About Security tools

Security is the category founders postpone until a customer's procurement questionnaire arrives. By then the questions are no longer technical — they are about SOC 2, data residency, and who has access to production — and answering them retroactively costs far more than building for them would have.

The listings here cover authentication and identity, secrets and key management, vulnerability scanning and dependency auditing, compliance automation, and the monitoring that tells you when something already went wrong.

Two decisions in this category are close to irreversible. Authentication is the first: rolling your own is cheap on day one and expensive every day after, once SSO, MFA, session revocation, and enterprise SAML requests arrive. Secrets management is the second, because the alternative — environment variables copied between laptops — has no upgrade path that does not involve rotating everything. Neither needs an enterprise budget to do properly, and both get harder the longer you wait.

What to look for

SSO without an enterprise plan

Charging a large multiple for SAML is common and worth checking early. If SSO is the gate on your first serious customer, the pricing of it stops being a detail.

What happens on lock-out

Account recovery, break-glass access, and admin succession. Every auth tool works until the one person with the admin account leaves the company.

Signal-to-noise on scanners

A scanner that reports four hundred findings, most of them unreachable, trains the team to ignore it. Reachability analysis and sensible severity ranking are what make a scanner useful rather than performative.

Compliance evidence, not checklists

Tools that collect evidence continuously make an audit routine. Tools that give you a checklist to fill in manually have moved the work rather than removed it.

Security questions

Keep reading