GRC &amp; compliance

AI agents automate GRC workflows+10

We're Anecdotes, and we're transforming how enterprise teams manage governance, risk, and compliance.

Archer (formerly RSA Archer)

Centralize GRC data in one repository+11

Archer, formerly RSA Archer and now independent after RSA Security divestiture, provides an integrated GRC platform for enterprise governance, risk, and compliance management.

ARCON

PAM

ARCON PAM is an enterprise-class privileged access management solution designed for hybrid, multi-cloud, and distributed datacenter environments.

AuditBoard

Audit management with continuous testing+11

Built by practitioners for practitioners, Optro is an AI-powered GRC system of action that unifies audit, risk, infosec, and compliance into a single, connected platform.

AvePoint

DSPM

Data access posture visibilitySensitive data flow analysis+9

AvePoint is the unifying Trust Layer for AI.

Avertro

Vulnerability Management

CyberHQ by Avertro is a cloud-native cyber resilience platform that unifies governance, risk, and compliance into a single, operationally integrated system.

Bitdefender

EDR

At Bitdefender, cybersecurity isn't just what we do, it's who we are. For over two decades, we've been at the forefront of protecting individuals, businesses, and governments against sophisticated cyber threats and attacks.

BitSight

7 products

Risk now moves across enterprises, supply chains, cloud environments, and digital identities, and AI is accelerating how quickly vulnerabilities can be exploited.

Black Kite

Vendor compliance managementAutomated compliance correlation+9

We're building a world where cyber risk is no longer a barrier to business performance.

BlinkOps

Agentic SOC & Investigations

AI agents investigate incoming alerts+8

BlinkOps is an agentic security automation platform that utilizes AI-driven agents to handle end-to-end security operations tasks including alert triage, investigation, and incident containment.

BLodgic LLC

AI governanceAI readinessAI security+6

BLodgic is a cybersecurity and AI security practice offering virtual CISO and security leadership, GRC and compliance engineering, AI security and governance, and AI transformation and readiness services. Services are delivered by senior practitioners who build controls, evidence, and security programs for regulated and complex environments.

Center for Internet Security (CIS)

CIS Hardened Images for cloud workloads+5

The Center for Internet Security (CIS) provides Hardened Images and configuration benchmarks that serve as the industry standard for securing cloud operating systems and infrastructure.

Coalition

Active Insurance is coverage designed to prevent digital risk before it strikes. We combine the power of technology and insurance to help organizations identify, mitigate and respond to digital risks.

Commugen

Vulnerability Management

Inherent risk evaluationResidual risk calculation+5

Commugen is a market leader in GRC management solutions

ComplianceQuest

Audit planning and scheduling+10

ComplianceQuest provides a cloud-based platform built natively on Salesforce for quality management (QMS), product lifecycle management (PLM), environmental health and safety (EHS), supplier relationship management (SRM), and

ComplyB4.com

AOCclient portaldescoping+6

ComplyB4 is a SaaS platform for managing PCI DSS assessments, used by QSAs, ISAs, merchants and acquirers. It automates SAQ and ROC workflows, evidence collection, reminders and QA sign-off, with AI-assisted document review. CAM+ extends it to continuous PCI DSS compliance management between assessments.

Compyl

To redefine GRC by delivering flexible, powerful solutions that help organizations confidently manage risk and compliance with clarity and ease.

Continuity

Continuous compliance monitoring+8

Continuity is a cloud-native, automated regulatory change management and risk solutions for the financial services industry, continuously updated by subject matter experts.

CyberRank

Security testingPrivacy testing+2

CyberRank is an AI-assisted vendor risk platform that scans a vendor's domains, privacy practices, public certifications and breach history and expresses the result as an AAA to D rating.

DefendSphere

attack surface visibilitycompliance tracking+4

DefendSphere is a compliance platform that automates audits, risk management and policy enforcement for businesses. It covers standards including NIS2, GDPR, DORA, ISO 27001, SOC 2 and PCI-DSS. It connects to an organization's IT systems, runs automated compliance checks and produces audit reports.

Diligent

Unified board and GRC platform+11

At Diligent, we believe in a world where transformational leaders can build more successful, equitable and sustainable organizations.

Drata

Building the Trust Layer Between Great Companies

DSALTA

AI complianceaudit readinesschecklists+4

DSALTA is an AI-powered compliance automation platform that connects to existing tools to collect evidence, generate policies, map controls and monitor compliance. It supports 100+ compliance frameworks and reuses shared controls and evidence across them.

Feroot Security

Automated PCI and privacy complianceWeb compliance scanningClient-side script monitoring+9

Automated PCI, HIPAA & Privacy Compliance

FireMon

NGFW

6 products

FireMon is a network security company focused on firewall policy control for the hybrid enterprise.

Firewall policy visibility and control+10

GRC-Maestro

Automates checks and controls+6

GRC-Maestro, from Dynamic GRC, is a Compliance-as-a-Service platform for automating governance, risk, and compliance processes.

Hyperproof

Hyperproof provides an AI-powered GRC platform for managing compliance programs, automating evidence collection via hypersyncs, and standardizing control operations across multiple frameworks like SOC 2.

IntelliGRC

Asset scoping and mapping+5

IntelliGRC is a cloud-based governance, risk, and compliance platform built for organizations pursuing certifications such as CMMC, NIST 800-171, SOC 2, ISO 27001, HIPAA, and CIS Controls.

Kovrr

Kovrr is a leading provider of AI and cyber risk, security, and governance solutions, helping global organizations evaluate exposure, quantify potential business impact, and strengthen resilience with data-driven insights.

LogicGate Risk Cloud

LogicGate Risk Cloud is a configurable GRC platform focused on compliance workflow automation, evidence collection, control mapping, and audit preparation.

LogicManager

LogicManager is the industry leader in SaaS-based Enterprise Risk Management (ERM) software that empowers organizations to anticipate what's ahead, uphold their reputations, and improve business performance.

Magnitude

Third-party risk assessments+11

Multi-agent TPRM platform that assesses products, monitors risk, and remediates issues across Nth-parties continuously.

MetaCompliance

Security Awareness & Phishing Simulation

Automated tailored phishing simulations+8

MetaCompliance provide effective, personalised and measurable Security Awareness Training to companies and organisations.

MetricStream

Regulatory and policy management+11

An AI-First GRC Platform that drives smarter decisions across risk, audit, compliance, cyber, and resilience.

Mimecast

Email Security

Mimecast protects the work of every person in the organization, across every channel, from every actor, human and AI.

Mindgard gives organizations the visibility and protection to discover, assess, and defend their AI systems and agents.

Montagne Security

Risk Assessment

clause mappingcontract analysisgap analysis+3

Farron converts Dutch and European cyber obligations, such as NIS2, into contract requirements. It shows clause by clause where supplier agreements cover those requirements and where they leave gaps. It is offered as SaaS or on-premise.

MyCISO

Automated security program managementCompliance status tracking+10

MyCISO is a GRC and security program management platform designed to replace manual spreadsheets with an automated, data-driven security operations hub.

Netwrix

IGA

Automate joiner mover leaver workflowsManage groups and user accounts+10

Netwrix provides a SaaS-based Identity Governance and Administration (IGA) platform, primarily through Netwrix Identity Manager (formerly Usercube), automating identity lifecycle management across hybrid IT environments.

Notice Labs

Trust centre publishingCurated control library+9

Notice Labs is a standalone trust centre for B2B software companies. It publishes a company's security controls, compliance status, documents, subprocessors, vulnerability disclosure intake and privacy request intake on one page at the company's own domain. Based in London.

OneTrust

6 products

Our mission is to enable innovation through the responsible use of data and AI. We believe that trusted data can be a transformative force in business and society.

Onyxia

AI-Powered Threat Exposure ManagementData-Driven Cyber Program Management+2

Setting the standard for Operational Cyber Resilience.

Optro

Optro provides an "agentic" GRC platform that utilizes AI to automate audit, risk management, and compliance workflows for Fortune 500 enterprises.

Unified AI Governance+8

Panorays

Pathlock (formerly Greenlight Technologies)

Panorays is a third-party risk and vendor compliance platform used by security and procurement teams to collect evidence, run security questionnaires, and document risk decisions across supplier relationships.

Application access governance+8

Driving secure and compliant digital transformation through risk-aware identity governance.

Prevalent AI

Assess, monitor, and remediate risk across your third-party vendor and supplier risk management lifecycle with unified, AI-powered software.

Reciprocity (ZenGRC)

Multi-framework compliance management+11

Reciprocity provides the ZenGRC platform, a SaaS GRC solution for managing information security risk and compliance across multiple frameworks.

RedCarbon

Agentic SOC & Investigations

7 products

Redefining cyber defense by combining cutting-edge AI Agents with human expertise to protect what matters most.

Relativity

We help organizations organize data, discover truth, and act on it. Learn more about how our customers enjoy reduced risk, unparalleled technical support, and a great product experience backed by generative AI.

RelyX

Risk Assessment

continuous assurancecontrol mapping+6

RelyX is a security assessment product that selects controls based on each system's context and checks them against live evidence. It quantifies risk in financial terms and recalculates it when evidence, exploitability or business context changes. Each decision is signed off by an owner and stored in a sealed record with its evidence trail.

Resilience

Automated compliance workflow management+7

Resilience offers a GRC Resilience Suite that focuses on governance, risk, and compliance workflows rather than security testing or incident response.

Risk Ledger

Third-party risk management+11

Risk Ledger is a network-first platform delivering Active Supply Chain Security, transforming outdated TPRM processes into connected collaboration for security and risk teams.

Riskonnect

Centralized risk and compliance data+10

Riskonnect is the leading integrated risk management software solution provider.

SafePaaS

IGA

Policy-based access governance+9

The governance control fabric that shields identity, transactions, data and applications across the enterprise.

Sahl

Instant framework mapping+11

3 products

Sahl transforms compliance from a manual, spreadsheet-driven process into a continuous and automated GRC operation.

Scrut Automation

access reviewsasset inventory+6

Scrut is an AI compliance automation platform that collects compliance evidence, assesses risk and manages vendor risk using AI agents. It supports SOC 2, ISO 27001 and 70+ other frameworks, and is aimed at startups and enterprises.

Scytale

Agentic SOC & Investigations

Scytale is an AI-powered security and compliance platform that automates GRC workflows across security, privacy and AI frameworks, including SOC 2, ISO 27001, GDPR and ISO 42001.

Seceon

Autonomous alert triage+11

Seceon is a cybersecurity platform vendor positioned for SOC operations, with its aiSOC/aiSIEM and SOC automation offerings used for alert triage, investigation, threat hunting, and response orchestration.

Secureframe

Empower businesses to build trust

Securiti

Privacy & Consent

At Securiti, our mission is to enable organizations to safely harness the incredible power of Data & AI.

A swarm of agents. An army of risk engineers. One threat-informed TPRM platform to stop risk before it spreads across your supply chain.

Sekit

audit logcontrol mapping+5

Sekit is a cybersecurity governance, risk and compliance (GRC) workspace for consultancies and companies. It assesses controls against frameworks such as ISO 27001, NIS2 and SOC 2, and keeps a living risk register with attached evidence. Claude or ChatGPT can connect to the workspace over MCP.

Sky BlackBox

Automated third-party risk assessmentsVendor compliance management+7

Sky BlackBox was created for this new reality.

SmartSuite

SmartSuite is a no-code Governance, Risk, and Compliance (GRC) platform designed to unify enterprise risk management, audit, and business continuity.

Socify by TAC Security

Socify by TAC Security is a SOC 2 compliance automation platform positioned in the Compliance & GRC category, centered on control mapping, evidence collection, policy management, and auditor collaboration for organizations

SOC 2 Type I readiness+9

SpamTitan by TitanHQ

Email Security

Phishing and malicious email blocking+11

SpamTitan by TitanHQ is a cloud-based or on-premises email security gateway that filters inbound and outbound emails, blocking spam, phishing, malware, ransomware, and APTs with a 99.99% spam catch rate and 0.003% false positive

Sprinto

Continuous compliance monitoring+11

The world's first Autonomous Trust Platform.

StandardFusion

Risk management workflowAudit management+10

We are a global leader in audit and GRC expert solutions with over 30 years dedicated to enabling organizations to become more resilient, anticipate change, adapt quickly, and respond with confidence.

SureCloud

Risk compliance and audit management+11

SureCloud helps organizations secure their futures by enabling governance, risk, and compliance (GRC) success.

TestifySec

TestifySec is an evidence-driven security and compliance platform that turns every software build into cryptographic proof, letting teams ship secure, audit-ready software at the speed of development.

Theta Lake

Redefining Modern Compliance and Security for Unified, AI-Powered Communications

TrustCloud (Kintent)

Automated compliance program management+11

TrustCloud (Kintent) is a cloud-delivered security assurance platform focused on governance, risk, and compliance (GRC) programs for CISOs and GRC teams.

Trustero

Unified cloud and network policy control+10

Trustero is a Compliance & GRC platform focused on automated evidence collection, control mapping, audit readiness, and continuous control monitoring.

Tufin is best known for network security policy orchestration, but its cloud security offering extends that policy management model into public cloud environments.

UpGuard

Vendor risk assessment workflowsContinuous third-party monitoring+10

3 products

UpGuard is a cybersecurity vendor whose platform includes GRC-adjacent workflows, but it is primarily positioned around cyber risk posture and third-party risk rather than a full enterprise GRC suite.

Vanta

Vanta provides a trust management platform focused on automating governance, risk, and compliance (GRC) workflows.

Vendict

Vulnerability Management

Eliminate manual GRC review work+5

Vendict is redefining how organizations manage third-party risk.

Whistic

Define internal security controls+10

Whistic is an agentic vendor risk management (VRM) platform that automates the third-party risk assessment process using AI.

Wolters Kluwer TeamMate

Wolters Kluwer TeamMate is a comprehensive GRC platform specifically designed to unite internal audit, risk management, and compliance workflows.

ZeroRisk

ZeroRisk is a merchant portfolio cyber risk and compliance management platform for acquiring banks, payment processors, ISOs, and payment facilitators.

Zywave