Governance, risk and compliance

Compliance automation

Tools that connect to company systems to collect evidence and track readiness for frameworks such as SOC 2, ISO 27001 and FedRAMP.

28 vendors · alphabetical

• AnchoreAnchore sells an SBOM-powered solution that enables continuous scanning of applications from cloud-native deployments to legacy on-prem installations for security and compliance issues.Privately held
• AnecdotesAnecdotes sells an enterprise agentic GRC platform that combines core GRC applications, AI agents and data collected automatically from an organization's systems.Ownership not established
• ApptegaApptega sells an end-to-end security and compliance platform for assessments, risk management, third-party oversight and audit readiness.Ownership not established · primary category
• CoalfireCoalfire sells advisory, audit and assessment services.Ownership not established
• ConnectSecureConnectSecure sells the ConnectSecure cybersecurity platform, which features what MSPs need to harden their clients’ attack surface and manage tightening compliance requirements.Ownership not established
• CoplaCopla is a cybersecurity compliance platform that automates evidence collection, policy management, audit cycles, and control monitoring across frameworks like DORA, NIS2, ISO 27001, SOC 2, and PCI DSS.Ownership not established · primary category
• CyberSaintCyberSaint sells CyberStrong, a platform that connects controls, assets, and vulnerabilities to live threat and business data.Ownership not established
• CynomiCynomi describes a Security Growth Platform as one that enables service providers to deliver, scale, and grow security services across their entire client base.Ownership not established
• DefenseStormDefenseStorm sells a cyber risk management platform designed exclusively for U.S. banks and credit unions.Ownership not established
• DrataDrata sells software that helps customers earn and keep trust with continuous compliance, integrated internal and third-party risk, and real-time customer assurance.Ownership not established · primary category
• Forte TechnologiesForte Technologies sells managed IT, cybersecurity, private and public cloud, and compliance services.Ownership not established
• HCLSoftwareHCLSoftware develops, markets, sells and supports solutions in four areas: digital transformation, data and analytics, AI and intelligent automation, and enterprise security.Ownership not established
• HyperproofHyperproof sells an AI-powered GRC platform that centralizes compliance, risk, and security workflows.Ownership not established · primary category
• ICFICF sells security and resilience services that help government and industry strengthen defenses against cyber, physical, and emerging threats.Ownership not established
• IndurexIndurex sells an AI-native platform to asset-intensive operators managing cyber-physical systems.Privately held
• JupiterOneJupiterOne is an AI Risk Management platform that continuously discovers every digital asset across an environment and maps the relationships between them.Ownership not established
• Knox SystemsKnox Systems sells pre-authorized infrastructure on which SaaS vendors can inherit 60% to 80% of required controls.Privately held · primary category
• MetricStreamMetricStream sells a connected GRC system that automates risk and compliance work with AI assistants and agents.Ownership not established
• OnspringOnspring is a flexible, cloud-based GRC platform that connects and monitors business-critical functions, processes and information.Ownership not established
• RegScaleRegScale sells a Continuous Controls Monitoring platform that connects live cloud telemetry, security tools and CI/CD pipelines to federal and commercial compliance frameworks.Ownership not established · primary category
• Scrut AutomationScrut Automation sells a platform that brings compliance, risk and reporting together for every entity, with role-based access.Ownership not established · primary category
• ScytaleScytale sells an AI GRC platform that combines automation, AI agents, continuous monitoring and dedicated GRC experts.Ownership not established · primary category
• SecureframeSecureframe sells Secureframe Comply for compliance automation, Secureframe Trust for a Trust Center, knowledge, and questionnaires, and Secureframe Defense for CMMC and defense-oriented secure environments.Ownership not established · primary category
• SprintoSprinto says compliance often lands on startups with no owner.Ownership not established · primary category
• StratoKeyStratoKey sells the CDP Platform, which encrypts or tokenizes sensitive data before it reaches SaaS applications or AI systems and secures it within API payloads.Ownership not established
• ThoropassThoropass is a licensed auditor that delivers audits, supported by purpose built software.Ownership not established · primary category
• UnderDefenseUnderDefense sells UnderDefense MAXI, a security and compliance automation platform, and an MDR service in which security experts monitor, detect and respond to incidents.Ownership not established
• VantaVanta offers automation, continuous monitoring and the Vanta Agent so that organizations get and stay compliant.Ownership not established · primary category