Phylum

Name: Phylum
Brand: Phylum

AI Native

The Software Supply Chain Security Company

Est 2020|Valuation $46.5M|Raised $19.5M|3 Ref Customers

LinkedIn 3K|Website|FTEs 21|HQ Evergreen, Colorado, US

MarketsApplication Security Testing (AST)

01Competitive Landscape

Narrative analysis

Where Phylum appears differentiated - The primary differentiator in public materials is detection and mitigation of malicious packages beyond CVE databases and the capability to enforce policy at the point of package consumption. Where competitors may be stronger - **Sonatype:** Longer history in artifact/repository governance and clearer baseline pricing for some offerings. - **Snyk:** Broader AppSec consolidation for buyers seeking a single vendor for SCA, SAST, containers, and IaC, plus developer-centric integrations. Adoption and market trend notes - Veracode’s acquisition of Phylum technology signals strategic value in Phylum’s malware-detection capabilities, but buyers should confirm whether purchase decisions will be for a standalone Phylum product or for Veracode SCA features that incorporate Phylum technology.

	Phylum (phylum.io)	Sonatype (Nexus Lifecycle/Firewall)	Snyk (Snyk Open Source)
Starting Price	Contract-based; marketplace examples indicate enterprise-level annual contracts	Firewall and Lifecycle pricing is published with per-user references; some features require additional infrastructure	Public pricing exists for basic tiers; enterprise tiers generally require a quote
Primary use case	Organizations prioritizing malicious package detection and enforcement at consumption time	Organizations wanting mature component intelligence, policy, and repository-centric controls	Developer-focused organizations seeking broad AppSec coverage (SCA, SAST, containers, IaC)
Key Strength	Near-real-time package monitoring with a focus on malware and behavior analysis; provides a threat feed and enforcement options	Established enterprise footprint; governance and repository controls; clearer baseline pricing	Broad platform coverage across AppSec domains; strong developer integrations and workflows
Key Weakness	Limited public third-party reviews; unclear public compliance disclosures; post-acquisition packaging uncertainty	Some features require additional infrastructure (IQ server); costs can scale with usage	Complex pricing at enterprise scale; some features gated by higher tiers

01Competitive Landscape

Narrative analysis

Where Phylum appears differentiated

The primary differentiator in public materials is detection and mitigation of malicious packages beyond CVE databases and the capability to enforce policy at the point of package consumption.

Where competitors may be stronger

Sonatype: Longer history in artifact/repository governance and clearer baseline pricing for some offerings.
Snyk: Broader AppSec consolidation for buyers seeking a single vendor for SCA, SAST, containers, and IaC, plus developer-centric integrations.

Adoption and market trend notes

Veracode’s acquisition of Phylum technology signals strategic value in Phylum’s malware-detection capabilities, but buyers should confirm whether purchase decisions will be for a standalone Phylum product or for Veracode SCA features that incorporate Phylum technology.

	Phylum (phylum.io)	Sonatype (Nexus Lifecycle/Firewall)	Snyk (Snyk Open Source)
Starting Price	Contract-based; marketplace examples indicate enterprise-level annual contracts	Firewall and Lifecycle pricing is published with per-user references; some features require additional infrastructure	Public pricing exists for basic tiers; enterprise tiers generally require a quote
Primary use case	Organizations prioritizing malicious package detection and enforcement at consumption time	Organizations wanting mature component intelligence, policy, and repository-centric controls	Developer-focused organizations seeking broad AppSec coverage (SCA, SAST, containers, IaC)
Key Strength	Near-real-time package monitoring with a focus on malware and behavior analysis; provides a threat feed and enforcement options	Established enterprise footprint; governance and repository controls; clearer baseline pricing	Broad platform coverage across AppSec domains; strong developer integrations and workflows
Key Weakness	Limited public third-party reviews; unclear public compliance disclosures; post-acquisition packaging uncertainty	Some features require additional infrastructure (IQ server); costs can scale with usage	Complex pricing at enterprise scale; some features gated by higher tiers