Key Takeaways:
- Every vendor on Tropic's Q3 2026 fastest-growing lists owes its growth to AI in some way, whether it builds AI, sells to teams adopting it, or protects companies from its risks.
- Security and resilience vendors made up the largest share of the list we've ever recorded, including Cloudflare, Wiz, Rubrik, incident.io, Adaptive Security, Vanta and CrowdStrike.
- Anthropic held #1 in enterprise but dropped to #10 in SMB and fell off the mid-market list entirely, after ranking #1 in all three segments in Q2 2026.
- AI coding moved from generation to review. Cursor, Vercel and Anthropic grew alongside Sonar and CodeRabbit, the tools that check what AI writes.
The fastest-growing software vendors in Q3 2026 split into two camps: the companies putting AI to work, and the companies protecting businesses from what AI creates. Tropic ranked vendor growth across its network of $25B+ in spend under management, segmented by company size. AI coding, AI-driven go-to-market and data infrastructure led one side. Security and resilience tools filled the other, in greater numbers than in any quarter we've tracked. You can see earlier rankings here.
Which Software Vendors Grew Fastest in Q3 2026?
Pave, Anthropic and SEMrush led Tropic's Q3 2026 fastest-growing vendor lists in mid-market, enterprise and SMB.
Three vendors placed in two segments: SEMrush (#2 mid-market, #1 SMB), Sonar (#7 mid-market, #2 SMB) and incident.io (#10 mid-market, #7 enterprise). When a vendor climbs in more than one segment in the same quarter, that's broad demand, not one big customer skewing the ranking.
Is AI Coding Still Driving Software Growth?
Yes, and in Q3 2026 the growth spread from writing code to checking it. AI code generation tools held their place on the list, and AI code review tools joined them.
Code generation: Anthropic, driven largely by Claude Code, ranked #1 in enterprise. Vercel (#5) and Cursor (#9) both made the mid-market list. Cursor also appeared on our Q2 enterprise list, making it one of the few vendors to place in back-to-back quarters.
Code review: Sonar ranked #7 in mid-market and #2 in SMB, and CodeRabbit closed out the enterprise list at #10. Both exist to catch bugs, security flaws and quality problems before code ships.
The pairing isn't a coincidence. When AI writes more of a company's code, someone has to review more of it, and engineering headcount isn't growing to match. In Q2, we saw that pattern in tools like Chainguard and DX. In Q3, it showed up directly in code review.
For buyers, these are two very different contracts. Code generation tools increasingly price on usage or credits, so cost scales with adoption. Our credit-based AI pricing negotiation guide covers how to protect that spend. Code review tools often price per seat or per repository, which makes them easier to forecast and to benchmark against what peers pay.
Why Are Security Vendors Growing So Fast in 2026?
Security vendors are growing because AI is expanding the attack surface faster than security teams can cover it. Q3 2026 had more security and resilience vendors on Tropic's fastest-growing lists than any quarter we've tracked: seven vendors filling eight of the 30 spots.
- Cloudflare (#3 mid-market) for network and application security
- Rubrik (#3 enterprise) for data security and recovery
- incident.io (#10 mid-market, #7 enterprise) for incident response
- Wiz (#8 enterprise) for cloud security
- Adaptive Security (#9 enterprise) for defending against AI-powered social engineering
- Vanta (#4 SMB) for security compliance
- CrowdStrike (#8 SMB) for endpoint protection
In Q2, security already accounted for a meaningful slice of the list through Wiz, HackerOne and Chainguard. Q3 roughly doubled it.
"AI is the accelerator. Security is the brake. In Q3, companies bought both."
The logic is simple. AI tools write more code, connect to more systems and handle more sensitive data. Attackers are using the same technology for phishing, deepfakes and faster exploits. Every new AI tool a company adopts adds something a CISO has to secure, and the budget follows.
Two patterns stand out. First, security is moving down-market. Vanta and CrowdStrike on the SMB list mean small teams now treat security as table stakes, not a later-stage purchase. Second, the list skews toward resilience, not just prevention. Rubrik and incident.io are about recovering fast when something breaks, which suggests companies are planning for incidents instead of assuming they can stop all of them.
Security contracts tend to be multi-year and tied to usage metrics like endpoints, workloads or data volume. Those terms are worth benchmarking carefully, since they compound as your AI footprint grows. Tropic's contract negotiation strategies cover how to structure them.
Why Did Pave Top the Mid-Market List?
Pave ranked #1 in mid-market because AI can't generate the one thing it sells: reliable, real-time compensation benchmark data.
A language model can tell you what a senior engineer typically earns. It can't tell you what companies your size, in your market, paid for that role last month. That answer only comes from live, verified data across thousands of companies, and in a year when teams are rethinking roles and headcount around AI, getting comp right matters more than ever.
Pave's ranking points to a broader pattern on this list. Some of the fastest-growing vendors aren't selling AI at all. They're selling proprietary data that AI tools can't replicate, and that becomes more valuable as more decisions get made with AI's help. The same applies to software pricing: knowing what a vendor says it charges is easy, while knowing what companies like yours actually pay takes real transaction data.
Drivetrain (#6 mid-market) and Ironclad (#9 SMB) fit a similar mold. Finance and legal teams are adopting AI-assisted planning and contracting, but the value still rests on the company's own data being accurate, structured and current.
What Changed Between Q2 and Q3 2026?
Most of the list turned over. Only five vendors placed in both quarters, and two of them moved from smaller segments into enterprise.
Anthropic slipped everywhere but enterprise. After ranking #1 in all three segments in Q2, Anthropic fell to #10 in SMB and dropped off the mid-market list. That doesn't mean demand is fading. AI-native vendors are still growing customer spend faster than any other cohort, as our Q3 net dollar retention data shows. The likelier explanation is saturation. When most smaller companies already have an Anthropic contract, there are fewer new ones left to sign, and growth shifts to expanding existing accounts.
OpenAI and Clay fell off entirely. Both were top-10 mid-market vendors in Q2. Like Anthropic outside enterprise, they look more like established vendors now than breakout ones.
Data infrastructure broke through. Databricks (#2 enterprise), ClickHouse (#4 enterprise) and Fivetran (#3 SMB) all made the list. AI is only as useful as the data underneath it, and companies are investing to get that data moved, stored and ready to query.
Vendors moved upmarket. In Q2, Wiz was the example of an enterprise vendor moving down-market. In Q3, both Wiz and Nooks showed up in enterprise after growing fastest with smaller companies the quarter before.
For more context on how these vendors fit into the broader market, see Tropic's State of Software Procurement 2026 and our analysis of the SaaSpocalypse.
How Should Buyers Negotiate With Fast-Growing Vendors?
Assume a fast-growing vendor isn't motivated by a discount request, and negotiate on terms instead. When customers are signing up on their own, list price is rarely where you have leverage.
- Lock in pricing before you scale. Fast growth often comes with price increases at renewal. Push for multi-year price holds, uplift caps and a contractual rate table on any usage-based component.
- Budget for the counterweight. If your teams are adopting AI coding or GTM tools, plan for the security, code review and data infrastructure spend that tends to follow. Q3 shows those categories growing right behind the AI tools themselves.
- Use your timing. Vendors moving upmarket, like Wiz and Nooks, want enterprise logos and case studies. Early enterprise customers can often trade a reference for better terms.
- Watch for repricing at renewal. Vendors adding AI features often bundle them into new tiers. Ask for a clear breakdown of what changed before accepting an increase, and catch renewals early with Tropic's Renewal Agent.
- Benchmark everything. Fast-growing vendors change pricing often, so last year's deal is a weak reference point. Compare against current Tropic pricing data and follow live supplier alerts for changes as they happen.
For a broader framework, see our guide to managing AI costs and the H1 2026 AI pricing trends report.
Frequently Asked Questions
What were the fastest-growing software companies in Q3 2026? In Tropic's Q3 2026 rankings, Pave led mid-market, Anthropic led enterprise and SEMrush led SMB. SEMrush, Sonar and incident.io each placed in two segments.
Is Anthropic still the fastest-growing AI vendor? Anthropic ranked #1 in enterprise for Q3 2026 but fell to #10 in SMB and dropped off the mid-market list, after leading all three segments in Q2. The shift likely reflects how many smaller companies already have contracts, not falling demand.
Why are security vendors growing so fast? AI adoption expands the attack surface: more code, more connected systems, more sensitive data and more AI-powered attacks. Seven security and resilience vendors made Tropic's Q3 2026 lists, the most we've recorded, including Cloudflare, Wiz, Rubrik and CrowdStrike.
What is the fastest-growing category of AI software? AI coding remains one of the strongest categories, now spanning both code generation tools like Claude Code, Cursor and Vercel and code review tools like Sonar and CodeRabbit. AI-driven go-to-market tools like SEMrush, Profound and Nooks also grew quickly in Q3 2026.
Can you negotiate a discount with a fast-growing software vendor? Rarely on list price, since fast-growing vendors have strong organic demand. Focus on price holds, uplift caps, contractual rate tables and usage protections, and use reference or case study value if you're an early customer in a new segment.
How does Tropic rank the fastest-growing vendors? Tropic ranks vendor growth across its customer network, segmented by company size into SMB, mid-market and enterprise. The rankings reflect real purchasing activity, not surveys or stated intent.
