Cloud Security Attestation and Secure-by-Design

Where this market publishes its structure

• CISA Secure by Design Pledge signers (cisa.gov/securebydesign/pledge/secure-design-pledge-signers) machine-readable, 393 signers, names only; 111 in-market providers linked (Wikidata P856 or register-name); 35 out-of-market held; 43 Wikidata domains held by no repo / name-failed; 202 no identity
• CSA STAR Registry (cloudsecurityalliance.org/star/registry) machine-readable, read by compliance-assurance (sweep-compliance-assurance.py, 2026-10-20); not re-read to avoid double edges
• EU Cloud Code of Conduct public register (eucoc.cloud/en/public-register) machine-readable, read by compliance-assurance; not re-read
• FIDO Alliance certified products (fidoalliance.org/certification/fido-certified-products/) not machine-readable: owned by identity / biometrics-testing; directory under migration freeze, search reCAPTCHA-gated
• CSA corporate member directory (cloudsecurityalliance.org/membership/current) not machine-readable: member grid renders empty in server HTML and in a headless browser (pagination only, reCAPTCHA on page); /membership/members 404

Own = declares at least one integration itself; covered = visible only because an aggregator, standards body, regulator or partner contract names it; distribution-only = listed only on cloud marketplaces it sells through, a channel reported beside, never counted as its own declared integrations; undeclared = nothing we can read, so no number; declares_compatibility = providers with a `compatible` shape vote, report only (kin, 2026-10-13): never counted as own, never in depth or position.

Taxonomy how this market maps onto apis.io

Derived 2026-10-21 from the 131 providers in this market we could resolve in the catalog. The percentage is the share of those providers carrying each one; it describes the market, not the tag or industry. Tag groups have no page of their own yet, so they are listed unlinked.

share of resolved cohort carrying it; tags >=0.20 & >=3 members (max 12, junk dropped), tag_groups >=0.20 (cooccurrence, non-cross-cutting; max 8), industries >=0.20 (max 6), areas >=0.10 (max 6; areas are keyword-matched and sparse), capabilities L1 >=0.20 (max 8); derive-market-taxonomy.py

Leaders by position (provisional)

Provisional: grouped by position, depth compared within a position only. Distribution (cloud marketplaces) and iPaaS bridges are counted beside position, never inside it. Unknown-builder listings are left out of position shares and counted here.

gravity 3 · other companies invest to build on it

builds-on 58 · publishes apps on other platforms' stores

standard 47 · listed by a voluntary standard's own directory

core 1 · builds the connectors its customers need

mixed 13 · no single mode dominates

long-tail 1 · reached only through iPaaS bridges

distribution 2 · only sells through cloud marketplaces

undeclared 6 · declares nothing we can read: no number

Top workflows by market votes

Workflows (Arazzo) and their phrasing are generated by API Evangelist, ranked by market votes (integration edges in the graph, weighted by channel).

In-market workflows only: a step on the market provider's side maps to this market's business capabilities (), and the partner is not a generic export/notify app. Other workflows are counted as bridges (including any whose steps do not resolve to a capability yet). Methodology. In-market: 4; bridges: 0.