Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
ProjectDiscovery won RSA Conference’s 20th annual Innovation Sandbox contest on April 28, 2025. The open-source security company was named “Most Innovative Startup 2025” after pitching at RSAC 2025 in San Francisco. In a first for the contest, RSAC also said each of the 10 finalists would receive a $5 million investment.
What is the RSAC Innovation Sandbox?
The Innovation Sandbox is RSA Conference’s startup contest, where early-stage cybersecurity companies present products to an expert judging panel. In 2025, each finalist was scheduled to give a three-minute pitch and answer judges’ questions at the conference in San Francisco on April 28.
The contest’s 20th edition drew more than 200 startup applications. RSAC said submissions were up by more than 40% compared with 2024. The annual event is also part of a wider set of RSAC programs for emerging companies, including Launch Pad, Early Stage Expo, and Next Stage.
Who won, and what does ProjectDiscovery do?
ProjectDiscovery was named “Most Innovative Startup 2025” on April 28. RSAC highlighted its open-source tools, powered by Nuclei, as helping security teams find and fix vulnerabilities quickly. The company’s COO, Andy Cao, described the award as recognition that “open source is possible in security.”
The award recognizes ProjectDiscovery as the contest winner; it is not, by itself, independent proof of how well its tools perform in a particular organization or environment. RSAC judge and Marconi Prize winner Paul Kocher called the contest a driver for bringing new technology to market.
How much did the 2025 finalists receive?
RSAC announced that every Top 10 finalist would receive a $5 million investment, describing the initiative as a $50 million annual investment program. This was the first year RSAC said all 10 finalists would receive an investment. The announcement establishes the amounts and the program’s framing, but does not specify individual investment terms or structures.
Which startups were 2025 finalists?
RSAC’s April 8, 2025 announcement confirms a Top 10 but names the following six companies in its available text. It does not identify the other four there, so they are not listed here.
| Finalist | Problem area | AI or automation focus | Security control or approach | Operating context | Product validation stated in the finalist announcement |
|---|---|---|---|---|---|
| Aurascape | Protecting AI systems | AI, generative AI, and AI agents | Protection for AI systems | AI applications and agents | Not stated in the finalist announcement |
| CalypsoAI | Runtime security for AI applications and agents | AI applications and agents | Defensive controls, red-teaming, remediation, governance, and observability | AI application runtime | Not stated in the finalist announcement |
| Command Zero | Security operations investigations and threat hunting | Autonomous and AI-assisted investigations | Investigation and threat-hunting workflows | Security operations | Not stated in the finalist announcement |
| EQTY Lab AG | AI-agent governance | AI agents | Cryptographic controls intended to make governance accountable and verifiable | AI-agent governance | Not stated in the finalist announcement |
| Knostic | Access control for large language models | Large language models | Need-to-know access controls | LLM use | Not stated in the finalist announcement |
| Twine Security | Identity-management work for cyber teams | AI digital employees | Automated identity-management tasks | Cybersecurity teams | Not stated in the finalist announcement |
These descriptions summarize the problem areas and approaches RSAC attributed to the named finalists; finalist status does not establish product effectiveness. RSAC’s published selection criteria did require client beta-testing or purchase validation, but the finalist announcement does not provide company-by-company validation details.
How did RSAC select the finalists?
For the 2025 contest, RSAC’s published criteria required a product and company to meet these conditions:
- The product launched between December 1, 2023, and February 14, 2025.
- It addressed an identified problem in the cybersecurity market.
- It used an original, sound approach with significant potential impact.
- It had client beta-testing or purchase validation.
- It could be demonstrated live.
- It came from a management team with a record of delivering products.
- It came from a privately held company below the published 2024 revenue-or-ARR threshold of $5 million.
The 2025 application deadline was 8 p.m. Pacific Time on February 14. Finalist presentations took place on April 28.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What does the contest’s track record show?
RSAC reported that, over the program’s first 19 years, Top 10 finalists collectively raised more than $16.4 billion, citing Crunchbase data as of December 31, 2024. RSAC also reported more than 90 merger-and-acquisition transactions involving finalists.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteExamples cited by RSAC illustrate the range of those outcomes. Wiz announced its acquisition of Dazz for an estimated $450 million, and Palo Alto Networks announced its acquisition of Talon Cyber Security for an estimated $625 million; both estimates were attributed to PitchBook as of April 8, 2025. In March 2025, Google announced an agreement to acquire Wiz for $32 billion. The Google transaction was an announced agreement, not a statement that the acquisition had closed.
Best Value
Recent winners show how the contest has changed across cybersecurity categories:
- 2025: ProjectDiscovery
- 2024: Reality Defender
- 2023: HiddenLayer
- 2022: Talon Cyber Security
- 2021: Apiiro
- 2020: Securiti.ai
- 2019: Axonius
- 2018: BigID
- 2017: UnifyID
- 2016: Phantom
- 2015: Waratek
Nasrin Rezai, Verizon SVP and CISO, said the Top 10 selection process sends the market a signal about which startups to watch. The funding totals and acquisition history offer context for why the contest attracts attention, but they do not guarantee a finalist’s future commercial success.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
