Periodic Table

The software supply chain, laid out so position means something.

Twenty-five domains, 348 products, laid out in the order the chain runs. Open one to see its controls arranged by the program maturity each demands, how much of the modeled threat it closes, and who actually sells it.

Table

Capabilities Products

← All 25 domains

14Runtime Application Validation

25 shown

Do we test our running applications and exposed surfaces often enough to find what attackers would find first — and verify our fixes actually work?

Color

Who maintains it Licensing Evaluation scores

Who maintains it

Foundation0
Community2
Company23

Open Source

5 here

Free

1 here

Of211OSS-Fuzz1 capabilities

Freemium

2 here

Commercial

17 here

NodeZero

Horizon3.ai · Runtime Application Validation

Close ×

CommercialCompany

NodeZero performs internal, external and cloud pentests on demand, verifies fixes and shows exploitable attack paths including identity compromise.

What it does4 capabilities · 4 at full coverage

4 of 4 at full coverage.

Fix ValidationFullEVM · level 3 · 5 providers
Identity Attack Path ValidationFullIAM · level 4 · 4 providers
Automated Penetration TestingFullVALIDATE · level 3 · 3 providers
Exploitability ValidationFullVALIDATE · level 3 · 7 providers

What it proves9 controls across 5 frameworks

Satisfied through its capabilities, not claimed by the vendor.

CSF 2.04 / 106ID.IM-02 ID.RA-01 ID.RA-04 RC.RP-05
SSDF 1.12 / 42RV.2.1 RV.2.2
CIS Controls1 / 18CIS 18
CRA1 / 41Annex I Part I (2)(a)
SAMM 2.01 / 90V-ST-2-B

What it stops3 techniques · 2 risks

3 techniques countered, 3 of them common

Remote ServicesT1021Very Common
Valid AccountsT1078Very Common
Account ManipulationT1098Common

2 risks reduced

Critical exposures lost in an unprioritized finding backlogHigh
Excessive standing privilege in engineering platformsHigh

Where it runs3 phases · 1 way to deploy

Capabilities per lifecycle phase

Test3
Operate3
Monitor1

How it is delivered

SaaS

What it unlocks3 activities · reaches level 4

Program activities its capabilities support, reaching level 4. Supporting an activity is not completing it.

Level 4

Continuous exploitability validation and attack simulationMedium effort
Identity threat detection and attack path validationMedium effort
Validate fixes and correlate across layersMedium effort

How it holds up

Not assessed yet: no strengths, limits or evaluation scores. 47 of 340 products carry an assessment and 29 are scored.

What it costsPer asset

LicensingPer asset

Priced perasset per year

BillingSubscription

Scales withDiscovered or scanned assets (IPs, hosts, domains)

Total cost

Asset discovery can increase counts unexpectedly; agree on counting rules.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with

No supported language, standard, integration or named feature recorded.

What else to look at

No alternative, competitor or family sibling is modeled for it.

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13

How this was produced

Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 1240 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.