GRC &amp; compliance

SBOM generation and analysisContinuous SBOM vulnerability monitoring+9

Anchore is creating a more secure software supply chain for priceless peace of mind.

Anecdotes.ai

AI agents automate GRC workflows+10

We're Anecdotes, and we're transforming how enterprise teams manage governance, risk, and compliance. We built the world's first enterprise agentic GRC platform to fundamentally change what's possible in GRC, and empower teams to focus on what matters.

Archer (formerly RSA Archer)

Centralize GRC data in one repository+11

Archer, formerly RSA Archer and now independent after RSA Security divestiture, provides an integrated GRC platform for enterprise governance, risk, and compliance management. It centralizes data aggregation from multiple sources, supports risk assessments, policy management, audit workflows, incident tracking, and business continuity planning. The configurable platform enables automated compliance monitoring for regulations like GDPR and HIPAA, with modules for controls testing and reporting. Widely adopted by large organizations and governments like Virginia Commonwealth, Archer serves enterprises needing holistic risk visibility across IT, operational, and third-party domains.

ARCON

Privileged Access Management (PAM)

11 products

ARCON PAM is an enterprise-class privileged access management solution designed for hybrid, multi-cloud, and distributed datacenter environments. The platform centralizes control of privileged accounts across heterogeneous IT infrastructure through a unified admin console and secure gateway server. ARCON PAM targets IT security, risk, and compliance teams managing complex privilege lifecycles in organizations with DevOps and cloud-native workloads requiring fine-grained access controls and comprehensive audit trails.

Discovery and onboarding of privileged accountsPrivileged access control policies+10

AuditBoard

Audit management with continuous testingMulti-framework compliance monitoring+10

Built by practitioners for practitioners, Optro is an AI-powered GRC system of action that unifies audit, risk, infosec, and compliance into a single, connected platform. We empower the world's leading organizations to turn intelligence into a competitive advantage.

AvePoint

Data Security Posture Management (DSPM)

Sensitive data discovery and classification+11

AvePoint is the unifying Trust Layer for AI. AvePoint enables more than 28,000 organizations and 6,000 channel partners to protect, secure, and govern their entire AI estate across data, infrastructure, AI and agents for Microsoft, Google, Salesforce, and other leading cloud environments, so that enterprises can deploy AI with confidence and scale innovation without scaling risk.

Avertro

Authenticated and unauthenticated vulnerability checks

CyberHQ by Avertro is a cloud-native cyber resilience platform that unifies governance, risk, and compliance into a single, operationally integrated system. It replaces fragmented spreadsheets and siloed workflows with dynamic modules spanning risk registers, capabilities assessments, threat modelling, issue tracking, and board-ready reporting. Its multi-workspace architecture lets organisations manage risk locally while maintaining enterprise-wide visibility from a single pane of glass

Bitdefender

Endpoint Detection & Response (EDR)

11 products

At Bitdefender, cybersecurity isn't just what we do, it's who we are. For over two decades, we've been at the forefront of protecting individuals, businesses, and governments against sophisticated cyber threats and attacks. Our AI-driven technologies and world class security expertise make us a trusted partner in safeguarding what matters most.

Automated cross-endpoint attack correlation+10

BitSight

Third-party risk monitoring and onboarding+10

12 products

Risk now moves across enterprises, supply chains, cloud environments, and digital identities, and AI is accelerating how quickly vulnerabilities can be exploited. Bitsight continuously maps assets and vulnerabilities, prioritizing them with real-time threat intelligence so teams can see where risk is building, focus on what matters, and act before exposure becomes disruption.

Black Kite

Vendor compliance managementAutomated compliance correlation+9

We're building a world where cyber risk is no longer a barrier to business performance.

BlinkOps

AI agents investigate incoming alerts+8

BlinkOps is an agentic security automation platform that utilizes AI-driven agents to handle end-to-end security operations tasks including alert triage, investigation, and incident containment. It replaces traditional, manual SOAR playbooks with LLM-powered agents that can interpret natural language instructions to execute complex workflows across disparate security tools. The platform provides a low-code/no-code interface for building scalable security automations that reduce Mean Time to Respond (MTTR).

Center for Internet Security (CIS)

CIS Hardened Images for cloud workloads+5

The Center for Internet Security (CIS) provides Hardened Images and configuration benchmarks that serve as the industry standard for securing cloud operating systems and infrastructure. Their virtual machine images are pre-configured to meet CIS Benchmark standards, providing a secure baseline for AWS, Azure, and GCP environments out of the box. They complement CSPM tools by providing the gold-standard configurations used for compliance auditing and system hardening.

CertiK

Blockchain Security

Smart contract audits for blockchain securityFormal verification of smart contracts+10

Founded in 2017 by professors from Columbia and Yale, CertiK is a New York-based leader in Web3 security.

Coalfire

Security Operations

Managed security servicesThreat hunting and incident response+10

Coalfire's team of cyber legends who hunt, test, and neutralize vulnerabilities before they become headlines

Coalition

Cyber Health Rating with action prioritization+11

Active Insurance is coverage designed to prevent digital risk before it strikes. We combine the power of technology and insurance to help organizations identify, mitigate and respond to digital risks.

Commugen

Inherent risk evaluationResidual risk calculation+5

Commugen is a market leader in GRC management solutions

ComplianceQuest

Audit planning and scheduling+10

ComplianceQuest provides a cloud-based platform built natively on Salesforce for quality management (QMS), product lifecycle management (PLM), environmental health and safety (EHS), supplier relationship management (SRM), and regulatory compliance. SafetyQuest module handles EHS data analysis for incidents, inspections, chemical management, permits, waste, and sustainability. It serves regulated industries like manufacturing, life sciences, energy, and healthcare, unifying siloed processes to mitigate risks and ensure adherence to standards such as GDPR, ISO 9001, and SOC 2 Type II. Best for enterprises needing integrated QHSE workflows with Salesforce scalability and security.

Compyl

Automated compliance management across frameworks

To redefine GRC by delivering flexible, powerful solutions that help organizations confidently manage risk and compliance with clarity and ease.

Continuity

Continuous compliance monitoring+8

Continuity is a cloud-native, automated regulatory change management and risk solutions for the financial services industry, continuously updated by subject matter experts.

Cranium

AI Security Posture (AI-SPM)

AI asset discovery and inventory+6

Born from KPMG Studio, Cranium gives enterprise teams one place to discover, observe, govern, secure and prove every AI and agentic system they build, buy or rely on, so innovation never outruns trust.

DataGrail

Privacy & Consent Management

Automated cookie consent management+10

We believe transparency builds trust. That's why we created a platform that is purpose-built for brands to create robust privacy programs with ease.

Digital.ai

Endpoint Detection & Response (EDR)

Endpoint telemetry collection+7

Digital.ai is an industry-leading technology company dedicated to helping Global 5000 enterprises achieve digital transformation goals.

Diligent

Unified board and GRC platform+11

At Diligent, we believe in a world where transformational leaders can build more successful, equitable and sustainable organizations.

Drata

Automated evidence collection for compliance frameworksContinuous control monitoring and audit readiness

Building the Trust Layer Between Great Companies

Endor Labs

Supply Chain Security

OSS dependency governance+11

Endor Labs is a software supply chain security platform focused on open source governance and CI/CD risk detection. The platform targets DevSecOps teams seeking to reduce alert fatigue while maintaining security posture. Endor Labs distinguishes itself through reachability analysis that eliminates up to 95% of false positives in vulnerability scanning, enabling developers to focus on exploitable risks. The vendor positions itself against traditional SCA tools by providing contextual intelligence on code usage patterns and safe upgrade paths.

Exabeam

SIEM

Cloud-native security log managementHigh-speed log ingestion and search+8

Exabeam is the leader in behavior intelligence for the agentic enterprise.

Fable Security

Realistic phishing attack simulations+11

Fable brings together the best of engineering, behavioral science, and AI to solve one of security's hardest problems.

Fencer

Application Security (DAST/SAST)

Continuous DAST scanningBlack-box runtime probingExact finding location+8

Fencer is the platform we wish we had.

Feroot Security

Automated PCI and privacy complianceWeb compliance scanningClient-side script monitoring+9

Automated PCI, HIPAA & Privacy Compliance

FireMon

Firewall / NGFW

Firewall policy visibility and control+10

FireMon is a network security company focused on firewall policy control for the hybrid enterprise. FireMon helps organizations manage and analyze security policy across multi-vendor firewalls, cloud networks, and microsegmentation environments with real-time change visibility, risk analysis, automation, and continuous compliance.

GRC-Maestro

Automates checks and controls+6

GRC-Maestro, from Dynamic GRC, is a Compliance-as-a-Service platform for automating governance, risk, and compliance processes. It supports rule-based incident identification, manual breach assessment with classification and reasoning, and targeted controls applied to employees, clients, legal entities, regulators, and departments. The platform enables automated checks, incident management, and record keeping for evidence and reporting. Designed for regulated firms, it uses customizable Maestro-Templates for regulatory, legal, and internal controls across GRC requirements, providing flexible functionality without system replacement.

Hyperproof

Automates compliance obligation management+10

Hyperproof provides an AI-powered GRC platform for managing compliance programs, automating evidence collection via hypersyncs, and standardizing control operations across multiple frameworks like SOC 2. It positions as a competitor to AuditBoard and Vanta, targeting technology companies scaling GRC for global entities and new markets. Best suited for IT, security, and compliance teams at enterprises like Reddit and Fortinet handling complex organizations with hierarchical scopes, real-time risk monitoring, and control-to-risk mapping to reduce duplicated work.

IntelliGRC

Asset scoping and mapping+5

IntelliGRC is a cloud-based governance, risk, and compliance platform built for organizations pursuing certifications such as CMMC, NIST 800-171, SOC 2, ISO 27001, HIPAA, and CIS Controls. It targets managed service providers and managed security service providers that operationalize compliance work across multiple clients, as well as compliance teams managing a single organization's certification. The platform maps assets across people, technology, facilities, and data, then uses AI-assisted evidence collection and gap analysis against a chosen framework. Continuous monitoring dashboards, audit-ready reporting, and cross-framework control mapping help teams track remediation and maintain compliance on an ongoing basis rather than as a one-time audit exercise.

Kovrr

Creates a cyber risk register that centralizes identified cybersecurity and compliance issues and tracks them through mitigation decisions.

Kovrr is a leading provider of AI and cyber risk, security, and governance solutions, helping global organizations evaluate exposure, quantify potential business impact, and strengthen resilience with data-driven insights.

LogicGate Risk Cloud

Automates evidence collection with support for unlimited evidence sources to reduce manual chasing of audit artifacts and control attestations.

LogicGate Risk Cloud is a configurable GRC platform focused on compliance workflow automation, evidence collection, control mapping, and audit preparation. In the Compliance & GRC category, it is positioned as a central system for linking obligations, assessments, controls, and reporting across regulatory programs. The platform is best suited for mid-market and enterprise teams managing recurring compliance tasks across multiple frameworks and internal control sets. LogicGate also offers adjacent GRC modules such as risk quantification and broader risk management, but the compliance offering centers on automating the operational side of governance and assurance.

LogicManager

Regulatory requirement scoping and gap analysis+11

LogicManager is the industry leader in SaaS-based Enterprise Risk Management (ERM) software that empowers organizations to anticipate what's ahead, uphold their reputations, and improve business performance.

Magnitude

Third-party risk assessments+11

Multi-agent TPRM platform that assesses products, monitors risk, and remediates issues across Nth-parties continuously.

MetaCompliance

Automated tailored phishing simulations+8

MetaCompliance provide effective, personalised and measurable Security Awareness Training to companies and organisations.

MetricStream

Regulatory and policy management+11

An AI-First GRC Platform that drives smarter decisions across risk, audit, compliance, cyber, and resilience.

Mimecast

Email Security

10 products

Mimecast protects the work of every person in the organization, across every channel, from every actor, human and AI.

Inbound and outbound email threat scanning+10

Mindgard

AI Model Security

Real-time AI threat detection and response+10

Mindgard gives organizations the visibility and protection to discover, assess, and defend their AI systems and agents.

MyCISO

Automated security program management+11

MyCISO is a GRC and security program management platform designed to replace manual spreadsheets with an automated, data-driven security operations hub. It provides integrated modules for risk management, compliance tracking (SOC2, ISO27001), supplier risk, and incident response planning. The platform focuses on 'Board-ready' reporting, translating technical security posture into financial and risk-prioritized metrics.

Netwrix

Identity Governance & Administration (IGA)

Automate joiner mover leaver workflows+11

Netwrix provides a SaaS-based Identity Governance and Administration (IGA) platform, primarily through Netwrix Identity Manager (formerly Usercube), automating identity lifecycle management across hybrid IT environments. It handles provisioning, deprovisioning, access reviews, and policy enforcement for joiner-mover-leaver processes. The solution builds role catalogs mapping technical entitlements to business roles, detects toxic role combinations and Segregation of Duties (SoD) conflicts, and generates compliance reports. Best suited for mid-to-large enterprises needing scalable IGA for Active Directory, Azure AD, and multi-system access governance to enforce least privilege and support audits.

OneTrust

Centralized policy, risk, and control workflows+11

10 products

Our mission is to enable innovation through the responsible use of data and AI. We believe that trusted data can be a transformative force in business and society.

Onyxia

AI-Powered Threat Exposure ManagementData-Driven Cyber Program Management+2

Setting the standard for Operational Cyber Resilience.

Optro

11 products

Optro provides an "agentic" GRC platform that utilizes AI to automate audit, risk management, and compliance workflows for Fortune 500 enterprises. The system transforms static compliance checks into active, automated systems of action that integrate with enterprise data sources. It competes with legacy GRC platforms by offering more dynamic, real-time risk assessments and automated evidence collection.

Unified AI Governance+8

Panorays

Automated third-party security questionnaires with configurable workflows to collect vendor responses and supporting evidence during onboarding and periodic reviews.

Panorays is a third-party risk and vendor compliance platform used by security and procurement teams to collect evidence, run security questionnaires, and document risk decisions across supplier relationships. Within Compliance & GRC, it centers on vendor onboarding, assessment workflows, remediation tracking, and audit-ready records rather than enterprise-wide policy management. The platform is best suited for organizations that need repeatable third-party due diligence, especially where security, legal, and compliance teams must review SOC 2, ISO 27001, and similar attestations. It can also synchronize third-party risk data into Archer for broader GRC workflows.

Patch My PC

CVE vulnerability details and prioritizationAutomated third-party patch packaging and deployment+8

Patch My PC provides automated patch management for third-party applications, integrating directly with Microsoft Configuration Manager (ConfigMgr/SCCM), WSUS, and Intune. It handles packaging, testing, and deployment of thousands of updates, delivering CVE-linked vulnerability details for prioritization. The SaaS-based Publisher portal consolidates reporting on patch compliance, installed updates, and endpoint risks. Trusted by over 10,100 customers, it targets IT/security teams in Microsoft-centric environments seeking to reduce manual patching efforts and enhance endpoint security against known vulnerabilities.

Pathlock (formerly Greenlight Technologies)

Application access governance+8

Driving secure and compliant digital transformation through risk-aware identity governance.

Paubox

Email Security

Automatic TLS encryption for all outbound emailsGenerative AI inbound phishing detectionHIPAA compliant email delivery without portals+8

Become the market leader for HIPAA compliant email security

Phriendly Phishing

Customizable phishing simulations with email attachments to test employee handling of malicious file downloads

Phriendly Phishing's mission is to transform how organisations manage human cyber risk and build resilient cyber cultures grounded in empathy, education, and measurable impact.

Pillar Security

AI Security Posture (AI-SPM)

Pillar Security provides an AI security platform designed to discover, govern, and secure AI agents across an organization. It offers capabilities to map AI landscapes, assess risks, red team AI systems, enforce data policies, and apply adaptive runtime guardrails for AI applications, models, and agents. The platform aims to ensure compliance and provide real-time protection against AI-specific threats.

AI Discovery & Posture+3

Prevalent

Sends standardized third-party risk questionnaires mapped to frameworks such as ISO 27001, NIST, HIPAA, SOC 2, and SIG, so vendor responses can be compared against a consistent control set.

Assess, monitor, and remediate risk across your third-party vendor and supplier risk management lifecycle with unified, AI-powered software.

Proofpoint 365 Total Protection

Automated awareness benchmarking+10

Proofpoint 365 Total Protection is a Microsoft 365 security suite that includes built-in security awareness training and adaptive phishing simulations for user behavior testing. In the security awareness scope, it is positioned around realistic spear-phishing exercises, multilingual phishing tests, and reporting-focused training for Microsoft 365 customers, including MSP-managed environments. It fits buyers that want awareness content tied to Proofpoint threat intelligence and user-risk measurement without adopting a separate standalone awareness platform. Adjacent Microsoft 365 security functions exist in the broader bundle, but are outside this scope.

Reciprocity (ZenGRC)

Multi-framework compliance managementContinuous compliance monitoring+10

Reciprocity provides the ZenGRC platform, a SaaS GRC solution for managing information security risk and compliance across multiple frameworks. Built on the ROAR platform, it integrates risk observation, assessment, and remediation into a single interface. ZenConnect offers pre-built connectors for automating data flows between systems, vendors, and partners. ZenComply maps over 10,000 content objects across frameworks, threats, and risks, providing real-time insights into compliance impact on risk posture. Best for mid-to-large organizations standardizing multi-framework compliance and third-party risk management with centralized evidence collection and auditor access.

RedCarbon

AI Analyst L1 continuously ingests and classifies alerts from connected SIEM, XDR, and EDR platforms such as Microsoft Sentinel, QRadar, and Cortex XDR, automatically closing up to 95% of false positives so analysts focus on high-fidelity incidents.AI Analyst L2 performs deep, multi-source alert investigations across tools like CrowdStrike Falcon, SentinelOne Singularity, and Microsoft 365 Defender, reconstructing attack timelines and reducing manual investigation time from approximately 2 hours to about 15 minutes.

Redefining cyber defense by combining cutting-edge AI Agents with human expertise to protect what matters most.

Reflectiz

Continuously monitor web exposure+11

Reflectiz is the AI-powered web exposure platform that continuously monitors and protects what executes on your websites. It detects and remediates security threats, privacy violations, compliance gaps, and AI-generated attacks in real time.

Relativity

AI-driven sensitive data identification for compliance

We help organizations organize data, discover truth, and act on it. Learn more about how our customers enjoy reduced risk, unparalleled technical support, and a great product experience backed by generative AI.

Resilience

Automated compliance workflow management+7

Resilience offers a GRC Resilience Suite that focuses on governance, risk, and compliance workflows rather than security testing or incident response. Its core value in this category is no-code automation for policy, risk, control, and compliance processes, with a centralized view of evidence, obligations, and review tasks. The product is aimed at organizations that want to replace manual spreadsheets and email-based tracking with structured workflow and auditability. Public materials indicate it is part of a broader ReadiNow platform, but the relevant scope here is its GRC process automation layer.

Rilian

Autonomous AI agent triage and investigation+7

3 products

Rilian is an agentic systems integrator and technology provider. We build AI that thinks like a practitioner, deploys into mission-controlled environments, and turns your team's hard-won expertise into a permanent, compounding asset.

Risk Ledger

Third-party risk management+11

Risk Ledger is a network-first platform delivering Active Supply Chain Security, transforming outdated TPRM processes into connected collaboration for security and risk teams. We’re building the largest interconnected database of supplier security data. Companies get standardised, continuously updated supplier assessments that reveal every connection and dependency, because every link matters.

Riskonnect

Centralized risk and compliance dataGovernance risk and compliance management+10

Riskonnect is the leading integrated risk management software solution provider.

SafeLogic (CryptoComply)

Encryption & Key Management

FIPS 140-3 validated cryptography+9

SafeLogic's proven and validated cryptographic software solutions enable enduring privacy and trust in the ever-changing digital world.

SafePaaS

Identity Governance & Administration (IGA)

Policy-based access governanceAccess request and approval workflows+8

The governance control fabric that shields identity, transactions, data and applications across the enterprise.

Sahl

Instant framework mappingReal-time evidence tracking+10

Sahl transforms compliance from a manual, spreadsheet-driven process into a continuous and automated GRC operation.

Salt Security

API Security

Enrich API intelligenceDetect API attackers earlyProactive API posture improvement+3

The world leader in Agentic Security

SANS Security Awareness

Security awareness training modules+11

SANS Security Awareness is the workforce training line from SANS Institute focused on helping organizations build security awareness programs for end users, managers, and technical staff. It is positioned around expert-authored, role-specific content rather than generic compliance video courses, with separate offerings for general workforce training, phishing, and specialized roles such as developers, IT administrators, ICS engineers, and business leaders. It is best suited for regulated and risk-sensitive organizations that want SANS-branded content and measurable awareness outcomes. Adjacent offerings include broader workforce security and risk training programs.

Seceon

Autonomous alert triageCross-source correlation for investigations+10

Seceon is a cybersecurity platform vendor positioned for SOC operations, with its aiSOC/aiSIEM and SOC automation offerings used for alert triage, investigation, threat hunting, and response orchestration. In the Agentic SOC & Investigations scope, its pitch centers on correlating logs, flows, identities, cloud, endpoint, and application data to reduce manual analyst work and speed incident decisions. It is best suited for MSSPs, MDR providers, and enterprise SOCs that want multi-tenant operations and automated investigation workflows rather than an endpoint-only tool.

Secureframe

Automates evidence collection from connected systems to support SOC 2, ISO 27001, HIPAA, and PCI DSS audit workflows.Maps internal controls to multiple compliance frameworks so the same control set can be reused across overlapping requirements.+6

Empower businesses to build trust

SecureVisio

SIEM

Risk-Based Prioritization+3

SecureVisio connects the dots between Incidents, Vulnerabilities, Assets, and Risks, empowering your team with AI-assisted guided response and risk-based prioritization. We give your teams the insight, automation, and context they need to act decisively.

Securiti

Privacy & Consent Management

Website cookie scanning and consent banner integration

At Securiti, our mission is to enable organizations to safely harness the incredible power of Data & AI.

SecurityScorecard

Attack Surface Management

Continuously rates external-facing vendor security posture using an A-F score derived from ten risk-factor groups, helping GRC teams maintain an always-current control view for third-party due diligence.

A swarm of agents. An army of risk engineers. One threat-informed TPRM platform to stop risk before it spreads across your supply chain.

Sky BlackBox

Automated third-party risk assessments+9

Sky BlackBox was created for this new reality. Our connected platform combines multi-layer vendor assurance methodologies, continuously refreshed vendor intelligence, and intelligent automation to help clients, vendors, and service providers maximize business confidence while minimizing operational effort.

SmartSuite

Unified governance, risk, compliance, and resilience workflows

SmartSuite is a no-code Governance, Risk, and Compliance (GRC) platform designed to unify enterprise risk management, audit, and business continuity. Built by the founders of industry-standard ArcherIRM, it modernizes legacy GRC workflows with connected data structures and automated reporting. It replaces rigid, siloed risk tools and spreadsheets, offering a flexible environment for managing enterprise resilience and third-party risk.

Socify by TAC Security

Socify by TAC Security is a SOC 2 compliance automation platform positioned in the Compliance & GRC category, centered on control mapping, evidence collection, policy management, and auditor collaboration for organizations preparing for Type I or Type II attestation. It is aimed at teams that want to reduce manual audit preparation and maintain ongoing compliance without relying heavily on external consultants. TAC Security presents it as an audit-focused product with cloud checks, policy templates, and guided remediation. Adjacent capabilities are mentioned only briefly, as the product is sold primarily as SOC 2 compliance software.

SOC 2 Type I readiness+9

Sonatype

Supply Chain Security

Open source component scanning+11

Sonatype handles the complexity of managing open source software and AI behind the scenes so teams stay focused on innovation, not maintenance.

SpamTitan by TitanHQ

Email Security

Phishing and malicious email blocking+11

SpamTitan by TitanHQ is a cloud-based or on-premises email security gateway that filters inbound and outbound emails, blocking spam, phishing, malware, ransomware, and APTs with a 99.99% spam catch rate and 0.003% false positive rate. It integrates with Office 365, Google Workspace, Active Directory, and LDAP via a web-based admin portal. Designed for MSPs with multitenancy and granular per-domain policies, it serves SMBs, enterprises, and service providers seeking rapid deployment without agents.

SplxAI

AI Runtime & Agent Security

Real-time prompt injection and jailbreak detection+11

SPLX helps global enterprises secure AI systems end-to-end, with scalable red teaming, real-time threat protection, and automated AI compliance and governance.

Sprinto

Continuous compliance monitoring+11

The world's first Autonomous Trust Platform. Sprinto detects change across your posture, determines what's at risk, and acts, across compliance, vendor risk, AI governance, and more, so your organization stays trustworthy without the operational chaos.

StandardFusion

Risk management workflowAudit management+10

We are a global leader in audit and GRC expert solutions with over 30 years dedicated to enabling organizations to become more resilient, anticipate change, adapt quickly, and respond with confidence.

SureCloud

Risk compliance and audit management+11

SureCloud helps organizations secure their futures by enabling governance, risk, and compliance (GRC) success. Recognised in the Gartner Magic Quadrant for Integrated Risk Management Solutions, SureCloud has been delivering innovative GRC solutions for 19 years.

Swimlane

SOAR

Autonomous AI investigation agents+7

Swimlane provides Swimlane Turbine, an agentic AI automation platform for AI SOCs, integrating AI agents, low-code playbooks, case management, dashboards, and reporting with infinite integrations. It automates triage, investigation, and response through governed workflows, delivering 60,000 SOC analyst equivalents daily across customers. The Investigation Agent synthesizes threat intelligence, past investigations, and knowledge bases to generate NIST-aligned, four-phase response plans (containment, eradication, recovery, hardening) with actionable steps. Best for enterprise SOCs and MSSPs seeking transparent, auditable AI execution to reduce context switching and MTTR by up to 75%. Leader in GenAI SOC platforms, #1 on Gartner Peer Insights.

TestifySec

Automated evidence collection and management+10

TestifySec is an evidence-driven security and compliance platform that turns every software build into cryptographic proof, letting teams ship secure, audit-ready software at the speed of development.

Theta Lake

Unified capture for collaboration communicationsSearchable archiving with unified conversation views+10

Redefining Modern Compliance and Security for Unified, AI-Powered Communications

TrustCloud (Kintent)

Automated compliance program management+11

TrustCloud (Kintent) is a cloud-delivered security assurance platform focused on governance, risk, and compliance (GRC) programs for CISOs and GRC teams. In the Compliance & GRC category, it is used to automate control management, audit preparation, risk tracking, vendor risk workflows, and evidence collection across frameworks such as SOC 2, ISO 27001, HIPAA, GDPR, and related standards. The product is positioned around continuous control monitoring and AI-assisted questionnaire and reporting workflows, with adjacent trust-sharing capabilities that help teams expose compliance posture to customers and auditors.

Trustero

Automated GRC evidence collection and mapping+11

Trustero is a Compliance & GRC platform focused on automated evidence collection, control mapping, audit readiness, and continuous control monitoring. It uses a multi-agent workflow to collect artifacts from connected systems, map them to controls and frameworks such as SOC 2, ISO 27001, and PCI, and validate evidence over time. The product is aimed at security, compliance, internal audit, and operations teams that want to reduce manual control testing and maintain a current view of compliance status. It can be used alongside existing GRC tooling or as a standalone system.

Tufin

Cloud Security / CSPM

Unified cloud and network policy control+10

Tufin is best known for network security policy orchestration, but its cloud security offering extends that policy management model into public cloud environments. In the Cloud Security/CSPM scope, it provides visibility into cloud assets, security groups, firewalls, and access paths across AWS, Azure, and Google Cloud, with misconfiguration detection and compliance validation. It is a fit for teams that want cloud posture findings tied to network policy and change workflows, especially in hybrid environments where on-prem and cloud controls are managed together. Adjacent CIEM and DSPM content exists, but they are separate capabilities.

UpGuard

Vendor risk assessment workflows+11

UpGuard is a cybersecurity vendor whose platform includes GRC-adjacent workflows, but it is primarily positioned around cyber risk posture and third-party risk rather than a full enterprise GRC suite. In a Compliance & GRC evaluation, it is best suited to teams that need continuous vendor risk monitoring, compliance tracking, and automated evidence-style workflows tied to security posture. UpGuard says it can track risk reduction against major compliance standards and support board-ready security ratings, making it useful for mid-market organizations and lean security teams that need ongoing assurance across suppliers and external exposure.

Vanta

Automate control monitoring and evidence collection

Vanta provides a trust management platform focused on automating governance, risk, and compliance (GRC) workflows. It integrates with over 350 tools including AWS, CrowdStrike, and Jira to collect evidence across 30 frameworks such as SOC 2, ISO 27001, NIST AI RMF, HITRUST, and CIS CSF. Features include a Report Center for program visibility, vendor risk management with customizable inherent risk rubrics, and cross-mapped controls for multi-framework compliance. Best suited for security and GRC teams in scaling organizations seeking continuous monitoring over manual audits.

Vendict

Automate security questionnaire responses+7

Vendict is redefining how organizations manage third-party risk. Our end-to-end Third-Party Risk Management (TPRM) managed solution combines AI-native automation with expert GRC services to transform how organizations identify, assess, and manage vendor risk. Vendict provides enterprises with the scalability, speed, and precision required to navigate today’s complex regulatory and threat landscapes.

VioletX

Continuous compliance program operation+11

VioletX is a managed compliance and GRC services vendor that operates trust programs on behalf of customers rather than selling a standard self-serve platform. In the Compliance & GRC scope, it covers framework implementation, evidence collection, auditor coordination, and ongoing program operation for SOC 2, ISO 27001, HIPAA, CMMC, FedRAMP, and related programs. VioletX also manages third-party risk workflows and security questionnaire responses. It is best suited for organizations that need practitioner-led compliance execution and ongoing program ownership across regulated or audit-sensitive environments.

Vorlon

AI Runtime & Agent Security

Maps live data flows across agents+11

The Agentic Ecosystem Security Platform. Powered by DataMatrix™, Vorlon's patented intelligent simulation engine, the platform monitors every agent action, detects threats across the full integration layer, and enforces data security in real time across every system AI agents touch.

Whistic

Define internal security controlsRun recurring control tests+9

Whistic is an agentic vendor risk management (VRM) platform that automates the third-party risk assessment process using AI. It streamlines the exchange of security documentation through a centralized Trust Center, allowing companies to share their security posture and automate the review of inbound vendor questionnaires. The platform replaces manual spreadsheet-based assessments with an automated, AI-driven workflow that accelerates procurement cycles and risk mitigation.

Wider Security

Security Operations

3 products

Wider Security is a veteran-owned cybersecurity services firm founded in 2019 that provides security operations-related support through engineering, integration, cloud security, and risk management work. In the Security Operations category, it appears to be a services-led provider rather than a software platform, with emphasis on securing government and defense environments and supporting DoD IT networks. It is best suited for organizations that need hands-on security operations support, systems integration, and technically skilled staffing rather than a standalone SOC product.

Security engineeringCloud securityInformation risk management+7

Wolters Kluwer TeamMate

Integrated audit and GRC management platform+10

Wolters Kluwer TeamMate is a comprehensive GRC platform specifically designed to unite internal audit, risk management, and compliance workflows. It provides a centralized source of truth for organizational governance, allowing for data-driven risk assessments and efficient audit management. The software helps large enterprises manage complex regulatory requirements and provides executive-level reporting on the overall risk posture.

Zywave