize, and control industrial equipment (since 2011).
Trustworthy data infrastructure for IoT/OT/AI in critical infrastructure.
OT system integrator working with best-of-breed technology partners.
Cybersecurity for the reliability and safety of industrial control systems and OT.
Azure Defender for IoT: IoT/OT security monitoring across devices.
Protects the operational integrity of industrial devices, machines, and manufacturing lines.
OT protection platform delivering segmentation and encryption alongside visibility tools.
Cyber-physical security platform for operational technology.
Vulnerability protection keeping critical infrastructure software safe.
Technology consultancy with an industrial cybersecurity department (Spain).
Content Disarm and Reconstruction (CDR) IT/OT file sanitization (GateScanner).
Industrial protection software (Xcore) for critical infrastructure.
ICS/OT/SCADA cybersecurity consultancy and training services.
Passwordless multi-factor authentication, marketed to industrial IT.
Hands-on OT cybersecurity training and cyber ranges (subscription).
Industrial cybersecurity business of Framatome, protecting IT and OT in nuclear environments.
Offline operational recovery vault for OT and critical infrastructure.
Offline OT cyber resilience and NIS2/DORA evidence for EU SMEs.
SafeGuard AI: an intelligence layer across OT, ICS, and industrial environments.
AI-driven OT cybersecurity platform for critical infrastructure.
Secures ICS and OT environments across manufacturing, defense, energy, and pharma.
Backup, system imaging, and recovery software for critical operational and embedded systems.
Specialty engineering, automation, and integration company with a cyber division.
Firmware security for critical infrastructure (aerospace, defense).
Splicecloud: preventing death and destruction from cyber-physical attacks.
Managed cybersecurity and risk management services, including SOC-as-a-Service and XDR.
Rail cybersecurity: prevents safety incidents and service disruptions from cyber attacks.
Passive, fail-safe sensor and machine-learning monitoring analytics for OT.
Quantifies OT cyber risk in monetary terms to prioritize programs and budgets.
HAWKEYE managed CSOC and XDR with an incident response team.
Pure-software OT network security monitoring purpose-built for ICS (FlowIdentifier engine).
Cybersecurity for smart manufacturers with connected physical operations.
Cybersecurity hardware protecting critical infrastructure as defense-in-depth.
Agentless asset intelligence, exposure management, and network access control for OT.
Industrial networking, connectivity, and OT security infrastructure.
OT security preventing attacks against ICS, SCADA, and critical infrastructure networks.
Zero trust protection for critical assets, data, and operations.
Automated IoT firmware analysis platform for security and compliance teams.
OT cybersecurity for critical energy and renewable infrastructure (Centrii Portal).
Cybersecurity and operations management for industrial and critical infrastructure environments.
Identity-driven security connecting the operational systems that run the world.
Software supply chain security for product development and operation.
Business, technology, and security consultancy within Burns & McDonnell serving critical infrastructure.
Electrification and automation company; the ABB Ability portfolio includes industrial cybersecurity products.
High-assurance encryption, network segmentation, and controlled data exchange (Sweden).
Software supply chain security for critical infrastructure and industrial environments (FACT platform).
Airbus' cybersecurity, safety, and sustainability services subsidiary; incident response and digital forensics among its published services.
Cyber-physical security convergence software unifying physical identity and access.
Services-only international OT security consulting across North America and Europe.
OT cybersecurity risk management platform quantifying cyber-physical risk.
Advisory, consulting, and managed services firm (Arcova, formerly MorganFranklin Cyber).
Engineering-led industrial cybersecurity and functional safety provider.
Continuous visibility and risk reduction across converged IT, OT, and IoT environments.
OT software for securing and governing process-critical industrial software.
Independent risk management and assurance expert operating in 100+ countries.
Cyber resilience support for transport and critical infrastructure operators (UK).
Advisory covering incident response coordination, ransomware negotiation, forensics, and crisis management.
Protection system for essential infrastructure against sophisticated attacks.
Digital investigation platform (Magnet AXIOM) for forensic artifact collection and analysis.
Digital forensics and intelligence platform, strongest in device data extraction and analysis.
EnCase Forensic, the long-standing disk forensics and investigation suite, plus Tableau write blockers.
Forensic and ediscovery platform whose portfolio includes the FTK (Forensic Toolkit) product line.
The open-source memory forensics framework (Volatility), maintained by a nonprofit foundation.
Digital forensics hardware and software, including write blockers and the PALADIN forensic suite.
Forensic workstations, write blockers, and lab equipment for digital investigations.
Cybersecurity training and GIAC certifications; its DFIR curriculum (FOR500, FOR508) is the standard credential path for forensic analysts.
Asset risk management platform for connected medical devices (IoMT).
IoT and medical device asset intelligence and security platform.
Medigate, the healthcare device security capability within the Claroty xDome platform.
Embedded device security and observability platform for medical IoT and connected devices.
Incident response management platforms
The software side of incident response: SOAR, case management, and command-center platforms the buyer operates, not services you hire. Ratings and review counts are opinion data from the Gartner Peer Insights "Cybersecurity Incident Response Management" category, captured October 2026, cited for context.
| Product | Company | Peer rating | Reviews |
|---|---|---|---|
| CrowdStrike Incident Response | CrowdStrike | 4.7/5 | 109 |
| Cortex XDR | Palo Alto Networks | 4.4/5 | 28 |
| ServiceNow Security Incident Response | ServiceNow | 4.5/5 | 26 |
| FortiSIEM | Fortinet | 4.3/5 | 23 |
| TheHive | StrangeBee | 4.4/5 | 23 |
| CYGNVS | CYGNVS | 4.4/5 | 5 |
| Rex Platform | BreachRx | 4.6/5 | 5 |
| FortiSOAR | Fortinet | 4.3/5 | 4 |
| Cydarm | Cydarm | 4/5 | 2 |
Source: Gartner Peer Insights, "Cybersecurity Incident Response Management" category, captured October 2026. Opinion data cited for context; not an endorsement and not a ranking of response firms.
OT/IoT security platforms
The detection and visibility side of operational technology: asset intelligence, monitoring, and NERC CIP compliance automation the buyer operates. These vendors are documented for context — they are platforms, not the incident response firms the directories list.
| Platform | Focus | Website |
|---|---|---|
| Dragos Platform | OT threat intelligence and ICS visibility | dragos.com |
| Claroty CPS Platform | Converged OT/IoT/medical device visibility | claroty.com |
| Nozomi Networks Guardian | OT/IoT visibility with AI-driven detection | nozominetworks.com |
| Tenable OT Security | OT vulnerability management | tenable.com |
| Armis Centrix | Agentless OT/IoT asset intelligence | armis.com |
Source: vendor-published platform pages, read September 2026. Listed for context; not an endorsement and not a ranking of response firms.
Why this is separate from the responder directories
The firm directories list companies that respond to incidents: they send people, they investigate, they contain. The platforms and products listed here are what those responders use, what buyers deploy, and what the ecosystem runs on. Both are essential. They are not the same thing.