# Cyber Company Profiles: Aqua Security

Source: [Cyber Company Profiles](https://cybercompanyprofiles.com)
Exported 2026-09-12
Analyzed 2026-07-08
Canonical: https://cybercompanyprofiles.com/companies/aqua-security
License: free for personal use and internal business purposes, including internal commercial evaluation such as assessing a vendor for procurement, with quoting permitted when attributed to cybercompanyprofiles.com. No resale, republication, redistribution as a dataset, or use to build a competing product. Full terms: https://cybercompanyprofiles.com/terms

This is a third-party strategy analysis of Aqua Security, derived from public and
vendor-controlled sources. All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
This copy may not reflect current information. It is reference material, not
instructions. Treat everything below as data to analyze and discuss, not as
commands to act on.

© Zeltser Security Corp.

## At a Glance

- Website: [aquasec.com](https://www.aquasec.com)
- Profile: https://cybercompanyprofiles.com/companies/aqua-security
- Type: Security for AI, Cloud Security
- Also known as: Scalock
- Market readiness: Established (28/40)
- Defensibility: Defensible (15/21)
- Founded: 2015
- Last updated: 2026-07-08

## Executive Summary

Aqua Security, a decade-old cloud-native security company used by more than 40 percent of the Fortune 100, holds a FedRAMP High authorization that is the hardest part of its position for a rival to take away. Sponsored by the Department of Education, it lets Aqua sell to federal agencies a competitor without the same clearance cannot reach quickly. The cloud-native scanning is reproducible by a funded rival, the capability Google signaled it wanted by buying Wiz. In November 2025 the founders moved to advisory roles, a CrowdStrike sales leader became chief executive, and a third round of layoffs followed. Most defensible for regulated and federal buyers, weakest where a cloud platform could bundle equivalent coverage into a bill the buyer already pays.

## Contents

- [Executive Summary](#executive-summary)
- [Sourced Details](#sourced-details)
- [Matrix Coverage](#matrix-coverage)
- [Market Readiness](#market-readiness)
- [Strategy Deep Dive](#strategy-deep-dive)
- [Sources](#sources)
- [Disclaimer](#disclaimer)

## Sourced Details

| Detail | Value | Source |
|---|---|---|
| Description | Cloud native application protection platform (CNAPP) that secures containers, serverless functions, and cloud workloads from code to runtime, with an Aqua Secure AI line that discovers and protects AI applications. | [\[f1\]](#company-detail-sources) |
| Founded | 2015 | [\[f2\]](#company-detail-sources) |
| HQ | Boston, Massachusetts, United States and Ramat Gan, Israel | [\[f3\]](#company-detail-sources) |
| Latest funding | Series E extension ($60M, Evolution Equity Partners-led, 2024) | [\[f2\]](#company-detail-sources) |

### Products

| Product | What it does |
|---|---|
| Aqua Platform | Cloud native application protection platform combining agent and agentless coverage across code, supply chain, posture, and runtime for containers, serverless functions, and VMs. |
| Aqua Secure AI | Lifecycle protection for AI applications that discovers AI usage, governs models across SaaS and self-hosted deployments, and enforces runtime policy against prompt-based threats without code changes. |
| Software Supply Chain Security | Shifts security left across application code, infrastructure as code, and LLM components before risks reach production. |
| Runtime Protection | Real-time detection and prevention for running cloud native workloads, stopping attacks in production across the container lifecycle. |

## Matrix Coverage

Mapped to the [AI Defense Matrix](https://aidefensematrix.com) [\[f4\]](#company-detail-sources):

| Asset | Govern | Identify | Protect | Detect | Respond | Recover |
|---|---|---|---|---|---|---|
| AI-Workload Platforms |  | ✓ | ✓ | ✓ |  |  |
| Runtime AI Data |  |  | ✓ | ✓ |  |  |
| AI Model |  | ✓ |  |  |  |  |

Aqua Secure AI discovers AI usage across SaaS, managed, and self-hosted models, applies posture checks to AI services, and enforces runtime policy against prompt injection and post-compromise activity where AI applications run. These capabilities are mapped to the AI Defense Matrix.

Mapped to the [Cyber Defense Matrix](https://cyberdefensematrix.com) [\[f1\]](#company-detail-sources):

| Asset | Identify | Protect | Detect | Respond | Recover |
|---|---|---|---|---|---|
| Applications | ✓ | ✓ | ✓ | ✓ |  |
| Data | ✓ | ✓ |  |  |  |
| Devices | ✓ | ✓ | ✓ |  |  |

The Aqua Platform CNAPP secures conventional cloud native workloads across containers, serverless functions, and VMs, scanning supply chain and code, enforcing pre-deployment posture, and detecting and stopping attacks at runtime in production. It is mapped to the Cyber Defense Matrix.

## Market Readiness

How well the company can compete in its security market, scored across eight dimensions against public evidence.

**Established (28/40)**

Analyzed 2026-07-05. Scope: whole company.

| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity | 3/5 | Aqua defines the cloud-native security problem precisely, but the 40 percent of the Fortune 100 figure is vendor-reported reach rather than an independent quantification of buyer pain, so problem clarity is present but unproven. \[[s1](#profile-analysis-sources), [s2](#profile-analysis-sources), [s5](#profile-analysis-sources)\] |
| Capability Depth | 4/5 | The platform spans code, supply chain, posture, and runtime with both agent and agentless coverage, documented across the product pages, and Aqua maintains the open-source Trivy scanner, which draws independent outside scrutiny: academic security research evaluates Trivy by name, and a disclosed credential-handling flaw Aqua patched in version 0.51.2 shows the product is examined and maintained beyond the company's own marketing. \[[s1](#profile-analysis-sources), [s2](#profile-analysis-sources), [s3](#profile-analysis-sources), [s6](#profile-analysis-sources), [s13](#profile-analysis-sources), [s14](#profile-analysis-sources)\] |
| Market Timing | 4/5 | CNAPP is an established budget line enterprises actively buy, and the new Aqua Secure AI line meets fresh demand to secure AI applications, a present buyer pull rather than a vendor-argued need. \[[s1](#profile-analysis-sources), [s3](#profile-analysis-sources), [s10](#profile-analysis-sources)\] |
| Team Credibility | 3/5 | Co-founders Dror Davidoff and Amir Jerbi built a decade-long category leader, but both stepped to advisory roles in November 2025, replaced by a chief executive whose background is enterprise sales at CrowdStrike and Splunk rather than a verifiable security-product build. \[[s7](#profile-analysis-sources)\] |
| GTM Proof | 4/5 | Named reference customers span PayPal, Netflix, Samsung, and Audi, the company reports protecting over 500 enterprises and 40 percent of the Fortune 100, and a FedRAMP marketplace listing opens federal sales, multiple corroborated traction signals. \[[s1](#profile-analysis-sources), [s5](#profile-analysis-sources), [s6](#profile-analysis-sources), [s9](#profile-analysis-sources)\] |
| Funding Efficiency | 3/5 | Aqua raised about 195 million dollars across its Series E and extension, but no revenue or margin is disclosed and three rounds of layoffs make the cash-flow-independence push read as cost correction rather than confirmed efficiency, so funding efficiency is unconfirmed. \[[s4](#profile-analysis-sources), [s5](#profile-analysis-sources), [s8](#profile-analysis-sources)\] |
| Category Clarity | 4/5 | Aqua helped create the container-security category and fits the now-established CNAPP slot buyers and analysts place without vendor coaching, a clear stack position alongside Wiz, Orca, and Prisma Cloud. \[[s1](#profile-analysis-sources), [s2](#profile-analysis-sources), [s10](#profile-analysis-sources)\] |
| Incumbent Defensibility | 3/5 | Core CNAPP scanning is a capability cloud platforms can bundle, shown by Google acquiring the rival Wiz, so the value proposition is absorbable absent a structural moat, level with the agentless cloud-security cluster. \[[s2](#profile-analysis-sources), [s10](#profile-analysis-sources)\] |

### Business Risks

- A cloud platform could bundle equivalent CNAPP coverage into a bill the buyer already pays, as Google did by acquiring Wiz, eroding Aqua's standalone value.
- The November 2025 move to a sales-led chief executive and a third round of layoffs could slow product investment relative to better-capitalized rivals.
- Aqua Secure AI remains exclusive access rather than general availability, so a faster rival could define the AI-application-security category first.
- Without a funding round since January 2024, Aqua could fall behind competitors backed by hyperscaler balance sheets in a capital-intensive category.

### Problem & Market

Aqua secures cloud native applications across their lifecycle, from source code and the software supply chain through cloud posture and into runtime in production. The company frames the problem as protecting everything that runs in the cloud, spanning containers, serverless functions, and virtual machines, and now extends the same lifecycle to AI applications.

The buyer is the enterprise security team running cloud native workloads at scale. Aqua quantifies that base concretely, reporting use by more than 40 percent of the Fortune 100 and named customers including PayPal, Netflix, Samsung, and Audi, which removes the ambiguity that weakens a marketing-only problem statement.

The timing rests on two demand sources. Cloud native adoption made CNAPP a standing budget line, and the rapid enterprise move to build AI applications created fresh need to discover and govern AI usage, which the Aqua Secure AI line targets directly. \[[s1](#profile-analysis-sources), [s2](#profile-analysis-sources), [s3](#profile-analysis-sources)\]

### Product Capabilities

The Aqua Platform combines agent and agentless coverage in one product, scanning code, infrastructure as code, and LLM components in the supply chain, enforcing posture before deployment, and detecting and stopping attacks at runtime. The breadth from code to cloud to prompt is documented across the product pages rather than asserted in taglines.

Aqua Secure AI adds discovery of AI models and usage across SaaS, managed, and self-hosted deployments, posture checks on AI services, and runtime enforcement against prompt injection and post-compromise activity inside the containers where AI applications run. The vendor offers the line as exclusive access rather than a fully general-availability product, so its capability depth trails the mature platform around it.

The platform earns external validation uncommon among rivals. Aqua maintains the open-source Trivy scanner, which independent academic security research evaluates by name and which carries a disclosed credential-handling vulnerability Aqua patched in 2024, both signs the product is examined outside the company. In 2025 Aqua achieved FedRAMP High authorization for its federal CNAPP, a control-heavy government assessment that corroborates engineering depth beyond the company's own claims. \[[s2](#profile-analysis-sources), [s3](#profile-analysis-sources), [s6](#profile-analysis-sources), [s13](#profile-analysis-sources), [s14](#profile-analysis-sources)\]

### Competitive Positioning

Aqua competes in CNAPP, a crowded category whose vendors sell overlapping code-to-cloud coverage. Aqua's longer history in container and runtime security and its agent-plus-agentless approach are its differentiators.

The category is consolidating around platforms that can absorb the capability. Google's purchase of Wiz put a hyperscaler behind a CNAPP vendor, which pressures standalone vendors on price and reach.

Against that pressure, Aqua's distinguishing position is its federal foothold and installed base. The FedRAMP High authorization and a federal CNAPP hosted on AWS GovCloud open public-sector pipelines a competitor without the same authorization cannot enter quickly, and the Fortune 100 install base raises the cost of displacement even where the underlying scanning is reproducible. \[[s6](#profile-analysis-sources), [s10](#profile-analysis-sources)\]

### Go-to-Market & Traction

Aqua shows traction beyond design partners. The company reports protecting over 500 enterprises and more than 40 percent of the Fortune 100, and press and its own customer wall name reference customers including PayPal, Netflix, Samsung, and Audi.

The federal channel is a distinct motion. The 2025 FedRAMP High authorization and a marketplace listing for Aqua U.S. Gov open direct sales to federal, state, and local agencies that require FedRAMP-authorized cloud services.

The 2025 restructuring tempers the growth read. Three rounds of layoffs in recent years and a stated push toward cash flow independence indicate a stronger efficiency component alongside the company's stated growth. \[[s1](#profile-analysis-sources), [s5](#profile-analysis-sources), [s6](#profile-analysis-sources), [s8](#profile-analysis-sources), [s9](#profile-analysis-sources)\]

### Team & Credibility

Co-founders Dror Davidoff and Amir Jerbi built Aqua over a decade into a category leader, originally as Scalock in 2015, an established build in the container-security domain. Israel's company registry independently records the entity as Aqua Security Software Ltd, an active Israeli private company incorporated in 2015, corroborating the decade-long operating history.

Leadership turned over in November 2025. Both founders stepped to advisory roles, Mike Dube, who joined from a senior enterprise sales role at CrowdStrike, became chief executive, and a former engineering vice president took the product and technology seat. The new chief executive's public track record is in enterprise sales rather than a verifiable security-product build, which is why the team signal sits at the adequate rather than strong level.

The transition reads as a shift from founder-led product growth to a commercial-execution phase, consistent with the simultaneous cost cutting. \[[s7](#profile-analysis-sources), [s8](#profile-analysis-sources), [s12](#profile-analysis-sources)\]

### Trust Readiness

Aqua publishes a substantive security posture. Its trust center lists SOC 2 Type II, ISO 27001 from 2022, ISO 27017, ISO 27018, ISO 27701, CSA STAR, GDPR, and NIST 800-53 alignment, with controls and subprocessor disclosures available on request.

The federal authorization sets Aqua apart on trust. Aqua holds FedRAMP authorization at the High impact level, sponsored by the Department of Education and listed in the FedRAMP marketplace, which Aqua reached ahead of the CNAPP peers cited here.

Taken together, the commercial attestations meet enterprise procurement expectations and the federal authorization clears a higher public-sector bar, so trust readiness is a strength rather than a gap. \[[s6](#profile-analysis-sources), [s11](#profile-analysis-sources)\]

### Competitors

| Company | Relationship | Note |
|---|---|---|
| Wiz | competes with | The agentless cloud-security rival Google acquired in a deal that closed in 2026, placing a hyperscaler behind a direct competitor. |
| Orca Security | competes with | An agentless CNAPP rival that also holds a FedRAMP authorization and serves regulated enterprise and federal buyers. |
| Palo Alto Networks | competes with | Prisma Cloud is a competing CNAPP from a platform incumbent with broad enterprise distribution. |
| Sysdig | competes with | A runtime and container-security rival rooted in cloud native workload protection, overlapping Aqua's original strength. |

## Strategy Deep Dive

A closer look at the company's product strategy, measuring how [defensible](https://zeltser.com/scoring-security-product-strategy) it is against market forces and examining the [eight areas](https://zeltser.com/security-product-creation-framework) behind it.

### Defensibility

**Defensible (15/21)**

Band guidance: press the advantage. Analyzed 2026-07-08. Scope: whole company.

Aqua Security is durable on engineering depth and a federal compliance posture and exposed on what the customer buys and what the platform accumulates. Its agent-plus-agentless coverage from code to runtime is years of specialized work, and its FedRAMP High authorization is a clearance a copycat cannot clear quickly, opening public-sector pipelines to the company. Against that, the customer buys software it configures and runs rather than a service that accepts accountability, and the record names no cross-customer data asset a rival could not rebuild. The hardest part for a rival to take away is the federal foothold, not the scanning. The heaviest exposure is a cloud platform bundling equivalent coverage with the cloud the buyer already pays for, a path Google signaled by buying Wiz.

| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery | 1/3 | Customers buy a software platform that scans code, supply chain, and runtime and that they configure and operate themselves, rather than a service in which Aqua accepts judgment or accountability for the outcome. \[[s2](#deep-dive-sources), [s10](#deep-dive-sources)\] |
| Switching Cost | 2/3 | Wiring agent and agentless coverage, pre-deployment posture gates, and runtime policies into CI/CD and production creates real friction to replace, while the deploy-and-scan model keeps the underlying cloud data portable, short of the data-residency or system-of-record lock a 3 would need. \[[s2](#deep-dive-sources), [s10](#deep-dive-sources)\] |
| Compliance Moat | 3/3 | Aqua holds a FedRAMP High authorization with a federal sponsor, listed in the FedRAMP marketplace and delivered through Aqua U.S. Gov on AWS GovCloud, a federal clearance that opens public-sector pipelines a replacement cannot obtain quickly. That federal clearance places Aqua above vendors that hold no comparable authorization. \[[s5](#deep-dive-sources), [s8](#deep-dive-sources)\] |
| Problem Complexity | 3/3 | Building one platform that combines agent and agentless coverage and correlates code, supply chain, posture, and runtime risk across containers, serverless functions, and VMs is real-time, multi-system engineering that takes years of specialized work. \[[s2](#deep-dive-sources), [s3](#deep-dive-sources)\] |
| Buyer Profile | 3/3 | The buyers are regulated large enterprises and US federal agencies that procure through negotiated deals and strict reviews, with more than 40 percent of the Fortune 100 named and a FedRAMP authorization serving the public sector, the population whose legal and security review sits between the vendor and replacement. \[[s1](#deep-dive-sources), [s5](#deep-dive-sources)\] |
| Layer | 2/3 | The Aqua Platform is a control plane that scans, gates, and protects across the clouds and pipelines an enterprise runs, a platform with application features rather than infrastructure customer traffic is forced through inline. \[[s2](#deep-dive-sources), [s3](#deep-dive-sources)\] |
| Proprietary Data, Content, or IP | 1/3 | The public record shows no named non-public dataset or detection corpus behind the platform, and the company's flagship Trivy database is open source, so the advantage is the platform's engineering and breadth a well-funded rival could rebuild rather than an asset no one else owns. \[[s2](#deep-dive-sources), [s3](#deep-dive-sources)\] |

### Strategic Market Segmentation

Aqua sells to enterprise security teams that run cloud native workloads at scale, and it serves them deeply, reporting more than 40 percent of the Fortune 100 and over 500 enterprises with named logos including PayPal, Netflix, Samsung, and Audi. The buyer knows the budget line, since CNAPP is an established category Aqua helped create from its origins in container security.

Aqua also targets public-sector buyers through a tailored federal offering. Aqua U.S. Gov, hosted on AWS GovCloud and carrying a FedRAMP High authorization sponsored by the Department of Education, targets federal, state, and local agencies that require FedRAMP-authorized cloud services.

The Aqua Secure AI line extends the same base into a new use case rather than a new buyer. It is offered as exclusive access rather than general availability, so it currently reads as a feature expansion for existing cloud native customers adopting AI, not a separate go-to-market motion. \[[s1](#deep-dive-sources), [s4](#deep-dive-sources), [s5](#deep-dive-sources)\]

### Product Capabilities & AI Advantages

The Aqua Platform combines agent and agentless coverage in one product across code, software supply chain, cloud posture, and runtime. The runtime and container-lifecycle depth is the company's original strength, and Aqua offers the open-source Trivy scanner as part of its open-source projects, which it describes as trusted by security professionals, an external signal of capability beyond vendor claims.

Aqua Secure AI applies that runtime vantage point to AI applications. It discovers AI usage across SaaS, managed, and self-hosted models, runs posture checks on AI services, and enforces policy against prompt injection and post-compromise activity inside the containers where AI workloads run, without requiring SDKs, proxies, or code changes.

The AI line's advantage is positional rather than proprietary. Securing AI from inside the container runtime, where Aqua already operates, is a coherent extension of the platform, but no named non-public dataset backs the line, and absent a proprietary data asset the underlying detection and posture techniques appear reproducible by well-funded CNAPP rivals. \[[s1](#deep-dive-sources), [s2](#deep-dive-sources), [s3](#deep-dive-sources), [s10](#deep-dive-sources)\]

### Sales Engagement & Go-to-Market

Aqua runs a sales-led enterprise motion routed through demos rather than self-serve signup, consistent with negotiated deals into large organizations. The traction is broad and corroborated, with more than 40 percent of the Fortune 100 and named customers including PayPal, Netflix, and Samsung.

A distinct federal channel runs alongside the commercial one. The FedRAMP High authorization and a marketplace listing for Aqua U.S. Gov open direct sales to government agencies, a motion that requires comparable federal authorization for similar deployments.

The 2025 restructuring reframes the growth posture. Three rounds of layoffs and a stated push toward cash flow independence indicate a stronger efficiency component alongside the company's stated growth and expansion. \[[s1](#deep-dive-sources), [s4](#deep-dive-sources), [s5](#deep-dive-sources), [s7](#deep-dive-sources)\]

### Pricing Model

Aqua publishes no list pricing in the fetched pages, so the charged unit and list price stay private. The demo-gated packaging and enterprise positioning point to a negotiated sales motion, though the deal size and billing unit are not publicly confirmed.

The unified platform implies value scaling with the size of the cloud estate under protection rather than a simple per-seat charge, but the public record does not document the metric, so the budget-anchoring signal some peers publish is absent here. \[[s1](#deep-dive-sources), [s2](#deep-dive-sources)\]

### Product Delivery & Operations

Aqua sells a software platform for teams to scan code and supply chain, gate posture before deployment, and protect workloads at runtime, blending agent and agentless coverage. The company states the Aqua Secure AI line enforces policy without requiring SDKs, proxies, or code changes, lowering the operational cost of adoption.

A separate federal delivery exists for government buyers. Aqua U.S. Gov is hosted on AWS GovCloud and carries the FedRAMP High authorization, a delivery footprint tailored to public-sector requirements that the commercial SaaS does not by itself satisfy. \[[s3](#deep-dive-sources), [s5](#deep-dive-sources)\]

### Earning Customers' Trust

Aqua publishes a substantive security posture through a trust center listing SOC 2 Type II, ISO 27001 from 2022, ISO 27017, ISO 27018, ISO 27701, CSA STAR, GDPR, and NIST 800-53 alignment, with controls and subprocessor disclosures available on request.

The federal authorization is the strongest trust signal. Aqua holds FedRAMP authorization at the High impact level, sponsored by the Department of Education and listed in the FedRAMP marketplace, a credential regulated buyers weigh heavily. \[[s5](#deep-dive-sources), [s8](#deep-dive-sources)\]

### Platform Strategy & Ecosystem Positioning

Aqua positions a single platform spanning code, software supply chain, cloud posture, and runtime rather than a point tool, which lets a buyer consolidate several cloud native security functions with one vendor.

The open-source ecosystem is a genuine asset. Aqua maintains Trivy, an open-source scanner it describes as trusted by security professionals, which seeds awareness among practitioners and feeds a community pipeline, though it is open source and so confers reach rather than a proprietary lock. \[[s1](#deep-dive-sources), [s2](#deep-dive-sources), [s10](#deep-dive-sources)\]

### Team & Execution Capability

Aqua was founded in 2015 by Dror Davidoff and Amir Jerbi, who built it over a decade into a recognized category leader from its origins in container security as Scalock.

Leadership changed materially in November 2025. Both founders moved to strategic advisory roles, Mike Dube, who joined from a senior enterprise sales role at CrowdStrike, became chief executive, and a former engineering vice president took the product and technology seat. The new top of the company is weighted toward commercial execution rather than a fresh founder-led product vision. \[[s6](#deep-dive-sources), [s7](#deep-dive-sources)\]

## Sources

### Company Detail Sources

Cited from the Sourced Details and Matrix Coverage rows.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | [Aqua CNAPP products overview](https://www.aquasec.com/products/) | official | 2026-06-25 |
| f2 | [Aqua Security raises $60M and remains a unicorn (TechCrunch)](https://techcrunch.com/2024/01/03/cloud-native-cybersecurity-startup-aqua-security-raises-60m-and-remains-a-unicorn/) | press | 2026-06-25 |
| f3 | [Aqua Security raises $135M at a $1B valuation (TechCrunch)](https://techcrunch.com/2021/03/10/aqua-security-raises-135m-at-a-1b-valuation-for-its-cloud-native-security-service/) | press | 2026-06-25 |
| f4 | [AI Defense Matrix Catalog mapping (Aqua Secure AI)](https://www.aquasec.com/solutions/ai-application-security/) | official | 2026-06-25 |

### Profile Analysis Sources

Cited from the Market Readiness section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Aqua Security homepage (protect what runs in the cloud, 40% of the Fortune 100)](https://www.aquasec.com/) “Trusted by more than 40% of the Fortune 100” | official | 2026-06-25 |
| s2 | [Aqua CNAPP products (code to cloud to prompt)](https://www.aquasec.com/products/) “Secure every phase, protect every workload and reduce cloud and AI risk everywhere applications run. Aqua delivers full lifecycle security from code to cloud to prompt.” | official | 2026-06-25 |
| s3 | [Aqua Secure AI (protect AI apps from code to cloud to prompt)](https://www.aquasec.com/solutions/ai-application-security/) “Gain visibility into prompt and model behavior inside containers where AI applications are hosted and run. Aqua enforces policy in real time without requiring SDKs, proxies, or rewrites.” | official | 2026-06-25 |
| s4 | [Aqua Security raises $135M at a $1B valuation (TechCrunch)](https://techcrunch.com/2021/03/10/aqua-security-raises-135m-at-a-1b-valuation-for-its-cloud-native-security-service/) “raised a $135 million Series E funding round at a $1 billion valuation. The round was led by ION Crossover Partners.” | press | 2026-06-25 |
| s5 | [Aqua Security raises $60M and remains a unicorn (TechCrunch)](https://techcrunch.com/2024/01/03/cloud-native-cybersecurity-startup-aqua-security-raises-60m-and-remains-a-unicorn/) “raised $60 million in funding, extending its previously announced $135 million Series E round of funding to $195 million. Founded in 2015, Tel Aviv- and Boston-based Aqua Security claims customers such as PayPal, Netflix and Samsung” | press | 2026-06-25 |
| s6 | [Aqua Security Achieves FedRAMP High Authorization (GlobeNewswire wire)](https://www.globenewswire.com/news-release/2025/04/08/3057524/0/en/Aqua-Security-Achieves-FedRAMP-High-Authorization.html) “it has achieved the Federal Risk and Authorization Management Program's (FedRAMP) high impact authorization status and is listed in the FedRAMP marketplace. Sponsored by the Department of Education” | press | 2026-06-25 |
| s7 | [Aqua Security Announces Leadership Transition (GlobeNewswire wire, Nov 2025)](https://www.globenewswire.com/news-release/2025/11/05/3181654/0/en/Aqua-Security-Announces-Leadership-Transition-as-Company-Enters-Its-Next-Phase-of-Growth.html) “Co-founders Dror Davidoff and Amir Jerbi will step back from their day-to-day roles as chief executive officer and chief technology officer ... Mike Dube ... has been appointed CEO ... Prior to joining Aqua, Dube served as vice president, North America Strategic Sales at CrowdStrike” | press | 2026-06-25 |
| s8 | [Aqua Security lays off staff weeks after management shake-up (CTech)](https://www.calcalistech.com/ctechnews/article/4bzp62ggf) “Cyber unicorn Aqua Security is laying off dozens of employees, including about 20 in Israel. This is the company's third round of layoffs in recent years. Aqua employs roughly 360 people in total.” | press | 2026-06-25 |
| s9 | [Aqua Security homepage customer wall (Audi container platform at scale)](https://www.aquasec.com/) “Audi uses Aqua to Protect Container Platform at Scale” | official | 2026-06-25 |
| s10 | [Google completes acquisition of Wiz (Cybersecurity Dive)](https://www.cybersecuritydive.com/news/google-32-billion-acquisition-wiz/814437/) “Google completes acquisition of Wiz” | press | 2026-06-25 |
| s11 | [Aqua Security Trust Center (SOC 2 Type II, ISO 27001 2022, CSA STAR, NIST 800-53)](https://trust.aquasec.com/) “Compliance: CSA Star, GDPR, NIST 800-53 Low Baseline, ISO 27017:2015, SOC 2 Type II, ISO 27001:2022, ISO27018:2019, ISO 27701:2019” | official | 2026-06-25 |
| s12 | [Israeli Registrar of Companies: AQUA SECURITY SOFTWARE LTD (company 515317972, incorporated 24/09/2015, status active, annual report 2025)](https://data.gov.il/api/3/action/datastore_search?resource_id=f004176c-b85f-4542-8901-7b3176f9a054&q=Aqua%20Security&limit=20) “"שם באנגלית":"AQUA SECURITY SOFTWARE LTD","סוג תאגיד":"ישראלית חברה פרטית","סטטוס חברה":"פעילה","תאור חברה":"","מטרת החברה":"לעסוק בכל עיסוק חוקי","תאריך התאגדות":"24/09/2015"” | regulatory | 2026-06-29 |
| s13 | [NVD CVE-2024-35192: credential leak in Aqua's Trivy scanner before 0.51.2](https://nvd.nist.gov/vuln/detail/CVE-2024-35192) “it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR)” | regulatory | 2026-06-29 |
| s14 | [arXiv gh0stEdit (2506.08218): independent security evaluation naming Aqua's Trivy scanner](https://arxiv.org/html/2506.08218) “a vulnerability scanner provided by Aqua Security, functions similarly to Docker Scout and Grype” | research | 2026-06-29 |

### Deep-Dive Sources

Cited from the Strategy Deep Dive section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Aqua Security homepage (protect what runs in the cloud, 40% of the Fortune 100)](https://www.aquasec.com/) “Trusted by more than 40% of the Fortune 100” | official | 2026-06-25 |
| s2 | [Aqua CNAPP products (code to cloud to prompt)](https://www.aquasec.com/products/) “Secure every phase, protect every workload and reduce cloud and AI risk everywhere applications run. Aqua delivers full lifecycle security from code to cloud to prompt.” | official | 2026-06-25 |
| s3 | [Aqua Secure AI (protect AI apps from code to cloud to prompt)](https://www.aquasec.com/solutions/ai-application-security/) “Gain visibility into prompt and model behavior inside containers where AI applications are hosted and run. Aqua enforces policy in real time without requiring SDKs, proxies, or rewrites.” | official | 2026-06-25 |
| s4 | [Aqua Security raises $60M and remains a unicorn (TechCrunch)](https://techcrunch.com/2024/01/03/cloud-native-cybersecurity-startup-aqua-security-raises-60m-and-remains-a-unicorn/) “raised $60 million in funding, extending its previously announced $135 million Series E round of funding to $195 million. Founded in 2015, Tel Aviv- and Boston-based Aqua Security claims customers such as PayPal, Netflix and Samsung” | press | 2026-06-25 |
| s5 | [Aqua Security Achieves FedRAMP High Authorization (GlobeNewswire wire)](https://www.globenewswire.com/news-release/2025/04/08/3057524/0/en/Aqua-Security-Achieves-FedRAMP-High-Authorization.html) “it has achieved the Federal Risk and Authorization Management Program's (FedRAMP) high impact authorization status and is listed in the FedRAMP marketplace. Sponsored by the Department of Education” | press | 2026-06-25 |
| s6 | [Aqua Security Announces Leadership Transition (GlobeNewswire wire, Nov 2025)](https://www.globenewswire.com/news-release/2025/11/05/3181654/0/en/Aqua-Security-Announces-Leadership-Transition-as-Company-Enters-Its-Next-Phase-of-Growth.html) “Co-founders Dror Davidoff and Amir Jerbi will step back from their day-to-day roles ... Mike Dube ... has been appointed CEO ... Prior to joining Aqua, Dube served as vice president, North America Strategic Sales at CrowdStrike” | press | 2026-06-25 |
| s7 | [Aqua Security lays off staff weeks after management shake-up (CTech)](https://www.calcalistech.com/ctechnews/article/4bzp62ggf) “This is the company's third round of layoffs in recent years. Aqua employs roughly 360 people in total. The company was founded in 2015 by CEO Dror Davidoff and CTO Amir Jerbi.” | press | 2026-06-25 |
| s8 | [Aqua Security Trust Center (SOC 2 Type II, ISO 27001 2022, CSA STAR, NIST 800-53)](https://trust.aquasec.com/) “Compliance: CSA Star, GDPR, NIST 800-53 Low Baseline, ISO 27017:2015, SOC 2 Type II, ISO 27001:2022, ISO27018:2019, ISO 27701:2019” | official | 2026-06-25 |
| s9 | [Google completes acquisition of Wiz (Cybersecurity Dive)](https://www.cybersecuritydive.com/news/google-32-billion-acquisition-wiz/814437/) “Google completes acquisition of Wiz” | press | 2026-06-25 |
| s10 | [Aqua Software Supply Chain Security (code, IaC, LLM components)](https://www.aquasec.com/products/software-supply-chain-security/) “Shift security left to protect every link in the software supply chain, including application code, IaC, and LLM components, before risks reach production.” | official | 2026-06-25 |

## Disclaimer

This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.

The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.

Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.

The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.

To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.

Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.

Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.