{ "meta": { "name": "Agent Index by Heritage Services", "version": "0.1.27", "generated": "2026-10-27", "license": "CC-BY-4.0", "citation": "Agent Index by Heritage Services (https://theagentindex.io). Dataset version 0.1.27.", "organization": { "name": "Heritage Services", "legal_name": "Heritage Services", "url": "https://theagentindex.io", "email": "sales@heritageservices.online", "gstin": "27ACQPA3590B1ZS", "udyam": "UDYAM-MH-33-0712021" } }, "agents": [ { "slug": "vanta", "name": "Vanta", "vendor": "Vanta Inc.", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.vanta.com/", "category": "compliance", "categories": [ "compliance", "security" ], "summary": "Agentic trust and compliance automation platform for continuous evidence collection, control monitoring, policies, and security questionnaire responses.", "description": "Vanta helps organizations automate compliance programs across many frameworks. It collects evidence from integrations, maps controls, drafts policies, monitors continuously, and automates security questionnaire answers. Positioning includes an agentic trust platform with Trust Center modules. The FedRAMP Marketplace lists Vanta Trust Management Platform (FR2525556241) as Authorized 20x Low (2025-07-25) and Vanta Government Cloud (FR2525556241XM) as Authorized 20x Moderate (2026-04-24). Vanta's September 2026 release notes describe custom agents that run recurring GRC workflows on a schedule or on program changes (public preview, Essentials plans and above; sensitive actions wait for approval), the Vanta MCP server connecting Claude, Cursor, Codex, Slack and other AI tools to controls, evidence, risks and vendors (public preview), and Claude and ChatGPT plug-ins (public preview); Skills are listed as coming soon.", "pricing": "Quote-based. AWS Marketplace lists Essentials from $14,000/year for 1\u201320 employees (12-month contracts); modules priced separately.", "pricing_model": "annual-contract", "frameworks": [ "soc2", "iso27001", "hipaa", "fedramp", "cmmc" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "HIPAA", "PCI DSS", "GDPR", "CMMC", "NIST", "FedRAMP" ], "tasks": [ "evidence-collection", "control-monitoring", "questionnaire-automation", "policy-management", "trust-center" ], "india_relevance": "", "featured": false, "source_url": "https://www.vanta.com/pricing", "sources": [ "https://www.vanta.com/", "https://www.vanta.com/pricing", "https://www.vanta.com/products/additional-frameworks", "https://aws.amazon.com/marketplace/pp/prodview-5ophamrbfxt44", "https://www.fedramp.gov/marketplace/products/FR2525556241/", "https://www.fedramp.gov/marketplace/products/FR2525556241XM/", "https://www.vanta.com/products/cmmc", "https://www.vanta.com/whats-new", "https://www.vanta.com/integrations" ], "last_checked": "2026-10-20", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Vanta Trust Management Platform", "id": "FR2525556241", "impact": "20x Low", "date": "2025-07-25", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR2525556241/", "checked": "2026-10-18" }, { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Vanta Government Cloud", "id": "FR2525556241XM", "impact": "20x Moderate", "date": "2026-04-24", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR2525556241XM/", "checked": "2026-10-18" } ], "integrations": [ "aws", "azure", "gcp", "github", "okta", "jira" ] }, { "slug": "drata", "name": "Drata", "vendor": "Drata", "hq_country": "United States", "hq_region": "north-america", "url": "https://drata.com/", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Compliance and trust management platform with AI-assisted evidence collection, continuous control monitoring, and multi-framework programs.", "description": "Drata automates SOC 2, ISO 27001, HIPAA and other compliance workflows with integrations, continuous monitoring, risk management, and AI features for questionnaires and vendor document retrieval. Public pricing pages are commonly quote-based; AWS Marketplace listings publish starting package prices. Following its SafeBase acquisition, Drata includes the SafeBase Trust Center and AI Questionnaire Assistance, and in March 2026 unified the SafeBase brand into Drata. The FedRAMP Marketplace lists Drata Trust Management Platform (FR2600167032) as Authorized 20x Low (2025-12-05). Drata updates describe EU Cyber Resilience Act framework support (29 Sep 2026; covering the 22 Annex I essential requirements) and the July 2026 AIUC-1 version (2 Oct 2026). Drata's CMMC page describes mapping CMMC requirements to reusable controls, AI explanation of control-test issues, POA&M tracking, and assistive agentic TPRM supplier checks. On 16 Sep 2026 Drata announced that its Third-Party Risk Management product is generally available as a standalone solution: Drata's agent evaluates each third party against the customer's standards, and reviewers can run the assessment in natural language from kickoff to the final decision.", "pricing": "Quote-based. AWS Marketplace Foundation Package listed at $15,000/year for 1\u201350 employees (third-party census of marketplace listing). Drata says Agentic TPRM is not priced by vendor count: every vendor gets a free inherent-risk assessment and customers pay only when a vendor needs a full security review (amounts not published).", "pricing_model": "annual-contract", "frameworks": [ "soc2", "iso27001", "hipaa", "fedramp", "cmmc" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "HIPAA", "GDPR", "PCI DSS", "NIST", "CMMC", "EU Cyber Resilience Act", "AIUC-1" ], "tasks": [ "evidence-collection", "control-monitoring", "questionnaire-automation", "vendor-risk", "trust-center" ], "india_relevance": "", "featured": false, "source_url": "https://drata.com/", "sources": [ "https://drata.com/", "https://drata.com/platform", "https://drata.com/blog/announcing-new-drata-look", "https://drata.com/safebase", "https://www.fedramp.gov/marketplace/products/FR2600167032/", "https://drata.com/frameworks/cmmc", "https://drata.com/updates", "https://drata.com/about/news/drata-debuts-agentic-third-party-risk-management-to-replace-checkbox-scoring-with-evidence-backed-defensible-vendor-risk-decisions", "https://drata.com/products/third-party-risk-management", "https://aws.amazon.com/marketplace/pp/prodview-3xw4sjqv2pb22", "https://aws.amazon.com/marketplace/pp/prodview-3ubrmmqkovucy", "https://drata.com/integrations" ], "last_checked": "2026-10-21", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Drata Trust Management Platform", "id": "FR2600167032", "impact": "20x Low", "date": "2025-12-05", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR2600167032/", "checked": "2026-10-18" } ], "integrations": [ "aws", "azure" ] }, { "slug": "sprinto", "name": "Sprinto", "vendor": "Sprinto", "hq_country": "India", "hq_region": "india", "url": "https://sprinto.com/", "category": "compliance", "categories": [ "compliance" ], "summary": "Autonomous Trust Platform with governed AI agents that detect change across systems, vendors, access and AI use, then refresh evidence, run vendor due diligence, prepare audits and close control gaps, with humans approving material decisions.", "description": "Sprinto launched its Autonomous Trust Platform on 21 Mar 2026, describing it as compliance infrastructure built around governed agents: it continuously monitors changes across systems, vendors, access and AI usage and executes routine work such as refreshing evidence, preparing audit artifacts, running vendor due diligence and resolving control gaps, routing decisions that need judgment to people. Platform modules on sprinto.com include Unified Commitments (frameworks, regulations, contracts and policies turned into machine-readable controls), Continuous Compliance, Autonomous TPRM (discovers vendors, tiers them by risk, launches due diligence and follows up until complete), AI Governance (detects AI tool adoption, keeps a live registry and maps to ISO 42001, NIST AI RMF and the EU AI Act), a unified risk register, an AI Trust Center and security-questionnaire responses, and Autonomous Audit Management (an Audit Agent reviews evidence, answers auditor queries and turns audit reports into tasks and risks). Sprinto says it supports 200+ frameworks and 300+ integrations (vendor claims). AWS Marketplace publishes a Starter Platform plus framework add-on pricing.", "pricing": "AWS Marketplace: Starter Platform $7,500/year (up to 100 employees) plus first compliance framework from $2,000/year (combined entry often cited as $9,500/year).", "pricing_model": "annual-contract", "frameworks": [ "soc2", "iso27001", "hipaa" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "HIPAA", "GDPR", "PCI DSS", "ISO 42001" ], "tasks": [ "evidence-collection", "control-monitoring", "policy-management", "vendor-risk", "questionnaire-automation", "trust-center", "audit-management", "ai-governance" ], "india_relevance": "India-founded vendor; commonly used by India and global SaaS teams pursuing SOC 2 / ISO 27001.", "featured": false, "source_url": "https://sprinto.com/", "sources": [ "https://sprinto.com/", "https://sprinto.com/integrations", "https://sprinto.com/autonomous-trust-platform/", "https://www.prnewswire.com/news-releases/sprinto-launches-autonomous-trust-platformmoving-compliance-from-automated-to-autonomous-302721365.html", "https://aws.amazon.com/marketplace/pp/prodview-ixyb464cbjkam", "https://sprinto.com/integrations/" ], "last_checked": "2026-10-20", "integrations": [ "aws", "azure", "microsoft-365-entra" ] }, { "slug": "scytale", "name": "Scytale", "vendor": "Scytale", "hq_country": "Israel", "hq_region": "middle-east", "url": "https://scytale.ai/", "category": "compliance", "categories": [ "compliance", "security" ], "summary": "AI-powered security and compliance platform combining agentic GRC automation with optional in-house GRC expert consulting bundles.", "description": "Scytale publishes Build / Scale / Enterprise platform packages and consulting bundles (LaunchReady, StayReady, ComplianceShield). Agentic features include evidence review, gap scanning, vendor intel, and questionnaire automation. Framework coverage includes SOC 2, ISO 27001, HIPAA, GDPR, SOX ITGC and ISO 42001 among others (vendor materials).", "pricing": "Quote-based packages (Build Starter, Build DFY, Build Stronger; Scale; Enterprise). Dollar amounts not published on the public pricing page.", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "hipaa" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "HIPAA", "GDPR", "SOX ITGC", "ISO 42001" ], "tasks": [ "evidence-collection", "gap-analysis", "questionnaire-automation", "vendor-risk", "pen-test-management" ], "india_relevance": "", "featured": false, "source_url": "https://scytale.ai/pricing/", "sources": [ "https://scytale.ai/", "https://scytale.ai/pricing/", "https://scytale.ai/integrations/" ], "last_checked": "2026-10-20", "integrations": [ "aws", "azure", "gcp", "github", "gitlab", "okta", "google-workspace", "microsoft-365-entra", "jira", "slack" ] }, { "slug": "comp-ai", "name": "Comp AI", "vendor": "Comp AI", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.trycomp.ai/", "category": "compliance", "categories": [ "compliance" ], "summary": "Open-source-leaning AI compliance software that automates evidence collection, policy generation, and continuous monitoring for SOC 2, ISO 27001, HIPAA and GDPR.", "description": "Comp AI markets AI agents for continuous evidence collection across 580+ integrations, policy generation tailored to the customer's stack, a device agent, live trust centers, and expert Slack support. Named frameworks on the homepage include SOC 2, ISO 27001, HIPAA, GDPR and FedRAMP.", "pricing": "Quote-based (Startup / Mid-Market / Enterprise). Specific dollar amounts not published on the homepage at last check.", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "hipaa" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "HIPAA", "GDPR", "FedRAMP" ], "tasks": [ "evidence-collection", "policy-management", "control-monitoring", "trust-center" ], "india_relevance": "", "featured": false, "source_url": "https://www.trycomp.ai/", "sources": [ "https://www.trycomp.ai/" ], "last_checked": "2026-10-15" }, { "slug": "secureframe", "name": "Secureframe", "vendor": "Secureframe", "hq_country": "United States", "hq_region": "north-america", "url": "https://secureframe.com/", "category": "compliance", "categories": [ "compliance", "security" ], "summary": "Compliance automation platform with Comply AI features for policies, remediation, risk, questionnaires and TPRM, plus Trust Center and CMMC/Defense packages.", "description": "Secureframe publishes Fundamentals, Complete and Defense packages covering evidence collection, personnel and policy management, risk, Trust Center, questionnaire automation and CMMC-oriented SSP/POA&M tooling on Defense. The FedRAMP Marketplace lists Secureframe Platform (FR2529360449) as Authorized 20x Moderate (2026-06-23). The Texas DIR TX-RAMP certified-products list (updated 13 Oct 2026) lists Secureframe Comply (TX1643526) at Level 1 (expires 2028-03-06).", "pricing": "Quote-based. Public page lists Fundamentals / Complete / Defense feature packages without dollar amounts on the pricing page at last check.", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "hipaa", "fedramp", "tx-ramp", "cmmc" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "PCI DSS", "CMMC", "HIPAA" ], "tasks": [ "evidence-collection", "policy-management", "questionnaire-automation", "vendor-risk", "trust-center" ], "india_relevance": "", "featured": false, "source_url": "https://secureframe.com/pricing", "sources": [ "https://secureframe.com/", "https://secureframe.com/pricing", "https://www.fedramp.gov/marketplace/products/FR2529360449/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://secureframe.com/frameworks/cmmc", "https://secureframe.com/integrations" ], "last_checked": "2026-10-20", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Secureframe Platform", "id": "FR2529360449", "impact": "20x Moderate", "date": "2026-06-23", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR2529360449/", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 1", "product": "Secureframe Comply", "id": "TX1643526", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2028-03-06" } ], "integrations": [ "aws", "azure", "gcp", "github", "google-workspace", "microsoft-365-entra", "jira", "slack" ] }, { "slug": "hyperproof", "name": "Hyperproof", "vendor": "Hyperproof", "hq_country": "United States", "hq_region": "north-america", "url": "https://hyperproof.io/", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "AI-powered GRC platform for program management, evidence, audits and multi-framework compliance.", "description": "Hyperproof provides GRC program workflows for collecting evidence, managing audits, linking controls across frameworks, and using AI assistance for compliance operations. Pricing is typically enterprise/quote-based.", "pricing": "", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "hipaa" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "NIST", "HIPAA", "PCI" ], "tasks": [ "evidence-collection", "audit-management", "control-mapping" ], "india_relevance": "", "featured": false, "source_url": "https://hyperproof.io/product/", "sources": [ "https://hyperproof.io/", "https://hyperproof.io/product/", "https://hyperproof.io/integrations/" ], "last_checked": "2026-10-20", "integrations": [ "aws", "azure", "jira" ] }, { "slug": "scrut", "name": "Scrut Automation", "vendor": "Scrut Automation", "hq_country": "India", "hq_region": "india", "url": "https://www.scrut.io/", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Compliance and risk automation platform popular with startups and mid-market teams for continuous control monitoring and multi-framework programs.", "description": "Scrut Automation provides automated evidence collection, controls, questionnaires and GRC workflows. The public /pricing path returned 404 at last check; AWS Marketplace and industry price censuses have listed published annual package prices for small headcounts.", "pricing": "Public pricing page not available (404 at last check). Industry AWS Marketplace census has listed $15,000/year for up to 20 employees \u2014 treat as secondary pending vendor confirmation.", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "hipaa" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "HIPAA", "GDPR", "PCI DSS" ], "tasks": [ "evidence-collection", "control-monitoring", "questionnaire-automation", "risk-management" ], "india_relevance": "India-founded; relevant for India SaaS teams pursuing global certifications and Indian customer due diligence.", "featured": false, "source_url": "https://www.scrut.io/", "sources": [ "https://www.scrut.io/", "https://aws.amazon.com/marketplace/pp/prodview-fz4mb7o7dzj4i", "https://www.scrut.io/platform/integrations" ], "last_checked": "2026-10-20", "integrations": [ "aws", "gcp", "github", "gitlab", "google-workspace", "jira", "slack" ] }, { "slug": "thoropass", "name": "Thoropass", "vendor": "Thoropass", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.thoropass.com/", "category": "compliance", "categories": [ "compliance" ], "summary": "Compliance platform that combines software with audit delivery pathways for SOC 2 and related frameworks.", "description": "Thoropass (formerly Laika) markets compliance software with audit confidence and partner/affiliated audit pathways. Public homepage focuses on compliance outcomes; detailed dollar pricing is typically quote or marketplace-listed.", "pricing": "", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "hipaa" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "HIPAA", "GDPR" ], "tasks": [ "evidence-collection", "audit-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.thoropass.com/", "sources": [ "https://www.thoropass.com/" ], "last_checked": "2026-10-15" }, { "slug": "strike-graph", "name": "Strike Graph", "vendor": "Strike Graph", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.strikegraph.com/", "category": "compliance", "categories": [ "compliance" ], "summary": "Compliance platform with published product pricing pages for building and maintaining security certification programs.", "description": "Strike Graph provides tooling for compliance program build-out, evidence and certification readiness. A public product pricing page exists on the vendor site.", "pricing": "Published on vendor pricing page (see source); verify current tiers on strikegraph.com/pricing.", "pricing_model": "published-tiers", "frameworks": [ "soc2", "iso27001", "hipaa" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "HIPAA", "GDPR" ], "tasks": [ "evidence-collection", "control-mapping" ], "india_relevance": "", "featured": false, "source_url": "https://www.strikegraph.com/pricing", "sources": [ "https://www.strikegraph.com/", "https://www.strikegraph.com/pricing", "https://www.strikegraph.com/integrations" ], "last_checked": "2026-10-20", "integrations": [ "aws", "azure", "gcp", "github", "gitlab", "microsoft-365-entra", "jira" ] }, { "slug": "zania", "name": "Zania", "vendor": "Zania Inc.", "hq_country": "United States", "hq_region": "north-america", "url": "https://zania.ai/", "category": "compliance", "categories": [ "compliance", "risk", "security" ], "summary": "Agentic AI platform for enterprise GRC that executes third-party risk, controls testing, evidence collection, questionnaires and gap analyses with explainability.", "description": "Zania markets purpose-built AI agents for TPRM, continuous compliance, controls testing, policy maintenance and security questionnaires. Vendor states SOC 2 Type 2 for its own security posture and lists support for SOC 2, HIPAA, ISO 27001, GDPR, PCI DSS and ISO 42001 among frameworks it helps customers work against.", "pricing": "", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "hipaa" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "HIPAA", "GDPR", "PCI DSS", "ISO 42001", "NIST CSF" ], "tasks": [ "vendor-risk", "controls-testing", "evidence-collection", "questionnaire-automation", "gap-analysis" ], "india_relevance": "", "featured": true, "source_url": "https://zania.ai/", "sources": [ "https://zania.ai/" ], "last_checked": "2026-10-15" }, { "slug": "credo-ai", "name": "Credo AI", "vendor": "Credo AI", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.credo.ai/", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "AI governance platform for policy packs, model risk and responsible AI compliance including EU AI Act and NIST AI RMF oriented programs.", "description": "Credo AI focuses on governing AI systems with policy packs, assessments and governance workflows aligned to emerging AI regulations and risk frameworks. TX-RAMP Level 2 certified (TX1881245, expires 2029-08-27) on the Texas DIR list updated 13 Oct 2026.", "pricing": "", "pricing_model": "quote", "frameworks": [ "iso27001", "tx-ramp" ], "frameworks_claimed": [ "EU AI Act", "NIST AI RMF", "ISO 42001" ], "tasks": [ "ai-governance", "policy-management", "risk-assessment" ], "india_relevance": "Useful context for Indian enterprises preparing AI governance alongside DPDP data obligations; DPDP-specific mapping not verified on vendor homepage.", "featured": false, "source_url": "https://www.credo.ai/", "sources": [ "https://www.credo.ai/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "AI Governance Platform (Credo AI)", "id": "TX1881245", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2029-08-27" } ] }, { "slug": "logicgate", "name": "LogicGate Risk Cloud", "vendor": "LogicGate", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.logicgate.com/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "AI GRC platform (Risk Cloud) with GRC Agents that act under human supervision for third-party risk, AI governance, enterprise risk and business continuity.", "description": "LogicGate Risk Cloud is a configurable GRC platform for risk, compliance and related workflows. LogicGate's own help centre (FAQ updated 1 Sep 2026) states that as of 17 August 2026 GRC Agents are available for Third-Party Risk Management, AI Governance, Enterprise Risk Management and Business Continuity Management; the August 2026 release notes say they are now available in customer environments. LogicGate describes the agents as acting while the customer supervises. Pricing is enterprise/quote-based. Per the same FAQ, every agent execution is currently followed by a review step where a designated reviewer confirms or corrects the agent's work before it becomes final, and agents are deployed with LogicGate's forward-deployed engineering team (vendor says an average of about 20 hours over 30 days per application).", "pricing": "Quote-based. AI Skills are included with every Risk Cloud subscription; GRC Agents are an optional paid add-on priced at a flat fee per year based on organisation size, with a fair-usage limit on yearly agent executions (amounts not published).", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "hipaa" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "NIST", "HIPAA" ], "tasks": [ "risk-management", "compliance-workflows", "vendor-risk", "ai-governance" ], "india_relevance": "", "featured": false, "source_url": "https://www.logicgate.com/", "sources": [ "https://www.logicgate.com/", "https://www.logicgate.ai/", "https://help.logicgate.com/hc/en-us/articles/52097599187732-GRC-Agents-Frequently-Asked-Questions-FAQs", "https://help.logicgate.com/hc/en-us/articles/52977404418580-2026-8-2-August-2026" ], "last_checked": "2026-10-21" }, { "slug": "snyk", "name": "Snyk", "vendor": "Snyk", "hq_country": "United States", "hq_region": "north-america", "url": "https://snyk.io/", "category": "security", "categories": [ "security", "code-security" ], "summary": "Developer-first application security platform. Snyk Agent Fix validates AI-suggested fixes for Snyk Code findings, and the Evo Agentic AppSec agents (scanning, dependency firewall, security review, remediation and secrets) run Snyk's engines as tools. Several of these agents are still in preview.", "description": "Snyk provides SAST, SCA and related AppSec engines. Vendor documentation states that DeepCode AI Fix is now Snyk Agent Fix, and that as of May 2026 Agent Fix uses an agentic architecture (dynamic few-shot prompting and retries against a Snyk Code rescan) to suggest production-ready fixes for Snyk Code vulnerabilities, with human review required. Vendor-claimed advantages (for example expert-written fix samples and language coverage) are as marketed by Snyk. Public plans remain on snyk.io/plans. On 15 Oct 2026 Snyk announced Evo Agentic AppSec, a team of AI security agents that operate Snyk's deterministic engines (Snyk Code, Snyk Open Source and others) as tools: Evo Code Scanning Agent (logic and access-control flaws), Evo Dependency Firewall (blocks malicious or out-of-policy packages at install time), Evo Agentic Security Review (builds an application and threat model of a repository and produces evidence-backed findings), Evo Remediation Agent (runs the fix loop across new code and the backlog, starting with Snyk Open Source issues; fixes that might break the build are queued for approval, not merged) and Evo Secrets Detection. At launch Snyk said Code Scanning Agent, Dependency Firewall and Agentic Security Review were in experimental preview for select customers, Remediation Agent was in open preview (Snyk's docs call it Early Access), and Secrets Detection, Evo Agentic Development Security and Evo Continuous Offensive Security were generally available. Snyk's benchmark figures (for example a 90% mergeable-fix rate for Remediation Agent vs 59.6% for LLMs alone) are vendor claims.", "pricing": "Published plans on snyk.io/plans (Free / Team / Enterprise style tiers; verify current amounts on the plans page).", "pricing_model": "freemium", "frameworks": [ "soc2", "iso27001" ], "frameworks_claimed": [], "tasks": [ "vulnerability-management", "appsec", "remediation", "sast", "sca", "secrets-detection" ], "india_relevance": "Supports secure SDLC practices relevant to CERT-In-oriented secure development and vulnerability handling programs; CERT-In-specific controls not claimed as a product module.", "featured": true, "source_url": "https://snyk.io/plans/", "sources": [ "https://snyk.io/", "https://snyk.io/plans/", "https://snyk.io/product/snyk-code/", "https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-code/manage-code-vulnerabilities/fix-code-vulnerabilities-automatically", "https://snyk.io/blog/snyk-agent-fix-agentic-architecture/", "https://snyk.io/news/snyk-launches-evo-agentic-appsec/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://govramp.org/program-participants", "https://snyk.io/evo/agentic-appsec/", "https://docs.snyk.io/scan-fix-and-prevent/fix/remediation-agent" ], "last_checked": "2026-10-20", "authorizations": [ { "program": "tx-ramp", "status": "Level 1", "product": "Snyk Container", "id": "TX1510094", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2027-07-10" }, { "program": "govramp", "status": "Pending (Progressing Product List)", "product": "Snyk for Government", "impact": "Moderate", "scope": "platform-only", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "wiz", "name": "Wiz", "vendor": "Wiz", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.wiz.io/", "category": "security", "categories": [ "security", "risk" ], "summary": "Cloud security / CNAPP platform with agentless visibility, risk prioritization and security graph across cloud environments.", "description": "Wiz scans cloud environments without agents to surface toxic combinations of vulnerabilities, misconfigurations, identities and data exposure. Pricing is custom quote on the public pricing page. Wiz AI Agents (Green for remediation pull requests, Blue for threat triage, Red for runtime attack-path analysis) became available in the FedRAMP High authorized Wiz for Gov environment on 14 Oct 2026. The FedRAMP Marketplace lists Wiz for U.S. Government (FR2308034636A) as Authorized High (2025-09-25). The Texas DIR TX-RAMP certified-products list (updated 13 Oct 2026) lists Wiz (TX1598948) at Level 2 (expires 2028-01-31) and Wiz Moderate for U.S. Government (TX1535564) at Level 2.", "pricing": "Custom quote (wiz.io/pricing).", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "fedramp", "tx-ramp" ], "frameworks_claimed": [], "tasks": [ "cloud-security", "vulnerability-management", "risk-prioritization" ], "india_relevance": "", "featured": false, "source_url": "https://www.wiz.io/pricing", "sources": [ "https://www.wiz.io/", "https://www.wiz.io/pricing", "https://www.wiz.io/blog/wiz-for-gov-agents-fedramp", "https://www.fedramp.gov/marketplace/products/FR2308034636A/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://govramp.org/program-participants" ], "last_checked": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Wiz for U.S. Government", "id": "FR2308034636A", "impact": "High", "date": "2025-09-25", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR2308034636A/", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "Wiz", "id": "TX1598948", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2028-01-31" }, { "program": "tx-ramp", "status": "Level 2", "product": "Wiz Moderate for U.S. Government", "id": "TX1535564", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" }, { "program": "govramp", "status": "Authorized", "product": "Wiz Moderate for U.S. Government", "impact": "High", "scope": "platform-only", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "orca-security", "name": "Orca Security", "vendor": "Orca Security", "hq_country": "Israel", "hq_region": "middle-east", "url": "https://orca.security/", "category": "security", "categories": [ "security" ], "summary": "AI-powered cloud security platform (CNAPP) for agentless workload and cloud posture risk detection.", "description": "Orca Security provides agentless cloud security covering vulnerabilities, misconfigurations, identity and data risks with AI-assisted prioritization and workflows. TX-RAMP Level 2 certified (TX1858466) on the Texas DIR list updated 13 Oct 2026.", "pricing": "", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "govramp", "tx-ramp" ], "frameworks_claimed": [], "tasks": [ "cloud-security", "vulnerability-management", "compliance-posture" ], "india_relevance": "", "featured": false, "source_url": "https://orca.security/", "sources": [ "https://orca.security/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://govramp.org/program-participants" ], "last_checked": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Orca Cloud Security Platform", "id": "TX1858466", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" }, { "program": "govramp", "status": "Authorized", "product": "Orca Cloud Security Platform", "impact": "Moderate", "scope": "listing", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "crowdstrike-charlotte-ai", "name": "CrowdStrike Charlotte AI", "vendor": "CrowdStrike", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.crowdstrike.com/en-us/platform/charlotte-ai/", "category": "security", "categories": [ "security" ], "summary": "Agentic AI analyst for cybersecurity within the CrowdStrike Falcon platform, assisting detection, investigation and response workflows.", "description": "Charlotte AI is CrowdStrike's agentic analyst for cybersecurity, designed to accelerate investigations and analyst workflows on the Falcon platform.", "pricing": "", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "threat-detection", "incident-response", "security-operations" ], "india_relevance": "Relevant to CERT-In incident detection and response capability building; not a CERT-In compliance product by itself.", "featured": false, "source_url": "https://www.crowdstrike.com/en-us/platform/charlotte-ai/", "sources": [ "https://www.crowdstrike.com/en-us/platform/charlotte-ai/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://govramp.org/program-participants" ], "last_checked": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Falcon Platform", "id": "TX985428", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" }, { "program": "govramp", "status": "Authorized", "product": "CrowdStrike Falcon Platform for Government", "impact": "High", "scope": "platform-only", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "tenable-one", "name": "Tenable One (Hexa AI)", "vendor": "Tenable", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.tenable.com/products/tenable-one", "category": "security", "categories": [ "security", "risk" ], "summary": "Exposure management platform with Tenable Hexa AI agentic orchestration for vulnerability triage and remediation workflows.", "description": "Tenable One unifies exposure data; Hexa AI orchestrates specialized AI agents for vulnerability triage, remediation workflows and scheduled autonomous routines with human-in-the-loop guardrails. TX-RAMP Level 2 certified (TX1331637, expires 2028-01-13) on the Texas DIR list updated 13 Oct 2026.", "pricing": "", "pricing_model": "quote", "frameworks": [ "tx-ramp" ], "frameworks_claimed": [], "tasks": [ "vulnerability-management", "exposure-management", "remediation" ], "india_relevance": "", "featured": false, "source_url": "https://www.tenable.com/products/tenable-one/capabilities/hexa-ai", "sources": [ "https://www.tenable.com/products/tenable-one", "https://www.tenable.com/products/tenable-one/capabilities/hexa-ai", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://govramp.org/program-participants" ], "last_checked": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Tenable One", "id": "TX1331637", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2028-01-13" }, { "program": "govramp", "status": "Authorized", "product": "Tenable Government Solutions", "impact": "Moderate", "scope": "platform-only", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "mondoo", "name": "Mondoo", "vendor": "Mondoo", "hq_country": "United States", "hq_region": "north-america", "url": "https://mondoo.com/", "category": "security", "categories": [ "security" ], "summary": "Agentic vulnerability management that finds, prioritizes, remediates and verifies fixes with policy-as-code and approval gates.", "description": "Mondoo markets agentic vulnerability management: agents detect issues, prioritize by risk, prepare remediations, seek approval where configured, and verify closure against policy.", "pricing": "Published pricing page at mondoo.com/pricing (verify current tiers).", "pricing_model": "published-tiers", "frameworks": [ "soc2", "iso27001" ], "frameworks_claimed": [], "tasks": [ "vulnerability-management", "policy-as-code", "remediation" ], "india_relevance": "", "featured": false, "source_url": "https://mondoo.com/pricing", "sources": [ "https://mondoo.com/", "https://mondoo.com/pricing", "https://mondoo.com/solutions/agentic-vulnerability-management" ], "last_checked": "2026-10-15" }, { "slug": "onetrust", "name": "OneTrust", "vendor": "OneTrust", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.onetrust.com/", "category": "risk", "categories": [ "risk", "compliance", "privacy" ], "summary": "Privacy, GRC and responsible AI governance platform used by large organizations for consent, preference, third-party risk and AI oversight.", "description": "OneTrust offers modules spanning privacy management, GRC, ethics and responsible AI. Useful for organizations mapping privacy programs; India DPDP-specific product claims should be verified per module with the vendor. On 15 Oct 2026 OneTrust announced a planned integration with Workday Agent Passport to map governance controls, collect evidence and keep audit-ready records for AI agents (not yet available). TX-RAMP Level 1 certified (TX1126478, expires 2027-05-23) on the Texas DIR list updated 13 Oct 2026. At TrustWeek (30 Sep 2026) OneTrust introduced CORIE (Contextual Orchestration for Reasoning, Intelligence and Evidence), described as the shared intelligence layer that powers OneTrust's native agents as well as customer-built and third-party agents. It has three parts: a Trust Graph, a Reasoning Engine that automates risk decisions with business-team oversight, and an Evidence Ledger. OneTrust also introduced an AI Control Plane that evaluates agent actions at runtime and decides whether each one proceeds, is blocked or needs human approval, plus a Governance Command Center. A headless MCP Gateway for ChatGPT, Claude, Copilot and Glean is in private preview (fall 2026). General availability dates for CORIE and the AI Control Plane are not stated.", "pricing": "", "pricing_model": "quote", "frameworks": [ "dpdp", "iso27001", "soc2", "tx-ramp" ], "frameworks_claimed": [ "GDPR", "ISO 27001", "SOC 2" ], "tasks": [ "privacy-management", "consent", "vendor-risk", "ai-governance" ], "india_relevance": "Privacy platforms are commonly evaluated for DPDP Act readiness (notice, consent, security). Confirm DPDP-specific templates/modules directly with OneTrust before relying on them.", "featured": false, "source_url": "https://www.onetrust.com/", "sources": [ "https://www.onetrust.com/", "https://www.onetrust.com/news/onetrust-plans-to-extend-ai-ready-governance-to-workday-agent-passport-through-integration/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://www.onetrust.com/news/onetrust-unveils-platform-and-product-innovations-to-govern-ai-at-enterprise-scale/" ], "last_checked": "2026-10-20", "authorizations": [ { "program": "tx-ramp", "status": "Level 1", "product": "Onetrust", "id": "TX1126478", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2027-05-23" } ] }, { "slug": "bigid", "name": "BigID (incl. AgentIQ agents)", "vendor": "BigID", "hq_country": "United States", "hq_region": "north-america", "url": "https://bigid.com/", "category": "risk", "categories": [ "risk", "compliance", "security", "privacy" ], "summary": "Data security, privacy and DSPM platform whose AgentIQ agentic layer runs data-risk work from a request: four BigID agents at launch (Remediate Sensitive Data, AI Governance Enforcement, Access Exposure Analysis, Privacy Operations) investigate, prioritise and act, e.g. revoking access, remediating exposure, applying retention, quarantining data and fulfilling data subject requests.", "description": "BigID focuses on data discovery, classification, DSPM and privacy/security workflows over sensitive data estates. TX-RAMP Level 2 certified (TX1591086, expires 2028-04-03) on the Texas DIR list updated 13 Oct 2026. AgentIQ is BigID's agentic automation layer for data and AI security, compliance and privacy, usable inside BigID or from Claude, Copilot, ChatGPT and Gemini. BigID lists four agents at launch: Remediate Sensitive Data (exposure prioritised and fixed on approval), AI Governance Enforcement (sanctioned and shadow AI discovered, data use mapped, violations flagged), Access Exposure Analysis (excessive and stale access identified and removed, with an attestation record) and Privacy Operations (a data subject request fulfilled across every system holding the person's data). Per BigID, agents inherit the requesting user's permissions, enforced at the API and MCP layer, and every action is logged and attributable to a person. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "dpdp", "iso27001", "hipaa", "tx-ramp" ], "frameworks_claimed": [ "GDPR", "HIPAA", "CCPA" ], "tasks": [ "data-discovery", "dspm", "privacy-management", "dsr-automation", "remediation", "ai-governance" ], "india_relevance": "Data discovery/classification tools are frequently used as part of DPDP inventory and purpose-limitation programs; DPDP-branded modules not verified on homepage.", "featured": false, "source_url": "https://bigid.com/", "sources": [ "https://bigid.com/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://bigid.com/solutions/agentiq/", "https://bigid.com/blog/meet-agentiq/" ], "last_checked": "2026-10-21", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "BigID Data Intelligence", "id": "TX1591086", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2028-04-03" } ] }, { "slug": "transcend", "name": "Transcend", "vendor": "Transcend", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.transcend.io/", "category": "compliance", "categories": [ "compliance", "risk", "privacy" ], "summary": "Data privacy infrastructure for DSRs, consent and data governance, plus Transcend Rails policy-as-code controls for what AI agents may do.", "description": "Transcend provides privacy infrastructure for data subject requests, consent and related automation. In October 2026 it launched Transcend Rails, an agent policy-as-code platform that allows, denies or escalates each AI agent action in real time, with policy applied at inference, MCP tool calls, network, memory and a decision API, plus an owner, audit trail and kill switch per agent. Pricing is obtained via contact/sales.", "pricing": "", "pricing_model": "quote", "frameworks": [ "dpdp" ], "frameworks_claimed": [ "GDPR", "CCPA" ], "tasks": [ "dsr-automation", "consent", "privacy-management", "policy-as-code", "ai-governance" ], "india_relevance": "DSR/consent automation patterns map to DPDP rights and notice/consent workflows; confirm India-specific support with vendor.", "featured": false, "source_url": "https://www.transcend.io/", "sources": [ "https://www.transcend.io/", "https://transcend.io/contact", "https://transcend.io/blog/introducing-transcend-rails" ], "last_checked": "2026-10-19" }, { "slug": "upguard", "name": "UpGuard", "vendor": "UpGuard", "hq_country": "Australia", "hq_region": "australia-new-zealand", "url": "https://www.upguard.com/", "category": "risk", "categories": [ "risk", "security" ], "summary": "Cyber risk and third-party risk management platform with published CRPM pricing page.", "description": "UpGuard provides external attack-surface and vendor risk ratings, questionnaires and continuous monitoring for third-party cyber risk programs. TX-RAMP Level 1 certified (TX1282156, expires 2027-02-22) on the Texas DIR list updated 13 Oct 2026.", "pricing": "Published on upguard.com/pricing (CRPM platform tiers; verify current figures).", "pricing_model": "published-tiers", "frameworks": [ "soc2", "iso27001", "tx-ramp" ], "frameworks_claimed": [], "tasks": [ "vendor-risk", "attack-surface", "security-ratings" ], "india_relevance": "", "featured": false, "source_url": "https://www.upguard.com/pricing", "sources": [ "https://www.upguard.com/", "https://www.upguard.com/pricing", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 1", "product": "UpGuard Cyber-Risk", "id": "TX1282156", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2027-02-22" } ] }, { "slug": "securityscorecard", "name": "SecurityScorecard", "vendor": "SecurityScorecard", "hq_country": "United States", "hq_region": "north-america", "url": "https://securityscorecard.com/", "category": "risk", "categories": [ "risk", "security" ], "summary": "Third-party cyber risk platform with security ratings and TITAN AI agents running TPRM intake, assessment, monitoring and remediation.", "description": "SecurityScorecard scores organizations' security posture for third-party and supply-chain risk programs. Its TITAN AI platform (TITAN Watch, Assess and Secure) now runs as one TPRM workflow: AI-assisted vendor intake and tiering, a Review Agent for questionnaire responses, and a Response Agent that drafts and follows up on remediation requests, with configurable human approval.", "pricing": "", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001" ], "frameworks_claimed": [], "tasks": [ "vendor-risk", "security-ratings", "questionnaire-automation", "remediation" ], "india_relevance": "", "featured": false, "source_url": "https://securityscorecard.com/", "sources": [ "https://securityscorecard.com/", "https://securityscorecard.com/blog/titan-ai-now-runs-third-party-risk-management-end-to-end/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://govramp.org/program-participants" ], "last_checked": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Provisional", "product": "SecurityScorecard Security Ratings", "id": "TX1535552", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" }, { "program": "govramp", "status": "Ready", "product": "Ratings Cloud Service", "impact": "Moderate", "scope": "platform-only", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "conveyor", "name": "Conveyor", "vendor": "Conveyor", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.conveyor.com/", "category": "security", "categories": [ "security", "compliance", "business-ops" ], "summary": "Customer trust platform with ConveyorAI for answering security questionnaires and sharing trust center content.", "description": "Conveyor focuses on customer trust: Trust Centers and AI-assisted security questionnaire responses with outcome-based pricing published on its pricing page.", "pricing": "Published outcome-based pricing on conveyor.com/pricing.", "pricing_model": "published-tiers", "frameworks": [ "soc2", "iso27001" ], "frameworks_claimed": [], "tasks": [ "questionnaire-automation", "trust-center" ], "india_relevance": "", "featured": false, "source_url": "https://www.conveyor.com/pricing", "sources": [ "https://www.conveyor.com/", "https://www.conveyor.com/pricing" ], "last_checked": "2026-10-15" }, { "slug": "safebase", "name": "SafeBase", "vendor": "Drata (acquired SafeBase)", "hq_country": "United States", "hq_region": "north-america", "url": "https://drata.com/safebase", "category": "security", "categories": [ "security", "compliance", "business-ops" ], "summary": "Trust Center and AI Questionnaire Assistance for customer security reviews, now part of Drata (SafeBase brand being unified into Drata).", "description": "SafeBase provides shareable Trust Centers and AI Questionnaire Assistance for answering customer security questionnaires. Drata acquired SafeBase and in March 2026 said the SafeBase company brand is being unified into Drata, with the Trust Center and AI Questionnaire Assistance remaining core Drata capabilities and existing contracts, pricing and URLs unchanged. safebase.com now redirects to drata.com.", "pricing": "", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001" ], "frameworks_claimed": [], "tasks": [ "trust-center", "questionnaire-automation" ], "india_relevance": "", "featured": false, "source_url": "https://drata.com/blog/announcing-new-drata-look", "sources": [ "https://safebase.com/", "https://drata.com/safebase", "https://drata.com/blog/announcing-new-drata-look" ], "last_checked": "2026-10-16" }, { "slug": "complyadvantage", "name": "ComplyAdvantage", "vendor": "ComplyAdvantage", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://complyadvantage.com/", "category": "risk", "categories": [ "risk", "business-ops" ], "summary": "AI-driven AML, fraud and financial crime risk detection platform for regulated financial institutions.", "description": "ComplyAdvantage provides AI-driven adverse media, sanctions and financial crime risk data/APIs used in KYC/AML programs.", "pricing": "", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "fraud-detection", "kyc" ], "india_relevance": "Relevant to RBI-regulated entities' AML/KYC operational controls; not a substitute for RBI IT Governance or SEBI CSCRF cyber frameworks.", "featured": false, "source_url": "https://complyadvantage.com/", "sources": [ "https://complyadvantage.com/" ], "last_checked": "2026-10-15" }, { "slug": "moveworks", "name": "Moveworks", "vendor": "ServiceNow (Moveworks)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.moveworks.com/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Enterprise AI assistant platform that automates employee support and business operations workflows across IT, HR and related systems.", "description": "Moveworks provides an AI assistant platform for resolving employee requests and automating workplace service workflows. ServiceNow has completed its acquisition of Moveworks, which is now offered as part of the ServiceNow AI Platform.", "pricing": "", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "employee-support", "workflow-automation", "it-service" ], "india_relevance": "", "featured": false, "source_url": "https://www.moveworks.com/", "sources": [ "https://www.moveworks.com/", "https://www.moveworks.com/us/en/company/news" ], "last_checked": "2026-10-16" }, { "slug": "uipath", "name": "UiPath Autopilot / agents", "vendor": "UiPath", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.uipath.com/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Enterprise automation platform with Autopilot and agentic automation for business operations and process orchestration.", "description": "UiPath combines RPA, API automation and AI agents/Autopilot capabilities for enterprise process automation.", "pricing": "", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001" ], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://www.uipath.com/", "sources": [ "https://www.uipath.com/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://govramp.org/program-participants" ], "last_checked": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Automation Cloud Public Sector", "id": "TX1082286", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" }, { "program": "govramp", "status": "Authorized", "product": "UiPath Automation Cloud Public Sector", "impact": "Moderate", "scope": "platform-only", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "servicenow-now-assist", "name": "ServiceNow Now Assist", "vendor": "ServiceNow", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.servicenow.com/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Generative AI assistance across the ServiceNow platform for IT, employee and customer workflows.", "description": "Now Assist brings generative AI into ServiceNow workflows for IT service, employee and customer operations. GRC and IRM capabilities sit in separate ServiceNow IRM modules, not this listing. On 15 Oct 2026 ServiceNow announced AI Passport, a cryptographically signed runtime credential that defines what first- and third-party AI agents and MCP servers may do in multi-agent workflows (with redirect/restrict responses and a kill switch), plus shadow AI detection and AI Cost Management; these are expected in Q4 2026. It also announced EmployeeWorks Productivity Assistants, Productivity Routines and ToolSmith (controlled availability) and an Operational Resilience solution for financial services (available now).", "pricing": "", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001" ], "frameworks_claimed": [], "tasks": [ "workflow-automation", "it-service" ], "india_relevance": "", "featured": false, "source_url": "https://www.servicenow.com/", "sources": [ "https://www.servicenow.com/", "https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-advances-its-operational-harness-for-enterprise-AI-with-AI-Passport-and-expanded-governance-capabilities/default.aspx", "https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-introduces-the-third-generation-of-its-employee-centric-AI-harness-so-the-workforce-can-build-and-use-the-AI-their-jobs-demand/default.aspx", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "ServiceNow Government Community Cloud", "id": "TX985554", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" } ] }, { "slug": "optro", "name": "Optro (formerly AuditBoard)", "vendor": "Optro, Inc. (formerly AuditBoard)", "hq_country": "United States", "hq_region": "north-america", "url": "https://optro.ai/", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "AI-powered GRC Intelligence Platform (formerly AuditBoard) with domain-trained agents for audit testing, compliance, third-party risk and AI governance.", "description": "Optro is the new name of AuditBoard, which renamed itself Optro on 9 Mar 2026 (auditboard.com now redirects to optro.ai); it remains the enterprise audit, risk and compliance platform used for SOX, internal audit and connected risk workflows, On 14 Oct 2026 it announced agentic products: Autonomous Testing (extended beyond SOX to operational audit testing), Agentic Stakeholder Management, Agentic Risk Assessment Scoring, Agentic Compliance (framework scoping, evidence collection and control evaluation), Agentic TPRM (vendor onboarding and due diligence) and Agentic AI Governance (AI system intake and evidence evaluation; AI Discovery previewing ahead of 2027 availability). Optro says agent actions are logged and cited, with humans owning decisions and attestations. Pricing is enterprise/quote-based. TX-RAMP Level 2 certified (TX1071985, expires 2028-10-13) on the Texas DIR list updated 13 Oct 2026.", "pricing": "", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "tx-ramp" ], "frameworks_claimed": [ "SOX", "SOC 2", "ISO 27001", "NIST" ], "tasks": [ "grc-intelligence", "risk-management", "control-testing", "audit-management", "vendor-risk", "ai-governance" ], "india_relevance": "", "featured": false, "source_url": "https://www.prnewswire.com/news-releases/optro-launches-domain-trained-agents-for-audit-compliance-third-party-risk-and-ai-governance-302907924.html", "sources": [ "https://optro.ai/", "https://optro.ai/auditboard-to-optro", "https://www.prnewswire.com/news-releases/meet-optro-auditboard-unveils-new-identity-as-ai-transforms-grc-302707325.html", "https://www.prnewswire.com/news-releases/optro-launches-domain-trained-agents-for-audit-compliance-third-party-risk-and-ai-governance-302907924.html", "https://optro.ai/blog/agentic-compliance-built-for-framework-complexity", "https://www.auditboard.com/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://optro.ai/blog/optro-launches-domain-trained-agents-for-audit-compliance-third-party-risk-and-ai-governance", "https://optro.ai/integrations" ], "last_checked": "2026-10-20", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Audit, Compliance, & Risk Management Software (Optro, formerly AuditBoard)", "id": "TX1071985", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2028-10-13" } ], "integrations": [ "jira", "slack" ] }, { "slug": "fis-aml-investigations-agent", "name": "FIS AML Investigations Agent", "vendor": "FIS", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.fisglobal.com/products/fis-data-and-ai-platform", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Governed AI agent for bank AML alert triage, case investigation and SAR narrative drafting, with analyst confirmation required before any case is closed, escalated or filed.", "description": "Built by FIS with support from Anthropic (runs in FIS private cloud on Claude models), the AML Investigations Agent is the first agent on the FIS Data & AI Platform. It assembles customer-specific evidence for alerts, drafts SAR narratives and links each statement to its source record, with a full audit trail. It became commercially available on 15 Oct 2026 to any U.S.-based bank, including non-FIS clients, and integrates natively with FIS Horizon and FIS Systematics. Pricing is not published.", "pricing": "", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "case-investigation", "sar-narratives" ], "india_relevance": "", "featured": false, "source_url": "https://www.fisglobal.com/about-us/media-room/press-release/2026/fis-aml-investigations-agent-now-commercially-available", "sources": [ "https://www.fisglobal.com/about-us/media-room/press-release/2026/fis-aml-investigations-agent-now-commercially-available", "https://www.fisglobal.com/products/fis-data-and-ai-platform" ], "last_checked": "2026-10-16", "added": "2026-10-16" }, { "slug": "rippling-automated-compliance", "name": "Rippling Automated Compliance", "vendor": "Rippling", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.rippling.com/products/it/automated-compliance", "category": "compliance", "categories": [ "compliance", "security" ], "summary": "Compliance automation built into Rippling's HR and IT platform, with AI framework setup, evidence collection, in-platform AI remediation, an audit portal and Trust Centers.", "description": "Rippling Automated Compliance uses first-party Rippling HR/IT data plus third-party integrations to collect evidence and monitor controls. The 15 Oct 2026 relaunch added multi-framework support (SOC 2, ISO 27001 and HIPAA today; ISO 27701, ISO 42001, GDPR and PCI DSS announced for December), AI-assisted framework setup and import of existing programs, AI-suggested remediations, a built-in auditor portal, publishable trust centers and AI-assisted security questionnaire answer banks. Rippling says it works for teams that do not use other Rippling products. Pricing is via demo/sales.", "pricing": "", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "hipaa" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "HIPAA" ], "tasks": [ "evidence-collection", "control-monitoring", "remediation", "audit-management", "trust-center", "questionnaire-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.rippling.com/blog/reintroducing-automated-compliance", "sources": [ "https://www.rippling.com/blog/reintroducing-automated-compliance", "https://www.rippling.com/products/it/automated-compliance" ], "last_checked": "2026-10-16", "added": "2026-10-16" }, { "slug": "darktrace-cyber-ai-analyst", "name": "Darktrace Cyber AI Analyst", "vendor": "Darktrace", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.darktrace.com/cyber-ai-analyst", "category": "security", "categories": [ "security" ], "summary": "Purpose-built agentic AI that autonomously investigates security alerts, tests hypotheses and produces natural-language incident reports for SOC teams.", "description": "Cyber AI Analyst is Darktrace's agentic investigation system. On the vendor product page it autonomously questions data, tests hypotheses and reaches conclusions, investigates Darktrace and third-party alerts, and writes natural-language summaries with recommended actions. Darktrace says fewer than 4% of investigations require human review. The company page lists Cambridge, UK among its global offices and places the Darktrace AI Research Center in Cambridge, UK. Public dollar pricing is not published.", "pricing": "", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "threat-detection", "incident-response", "security-operations" ], "india_relevance": "Relevant to CERT-In incident detection and response capability building; not a CERT-In compliance product by itself.", "featured": false, "source_url": "https://www.darktrace.com/cyber-ai-analyst", "sources": [ "https://www.darktrace.com/cyber-ai-analyst", "https://www.darktrace.com/company", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://govramp.org/program-participants" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Provisional (provisional expiry 2027-05-08)", "product": "Active AI Security Platform", "id": "TX1896215", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" }, { "program": "govramp", "status": "In Process (Progressing Product List)", "product": "Cyber AI Mission Defense and Email Protection (Darktrace Federal)", "impact": "", "scope": "platform-only", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "luci-ai-agent", "name": "Luci AI Agent", "vendor": "Lucinity", "hq_country": "Iceland", "hq_region": "europe", "url": "https://lucinity.com/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Explainable AI agent for financial-crime investigations that prepares cases, runs triage and supports SAR-oriented workflows while institutions keep governance decisions.", "description": "Lucinity's Luci AI Agent is marketed as an agentic system for FinCrime operations. Vendor pages describe it automating investigations (case summarization, money-flow analysis, adverse-media search), performing first-line triage, and preparing explainable case work so analysts focus on decisions. Lucinity's platform also includes Case Manager, Transaction Monitoring, Customer 360 and Regulatory Reporting. The site lists headquarters at Borgart\u00fan 25, 105 Reykjav\u00edk, Iceland. Public dollar pricing is not published.", "pricing": "", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "case-investigation", "kyc" ], "india_relevance": "Relevant to RBI-regulated entities' AML/KYC operational controls; not a substitute for RBI IT Governance or SEBI CSCRF cyber frameworks.", "featured": false, "source_url": "https://lucinity.com/", "sources": [ "https://lucinity.com/", "https://lucinity.com/platform", "https://lucinity.com/blog/less-chat-more-action", "https://lucinity.com/blog/lucinity-achieves-microsoft-certified-software-for-financial-ai" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "datasnipper-alwin", "name": "DataSnipper Alwin", "vendor": "DataSnipper", "hq_country": "Netherlands", "hq_region": "europe", "url": "https://www.datasnipper.com/", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Agentic automation platform for audit and finance in which agents run end-to-end procedures over evidence and return traceable workpapers for human review and sign-off.", "description": "DataSnipper markets Alwin as its agentic automation platform for audit and finance. Agents execute multi-step procedures (tests of details, controls testing, document extraction) in the background; every result is linked to source evidence and a human reviews and signs off. The vendor says it is SOC 2 compliant for its own platform security and does not train models on customer data. Contact and about pages place the company in Amsterdam, the Netherlands. Public dollar pricing is not published.", "pricing": "", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "SOX" ], "tasks": [ "audit-management", "control-testing", "evidence-collection" ], "india_relevance": "", "featured": false, "source_url": "https://www.datasnipper.com/", "sources": [ "https://www.datasnipper.com/", "https://www.datasnipper.com/about-us", "https://www.datasnipper.com/contact-us", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "DataSnipper", "id": "TX1839020", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2029-03-02" } ] }, { "slug": "signzy-agentic-ckyc", "name": "Signzy Agentic CKYC", "vendor": "Signzy", "hq_country": "India", "hq_region": "india", "url": "https://www.signzy.com/agentic-ckyc-platform", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Agentic KYC operations layer that validates, auto-cures and submits CKYCRR 2.0 records to CERSAI, plus broader AI-powered KYC, KYB and AML screening.", "description": "Signzy's Agentic CKYC Platform connects core banking and onboarding systems to India's CERSAI CKYCRR 2.0 registry. Vendor pages describe real-time API orchestration, first-time-right validation, automatic image correction and Aadhaar masking, de-duplication, and lifecycle sync back to internal systems. Signzy also markets KYC/KYB, Video KYC and AML screening. The about page states headquarters is in Bengaluru, India, and that Signzy is ISO 27001, SOC 2 Type II and PCI-DSS compliant and audits systems against GDPR and India's DPDP Act. Public dollar pricing is not published.", "pricing": "", "pricing_model": "quote", "frameworks": [ "dpdp" ], "frameworks_claimed": [ "DPDP", "GDPR" ], "tasks": [ "kyc", "aml", "fraud-detection" ], "india_relevance": "India-headquartered. Agentic CKYC is built for CERSAI CKYCRR 2.0 used by RBI, SEBI and IRDAI regulated entities. Vendor says it continually audits systems against India's DPDP Act. Confirm current CERSAI and DPDP scope with the vendor.", "featured": false, "source_url": "https://www.signzy.com/agentic-ckyc-platform", "sources": [ "https://www.signzy.com/agentic-ckyc-platform", "https://www.signzy.com/about-us", "https://www.signzy.com/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "idfy-ai-agents", "name": "IDfy AI Agents", "vendor": "IDfy", "hq_country": "India", "hq_region": "india", "url": "https://ai.idfy.com/", "category": "risk", "categories": [ "risk", "compliance", "privacy" ], "summary": "Governed AI agents for KYC/KYB onboarding, credit underwriting, due diligence and DPDP-oriented privacy compliance in regulated finance.", "description": "IDfy's AI agent platform (ai.idfy.com) lists KYC and KYB agents, a Credit Underwriting Agent, asset/merchant/property due-diligence agents, a Data Discovery Agent and a Privacy Compliance Agent. Privy by IDfy is described as keeping agent decisions auditable and DPDP-ready, with consent, data discovery and a replayable trail. The contact and master-services pages give the registered office of Baldor Technologies Pvt. Ltd. (IDfy) in Andheri East, Mumbai, India. Public dollar pricing is not published.", "pricing": "", "pricing_model": "quote", "frameworks": [ "dpdp" ], "frameworks_claimed": [ "DPDP" ], "tasks": [ "kyc", "aml", "privacy-management" ], "india_relevance": "India-headquartered. Vendor documents a live DPDP implementation for a major Indian bank and positions Privy for DPDP-ready agent audit trails. Confirm RBI/DPDP fit for each agent with the vendor.", "featured": false, "source_url": "https://ai.idfy.com/", "sources": [ "https://ai.idfy.com/", "https://www.idfy.com/idfy-contact-us/", "https://www.idfy.com/master-services-agreement/" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "tookitaki-fincense", "name": "Tookitaki FinCense", "vendor": "Tookitaki", "hq_country": "Singapore", "hq_region": "asia-pacific", "url": "https://www.tookitaki.com/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "APAC AML and fraud platform that combines community typologies with purpose-built AI agents for detection, screening, customer risk and investigation.", "description": "Tookitaki FinCense is marketed as an end-to-end financial-crime platform with modular AI agents for detection, alert ranking, investigation and reporting, plus FinMate as an investigation copilot (alert summaries, risk indicators, STR-ready narratives). The AFC Ecosystem shares typologies across member institutions. About and privacy pages state Tookitaki was founded in Singapore, with offices at One Raffles Place / 1 Raffles Place, Singapore. Public dollar pricing is not published.", "pricing": "", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "fraud-detection", "kyc", "case-investigation" ], "india_relevance": "Relevant to RBI-regulated entities' AML/KYC operational controls; MAS/APAC typologies are the vendor's published focus. Confirm India-specific scenario coverage with the vendor.", "featured": false, "source_url": "https://www.tookitaki.com/", "sources": [ "https://www.tookitaki.com/", "https://www.tookitaki.com/compliance-hub/anti-money-laundering-solutions-singapore", "https://www.tookitaki.com/privacy-policy", "https://landingpage.tookitaki.ai/company/about" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "cloudsek-ai-agents", "name": "CloudSEK AI Agents", "vendor": "CloudSEK", "hq_country": "Singapore", "hq_region": "asia-pacific", "url": "https://www.cloudsek.com/", "category": "security", "categories": [ "security", "risk" ], "summary": "Predictive attack-path platform whose AI agents correlate digital-risk, attack-surface and threat signals into validated paths, plus AIVigil for exposed AI and agentic workflows.", "description": "CloudSEK's homepage describes AI agents that connect scattered signals into an attack graph, traverse paths the way an attacker would, and turn validated paths into remediation or takedown workflows. Products include XVigil (digital risk protection), BeVigil (external attack surface), AIVigil (AI attack-surface monitoring, including exposed MCP servers and agentic workflows), SVigil (third-party/supply-chain risk) and Nexus AI (correlation). CloudSEK's official llm-info page states headquarters is Singapore. Public dollar pricing is not published.", "pricing": "", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "NIST AI RMF", "EU AI Act" ], "tasks": [ "threat-detection", "vendor-risk", "security-operations" ], "india_relevance": "Vendor lists an India office and positions the platform for CERT-In-oriented external monitoring and incident awareness. Not a certified CERT-In compliance product.", "featured": false, "source_url": "https://www.cloudsek.com/", "sources": [ "https://www.cloudsek.com/", "https://www.cloudsek.com/llm-info", "https://www.cloudsek.com/contact" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "6clicks-hailey-ai", "name": "6clicks Hailey AI", "vendor": "6clicks", "hq_country": "Australia", "hq_region": "australia-new-zealand", "url": "https://www.6clicks.com/platform/hailey-ai", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Sovereign GRC AI engine that maps controls, finds gaps, drafts assessment responses and creates risks, issues and tasks inside the 6clicks Hub & Spoke platform.", "description": "Hailey AI is 6clicks' purpose-built GRC engine. Vendor pages describe automated compliance mapping, control gap analysis, audit/assessment crosswalking and response generation, control and policy creation, risk/issue identification and remediation-task creation, plus Hailey Assist for natural-language queries and platform actions. Humans review outputs. 6clicks says Hailey supports frameworks including ISO 27001, NIST, SOC 2, PCI DSS and HIPAA, and that its AI management system is ISO/IEC 42001 certified. About and FAQ pages describe 6clicks as an Australian company headquartered in Melbourne, Australia. Public dollar pricing is not published.", "pricing": "", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "hipaa", "cmmc", "dora" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "HIPAA", "NIST", "PCI DSS", "DORA", "CMMC" ], "tasks": [ "control-mapping", "gap-analysis", "audit-management", "risk-management", "vendor-risk" ], "india_relevance": "", "featured": false, "source_url": "https://www.6clicks.com/platform/hailey-ai", "sources": [ "https://www.6clicks.com/platform/hailey-ai", "https://www.6clicks.com/company/about-us", "https://www.6clicks.com/resources/faqs", "https://www.6clicks.com/intelligent-grc" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "first-aml-ai-screening-agent", "name": "First AML AI Screening Agent", "vendor": "First AML", "hq_country": "New Zealand", "hq_region": "australia-new-zealand", "url": "https://www.firstaml.com/inside-the-platform/features/ai/ai-screening-agent/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Search and review agents that run the AML screening lifecycle \u2014 finding matches, assessing them against the entity profile, and re-checking hits as cases age.", "description": "First AML's AI screening agents (search agent and review agent) run screening end to end: widening search beyond the data provider, assessing each hit against the on-file entity profile, clearing what evidence rules out, and flagging uncertain hits for humans. Ongoing-monitoring hits re-trigger the review agent. Related AI features include a document reader, entity insights and biometric individual verification. The privacy policy lists First AML Limited as a New Zealand company with its registered office at 12 MacKelvie Street, Grey Lynn, Auckland. Public dollar pricing is not published.", "pricing": "", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "kyc", "case-investigation" ], "india_relevance": "", "featured": false, "source_url": "https://www.firstaml.com/inside-the-platform/features/ai/ai-screening-agent/", "sources": [ "https://www.firstaml.com/inside-the-platform/features/ai/ai-screening-agent/", "https://www.firstaml.com/inside-the-platform/features/ai/", "https://www.firstaml.com/nz/about/help/legal/privacy-policy/", "https://www.firstaml.com/about/help/contact/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "mindbridge-ai", "name": "MindBridge AI", "vendor": "MindBridge", "hq_country": "Canada", "hq_region": "north-america", "url": "https://www.mindbridge.ai/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Autonomous financial-oversight platform that analyses 100% of transactions to surface anomalies, control failures and fraud risk for finance and audit teams.", "description": "MindBridge markets Autonomous Financial Oversight: full-population analysis of financial transactions and journal entries using statistical models, business rules and unsupervised machine learning to detect anomalies, control failures, policy breaches and fraud risk. Findings are positioned as explainable so auditors and finance leaders keep judgement and accountability. The contact page labels 80 Aberdeen Street, Suite 400, Ottawa, Ontario, Canada as North America headquarters. Public dollar pricing is not published.", "pricing": "", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "audit-management", "risk-management", "fraud-detection" ], "india_relevance": "", "featured": false, "source_url": "https://www.mindbridge.ai/", "sources": [ "https://www.mindbridge.ai/", "https://www.mindbridge.ai/contact/", "https://www.mindbridge.ai/company/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "github-copilot-autofix", "name": "GitHub Copilot Autofix", "vendor": "GitHub", "hq_country": "United States", "hq_region": "north-america", "url": "https://docs.github.com/en/code-security/concepts/code-scanning/autofix-for-code-scanning", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "LLM-generated suggested fixes for GitHub code-scanning alerts (CodeQL), plus agentic autofix (generally available 15 Oct 2026), where an alert is assigned to Copilot, which investigates, validates a fix and opens a pull request. Part of GitHub Code Security / Advanced Security.", "description": "GitHub Copilot Autofix is a GitHub Code Security feature that generates a suggested code change and explanation for supported code-scanning alerts. GitHub docs distinguish it from agentic autofix: Copilot Autofix produces a single suggestion that a human reviews and can turn into a pull request, while agentic autofix (generally available 15 Oct 2026) assigns default-branch backlog alerts to Copilot to investigate, validate with CodeQL and open a draft PR (up to 25 alerts in one PR). Copilot Autofix is enabled by default when CodeQL code scanning is enabled, is available on all public repositories on GitHub.com, and on private/internal repositories with a GitHub Code Security licence. GitHub docs state it interfaces with OpenAI GPT-5.3-Codex (vendor-claimed model). Copilot Autofix does not consume Code Security AI credits; Agentic autofix consumes AI Credits from the Code Security budget plus GitHub Actions minutes; per GitHub's GA changelog it must be enabled by an enterprise administrator through the 'Agentic autofix' Advanced Security policy, and access also requires a Copilot billing method to be defined. When enabled it replaces the free 'Generate fix' option on individual alerts with an 'Assign to Copilot' button; alerts can also be assigned in bulk (up to 25 in one pull request) or through the code-scanning alert REST API. It supports alerts on the default branch only. GitHub states generated fixes are best-effort and must be reviewed.", "pricing": "Included with GitHub Code Security. Public repositories: available at no extra Code Security licence. Private/internal repositories: GitHub Code Security is published at $30 USD per active committer/month on github.com/security/plans. Not a Copilot seat add-on; GitHub docs say no Copilot subscription is required. Agentic autofix (GA 15 Oct 2026) is usage-billed: AI Credits from the Code Security budget plus Actions minutes; requires a Copilot billing method.", "pricing_model": "freemium", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "remediation", "vulnerability-management", "pr-review" ], "india_relevance": "Supports finding and suggesting fixes for code-scanning alerts in a secure SDLC, which is relevant to CERT-In-oriented vulnerability handling. GitHub does not market a CERT-In product module.", "featured": false, "source_url": "https://docs.github.com/en/code-security/concepts/code-scanning/autofix-for-code-scanning", "sources": [ "https://docs.github.com/en/code-security/concepts/code-scanning/autofix-for-code-scanning", "https://docs.github.com/en/code-security/concepts/code-scanning/copilot-autofix-for-code-scanning", "https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security", "https://github.com/security/plans", "https://github.com/features/copilot/plans", "https://github.com/about", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://github.blog/changelog/2026-10-15-agentic-autofix-for-code-scanning-alerts-general-availability/" ], "last_checked": "2026-10-21", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "GitHub Enterprise Cloud", "id": "TX988014", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2028-03-28" } ] }, { "slug": "claude-code-security-review", "name": "Claude Code security review", "vendor": "Anthropic", "hq_country": "United States", "hq_region": "north-america", "url": "https://support.claude.com/en/articles/11932705-automated-security-reviews-in-claude-code", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Anthropic automated security review in Claude Code: the /security-review command and the anthropics/claude-code-security-review GitHub Action for pull-request comments.", "description": "Anthropic documents automated security reviews in Claude Code. Developers can run /security-review in the terminal to analyse pending changes; a GitHub Action (anthropics/claude-code-security-review) can review pull requests and post comments. Anthropic\u2019s help centre and blog list checks for common patterns including SQL injection, XSS, authentication/authorisation flaws, insecure data handling and dependency vulnerabilities (vendor-claimed coverage). The GitHub Action repository states it is not hardened against prompt injection and should only review trusted PRs. Anthropic labels the features as a complement to, not a replacement for, existing security practices. Availability is described for Claude Code users on individual paid plans (Pro or Max) and API Console accounts.", "pricing": "Included with Claude Code for users on individual paid plans (Pro or Max) and pay-as-you-go API Console accounts, per Anthropic\u2019s help centre. Public Claude plan list prices are on claude.com/pricing; the GitHub Action uses a Claude API key.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "pr-review", "sast", "vulnerability-management" ], "india_relevance": "PR and local review of common vulnerability classes is relevant to secure-development programmes, including CERT-In-oriented handling. Anthropic does not market a CERT-In module.", "featured": false, "source_url": "https://support.claude.com/en/articles/11932705-automated-security-reviews-in-claude-code", "sources": [ "https://support.claude.com/en/articles/11932705-automated-security-reviews-in-claude-code", "https://claude.com/blog/automate-security-reviews-with-claude-code", "https://github.com/anthropics/claude-code-security-review", "https://www.anthropic.com/legal/privacy", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Claude (Claude for Enterprise)", "id": "TX1880972", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2029-04-08" } ] }, { "slug": "cursor-bugbot", "name": "Cursor Bugbot", "vendor": "Anysphere", "hq_country": "United States", "hq_region": "north-america", "url": "https://cursor.com/docs/bugbot", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Cursor\u2019s AI pull-request reviewer. Official docs say it identifies bugs, security issues and code-quality problems and comments with explanations and suggested fixes.", "description": "Bugbot is Cursor\u2019s automated PR review product. Cursor docs state that it analyses PR diffs, leaves comments with explanations and fix suggestions, can run on each PR update or on a manual trigger (cursor review / bugbot run), and supports GitHub, GitLab, Bitbucket, Azure DevOps and Origin after the repository is connected. Findings can include security issues; this is a general PR reviewer, not a dedicated SAST scanner. Cursor documents CI check statuses, optional fail-on-unresolved-issues, .cursor/BUGBOT.md rules, and a Bugbot API for enterprise teams. Vendor-claimed accuracy figures (for example that more than half of reported bugs are eventually fixed by engineers) are as marketed on cursor.com/bugbot.", "pricing": "Usage-based on Individual and Teams plans; no separate Bugbot subscription. Cursor\u2019s Bugbot page states Individual plans use included usage first, Teams bill from on-demand usage, and the average review costs $1.00\u2013$1.50 depending on PR size. Enterprise trials are arranged with the account team.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pr-review", "appsec", "remediation" ], "india_relevance": "PR review that flags security issues can support secure SDLC programmes. Cursor does not market a CERT-In module.", "featured": false, "source_url": "https://cursor.com/docs/bugbot", "sources": [ "https://cursor.com/docs/bugbot", "https://cursor.com/bugbot", "https://cursor.com/help/ai-features/bugbot.md", "https://cursor.com/terms-of-service" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "aikido-ai-autofix", "name": "Aikido AI AutoFix", "vendor": "Aikido Security", "hq_country": "Belgium", "hq_region": "europe", "url": "https://www.aikido.dev/code/autofix", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Aikido AutoFix turns SAST, SCA, IaC, container, pentest and AI code-audit findings into reviewable pull requests or IDE patches. Vendor is Belgium-founded with a Ghent European HQ.", "description": "Aikido documents AutoFix as a core remediation workflow: it generates concrete, reviewable patches for open-source dependencies, application code, infrastructure as code, containers, pentest findings and AI code-audit issues, delivered as PRs, CI gating and IDE fixes. Product pages describe an AI Agent for SAST and IaC AutoFix. Aikido\u2019s about page lists a US HQ in San Francisco and a European HQ at Keizer Karelstraat 15, 9000 Ghent, Belgium, and a Europe office page says the company was born in Belgium; product JSON-LD uses addressCountry BE. This listing uses Belgium as HQ on that basis. Public dollar pricing is on aikido.dev/pricing.", "pricing": "Published plans on aikido.dev/pricing include a free option and paid team plans (Basic listed at $300/month for 10 users on the pricing page at last check). Confirm current amounts on the vendor pricing page.", "pricing_model": "freemium", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "remediation", "sast", "vulnerability-management", "iac" ], "india_relevance": "Automated patches for SAST/SCA findings can support CERT-In-oriented vulnerability handling. Aikido does not market a CERT-In module.", "featured": false, "source_url": "https://www.aikido.dev/code/autofix", "sources": [ "https://www.aikido.dev/code/autofix", "https://help.aikido.dev/autofix-and-remediation/overview-aikido-autofix", "https://www.aikido.dev/company/about", "https://www.aikido.dev/company/europe-office", "https://www.aikido.dev/pricing" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "sonar-ai-codefix", "name": "SonarQube AI CodeFix and Remediation Agent", "vendor": "SonarSource", "hq_country": "Switzerland", "hq_region": "europe", "url": "https://docs.sonarsource.com/sonarqube-cloud/managing-your-projects/administering-your-projects/ai-features/enable-ai-codefix", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Sonar LLM-generated fix suggestions for a documented subset of SonarQube issues, in Cloud Team/Enterprise and Server Enterprise/Data Center editions.", "description": "Sonar\u2019s AI CodeFix uses a large language model to propose edits for a select set of rules in Java, JavaScript, TypeScript, Python, HTML, CSS, C# and C++. SonarQube Cloud docs state it is available on Team and Enterprise plans and can use Anthropic Claude Sonnet 4 (recommended) or OpenAI GPT-5.1; Server docs (2026.5) describe Enterprise and Data Center editions, with optional Sonar-hosted or customer-hosted LLMs. An instance/project admin must enable it. Suggestions are generated on request (Generate AI Fix) and can be applied in connected-mode IDEs. AI CodeFix is on-request fix suggestions inside SonarQube; the Remediation Agent opens verified pull requests. Neither is a standalone AppSec agent platform. SonarSource S\u00e0rl\u2019s official contact page lists headquarters in Geneva/Vernier, Switzerland. Sonar's blog (1 Oct 2026) says the SonarQube Remediation Agent is now available on SonarQube Server (2026.5 LTA) Enterprise and Data Center editions, billed on suggestion consumption: pointed at the issues backlog (on demand or on a daily/weekly schedule), it generates a fix, applies it in a sandbox, re-runs the same Sonar analysis and discards the fix if the issue is not cleared or a new one appears, then opens a pull request grouped by rule for developers to review; it works with GitHub, GitLab and Azure DevOps for C#, Java, JavaScript/TypeScript and Python, and runs inside self-managed infrastructure with the customer's chosen model endpoint. Verification does not run the customer's test suite.", "pricing": "AI CodeFix is a paid-edition feature (SonarQube Cloud Team/Enterprise; Server Enterprise/Data Center). Sonar\u2019s plans page lists SonarQube Cloud Team from $32/month; Enterprise and Server commercial editions are quote or sales-led. Community Build does not include AI CodeFix.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "remediation", "code-quality" ], "india_relevance": "Fix suggestions for Sonar issues can support secure SDLC and CERT-In-oriented vulnerability handling. Sonar does not market a CERT-In module.", "featured": false, "source_url": "https://docs.sonarsource.com/sonarqube-cloud/managing-your-projects/administering-your-projects/ai-features/enable-ai-codefix", "sources": [ "https://docs.sonarsource.com/sonarqube-cloud/managing-your-projects/administering-your-projects/ai-features/enable-ai-codefix", "https://docs.sonarsource.com/sonarqube-server/project-administration/ai-features/enable-ai-codefix", "https://docs.sonarsource.com/sonarqube-server/instance-administration/ai-features/enable-ai-codefix", "https://www.sonarsource.com/company/contact-partner/", "https://www.sonarsource.com/plans-and-pricing/", "https://www.sonarsource.com/blog/sonarqube-remediation-agent-is-now-available-on-sonarqube-server/", "https://www.sonarsource.com/company/press-releases/sonarqube-server-2026-5-lta-release/", "https://docs.sonarsource.com/sonarqube-server/instance-administration/ai-features/remediation-agent" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "codacy-ai-reviewer", "name": "Codacy AI Reviewer", "vendor": "Codacy", "hq_country": "Portugal", "hq_region": "europe", "url": "https://www.codacy.com/ai-reviewer", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Hybrid AI pull-request reviewer from Codacy (Lisbon). Combines static analysis with LLM context; vendor pages include security-vulnerability feedback and suggested fixes.", "description": "Codacy AI Reviewer is an opt-in GitHub pull-request reviewer on Team and Business plans. Codacy docs describe a hybrid engine: deterministic static analysis plus LLM context from the PR, Jira (if connected), source and Codacy data. The product page lists security vulnerabilities, missing tests, complexity, duplication and logic gaps as review targets, and intelligent remediation with actionable code fixes (vendor-claimed). Related Codacy AI features include Guardrails in IDEs/agents; this listing is the PR reviewer. Codacy\u2019s official AI info page states headquarters in Lisbon, Portugal.", "pricing": "Developer IDE plugin is $0. Team plan, which includes AI Reviewer, starts at $18 per developer/month billed annually ($21 monthly) on codacy.com/pricing. Business is custom.", "pricing_model": "freemium", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pr-review", "appsec", "sast", "code-quality", "remediation" ], "india_relevance": "PR security and quality review can support secure SDLC programmes. Codacy does not market a CERT-In module.", "featured": false, "source_url": "https://www.codacy.com/ai-reviewer", "sources": [ "https://www.codacy.com/ai-reviewer", "https://docs.codacy.com/codacy-ai/codacy-ai/", "https://www.codacy.com/ai-info", "https://www.codacy.com/pricing" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "checkmarx-one-assist", "name": "Checkmarx One Assist", "vendor": "Checkmarx", "hq_country": "Israel", "hq_region": "middle-east", "url": "https://checkmarx.com/product/checkmarx-one-assist/", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Family of agentic AppSec agents on Checkmarx One (Developer Assist in the IDE, plus triage/remediation). Checkmarx Ltd\u2019s registered office is Ramat Gan, Israel.", "description": "Checkmarx One Assist is marketed as a family of agentic AI AppSec agents. Developer Assist (generally available) provides real-time detection and agentic-AI remediation in AI-native IDEs (GitHub Copilot, Cursor, Windsurf per vendor pages). Docs describe realtime scanning plus an Agentic-AI session that uses the Checkmarx MCP server. Triage and remediation agents are listed as available; Insights Assist is described as coming soon on the product page. Vendor-claimed scope includes SAST, SCA, secrets, IaC and malicious packages. Checkmarx\u2019s privacy policy names Checkmarx Ltd as controller and gives the registered office as Amot Atrium Tower, Ramat Gan, Israel; a US office in Mountain View is also listed on the contact page.", "pricing": "", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "remediation", "vulnerability-management", "ide-assist" ], "india_relevance": "IDE-time detection and suggested fixes can support secure SDLC programmes. Checkmarx does not market a CERT-In module.", "featured": false, "source_url": "https://checkmarx.com/product/checkmarx-one-assist/", "sources": [ "https://checkmarx.com/product/checkmarx-one-assist/", "https://docs.checkmarx.com/en/34965-719261-about-checkmarx-developer-assist.html", "https://checkmarx.com/press-releases/checkmarx-enables-real-time-code-security-with-launch-of-developer-assist-agent-for-ai-native-ides/", "https://checkmarx.com/legal/privacy-policy/", "https://checkmarx.com/contact/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "semgrep-multimodal", "name": "Semgrep Multimodal", "vendor": "Semgrep", "hq_country": "United States", "hq_region": "north-america", "url": "https://semgrep.dev/products/semgrep-multimodal", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Semgrep\u2019s AI layer (successor branding to Semgrep Assistant) for detection, triage, remediation guidance and optional autofix on the Semgrep AppSec Platform.", "description": "Semgrep Multimodal combines AI reasoning with Semgrep\u2019s rule-based analysis for detection, triage and remediation. Vendor pages describe PR remediation guidance, suggested fixes and optional autofix PRs; docs say AI-assisted remediation requires Multimodal to be enabled (Settings > Global). Semgrep\u2019s pricing page lists Multimodal capabilities (AI-powered detection, auto-triage, remediation guidance, autofix) on Free, Teams and Enterprise, with included AI credits. Semgrep Assistant is the earlier name for related AI assistance; this listing uses the current Multimodal product name. Semgrep, Inc. privacy notice gives a postal address at 799 Market Street, San Francisco, CA, United States.", "pricing": "Free Edition: no charge for up to 10 contributors, 60 AI credits included, up to 10 private repositories. Teams starts at Code or Supply Chain $30/month/contributor and Secrets $15/month/contributor, with 20 AI credits per developer/month. Enterprise is volume/quote with 50 AI credits per developer/month. Figures from semgrep.dev/pricing at last check.", "pricing_model": "freemium", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "remediation", "pr-review", "vulnerability-management" ], "india_relevance": "SAST/SCA/secrets findings with AI triage and fix guidance can support CERT-In-oriented vulnerability handling. Semgrep does not market a CERT-In module.", "featured": false, "source_url": "https://semgrep.dev/products/semgrep-multimodal", "sources": [ "https://semgrep.dev/products/semgrep-multimodal", "https://docs.semgrep.dev/semgrep-multimodal/getting-started.md", "https://docs.semgrep.dev/for-developers/resolve-findings-through-comments", "https://semgrep.dev/pricing", "https://semgrep.dev/legal/privacy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "gitlab-duo-vulnerability-resolution", "name": "GitLab Duo Vulnerability Resolution", "vendor": "GitLab", "hq_country": "United States", "hq_region": "north-america", "url": "https://docs.gitlab.com/user/application_security/vulnerabilities/", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "GitLab Duo features that explain SAST vulnerabilities and open merge requests with proposed AI remediations, including an agentic resolution flow.", "description": "GitLab Duo Vulnerability Explanation summarises a SAST finding, how it could be exploited, and a suggested mitigation (/vulnerability_explain or Explain with AI). Vulnerability Resolution creates a merge request with proposed code changes (Resolve with AI). Docs also describe Agentic SAST Vulnerability Resolution, which can automatically analyse high/critical SAST findings on the default branch and open MRs with confidence scoring. GitLab states results are not guaranteed and must be reviewed. Explanation is generally available and requires a GitLab Duo add-on; Resolution is Ultimate plus GitLab Duo Enterprise (or Duo with Amazon Q). GitLab is all-remote; GitLab Inc\u2019s mailing address is San Francisco, United States.", "pricing": "Requires GitLab Ultimate and a GitLab Duo add-on (Duo Enterprise or Duo with Amazon Q per docs). GitLab.com Premium is published at $29 per user/month billed annually with included GitLab Credits; Ultimate is listed on about.gitlab.com/pricing without a public dollar amount (sales/credits). Confirm current Duo add-on prices with GitLab.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "remediation", "vulnerability-management" ], "india_relevance": "SAST explanation and MR-based resolution can support CERT-In-oriented vulnerability handling. GitLab does not market a CERT-In module.", "featured": false, "source_url": "https://docs.gitlab.com/user/application_security/remediate/duo/", "sources": [ "https://docs.gitlab.com/user/application_security/analyze/duo/", "https://docs.gitlab.com/user/application_security/remediate/duo/", "https://docs.gitlab.com/user/application_security/vulnerabilities/", "https://docs.gitlab.com/user/application_security/vulnerabilities/agentic_vulnerability_resolution/", "https://about.gitlab.com/pricing/", "https://about.gitlab.com/company/visiting/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://govramp.org/program-participants" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "GitLab Dedicated for Government", "id": "TX1549412", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" }, { "program": "govramp", "status": "Authorized", "product": "GitLab Dedicated for Government", "impact": "Moderate", "scope": "platform-only", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "veracode-fix", "name": "Veracode Fix", "vendor": "Veracode", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.veracode.com/products/fix/", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Veracode\u2019s AI-assisted remediation for SAST flaws and SCA dependency vulnerabilities, with suggested patches in IDE, CLI and SCM workflows.", "description": "Veracode Fix generates secure code patches for Veracode findings. Vendor docs split Fix for SAST (interactive IDE/CLI patches for first-party code) and Fix for SCA (sandbox/remote agent that can open merge requests for dependency upgrades, including transitives). Surfaces include Eclipse, JetBrains, Visual Studio, VS Code, the Veracode CLI, and SCM for SCA. Veracode states the architecture does not retain customer code, that nothing merges without human approval, and that Fix for SAST covers over 70% of detected flaws across 10 languages (vendor-claimed). Public dollar list prices for Fix were not published on the product pages at last check. Veracode\u2019s company pages describe a US company (leadership in Burlington, Massachusetts).", "pricing": "", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "remediation", "vulnerability-management", "sca" ], "india_relevance": "Suggested patches for SAST/SCA findings can support CERT-In-oriented vulnerability handling. Veracode does not market a CERT-In module.", "featured": false, "source_url": "https://www.veracode.com/products/fix/", "sources": [ "https://www.veracode.com/products/fix/", "https://docs.veracode.com/r/About_Veracode_Fix", "https://docs.veracode.com/r/Veracode_Fix_for_SAST", "https://www.veracode.com/company/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://govramp.org/program-participants" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Veracode Online Security Platform for Government", "id": "TX1009331", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" }, { "program": "govramp", "status": "Authorized", "product": "Veracode Online Security Platform for Government", "impact": "Moderate", "scope": "platform-only", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "amazon-q-developer-security", "name": "Amazon Q Developer security scanning", "vendor": "Amazon Web Services", "hq_country": "United States", "hq_region": "north-america", "url": "https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/code-reviews.html", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Amazon Q Developer code reviews that scan for SAST issues, secrets, IaC misconfigurations, quality issues, deployment risks and SCA, with some in-IDE suggested fixes.", "description": "Amazon Q Developer can review a file, a git diff or a project for security and quality issues. AWS docs list SAST, secrets detection, IaC issues, code quality, deployment risks and software composition analysis, powered by generative AI and Amazon Q detectors. Some findings include a suggested in-IDE fix. AWS has announced end of support for Amazon Q Developer IDE plugins on 30 April 2027, pointing users to Kiro for similar IDE capabilities; console and other Q Developer surfaces remain documented separately. This listing is the security-scanning/review capability, not a dedicated AppSec platform.", "pricing": "Free Tier with monthly limits; Amazon Q Developer Pro is $19 per user/month on aws.amazon.com/q/developer/pricing. Security scanning is a capability of those tiers, not a separately priced SKU on that page.", "pricing_model": "freemium", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "secrets-detection", "sca", "iac", "remediation" ], "india_relevance": "IDE/project scanning for vulnerabilities and secrets can support CERT-In-oriented secure development. AWS does not market a CERT-In module for this feature.", "featured": false, "source_url": "https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/code-reviews.html", "sources": [ "https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/code-reviews.html", "https://aws.amazon.com/blogs/devops/code-security-scanning-with-amazon-q-developer/", "https://aws.amazon.com/q/developer/pricing/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "tembo", "name": "Tembo", "vendor": "Tembo Data Systems", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.tembo.io/", "category": "code-security", "categories": [ "code-security", "business-ops" ], "summary": "Agent orchestration platform (not a dedicated AppSec scanner) that opens auto-fix PRs from Snyk vulnerability scans and Sentry production errors.", "description": "Tembo is a cloud platform for running coding agents in isolated environments connected to repos and tools. It is listed here only because Tembo\u2019s own docs document security-scanner integrations: the Snyk integration scans dependencies (Snyk Open Source) and opens PRs that bump vulnerable packages; the Sentry integration receives error webhooks, analyses stack traces and opens fix PRs. Tembo is not a SAST product. Terms name Tembo Data Systems, Inc., a Delaware corporation located at 646 Main St, Cincinnati, OH.", "pricing": "Published on tembo.io/pricing: free trial; Pro $60/month ($60 usage allowance, up to 5 users); Max $200/month (up to 10 users); Enterprise custom. Usage allowance covers Tembo Gateway tokens and cloud VM compute; overages optional on paid plans.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "agent-platform-security-integrations", "remediation", "sca" ], "india_relevance": "", "featured": false, "source_url": "https://docs.tembo.io/integrations/snyk", "sources": [ "https://docs.tembo.io/integrations/snyk", "https://docs.tembo.io/integrations/sentry", "https://docs.tembo.io/learn/fix-production-bugs", "https://www.tembo.io/pricing/", "https://www.tembo.io/terms" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "cognition-devin", "name": "Devin", "vendor": "Cognition", "hq_country": "United States", "hq_region": "north-america", "url": "https://devin.ai/", "category": "code-security", "categories": [ "code-security", "business-ops" ], "summary": "Cognition\u2019s autonomous coding agent. Listed here only for documented Snyk MCP/CLI scanning and SonarQube/Snyk/Checkmarx IDE plugins \u2014 not as a dedicated security product.", "description": "Devin is an autonomous software-engineering agent. Cognition\u2019s own MCP docs include a Snyk server setup (install Snyk CLI on Devin\u2019s machine, configure the MCP, run Snyk scans). Devin Desktop recommended plugins include SonarQube for IDE, Snyk Security and Checkmarx One. Enterprise environment docs show installing Snyk, Safety, Bandit and Trivy as organisation-wide scanners. Devin is a general coding agent with optional scanner integrations, not a SAST vendor. Cognition\u2019s about page states headquarters in San Francisco. Palantir Federal Cloud Service \u2013 Supporting Services (PFCS-SS, FR2315464863) is FedRAMP Authorized at High (2024-11-19) and its Marketplace description names Cognition's Devin Desktop in that boundary. Cognition's federal docs say Devin Desktop and CLI are FedRAMP High via Palantir FedStart, while Devin Cloud is listed as In Process. That is Palantir's authorized boundary, not a Cognition Marketplace listing, so FedRAMP is vendor-claimed / platform-only for this agent.", "pricing": "Self-serve plans on devin.ai/pricing: Free $0; Pro $20/month; Max $200/month; Teams $80/month minimum plus $40/month per full seat; Enterprise custom (ACUs).", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [ "FedRAMP" ], "tasks": [ "agent-platform-security-integrations", "remediation", "appsec" ], "india_relevance": "", "featured": false, "source_url": "https://docs.devin.ai/work-with-devin/mcp", "sources": [ "https://docs.devin.ai/work-with-devin/mcp", "https://docs.devin.ai/desktop/recommended-plugins", "https://docs.devin.ai/enterprise/environment-management/overview", "https://devin.ai/pricing", "https://cognition.com/about", "https://www.fedramp.gov/marketplace/products/FR2315464863/", "https://docs.devin.ai/federal/compliance" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Palantir Federal Cloud Service \u2013 Supporting Services (PFCS-SS) (Devin Desktop)", "id": "FR2315464863", "impact": "High", "date": "2024-11-19", "scope": "platform-only", "source_url": "https://www.fedramp.gov/marketplace/products/FR2315464863/", "checked": "2026-10-18" } ] }, { "slug": "factory-droid", "name": "Factory Droids", "vendor": "Factory", "hq_country": "United States", "hq_region": "north-america", "url": "https://factory.ai/", "category": "code-security", "categories": [ "code-security", "business-ops" ], "summary": "Factory\u2019s Droid coding agents. Listed here only because Factory\u2019s own pages document Snyk Studio integration for scan/fix/verify inside Droid workflows.", "description": "Factory Droids are enterprise coding agents. Factory\u2019s Snyk partnership page describes Snyk Studio for Factory: Droids can scan with Snyk as they write or modify code, apply patches, re-scan and verify, via MCP. Factory docs also describe Droid Shield secret scanning on git commit/push, which is an agent-safety control rather than AppSec SAST. Factory is not a dedicated security vendor. The San Francisco AI Factory, Inc. terms give a principal address at 475 Brannan Street, Suite 410, San Francisco, CA; a company news post says the firm is headquartered in San Francisco. Public dollar list prices were not verified on factory.ai at last check.", "pricing": "", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "agent-platform-security-integrations", "remediation", "appsec", "secrets-detection" ], "india_relevance": "", "featured": false, "source_url": "https://factory.ai/news/snyk-partnership", "sources": [ "https://factory.ai/news/snyk-partnership", "https://docs.factory.ai/harness/mcp", "https://docs.factory.ai/enterprise/llm-safety-and-agent-controls", "https://factory.ai/terms-of-service" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "github-copilot-coding-agent", "name": "GitHub Copilot coding agent", "vendor": "GitHub", "hq_country": "United States", "hq_region": "north-america", "url": "https://docs.github.com/en/copilot/concepts/agents/coding-agent", "category": "code-security", "categories": [ "code-security", "business-ops" ], "summary": "GitHub Copilot\u2019s coding agent. Listed here only for the official workflow that assigns Dependabot security alerts to Copilot (or other agents) to open a draft fix PR.", "description": "Copilot coding agent is GitHub\u2019s autonomous coding agent, not a SAST product. GitHub docs and changelog state that Dependabot alerts can be assigned to AI agents including Copilot: the agent analyses the advisory and repository usage and opens a draft pull request, including cases that need code changes beyond a version bump. Assignment requires GitHub Code Security and a Copilot plan with coding-agent access. GitHub warns that agent output must be reviewed. This listing is distinct from Copilot Autofix (suggested fixes for CodeQL code-scanning alerts).", "pricing": "Requires a Copilot plan that includes coding agent (Copilot Pro is $10/month with included AI credits on github.com/features/copilot/plans) plus GitHub Code Security for assigning Dependabot alerts ($30 per active committer/month on github.com/security/plans; public repos differ). Coding-agent sessions consume GitHub AI credits.", "pricing_model": "freemium", "frameworks": [], "frameworks_claimed": [], "tasks": [ "agent-platform-security-integrations", "remediation", "sca" ], "india_relevance": "", "featured": false, "source_url": "https://github.blog/changelog/2026-04-07-dependabot-alerts-are-now-assignable-to-ai-agents-for-remediation/", "sources": [ "https://github.blog/changelog/2026-04-07-dependabot-alerts-are-now-assignable-to-ai-agents-for-remediation/", "https://docs.github.com/en/code-security/concepts/supply-chain-security/dependabot-alerts", "https://github.com/features/copilot/plans", "https://github.com/security/plans", "https://github.com/about" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "hawk-ai-agents", "name": "Hawk AI agents (AML Investigative, CDD, Screening and Regulatory Reporting Agents)", "vendor": "Hawk", "hq_country": "Germany", "hq_region": "europe", "url": "https://hawk.ai/solutions/aml/aml-investigative-agent", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Agentic AI overlay for AML teams: agents that gather data, summarise cases, flag typologies, draft SAR narratives and triage screening hits, with a human in the loop.", "description": "Hawk's AML Investigative Agent sits on top of existing systems, aggregates internal and external data before an analyst opens an alert, summarises the case, identifies AML typologies (drawing on FinCEN, Europol and FATF material), recommends next steps and drafts documentation and SAR narratives for review, with audit logs of every agent action. Hawk also lists a CDD Agent (pre-populates due-diligence review files), Customer and Payment Screening Agents (compile evidence on hits; the payment agent can resolve clear-cut false positives) and a Regulatory Reporting Agent. The imprint names Hawk AI GmbH in Munich, Germany. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "case-investigation", "sar-narratives", "kyc", "fraud-detection" ], "india_relevance": "", "featured": false, "source_url": "https://hawk.ai/solutions/aml/aml-investigative-agent", "sources": [ "https://hawk.ai/solutions/aml/aml-investigative-agent", "https://hawk.ai/solutions/aml/cdd-agent", "https://hawk.ai/solutions/screening/customer-screening-agent", "https://hawk.ai/solutions/agentic-ai/payment-screening-agent", "https://hawk.ai/solutions/platform/regulatory-reporting-agent", "https://hawk.ai/imprint", "https://hawk.ai/about-us", "https://hawk.ai/news-press/hawk-releases-regulatory-reporting-agent-increase-quality-and-efficiency-sar-filings" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "silent-eight-iris-7-ai-agents", "name": "Silent Eight Iris 7 AI Agents", "vendor": "Silent Eight", "hq_country": "Singapore", "hq_region": "asia-pacific", "url": "https://www.silenteight.com/iris-7-ai-agents", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Policy-bound AI agents that adjudicate sanctions, PEP, adverse-media, transaction-monitoring, CDD, trade and fraud alerts on top of a bank's existing screening and monitoring systems.", "description": "Iris 7 is Silent Eight's decisioning platform for financial-crime compliance. Its AI agents take in alerts from existing systems, assemble customer, transaction, network and external context, apply institutional policy and return explainable decisions; listed agents cover payment screening, customer screening, transaction monitoring, trade screening, CDD/EDD, fraud, QA and regulatory reporting (SAR/STR/CTR drafting). Silent Eight says low-risk monitoring cases can be closed automatically while higher-risk cases are escalated with evidence, under policy thresholds, QA sampling and audit trails. The contact page lists Silent Eight Pte. Ltd. in Singapore as HQ.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "kyc", "fraud-detection", "case-investigation", "sar-narratives" ], "india_relevance": "", "featured": false, "source_url": "https://www.silenteight.com/iris-7-ai-agents", "sources": [ "https://www.silenteight.com/iris-7-ai-agents", "https://www.silenteight.com/ai-agents-by-capability/transaction-monitoring", "https://www.silenteight.com/iris-7-architecture", "https://www.silenteight.com/contact", "https://www.silenteight.com/legal/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "qevlar-ai-soc", "name": "Qevlar AI", "vendor": "Qevlar AI", "hq_country": "France", "hq_region": "europe", "url": "https://www.qevlar.com/", "category": "security", "categories": [ "security" ], "summary": "Autonomous AI SOC platform that triages, enriches and investigates security alerts across SIEM/XDR, EDR and other tools and returns a documented verdict for analysts.", "description": "Qevlar AI describes itself as an AI SOC platform that investigates every alert across a customer's stack, links related activity into an incident, maps blast radius and moves containment forward under analyst control, plus continuous threat hunting and vulnerability prioritisation. Its FAQ says a proprietary graph-based orchestrator defines investigation steps while LLM agents execute them, pull data and write reports, and that it integrates with SIEM/XDR, EDR, NDR and threat-intel tools. Analysts can review or override conclusions. The FAQ states Qevlar is a French company headquartered in Paris, founded in 2023.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "incident-response", "threat-detection" ], "india_relevance": "", "featured": false, "source_url": "https://www.qevlar.com/faq", "sources": [ "https://www.qevlar.com/", "https://www.qevlar.com/faq", "https://www.qevlar.com/about" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "sophos-mdr-ai-agents", "name": "Sophos MDR AI Agents (Triage and Case Investigation)", "vendor": "Sophos", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.sophos.com/en-us/services/managed-detection-and-response", "category": "security", "categories": [ "security" ], "summary": "Sophos's managed detection and response service uses in-house AI agents for alert triage and case investigation, with Sophos analysts supervising and owning response decisions.", "description": "Sophos says its MDR service runs two production AI agents: a Triage Agent that activates on each new detection to extract entities, link duplicates, spot benign pen-test activity and set severity, and a Case Investigation Agent whose planning, execution and analysis sub-agents run queries, enrich IoCs and produce a verdict, timeline and recommended actions. Sophos analysts validate findings and act. The MDR page markets the service as an 'Agentic SOC' and states 52% of MDR cases are resolved end-to-end by AI. Separately, Sophos XDR has an AI Assistant for self-managed investigations. Sophos Ltd is incorporated in England and Wales with registered offices in Abingdon, UK; Taegis MDR (from Secureworks) is also sold in the Sophos portfolio.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "NIS2", "NIST" ], "tasks": [ "security-operations", "alert-triage", "incident-response", "threat-detection" ], "india_relevance": "", "featured": false, "source_url": "https://www.sophos.com/en-us/blog/sophos-ai-agents-accelerating-mdr-and-powering-the-agentic-soc", "sources": [ "https://www.sophos.com/en-us/blog/sophos-ai-agents-accelerating-mdr-and-powering-the-agentic-soc", "https://www.sophos.com/en-us/services/managed-detection-and-response", "https://www.sophos.com/en-us/solutions/ai-cybersecurity/ai-assistant", "https://www.sophos.com/en-us/legal", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Sophos Cloud", "id": "TX1138700", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2029-08-31" } ] }, { "slug": "trendai-vision-one-agentic-siem", "name": "TrendAI Vision One Agentic SIEM and Companion", "vendor": "Trend Micro (TrendAI)", "hq_country": "Japan", "hq_region": "asia-pacific", "url": "https://www.trendaisecurity.com/en/platform/security-operations", "category": "security", "categories": [ "security" ], "summary": "Trend Micro's SOC stack (now under the TrendAI brand) pairing an Agentic SIEM and Agentic SOAR with purpose-built agents and the Trend Companion AI assistant.", "description": "TrendAI Vision One Security Operations combines XDR, Agentic SIEM and Agentic SOAR in one console. Trend describes purpose-built agents such as a Schema Mapping Agent for third-party logs and a Threat Hunting & Intelligence Agent, natural-language playbook creation, and Trend Companion, which summarises and explains alerts, writes search queries, decodes command lines and helps add responses to cases. Agentic SIEM became generally available in August 2025. TrendAI is a business unit of Trend Micro Incorporated, a listed Japanese corporation (TSE: 4704).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "threat-detection", "incident-response", "alert-triage" ], "india_relevance": "", "featured": false, "source_url": "https://www.trendaisecurity.com/en/platform/security-operations", "sources": [ "https://www.trendaisecurity.com/en/platform/security-operations", "https://www.trendmicro.com/en/research/25/j/soc-agentic-siem.html", "https://docs.trendmicro.com/en-us/documentation/article/trend-vision-one-agentic-siem-ga", "https://www.trendmicro.com/en/business/ai/companion.html", "https://www.trendmicro.com/en/about/legal.html", "https://www.trendmicro.com/en/about/investor-relations.html", "https://newsroom.trendmicro.com/2026-09-29-TrendAI-Vision-One-TM-Extends-Claude-Compliance-API-Integration-to-Cover-Claude-Code-and-Cowork-Sessions", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://govramp.org/program-participants" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Trend Micro Vision One for Government", "id": "TX1443251", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" }, { "program": "govramp", "status": "Authorized", "product": "Trend Micro Vision One for Government", "impact": "Moderate", "scope": "platform-only", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "luminance-agent-lumi", "name": "Luminance Agent Lumi and Autonomous Negotiation", "vendor": "Luminance", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.luminance.com/platform/product/negotiation", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Legal AI platform whose agent (Agent Lumi) marks up contracts against company playbooks and triggers approvals; its Autonomous Negotiation can run AI-to-AI contract negotiations.", "description": "Luminance's contract platform applies a company's playbooks and preferred positions to draft, review and redline contracts. Agent Lumi (launched October 2024) takes natural-language instructions, such as marking up an incoming NDA and triggering required approvals, using Luminance's legal LLM plus tools and memory. Autonomous Negotiation (formerly Autopilot) is described as running the negotiation lifecycle end to end, sending revised drafts to counterparties and reacting to their changes, with optional human oversight; a March 2026 release opened it to non-lawyer users. Luminance Technologies Ltd is registered in Cambridge, England, with offices in London and Cambridge.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.luminance.com/press-releases/luminance-launches-agent-lumi-automating-legal-work-across-the-enterprise-with-agentic-ai", "sources": [ "https://www.luminance.com/platform/product/negotiation", "https://www.luminance.com/press-releases/luminance-launches-agent-lumi-automating-legal-work-across-the-enterprise-with-agentic-ai", "https://www.luminance.com/press-releases/luminance-enhances-the-legal-industrys-only-100-ai-autonomous-contract-negotiation-tool-to-show-the-why-behind-every-decision-and-opens-it-to-the-entire-enterprise", "https://www.luminance.com/company/contact", "https://www.luminance.com/company/about", "https://find-and-update.company-information.service.gov.uk/search/companies?q=luminance+technologies" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "legalon-agents", "name": "LegalOn Agents", "vendor": "LegalOn Technologies", "hq_country": "Japan", "hq_region": "asia-pacific", "url": "https://www.legalontech.com/agents", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Specialised AI agents for in-house legal teams that build review playbooks, handle intake requests, translate contracts and triage low-risk agreements, under attorney control.", "description": "LegalOn's agents run inside its legal AI platform and return review-ready outputs for lawyers to approve. The February 2026 launch named five: Playbook (builds review playbooks from templates or guidelines), Intake (collects missing information on business requests), Translate (translates contracts and redlines), Triage (automated review of high-volume low-risk contracts; early access at launch) and Draft (announced as coming soon). The platform also covers AI contract review, matter management and a legal assistant. The parent, LegalOn Technologies (\u682a\u5f0f\u4f1a\u793eLegalOn Technologies), is a Tokyo company founded in 2017 as LegalForce, with a US subsidiary in San Francisco. On 19 Oct 2026 LegalOn Technologies began offering a beta of Agent Builder (\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u30d3\u30eb\u30c0\u30fc, task automation) in LegalOn. A legal-specialised AI agent runs a chain of tasks automatically when a set condition is met. In this first release the trigger is an event in Matter Management, such as a new matter or a change of status or assignee, and the first use cases are legal consultations and matter assignment. Teams choose which information the agent can use, including whether it may search the web, and can block actions such as emailing the requester. LegalOn plans to add automatic first-pass contract review and lawyer-built workflow templates. Announced in Japan (patent pending).", "pricing": "Quote-based", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.legalontech.com/press-releases/legalon-launches-five-ai-agents-driving-step-change-productivity-for-in-house-legal-teams", "sources": [ "https://www.legalontech.com/agents", "https://www.legalontech.com/press-releases/legalon-launches-five-ai-agents-driving-step-change-productivity-for-in-house-legal-teams", "https://www.legalontech.com/pricing", "https://legalontech.jp/company/", "https://www.legalontech.com/jp/news/310" ], "last_checked": "2026-10-20", "added": "2026-10-18" }, { "slug": "mineos-mira-ai", "name": "MineOS Mira AI", "vendor": "MineOS (Mine)", "hq_country": "Israel", "hq_region": "middle-east", "url": "https://www.mineos.ai/mira-ai", "category": "compliance", "categories": [ "compliance", "risk", "privacy" ], "summary": "Autonomous AI agents for privacy, vendor risk and AI governance: discovery, DSR fulfilment, cross-border transfer checks, assessment autofill and AI-agent posture profiles.", "description": "Mira AI is the agent layer of the MineOS privacy and AI governance platform, which the vendor pitches as 'real agents that observe, decide, and act' rather than copilots. Named agents include Agent Posture (governance profile for each AI system and agent), Vendor Scout (continuous vendor assessment), Autofill (completes assessments from organisational context), Transfer (flags cross-border data transfers and triggers workflows), Discovery (finds systems, AI, vendors and data), DSR Autopilot (end-to-end privacy request handling) and eDiscovery (search, classify, redact). MineOS lists support for the EU AI Act, GDPR, CCPA/CPRA and other privacy laws. The operator, Say Mine Technologies Ltd., gives its contact address in Tel Aviv, Israel.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "GDPR", "CCPA/CPRA", "EU AI Act", "LGPD", "PIPL" ], "tasks": [ "privacy-management", "dsr-automation", "data-discovery", "vendor-risk", "ai-governance" ], "india_relevance": "", "featured": false, "source_url": "https://www.mineos.ai/mira-ai", "sources": [ "https://www.mineos.ai/mira-ai", "https://www.mineos.ai/", "https://www.mineos.ai/legal/portal-privacy-policy", "https://www.prnewswire.com/news-releases/mineos-unveils-ai-asset-discovery-302098909.html" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "saidot-ai-governance", "name": "Saidot", "vendor": "Saidot", "hq_country": "Finland", "hq_region": "europe", "url": "https://www.saidot.ai/", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Agent-first AI governance platform: a knowledge graph of AI risks, controls and policies, an Agent Catalogue, and MCP servers that let customers' agents draft risk assessments.", "description": "Saidot inventories AI systems, agents, models and datasets and links them to a curated knowledge graph of risks, controls, policies and third-party models so risks and controls are inherited automatically. Its Agent Catalogue records each agent's purpose, lineage and autonomy level and classifies the risk of the tools it can access. Customers can connect their own AI assistants and agents through Saidot's MCP servers to draft risk assessments, register systems and research the Saidot Library, with humans approving the output. The site footer gives Saidot Ltd., Lapinlahdenkatu 16, Helsinki, Finland.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "EU AI Act" ], "tasks": [ "ai-governance", "risk-assessment" ], "india_relevance": "", "featured": false, "source_url": "https://www.saidot.ai/", "sources": [ "https://www.saidot.ai/", "https://www.saidot.ai/pricing", "https://www.saidot.ai/about-us" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "hadrian-nova", "name": "Hadrian Nova (agentic pentesting)", "vendor": "Hadrian", "hq_country": "Netherlands", "hq_region": "europe", "url": "https://hadrian.io/products/nova", "category": "security", "categories": [ "security", "code-security" ], "summary": "On-demand penetration testing run by a fleet of AI hacker agents, paired with Hadrian Atlas for continuous external exposure management.", "description": "Nova points a fleet of AI hacker agents at an application to test it step by step like a human pentester until it can show impact, for example checking whether one customer can reach another's data, and returns evidence for each finding; most tests finish in 24-48 hours per the vendor. Atlas, the companion product, continuously maps and validates the external attack surface. Hadrian says Nova reports map to SOC 2, ISO 27001 and NIS2. Hadrian Security B.V. was founded in Amsterdam in 2021 and lists its office at Leidseplein 1, Amsterdam.", "pricing": "Nova: from EUR 1,250 per test excluding VAT, bundles available; Atlas priced on total asset count (hadrian.io/pricing).", "pricing_model": "published-tiers", "frameworks": [ "soc2", "iso27001", "dora" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "NIS2", "DORA", "MITRE ATT&CK" ], "tasks": [ "pen-test-management", "attack-surface", "exposure-management", "appsec" ], "india_relevance": "", "featured": false, "source_url": "https://hadrian.io/products/nova", "sources": [ "https://hadrian.io/products/nova", "https://hadrian.io/pricing", "https://hadrian.io/company", "https://hadrian.io/privacy-policy" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "escape-ai-pentesting", "name": "Escape (AI pentesting and DAST)", "vendor": "Escape", "hq_country": "France", "hq_region": "europe", "url": "https://escape.tech/", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Offensive security platform using AI agents for attack surface discovery, business-logic DAST and multi-agent pentesting (Cascade) of APIs and web apps.", "description": "Escape combines attack surface management, business-logic-aware DAST and AI pentesting for APIs, web apps and external assets. Its Cascade engine is described as multi-agent penetration testing that reasons about the application, chains multi-step exploits and proves findings with a working exploit, screenshots and logs; it can also re-test bug bounty findings. The vendor says its agents discover, test and remediate within engineering workflows and lists a Wiz integration. The privacy policy names Escape Technologies SAS with France as the country of the company.", "pricing": "Quote-based", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "pen-test-management", "attack-surface" ], "india_relevance": "", "featured": false, "source_url": "https://escape.tech/blog/introducing-cascade-the-multi-agent-penetration-testing/", "sources": [ "https://escape.tech/", "https://escape.tech/blog/introducing-cascade-the-multi-agent-penetration-testing/", "https://escape.tech/pricing", "https://escape.tech/about", "https://escape.tech/privacy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "stacks-accounting-agents", "name": "Stacks accounting agents", "vendor": "Stacks", "hq_country": "Netherlands", "hq_region": "europe", "url": "https://www.stacks.ai/accounting-agents", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Agentic financial close workspace where AI agents handle reconciliations, journal entries, anomaly detection and reporting while accounting teams review the work.", "description": "Stacks pitches itself as a workspace where enterprise accounting teams and AI agents work together through the month instead of only at month-end. Listed agents handle reconciliations (routine matching, with people reviewing exceptions), journals (pre-categorised entries routed for review and posted to the ERP with audit evidence), anomalies (continuous discrepancy detection with explanations) and reporting. Stacks Technologies B.V. is incorporated in the Netherlands with a registered office in Amsterdam.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "agentic-ops", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.stacks.ai/accounting-agents", "sources": [ "https://www.stacks.ai/accounting-agents", "https://www.stacks.ai/", "https://www.stacks.ai/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "torq-ai-soc-socrates", "name": "Torq AI SOC Platform (Socrates and HyperAgents)", "vendor": "Torq", "hq_country": "Israel", "hq_region": "middle-east", "url": "https://torq.io/socrates/", "category": "security", "categories": [ "security" ], "summary": "Agentic SOC platform where the Socrates orchestrator plans and delegates to specialised HyperAgents for alert triage, investigation and response automation.", "description": "Torq's AI SOC platform applies agentic AI across triage, investigation and response. Socrates is the central interface and orchestrator: it plans, calls and builds Torq HyperAgents to investigate, reason and act across the threat lifecycle, and users can ask questions, prompt agents, find cases or mitigate threats from it. The platform also includes Auto Triage, case management and hyperautomation workflows. The contact page lists Tel Aviv as international HQ and Denver as Americas HQ; the privacy policy names Torq Technologies Ltd. TX-RAMP Level 1 certified (TX1915837, expires 2029-08-12) on the Texas DIR list updated 13 Oct 2026.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "tx-ramp" ], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "incident-response", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://torq.io/socrates/", "sources": [ "https://torq.io/socrates/", "https://torq.io/", "https://torq.io/contact-us/", "https://torq.io/company/", "https://torq.io/privacy/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 1", "product": "Torq AI SOC Platform", "id": "TX1915837", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2029-08-12" } ] }, { "slug": "dropzone-ai-soc-analyst", "name": "Dropzone AI SOC Analyst", "vendor": "Dropzone AI", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.dropzone.ai/", "category": "security", "categories": [ "security" ], "summary": "AI agents for the SOC: an AI SOC Analyst that investigates alerts end to end and shows its reasoning, plus an AI Threat Hunter and AI Threat Intel Analyst.", "description": "Dropzone AI's AI SOC Analyst investigates security alerts end to end (phishing, endpoint, network, cloud, identity and insider-threat alert types) and presents its evidence and reasoning so analysts decide what matters. The AI Threat Hunter runs hypothesis-driven hunts across SIEM, EDR and cloud data, and the AI Threat Intel Analyst turns new advisories into hunt packs. Pricing is sold as investigation capacity (up to 4,000 full investigations per year per AI analyst, unlimited users) with enterprise and MSSP plans; no dollar figure is published. Dropzone AI press releases are datelined Seattle, WA. TX-RAMP Level 2 certified (TX1957118, expires 2029-07-15) on the Texas DIR list updated 13 Oct 2026.", "pricing": "Quote-based (priced per AI analyst; each covers up to 4,000 full investigations per year, unlimited users; enterprise and MSSP pricing on request)", "pricing_model": "quote", "frameworks": [ "tx-ramp" ], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "threat-detection" ], "india_relevance": "", "featured": false, "source_url": "https://www.dropzone.ai/", "sources": [ "https://www.dropzone.ai/", "https://www.dropzone.ai/pricing", "https://www.dropzone.ai/company", "https://www.dropzone.ai/press-release/dropzone-ai-37m-series-b-funding-ai-soc-agents", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Dropzone AI, agentic soc", "id": "TX1957118", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2029-07-15" } ] }, { "slug": "zoven-ai", "name": "Zoven AI", "vendor": "Zoven AI (Zivy Applications India Private Limited)", "hq_country": "India", "hq_region": "india", "url": "https://www.zoven.ai/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Bengaluru-built fraud, AML and KYC/KYB platform where AI agents run investigation SOPs case by case and draft cited verdicts for analysts to decide.", "description": "Zoven combines merchant risk, KYB and video KYC, AML name screening, transaction monitoring, ongoing monitoring and case management for financial institutions. Its agents carry out a firm's fraud and risk SOPs step by step on each case (for example a Fraud Investigation Agent that pulls KYC, checks document metadata and resolves email, IP and device risk), cross-reference past cases and draft a cited verdict, leaving the decision to the analyst. Zoven AI is the trading name of Zivy Applications India Private Limited, whose privacy policy gives a Bengaluru, Karnataka address. The product launched publicly in 2026.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "fraud-detection", "aml", "kyc", "case-investigation" ], "india_relevance": "Indian company (Bengaluru); privacy policy is written to comply with India's DPDP Act. Homepage demo shows UPI transactions and Aadhaar-based ID checks (illustrative UI, not a coverage statement).", "featured": false, "source_url": "https://www.zoven.ai/", "sources": [ "https://www.zoven.ai/", "https://www.zoven.ai/privacy-policy", "https://www.zoven.ai/terms-of-service", "https://e27.co/zoven-ai-launches-the-ai-native-platform-that-puts-fraud-and-aml-teams-back-in-control-20260413/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "spellbook-associate", "name": "Spellbook Associate and Autonomous Contract Management (ACM)", "vendor": "Spellbook", "hq_country": "Canada", "hq_region": "north-america", "url": "https://www.spellbook.com/associate", "category": "business-ops", "categories": [ "business-ops" ], "summary": "AI agents for transactional lawyers and legal teams: Associate plans and executes multi-document drafting and review projects, and Autonomous Contract Management (GA Oct 2026) runs intake, first-pass review, approvals and redline review.", "description": "Spellbook Associate is described as an AI agent for transactional law: it breaks a goal into tasks and executes them across document sets, for example updating terms and party details, fixing issues across multiple documents, data-room reviews, financing documents and disclosure schedules, with lawyer oversight. It ships in the Spellbook Suite alongside the Word add-in for review, drafting, benchmarks and playbooks. Pricing is custom; a 7-day free trial is offered. For customers outside the US the contracting entity is Dialog Enterprises Inc., a Canadian federal corporation (US customers contract with Spellbook US Inc.). On 7 Oct 2026 Spellbook made Autonomous Contract Management (ACM) generally available. ACM is an AI contract-lifecycle system that pulls contracts in from intake forms, Gmail, Outlook and Slack. It routes them to the right pipeline and deal owner and runs a first-pass playbook review that marks clean routine agreements ready to approve and flags the rest. It routes approvals by internal rules, which can be set in plain language (for example auto-approving contracts under a set value that pass every playbook rule). It also reviews counterparty redlines automatically and stores signed agreements in a searchable repository.", "pricing": "Quote-based (custom pricing; 7-day free trial)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.spellbook.com/associate", "sources": [ "https://www.spellbook.com/associate", "https://www.spellbook.com/pricing", "https://www.spellbook.com/legal/terms-of-service", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://spellbook.com/blog/autonomous-contract-management-is-generally-available" ], "last_checked": "2026-10-20", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Spellbook", "id": "TX1820375", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2029-09-04" } ] }, { "slug": "legora-agent", "name": "Legora Agent", "vendor": "Legora", "hq_country": "Sweden", "hq_region": "europe", "url": "https://legora.com/product/agent", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Agent at the core of Legora's legal AI platform that plans, executes, reviews and delivers multi-step legal work with autonomous tool use and firm-specific skills.", "description": "Legora describes its Agent as the execution engine of the Legora aOS, its 'agentic operating system' for legal work. The Agent analyses a task, picks tools and proposes a plan, then executes, reviews and delivers the work, with lawyers stepping in where judgment is required; 'Skills' encode a firm's processes and standards as reusable instructions. The platform also covers legal research, review, drafting and regulatory Monitors. The privacy policy names Legora AB (org. no. 559338-6872), Stockholm, Sweden, as controller.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://legora.com/product/agent", "sources": [ "https://legora.com/product/agent", "https://legora.com/", "https://legora.com/about", "https://legora.com/legal/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "feedzai-farol", "name": "Feedzai Farol AI Agent", "vendor": "Feedzai", "hq_country": "Portugal", "hq_region": "europe", "url": "https://www.feedzai.com/farol-agentic-riskops/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "AI agent embedded in Feedzai's RiskOps Studio that analyses fraud rules, retrieves and summarises alert data for investigations, and drafts SAR narratives for investigator review.", "description": "Farol (launched 24 Sep 2026) is Feedzai's embedded agent for fraud and financial-crime operations. It ships with skills for Risk Strategy (interrogates rule sets, flags noisy rules and recommends sharper thresholds), Investigations (retrieves and summarises alert, customer and transaction context), SAR Narrative (turns case data into an evidence-backed SAR draft for review) and Knowledge (in-product guidance). Feedzai says Farol runs inside each institution's own environment, with reasoning and explanations for each result. The group's controlling entity is Feedzai \u2013 Consultadoria e Inova\u00e7\u00e3o Tecnol\u00f3gica, S.A., with its postal address in Coimbra, Portugal; Feedzai also runs a US headquarters in New York. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "fraud-detection", "aml", "case-investigation", "sar-narratives" ], "india_relevance": "", "featured": false, "source_url": "https://www.feedzai.com/farol-agentic-riskops/", "sources": [ "https://www.feedzai.com/farol-agentic-riskops/", "https://www.feedzai.com/pressrelease/as-banks-pivot-to-agentic-ai-feedzai-unveils-farol-to-transform-fraud-analysis-and-cut-investigation-times/", "https://www.feedzai.com/solutions/ai/", "https://www.feedzai.com/legal/privacy-policy/", "https://www.feedzai.com/contact-us/", "https://www.feedzai.com/pressrelease/us-hq-nyc/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "fenergo-kyra", "name": "Fenergo KYRA (Fen-AI agentic workforce)", "vendor": "Fenergo", "hq_country": "Ireland", "hq_region": "europe", "url": "https://www.fenergo.com/ai-agents", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Governed agentic workforce on Fenergo's client lifecycle (CLM/KYC) platform: agents complete routine KYC steps, resolve routine screening hits, process documents and source client data, with humans approving outcomes.", "description": "KYRA runs on Fenergo's Fen-X legal-entity system of record and coordinates agentic work across onboarding, periodic reviews, monitoring and change events. Named agents include KYRA:Complete (completes routine fields, forms and workflow steps using known rules), KYRA:Screen (resolves routine screening hits by comparing matches and assessing materiality), KYRA:Docs (classifies, extracts and links document data into review-ready records) and KYRA:Source (retrieves and reconciles client data and surfaces conflicts). Fenergo states that agents execute, humans stay in the loop, and every action, source and rationale is recorded for audit. Fenergo Limited is based in Dublin, Ireland. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "kyc", "aml", "workflow-automation", "case-investigation" ], "india_relevance": "", "featured": false, "source_url": "https://www.fenergo.com/ai-agents", "sources": [ "https://www.fenergo.com/ai-agents", "https://www.fenergo.com/", "https://www.fenergo.com/privacy-policy", "https://www.fenergo.com/contact" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "taktile-ai-agents", "name": "Taktile AI agents (onboarding, sanctions and adverse-media agents)", "vendor": "Taktile", "hq_country": "Germany", "hq_region": "europe", "url": "https://taktile.com/product/agents", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Agentic decision platform for banks and insurers with a library of pre-built agents, including Adverse Media Investigation, Business Ownership Intelligence and Sanctions and Watchlist Match Review agents, that run inside decision flows with human review.", "description": "Taktile's agent library lists 11 pre-trained agents for banking and insurance, including an Adverse Media Investigation Agent, Business Ownership Intelligence Agent, Sanctions and Watchlist Match Review Agent, Application Completeness Check Agent, Document Classification and Data Extraction agents, and a Regulatory Report Generation Agent, plus custom agents. Agents summarise, classify, present context and take action inside a decision flow, and their structured outputs feed rules, models and human review. Use cases are business onboarding (KYB), underwriting and claims. Taktile GmbH is registered in Berlin, Germany. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "kyc", "aml", "fraud-detection", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://taktile.com/product/agents", "sources": [ "https://taktile.com/product/agents", "https://taktile.com/", "https://taktile.com/imprint" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "hummingbird-ai-agents", "name": "Hummingbird AI Agents (Research and Review Agents)", "vendor": "Hummingbird", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.hummingbird.co/platform/ai", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "AI agents for financial-crime compliance: a Research Agent that gathers and synthesises subject evidence and a Review Agent that fills out case reviews per your procedures, on an agent orchestration platform with analyst approval.", "description": "Hummingbird's AI Agents automate routine AML casework, from entity research to narrative writing. The Research Agent reviews and synthesises data from the web, internal systems and prior case history into a cited report; the Review Agent follows the customer's procedures to fill out the review for approval. Hummingbird positions this on an agent orchestration platform where its agents, customer-built agents and analysts share one workspace, with autonomy that can grow from approved recommendations to fully automated casework. Every agent action is documented and audit-ready, and an AI Assistant supports complex investigations. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "case-investigation", "sar-narratives", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.hummingbird.co/platform/ai", "sources": [ "https://www.hummingbird.co/platform/ai", "https://www.hummingbird.co/resources/research-and-review-agents", "https://www.hummingbird.co/resources/introducing-agent-orchestration-platform", "https://help.hummingbird.co/features/hummingbird-ai-security-and-privacy-overview", "https://www.hummingbird.co/privacy-policy", "https://www.hummingbird.co/careers" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "unit21-ai-agents", "name": "Unit21 AI Agents for fraud and AML", "vendor": "Unit21", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.unit21.ai/products/ai-agent", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "AI agents that run fraud and AML alert triage and investigations: they pull transaction history, check watchlists, run open-source research, assemble evidence, draft narratives and recommend dispositions for analyst approval.", "description": "Unit21's agents run the financial-crime lifecycle from first alert to filed SAR, producing outputs analysts review, approve and defend. For L1 triage and investigations the agent gathers transaction and counterparty data, runs open-source research, assembles evidence and recommends a disposition. Autonomy is configurable by queue and risk tier, up to guarded auto-closing of defined low-risk alerts. Unit21 reports more than 1.5M alert reviews run by its agents. Unit21, Inc. is based in San Francisco. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "fraud-detection", "case-investigation", "sar-narratives" ], "india_relevance": "", "featured": false, "source_url": "https://www.unit21.ai/products/ai-agent", "sources": [ "https://www.unit21.ai/products/ai-agent", "https://www.unit21.ai/blog/the-new-unit21-why-we-rebuilt-everything-around-ai-agents", "https://www.unit21.ai/blog/progressive-autonomy-the-trust-ladder-for-ai-in-compliance", "https://www.unit21.ai/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "anecdotes-agentic-grc", "name": "Anecdotes Agentic GRC (Agent Library and Agent Studio)", "vendor": "Anecdotes", "hq_country": "Israel", "hq_region": "middle-east", "url": "https://www.anecdotes.ai/agent-library", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Enterprise GRC platform with built-in agents for evidence analysis, control assessment, risk enrichment and findings extraction, plus an Agent Studio for custom GRC agents and agentic TPRM.", "description": "Anecdotes' Agent Library lists agents built into its applications, such as an Evidence Analyzer (turns screenshots and documents into structured, searchable evidence), Control Assessment / Automated Findings Extractor (scans audit and pentest reports to find gaps and auto-create findings with remediation tasks), a Risk Enricher (fills missing risk fields and links mitigating controls) and an Analysis Rule Generator. Off-the-shelf templates run in Agent Studio, and MCP-orchestrated agents connect Anecdotes to tools such as Jira. The platform also offers agentic continuous control monitoring, agentic TPRM, and FedRAMP-focused CCM. On the FedRAMP Marketplace, Anecdotes (FR2620235600) is FedRAMP Authorized at 20x Moderate (authorized 2026-06-23); the marketplace listing describes it as an agentic GRC platform for continuous compliance. The website is owned by Anecdotes A.I Ltd., an Israeli company (terms of use); the site footer also lists a Palo Alto, California office. Homepage copy says the same evidence can satisfy NIST, ISO 27001 and HIPAA. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "fedramp", "iso27001", "hipaa" ], "frameworks_claimed": [ "FedRAMP", "ISO 27001", "HIPAA", "NIST", "NIS2" ], "tasks": [ "evidence-collection", "control-monitoring", "risk-management", "vendor-risk", "audit-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.anecdotes.ai/agent-library", "sources": [ "https://www.anecdotes.ai/agent-library", "https://www.anecdotes.ai/", "https://www.anecdotes.ai/terms-of-use", "https://www.anecdotes.ai/about-us", "https://www.fedramp.gov/marketplace/products/FR2620235600/", "https://www.anecdotes.ai/plugins" ], "last_checked": "2026-10-20", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Anecdotes", "id": "FR2620235600", "impact": "20x Moderate", "date": "2026-06-23", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR2620235600/", "checked": "2026-10-18" } ], "integrations": [ "aws", "azure", "gcp", "github", "microsoft-365-entra" ] }, { "slug": "cypago-agentic-workflows", "name": "Cypago Agentic Workflows", "vendor": "Cypago", "hq_country": "Israel", "hq_region": "middle-east", "url": "https://cypago.com/agentic-workflows/", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Cyber GRC platform whose AI agents build and run end-to-end compliance workflows from natural-language prompts, covering evidence collection, control testing, gap analysis and continuous control monitoring.", "description": "Cypago's Agentic Workflows let teams generate security-compliance and GRC workflows from natural-language prompts. Cypago's AI agents then build and execute them end to end, from evidence collection to control testing, gap analysis and continuous controls monitoring, adapted to the organisation's policies and environment. The platform also covers user access reviews, risk management and ChatGRC, with framework coverage that includes SOC 2, ISO 27001/27017/27018/27701/42001, NIST 800-53/800-171/CSF 2.0/AI RMF, HIPAA, PCI DSS, GDPR, CMMC 2.0, SOX ITGC and FedRAMP. Contracts are with Cypago Security Ltd. under Israeli law (Tel Aviv courts). Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "hipaa", "cmmc" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "ISO 42001", "HIPAA", "PCI DSS", "GDPR", "NIST CSF 2.0", "NIST 800-53", "CMMC 2.0", "FedRAMP (framework support; not an authorization)" ], "tasks": [ "evidence-collection", "control-testing", "gap-analysis", "control-monitoring", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://cypago.com/agentic-workflows/", "sources": [ "https://cypago.com/agentic-workflows/", "https://cypago.com/", "https://cypago.com/terms-and-conditions/", "https://cypago.com/about-cypago/", "https://cypago.com/pricing/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "kodex-ai-agents", "name": "Kodex AI regulatory compliance agents", "vendor": "Kodex AI", "hq_country": "Germany", "hq_region": "europe", "url": "https://www.kodex-ai.com/", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Generative-AI agents for financial-services regulatory compliance: a Screening Agent for horizon scanning and alerts, a Gap Analysis Agent that maps rules such as DORA, PSD3 and MiCAR against your policies, and a Reports Agent.", "description": "Kodex AI builds agents for banks, fintechs, crypto and payment firms. The Screening Agent continuously monitors regulatory sources, keeps a tailored regulatory inventory and sends filtered alerts. The Gap Analysis Agent maps regulatory requirements (e.g. DORA, PSD3, MiCAR) against internal policies and proposes changes that users accept or reject into their policy library. The Reports Agent produces regulatory and audit reports, and a regulatory chat assistant covers research. Kodex AI GmbH is a Berlin-based startup. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "dora" ], "frameworks_claimed": [ "DORA", "PSD3", "MiCAR" ], "tasks": [ "gap-analysis", "policy-management", "grc-intelligence", "compliance-workflows" ], "india_relevance": "", "featured": false, "source_url": "https://www.kodex-ai.com/", "sources": [ "https://www.kodex-ai.com/", "https://www.kodex-ai.com/gap-analysis", "https://www.kodex-ai.com/imprint" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "trustero-ai", "name": "Trustero AI (GRC agents)", "vendor": "Trustero (Interstice Labs, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://trustero.com/", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "AI GRC platform whose agents collect and map evidence, test controls continuously, assess policies against frameworks, run natural-language 'TI Playbooks' and answer security questionnaires.", "description": "Trustero uses AI agents across GRC work. Agents collect, enrich and map evidence; test controls continuously using natural-language definitions; assess policies and controls against any regulation or framework; and answer inbound RFPs and security questionnaires from GRC context. TI Playbooks let teams describe busywork in natural language for agents to complete. Trustero says it is framework-agnostic and highlights SOC 2, ISO 27001, NIST, CMMC and HIPAA, and it can layer onto existing GRC tools such as Archer. Interstice Labs, Inc. (dba Trustero) is in Palo Alto, CA. Pricing is not published. On Oct 7, 2026 Trustero launched Third-Party Risk Management (TPRM): an agentic orchestrator reads vendor attestations and security questionnaires, sorts vendors into customer-defined risk tiers, requests documents (e.g. ISO 27001 certificates, proof of insurance) by tier and gives the team a recommended risk determination to review and approve.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "hipaa", "cmmc" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "NIST", "CMMC", "HIPAA", "SOC 1" ], "tasks": [ "evidence-collection", "control-monitoring", "control-testing", "questionnaire-automation", "policy-management", "vendor-risk" ], "india_relevance": "", "featured": false, "source_url": "https://trustero.com/", "sources": [ "https://trustero.com/", "https://trustero.com/privacy-policy", "https://trustero.com/terms-of-use", "https://www.prnewswire.com/news-releases/trustero-extends-its-ai-powered-grc-platform-to-third-party-risk-management-302901165.html", "https://www.trustero.com/" ], "last_checked": "2026-10-25", "added": "2026-10-18" }, { "slug": "modulos-ai-governance-agents", "name": "Modulos AI governance agents (Scout, Risk Agent, Control Assessment Agent)", "vendor": "Modulos", "hq_country": "Switzerland", "hq_region": "europe", "url": "https://www.modulos.ai/modulos-ai-governance-platform/agents", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "AI governance platform whose agents discover AI systems, assess controls against evidence, quantify AI risk in euros and investigate changes on a schedule, while decisions on the record stay with your team.", "description": "Modulos governs the AI an organisation builds, buys and uses. Its platform agents run recurring governance work on a set cadence. Scout gathers evidence and identifies issues. The Risk Agent turns usage data, controls and evidence into an annual loss estimate in euros with its reasoning. The Control Assessment Agent assesses the evidence attached to each control. Each agent reads a defined input, produces a defined output on a defined trigger, and cites the records it used. Discovery keeps an inventory of AI systems and agents, and one control library covers the EU AI Act and ISO/IEC 42001. Modulos AG operates from Zurich, Switzerland. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "EU AI Act", "ISO/IEC 42001" ], "tasks": [ "ai-governance", "risk-assessment", "control-testing", "evidence-collection" ], "india_relevance": "", "featured": false, "source_url": "https://www.modulos.ai/modulos-ai-governance-platform/agents", "sources": [ "https://www.modulos.ai/modulos-ai-governance-platform/agents", "https://www.modulos.ai/", "https://www.modulos.ai/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "datagrail-vera", "name": "DataGrail Vera (AI privacy agent)", "vendor": "DataGrail", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.datagrail.io/blog/product/introducing-vera-the-first-complete-ai-privacy-agent/", "category": "risk", "categories": [ "risk", "compliance", "privacy" ], "summary": "AI privacy agent built into DataGrail's privacy platform that autofills privacy and AI-risk assessments, classifies cookies, detects AI risk, suggests processing activities and troubleshoots DSR integration errors, acting only with user approval.", "description": "Vera (announced 17 Mar 2026) is DataGrail's privacy-operations agent. It works from live privacy-program data, risk metadata on 22,000+ systems and a continuously updated view of regulations. It is used through chat and through automated in-product capabilities: assessment autofill, automated cookie classification, AI risk detection, suggested processing activities and DSR integration-error troubleshooting. Vera adopts user permissions, never acts without approval, and tracks each completed task. DataGrail's platform also covers a live data map, consent management, DSR automation across 2,500 apps and a risk register. DataGrail, Inc. is in San Francisco. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "GDPR", "CCPA/CPRA", "US state privacy laws" ], "tasks": [ "privacy-management", "dsr-automation", "consent", "risk-assessment", "data-discovery" ], "india_relevance": "", "featured": false, "source_url": "https://www.datagrail.io/blog/product/introducing-vera-the-first-complete-ai-privacy-agent/", "sources": [ "https://www.datagrail.io/blog/product/introducing-vera-the-first-complete-ai-privacy-agent/", "https://docs.datagrail.io/docs/vera/overview/", "https://www.datagrail.io/", "https://www.datagrail.io/privacy-policy/" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "privado-wren", "name": "Privado Wren (AI privacy analyst agent)", "vendor": "Privado AI", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.privado.ai/products/wren", "category": "risk", "categories": [ "risk", "compliance", "privacy" ], "summary": "AI privacy agent that runs privacy assessments end to end: it monitors tools like Jira, CLM and procurement for new activity, triggers the right PIA/DPIA/TIA/RoPA, researches risk, populates assessments with evidence and routes approvals.", "description": "Wren watches internal tools (Jira, CLM, procurement, etc.) for activity that needs a privacy review and researches risk against the customer's policies and regulations. It then triggers the right PIA, DPIA, TIA or RoPA, issues guidance for low-risk activity, and fills in whole assessments by analysing imported documents, interview transcripts, contracts, code and third-party apps. Findings carry cited evidence, and Wren routes approvals and tracks remediation. Privado also sells web and app privacy auditors and DSR automation. Published pricing: Wren starts at $4,200 per month billed annually for up to 500 assessments.", "pricing": "Wren AI privacy agent: from $4,200/month billed annually for up to 500 assessments (privado.ai/pricing). Web Auditor from $600/website/month and App Auditor from $800/app/month, billed annually.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [ "GDPR", "CCPA" ], "tasks": [ "privacy-management", "risk-assessment", "data-discovery", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.privado.ai/products/wren", "sources": [ "https://www.privado.ai/products/wren", "https://www.privado.ai/products/agentic-assessments", "https://www.privado.ai/pricing", "https://www.privado.ai/privacy-policy" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "ketch-agent-network", "name": "Ketch Agent Network", "vendor": "Ketch (Ketch Kloud, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.ketch.com/platform/agent-network", "category": "risk", "categories": [ "risk", "compliance", "privacy" ], "summary": "Agent layer behind Ketch's privacy platform that self-populates data maps, runs always-on gap analysis between regulations, your commitments and live systems, and proposes reviewable configuration changes, DPIAs and RoPA exports.", "description": "Ketch describes the Agent Network as the orchestration layer that powers every Ketch product and turns insight into action. It covers agentic data mapping (connects SaaS systems, repositories and Ketch configurations to classify fields by sensitivity, category and processing activity), agentic risk management (continuous gap analysis that flags contradictions with citations and assignable remediation, such as DPA contract gaps with CCPA citations), and outputs such as automated DPIAs, RoPA exports and a proposed CMP configuration for a new jurisdiction, with an audit trail. Ketch Kloud, Inc. is in San Francisco. Consent-management tiers are published, but data mapping, DSR automation and risk assessments are priced separately.", "pricing": "Consent tiers published: Free $0 (5k users), Starter $150/month, Plus from $499/month billed annually, Pro custom. Data mapping, DSR automation and risk assessments (where the agent features sit) are priced separately and not published.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "CCPA", "GDPR" ], "tasks": [ "privacy-management", "data-discovery", "consent", "dsr-automation", "gap-analysis" ], "india_relevance": "", "featured": false, "source_url": "https://www.ketch.com/platform/agent-network", "sources": [ "https://www.ketch.com/platform/agent-network", "https://www.ketch.com/", "https://www.ketch.com/pricing", "https://www.ketch.com/privacy-policy" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "whistic-automation-orchestrator", "name": "Whistic Automation Orchestrator (agentic assessments)", "vendor": "Whistic", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.whistic.com/automation-orchestrator", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Agentic vendor-assessment workflow in which four agents (Initiator, Collector, Analyst, Reporter) start assessments, gather evidence, produce cited findings and route an executive summary for human approval.", "description": "Whistic's Automation Orchestrator coordinates four specialised agents across the third-party assessment lifecycle. The Initiator starts the right assessment when configured criteria or cadence are met. The Collector assembles configured evidence and surfaces collection exceptions. The Analyst runs Vendor Summary and produces cited, confidence-scored findings. The Reporter compiles the executive summary and routes it to configured approvers, and the customer's team makes the final decision. Whistic estimates 12\u201315 hours saved per assessment. The platform also includes vendor monitoring, Trust Center and the Trust Center Exchange. Whistic, Inc. is a Delaware corporation based in Utah. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "vendor-risk", "questionnaire-automation", "risk-assessment", "trust-center" ], "india_relevance": "", "featured": false, "source_url": "https://www.whistic.com/automation-orchestrator", "sources": [ "https://www.whistic.com/automation-orchestrator", "https://www.whistic.com/", "https://www.whistic.com/about-whistic", "https://www.whistic.com/terms", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 1", "product": "Whistic - Assess", "id": "TX1435648", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2027-01-25" } ] }, { "slug": "black-kite-ai-agent", "name": "Black Kite AI Agent", "vendor": "Black Kite (NormShield, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://blackkite.com/ai", "category": "risk", "categories": [ "risk", "security" ], "summary": "Third-party cyber risk agent made of sub-agents (Assessment, Incident Response, Threat Actor Intelligence, Investigation, Prioritization, Procurement) that assess vendors, investigate exposures, trigger rescans and draft outreach.", "description": "The Black Kite AI Agent runs on a network of TPRM sub-agents. The Assessment Agent maps vendor controls to questionnaires, frameworks and regulations. The Incident Response Agent analyses vendor exposure to breaches, zero-days and CVEs. The Threat Actor Intelligence Agent monitors for emerging threats to vulnerable vendors. The Investigation Agent validates exposures, checks patch status and triggers rescans. The Prioritization Agent ranks vendors by severity and business impact, and the Procurement Agent benchmarks vendors side by side. Pre-built 'Blueprints' cover deep-dive investigations and TPRM board reporting, and the agent can draft vendor outreach. NormShield, Inc. dba Black Kite is in Boston, MA. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "vendor-risk", "security-ratings", "risk-prioritization", "incident-response", "questionnaire-automation" ], "india_relevance": "", "featured": false, "source_url": "https://blackkite.com/ai", "sources": [ "https://blackkite.com/ai", "https://blackkite.com/", "https://blackkite.com/privacy-policy", "https://blackkite.com/contact-us", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://govramp.org/program-participants" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 1", "product": "Black Kite", "id": "TX1464698", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2027-03-04" }, { "program": "govramp", "status": "Ready", "product": "Black Kite Third Party Risk Intelligence", "impact": "Moderate", "scope": "platform-only", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "processunity-tprm-ai-agents", "name": "ProcessUnity TPRM AI Agents (Evidence Evaluator, Assessment Autofill)", "vendor": "ProcessUnity", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.processunity.com/tprm-ai-agents/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Team of risk-informed AI agents for each stage of the third-party risk lifecycle, covering intake checks, evidence review, issues management and executive reporting, with the customer's team in control.", "description": "ProcessUnity's TPRM AI Agents handle intake checks, evidence review (Evidence Evaluator), assessment autofill, issues management and executive reporting across the third-party risk lifecycle, with human control over decisions. They sit on ProcessUnity's TPRM platform alongside the Global Risk Exchange, the ProcessUnity Risk Index and threat and vulnerability response. Regulatory solution pages cover DORA, APRA, LkSG and the PRA's SS2/21. ProcessUnity, Inc. is in Concord, MA. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "dora" ], "frameworks_claimed": [ "DORA", "APRA", "LkSG", "PRA SS2/21" ], "tasks": [ "vendor-risk", "risk-assessment", "evidence-collection", "questionnaire-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.processunity.com/tprm-ai-agents/", "sources": [ "https://www.processunity.com/tprm-ai-agents/", "https://www.processunity.com/", "https://www.processunity.com/assessment-autofill/", "https://www.processunity.com/contact-us/", "https://www.processunity.com/privacy-policy/" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "sekoia-elevate-ai-soc-agents", "name": "Sekoia Elevate (AI SOC agents)", "vendor": "Sekoia.io", "hq_country": "France", "hq_region": "europe", "url": "https://www.sekoia.io/en/product/elevate/", "category": "security", "categories": [ "security" ], "summary": "Agentic AI SOC analyst inside the Sekoia SOC platform: agents autonomously investigate every alert and case, show their reasoning and produce audit-ready reports for analyst validation.", "description": "Sekoia Elevate is the AI investigation layer of the Sekoia autonomous SOC platform (SIEM, CTI, CAASM). The product page says Elevate AI agents autonomously investigate alerts and cases, correlate logs, assets, detections and threat intelligence, and return a verdict with confidence level, discrete Findings (each showing the exact query or action the agent ran) and the reasoning questions it explored. Agent behaviour is shaped by Runbooks that Elevate generates for every detection rule (editable detection rationale, false-positive scenarios and investigation questions), and agents can be configured per tenant for MSSPs. Sekoia states all AI runs on its own infrastructure with no customer data sent outside. Analysts keep control and validate outcomes. The legal notice names Sekoia.io SAS with its registered office in Rennes, France. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "incident-response", "threat-detection" ], "india_relevance": "Relevant to CERT-In incident detection and response capability building; not a CERT-In compliance product by itself.", "featured": false, "source_url": "https://www.sekoia.io/en/product/elevate/", "sources": [ "https://www.sekoia.io/en/product/elevate/", "https://www.sekoia.io/en/legal-notice/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "mindflow-ai-agents", "name": "Mindflow AI Agents (agentic SecOps/ITOps automation)", "vendor": "Mindflow", "hq_country": "France", "hq_region": "europe", "url": "https://mindflow.io/autonomous-agents", "category": "security", "categories": [ "security", "business-ops" ], "summary": "No-code agentic automation platform for SecOps, ITOps and CloudOps: mission-oriented AI agents that reason and act across 4,000+ integrations, with RBAC, approval steps and full audit logs.", "description": "Mindflow sells an enterprise automation platform whose AI Agents are given a mission, scope and scoped permissions and then build their own logic, choosing and chaining operations across Mindflow's catalogue of about 4,000 integrated tools (vendor-claimed 150,000+ operations). The Autonomous Agents page documents triggers from flows, other agents, webhooks and schedules, granular RBAC, scoped credentials and action whitelists, optional human approval for any step, end-to-end audit of agent actions, prompts and API calls, and RAG over customer policies. An AI Agent Library lists prebuilt security-analyst agents (for example an Access Anomaly Detector agent for SOC work) alongside IT and finance agents. This is a general automation platform with a SecOps focus rather than a dedicated SOC analyst product. The legal notice names Mindflow SAS, registered in Paris, France. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "workflow-automation", "incident-response" ], "india_relevance": "", "featured": false, "source_url": "https://mindflow.io/autonomous-agents", "sources": [ "https://mindflow.io/autonomous-agents", "https://mindflow.io/ai-agents-library", "https://mindflow.io/legal-notice" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "cyble-blaze-ai", "name": "Cyble Blaze AI", "vendor": "Cyble", "hq_country": "United States", "hq_region": "north-america", "url": "https://cyble.com/platforms/blaze-ai/", "category": "security", "categories": [ "security" ], "summary": "Multi-agent cybersecurity engine across Cyble's threat-intelligence, endpoint and cloud products: agents hunt, correlate IOCs, isolate endpoints, block domains and draft reports, with human-in-the-loop guardrails.", "description": "Cyble markets Blaze AI as an AI-native, multi-agent platform layered over its threat-intelligence (Vision), cloud (Strato) and endpoint (Titan) products. The product page describes autonomous agents that plan, collaborate and execute incident lifecycles: hunting dark-web chatter and extracting IOCs, cross-checking IOCs across endpoints and cloud, isolating endpoints, blocking domains, running automated takedowns and producing executive briefs, with built-in guardrails and human-in-the-loop oversight. Performance claims on the page (for example predicting attacks up to six months early) are vendor marketing and are not independently verified here. Cyble's About page says the company was established in 2019 and is headquartered in Cupertino, California, and the contact page gives a Cupertino address. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "threat-detection", "security-operations", "incident-response", "threat-intelligence" ], "india_relevance": "Relevant to CERT-In incident detection and response capability building; not a CERT-In compliance product by itself.", "featured": false, "source_url": "https://cyble.com/platforms/blaze-ai/", "sources": [ "https://cyble.com/platforms/blaze-ai/", "https://cyble.com/about-us/", "https://cyble.com/contact-us" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "exaforce-exabots", "name": "Exaforce Exabots (agentic SOC)", "vendor": "Exaforce", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.exaforce.com/exabots", "category": "security", "categories": [ "security" ], "summary": "Four role-based AI agents (Detect, Triage, Investigate, Respond) on Exaforce's own security data platform, covering detection engineering, tier-3 triage, threat hunting and playbook-driven response with approval gates.", "description": "Exaforce's Exabots are four agents that each own one SOC role and reason over a shared real-time knowledge graph of events, configuration, identities and resources. Exabot Detect acts as an AI detection engineer across identity, cloud, SaaS and code sources (including GitHub and Google Workspace) with 800+ out-of-the-box condition combinations; Exabot Triage investigates every alert and filters false positives before escalation with evidence; Exabot Investigate takes natural-language questions for threat hunting; Exabot Respond runs built-in or plain-language playbooks with approval gates and an audit trail on every action. Exaforce can be operated in-house or as an MDR service. Percentage improvements on the page are vendor-claimed. The privacy policy states Exaforce is headquartered in California, United States. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "threat-detection", "incident-response" ], "india_relevance": "Relevant to CERT-In incident detection and response capability building; not a CERT-In compliance product by itself.", "featured": false, "source_url": "https://www.exaforce.com/exabots", "sources": [ "https://www.exaforce.com/exabots", "https://www.exaforce.com/about", "https://www.exaforce.com/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "qodo-code-review-agents", "name": "Qodo multi-agent code review", "vendor": "Qodo (Codium Ltd.)", "hq_country": "Israel", "hq_region": "middle-east", "url": "https://www.qodo.ai/products/qodo-merge/", "category": "code-security", "categories": [ "code-security" ], "summary": "Agentic pull-request review platform (formerly CodiumAI) that flags bugs, security issues and rule violations with organisational context. A general code reviewer, not a dedicated SAST scanner.", "description": "Qodo (Codium Ltd., doing business as Qodo) sells an agentic PR review system for GitHub/GitLab/Bitbucket and IDEs: multi-agent review that enforces organisational rules and standards, cross-repo breaking-change detection, pre-PR review skills and a self-learning rules system. Qodo's documentation lists security issues as one of the finding types tracked in its review analytics alongside bugs, rule violations and requirement gaps, so the security coverage is part of general code review rather than a dedicated AppSec scanner (same framing as other PR reviewers listed here). Qodo also offers an Agentic Toolbox that gives coding agents such as Codex, Claude and Kiro a CLI-based quality counterpart. The privacy policy gives Codium Ltd.'s address in Tel Aviv, Israel. Pricing is published.", "pricing": "Free 14-day trial. Pro Team plan (designed for up to 30 users) is listed from $30 on qodo.ai/pricing with pooled credit packs at $0.012 per credit (for example 2,500 credits \u2248 18 reviews/month); Enterprise (30+ users, SSO, on-prem, BYOK) is custom. Confirm the billing unit on the vendor page.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pr-review", "appsec", "code-quality" ], "india_relevance": "PR review that flags security issues can support secure SDLC programmes. Qodo does not market a CERT-In module.", "featured": false, "source_url": "https://www.qodo.ai/products/qodo-merge/", "sources": [ "https://www.qodo.ai/products/qodo-merge/", "https://docs.qodo.ai/governance/code-review-analytics", "https://www.qodo.ai/pricing/", "https://www.qodo.ai/privacy-policy/", "https://www.qodo.ai/about/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "xygeni-devai-coreai", "name": "Xygeni DevAI and CoreAI (agentic AppSec)", "vendor": "Xygeni Security", "hq_country": "Spain", "hq_region": "europe", "url": "https://xygeni.io/dev-ai", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Agentic AppSec from Valladolid-based Xygeni: DevAI scans code in the IDE and generates validated fixes (including for AI-generated code), while CoreAI prioritises risk and orchestrates remediation PRs across the platform.", "description": "Xygeni's DevAI runs continuously in the IDE (VS Code, IntelliJ, Cursor, Windsurf), doing incremental SAST, secrets and supply-chain checks on human-written and AI-generated code, explaining attack paths and generating fixes for code, dependencies and secrets that are checked by Xygeni's MCP server for breaking-change and policy risk before developers apply them. CoreAI is described as a continuous intelligence layer that correlates findings from code to runtime, ranks them by exploitability, generates remediation plans and can open pull requests, apply guardrails and update configurations, with the Xyra interface for teams to review and approve actions. The wider platform covers SAST, SCA, secrets, CI/CD, IaC, DAST and ASPM. The legal notice names XYGENI SECURITY SL, Valladolid, Spain. A free plan is listed; paid plans are priced by contributors and scans.", "pricing": "Free plan listed on xygeni.io/pricing; paid annual plans are priced by number of contributors and daily scans (amounts load dynamically and were not captured from the static page).", "pricing_model": "freemium", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "sca", "secrets-detection", "remediation" ], "india_relevance": "Automated fixes for SAST/SCA/secrets findings can support CERT-In-oriented vulnerability handling. Xygeni does not market a CERT-In module.", "featured": false, "source_url": "https://xygeni.io/dev-ai", "sources": [ "https://xygeni.io/dev-ai", "https://xygeni.io/core-ai", "https://xygeni.io/legal/legal-notice", "https://xygeni.io/pricing/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "zeropath-agentic-appsec", "name": "ZeroPath (AI-native SAST and autofix)", "vendor": "ZeroPath", "hq_country": "United States", "hq_region": "north-america", "url": "https://zeropath.com/products/sast-autofix", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "AI-native AppSec platform that finds business-logic and auth flaws, validates findings from existing SAST tools, runs PR security reviews and generates one-click patches refined in natural language.", "description": "ZeroPath describes itself as agentic AppSec covering code, dependencies, infrastructure and runtime. Its SAST Auto-Fix product uses AI to validate findings from existing scanners (Snyk, Semgrep, Checkmarx, SonarQube, Veracode, Fortify, Synopsys) to cut false positives, deduplicates them and generates working patches that developers can refine with natural-language PR comments before approval. The platform also offers AI-native SAST with business-logic and broken-auth detection, SCA with reachability, secrets and IaC scanning, DAST-style runtime validation, automated PR security reviews and automated threat modelling. Noise-reduction percentages are vendor-claimed. The privacy policy and terms give a San Francisco address. Team pricing is published.", "pricing": "Team plan starting from $1,000/month + $60 per developer (unlimited repositories and scans) on zeropath.com/pricing; Enterprise is custom; usage-based credits listed as coming soon; startup discounts up to 50%.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "remediation", "pr-review", "sca" ], "india_relevance": "", "featured": false, "source_url": "https://zeropath.com/products/sast-autofix", "sources": [ "https://zeropath.com/products/sast-autofix", "https://zeropath.com/", "https://zeropath.com/pricing", "https://zeropath.com/privacy", "https://zeropath.com/terms" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "pixee-triage-and-fix", "name": "Pixee (automated triage and fix)", "vendor": "Pixee", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.pixee.ai/platform", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Security 'harness' that triages SAST/SCA/DAST/secrets findings for exploitability, opens fix pull requests with the analysis attached, works inside coding agents, and builds design-stage threat models.", "description": "Pixee's platform ingests findings from existing scanners (SAST, SCA, DAST and secrets), uses reachability analysis to show which can actually be exploited and opens pull requests that carry the triage verdict and the analysis behind each fix for reviewers. Exploit Chains combines findings across SAST and SCA into attack paths checked step by step in code, and Foresight turns design documents into a living threat model with drift detection. Pixee states it works inside customers' coding agents. Backlog and false-positive reduction figures are vendor-claimed (for example a MoneyGram case study). The About page says the team comes from Contrast Security; the terms name Pixee, Inc. under Delaware law. Pricing is outcome-based (per resolution) and quoted, not seat-based.", "pricing": "Not published as list prices. Pixee describes outcome-based pricing per 'resolution' (each automated triage or fix action), not per developer; custom quote.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "remediation", "sast", "sca", "vulnerability-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.pixee.ai/platform", "sources": [ "https://www.pixee.ai/platform", "https://www.pixee.ai/pricing", "https://www.pixee.ai/about", "https://www.pixee.ai/policies/terms-of-service" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "plerion-pleri", "name": "Plerion Pleri (AI security engineer)", "vendor": "Plerion", "hq_country": "Australia", "hq_region": "australia-new-zealand", "url": "https://www.plerion.com/agents", "category": "security", "categories": [ "security" ], "summary": "Sydney-based cloud and AI security platform with Pleri, an agent that investigates findings, checks real exploitability, raises fix PRs and Jira tickets, and follows each change through to merge.", "description": "Plerion's Pleri is described as an AI security engineer for cloud and AI workloads (AWS, Azure, Google Cloud). For each finding Pleri pulls context (what the resource is, who can reach it, what it connects to), checks whether it is actually exploitable in the customer's environment, raises a pull request with the fix (for example Terraform changes), files a Jira ticket and messages the owner in Slack with its reasoning, then nudges stale PRs, confirms the fix after merge and closes the ticket. The page also shows Pleri running AI-SPM assessments (for example Vertex AI and Model Armor checks) and applying stopgaps such as blocking public S3 access. Every change is approved by the customer. Backlog-reduction figures are vendor-claimed. The privacy policy names Plerion Pty Ltd with a registered address in Sydney, and the terms are governed by New South Wales law. Pricing is published as a cloud-spend-based estimate.", "pricing": "Published estimator on plerion.com/pricing: a fixed monthly Plerion bill set by combined monthly AWS/Azure/GCP spend (example shown: $100,000\u2013$130,000 cloud bill \u2192 about $3,100\u2013$3,700/month, USD), all capabilities and the agent included; 'Start free' option.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "cloud-security", "vulnerability-management", "remediation", "exposure-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.plerion.com/agents", "sources": [ "https://www.plerion.com/agents", "https://www.plerion.com/pricing", "https://www.plerion.com/company/privacy-policy", "https://www.plerion.com/company/terms-and-conditions" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "sysdig-agentic-ai", "name": "Sysdig Agentic AI (Sysdig Secure AI agents)", "vendor": "Sysdig", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.sysdig.com/products/agentic-ai", "category": "security", "categories": [ "security" ], "summary": "Outcome-driven AI agents inside Sysdig Secure for cloud and container security: Vuln, SOC, Posture, Risk and Response agents that investigate, prioritise and drive remediation on Falco-based runtime data.", "description": "Sysdig Agentic AI replaces dashboard navigation with goal-driven agents in the Sysdig Secure UI. The product page names five agents: Vuln (finds and investigates the most exploitable vulnerabilities and drives remediation from ticket to resolution), SOC (investigates alerts like an analyst and initiates response when a threat is confirmed), Posture (fixes misconfigurations and builds custom policies), Risk (prioritises risk from exposure to business impact) and Response (coordinates containment through to preventing recurrence). Agents use Sysdig's runtime telemetry (including Falco) and threat research, recommend outcomes by role, then build and execute plans. A 'headless' option lets customers' own coding agents use Sysdig intelligence. Cost and throughput comparisons on the page are vendor-claimed. Sysdig's legal page lists headquarters in Raleigh, North Carolina. Pricing for Sysdig Secure is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "cloud-security", "vulnerability-management", "security-operations", "remediation", "incident-response" ], "india_relevance": "", "featured": false, "source_url": "https://www.sysdig.com/products/agentic-ai", "sources": [ "https://www.sysdig.com/products/agentic-ai", "https://www.sysdig.com/legal", "https://www.sysdig.com/legal/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "palo-alto-cortex-agentix", "name": "Cortex AgentiX (agents for Cortex Cloud, XSIAM and XDR)", "vendor": "Palo Alto Networks", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.paloaltonetworks.com/cortex/agentix", "category": "security", "categories": [ "security" ], "summary": "Palo Alto Networks' agentic layer for Cortex: prebuilt and custom security agents that investigate and resolve cloud and SOC issues across Cortex Cloud, XSIAM and XDR, with configurable autonomy and approvals.", "description": "Cortex AgentiX is Palo Alto Networks' platform to build, deploy and govern security agents. The product page says it powers the Cortex Agentic Assistant across Cortex XSIAM, Cortex XDR and Cortex Cloud, offers a library of specialised agents (blog posts cover a Case Investigation Agent, an Automation Engineer agent and AI-driven phishing response), lets administrators define when agents act independently or need human approval, runs agents within existing roles and permissions with visible reasoning, and supports 1,100+ integrations plus MCP. Palo Alto's Cortex Cloud 2.0 release (Oct 28, 2025) describes a workforce of autonomous AI agents in its CNAPP that investigate and resolve cloud security issues within enterprise guardrails, with upgrades to 2.0 rolling out in the first half of 2026. Volume claims (for example training on 1.2 billion responses) are vendor marketing. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "FedRAMP" ], "tasks": [ "cloud-security", "security-operations", "incident-response", "workflow-automation" ], "india_relevance": "Relevant to CERT-In incident detection and response capability building; not a CERT-In compliance product by itself.", "featured": false, "source_url": "https://www.paloaltonetworks.com/cortex/agentix", "sources": [ "https://www.paloaltonetworks.com/cortex/agentix", "https://www.paloaltonetworks.com/company/press/2025/palo-alto-networks-ushers-in-autonomous-ai-workforce-for-cloud-security-with-cortex-cloud-2-0", "https://www.paloaltonetworks.com/cortex/cloud", "https://cortex-docs.paloaltonetworks.com/cortex-agentix-docs", "https://www.paloaltonetworks.com/company/press/2025/palo-alto-networks-unveils-cortex-agentix-to-build--deploy-and-govern-the-agentic-workforce-of-the-future" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "lumos-albus", "name": "Lumos Albus and Identity Agent Force (identity governance agents)", "vendor": "Lumos", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.lumos.com/products/albus", "category": "security", "categories": [ "security", "compliance" ], "summary": "AI agent built into the Lumos identity governance platform that designs roles, completes access reviews (approve/flag with peer and usage analysis) and investigates identity risk, explaining every decision.", "description": "Lumos describes Albus as an identity agent for agentic IGA that works on entitlement-level data across IdP, HRIS, SaaS, cloud and on-premises systems. It ingests HRIS data, app assignments and usage logs to propose RBAC/ABAC roles with explanations; approves or flags access in user access reviews using peer-group analysis and usage anomalies, focusing reviewers on what changed and auto-capturing evidence; and acts as an LLM-based identity analyst to find dormant accounts, policy drift and SoD violations. Albus has memory of owners, approval paths and past exceptions, starts in a copilot mode where recommendations need approval, logs every action and limits permissions per workflow. Speed multipliers are vendor-claimed. The privacy notice gives Lumos App, Inc.'s mailing address in San Francisco. Pricing is custom. Lumos launched the Identity Agent Force on 15 Jun 2026: a team of purpose-built identity agents coordinated on the same access graph and customer-set policies, guardrails and approval thresholds. The product page lists an Access Review Agent (runs reviews end to end, certifying safe access and sending exceptions to a human), Access Request Agent (time-bound grants that it revokes), NHI Owner Hunter Agent (dormant or over-scoped service accounts, keys and tokens), Role Mining Agent, Agent Ownership Finder (catalogues AI agents and NHIs and assigns human owners) and Entitlement Analyst (explains permissions in plain English). Outcome figures on the page are vendor claims.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "identity-governance", "access-reviews", "risk-assessment" ], "india_relevance": "", "featured": false, "source_url": "https://www.lumos.com/products/albus", "sources": [ "https://www.lumos.com/products/albus", "https://www.lumos.com/privacy", "https://www.lumos.com/company/about", "https://www.lumos.com/products/identity-agent-force", "https://www.lumos.com/blog/pr-lumos-launches-identity-agent-force-govern-access-every-human-nhi-ai" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "microsoft-entra-conditional-access-optimization-agent", "name": "Microsoft Entra Conditional Access Optimization Agent", "vendor": "Microsoft", "hq_country": "United States", "hq_region": "north-america", "url": "https://learn.microsoft.com/en-us/entra/security-copilot/conditional-access-agent-optimization", "category": "security", "categories": [ "security" ], "summary": "Security Copilot agent in Microsoft Entra that scans a tenant for users, apps and agent identities not covered by Conditional Access, recommends or updates policies and applies one-click remediation.", "description": "Microsoft Learn documents the Conditional Access Optimization Agent as a Security Copilot agent in Microsoft Entra that can run automatically every 24 hours (activity-based runs are in preview), scans for new users, applications and agent identities, and checks them against Conditional Access best practice: MFA, device-based controls, blocking legacy authentication and device-code flow. It proposes new policies, suggests consolidating similar policies, and can update the associated policy through one-click remediation by an authorised administrator; settings let it create policies in report-only mode, send Teams notifications and build phased rollout plans; policy review reports and a ServiceNow integration are in preview. Documented limits include up to 300 users and 150 applications per run and no way to stop a run once started. It requires at least Microsoft Entra ID P1 and Security Copilot security compute units (SCUs). Microsoft's privacy statement gives Microsoft Corporation's address in Redmond, Washington.", "pricing": "No standalone price. Requires Microsoft Entra ID P1 or higher plus Security Copilot security compute units (Microsoft Learn says a run averages under one SCU); Microsoft says Security Copilot agents are also made available to Microsoft 365 E5 customers. Check Microsoft's Security Copilot pricing for SCU rates.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "identity-governance", "policy-management", "remediation" ], "india_relevance": "", "featured": false, "source_url": "https://learn.microsoft.com/en-us/entra/security-copilot/conditional-access-agent-optimization", "sources": [ "https://learn.microsoft.com/en-us/entra/security-copilot/conditional-access-agent-optimization", "https://www.microsoft.com/en-us/security/business/ai-machine-learning/microsoft-security-copilot", "https://privacy.microsoft.com/en-us/privacystatement" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "equixly-agentic-ai-hacker", "name": "Equixly Agentic AI Hacker (continuous API pentesting)", "vendor": "Equixly", "hq_country": "Italy", "hq_region": "europe", "url": "https://equixly.com/", "category": "security", "categories": [ "security", "code-security" ], "summary": "Italian offensive-security platform whose agentic AI hacker continuously maps APIs and applications, chains API interactions to find exploitable flaws, and validates findings for remediation.", "description": "Equixly replaces point-in-time manual penetration tests with AI agents that run continuously. Its proprietary Agentic AI Hacker is trained on how APIs are built and attacked; it learns how a system behaves, chains API interactions across services and adapts its attack strategy as the architecture changes, covering discovery (continuous API and application mapping), attack (24/7 testing) and remediation (validated, exploitable findings ranked for fixing). Equixly also offers attack surface management and a one-off rapid penetration test with a full audit report in two days. The contact page lists headquarters in Verona, Italy, with offices in Florence and London. Pentest pricing is published.", "pricing": "Penetration Test: \u20ac4,999 per test (results in 2 days, blackbox/greybox, full audit report). Continuous Equixly Platform: custom pricing (equixly.com/pricing).", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pen-test-management", "appsec", "attack-surface" ], "india_relevance": "", "featured": false, "source_url": "https://equixly.com/", "sources": [ "https://equixly.com/", "https://equixly.com/contact-us", "https://equixly.com/about-us", "https://equixly.com/pricing/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "ethiack-hackian", "name": "Ethiack Hackian (agentic AI pentesting)", "vendor": "Ethiack", "hq_country": "Portugal", "hq_region": "europe", "url": "https://ethiack.com/", "category": "security", "categories": [ "security" ], "summary": "Portuguese autonomous pentesting platform: the Hackian agentic AI maps the attack surface, runs exploitation routines, chains attack paths and delivers proof-of-exploit with compliance-ready reports.", "description": "Ethiack's Hackian is described as the agentic AI engine behind its platform. It continuously maps external, internal and third-party assets (including APIs, mobile, IoT, OT and cloud), runs event-driven tests triggered by code pushes, infrastructure changes or new threat knowledge, executes exploitation routines, chains attack paths and attaches proof-of-exploit to every confirmed risk, alongside prioritised remediation guidance. Ethiack combines the AI with human ethical hackers and offers live reports aimed at NIS2, DORA, SOC 2, ISO 27001 and PCI evidence (reporting support, not a certification). Accuracy and speed figures are vendor-claimed. The privacy policy and terms name Ethiack, S.A., registered in Coimbra, Portugal. Pricing is published.", "pricing": "Published on ethiack.com/pricing: on-demand pentest \u20ac3,000 per test; Continuous 'Core' \u20ac9,000/year (shown as 25% off \u20ac12,000); Enterprise custom. Guarantee offer: free of charge unless a validated, proven-exploitable vulnerability is found.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pen-test-management", "attack-surface", "exposure-management" ], "india_relevance": "", "featured": false, "source_url": "https://ethiack.com/", "sources": [ "https://ethiack.com/", "https://ethiack.com/pricing", "https://ethiack.com/legal/privacy-policy", "https://ethiack.com/legal/terms-of-service" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "intruder-ai-pentesting", "name": "Intruder AI Pentesting", "vendor": "Intruder", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.intruder.io/platform/ai-pentesting", "category": "security", "categories": [ "security", "code-security" ], "summary": "On-demand, code-aware web-app pentesting by AI agents built by Intruder's CREST-certified testers, with audit-ready reports in hours and issue-level 'micro pentests' to triage scanner findings.", "description": "Intruder, a London-based exposure-management vendor, offers AI pentesting for web applications. Its page says pentesting agents built and trained by its CREST-certified pentesters run with full code awareness after customers connect a GitHub or GitLab repository and provide context and credentials, and deliver a pentest report within hours intended as evidence for SOC 2 and ISO 27001. Example issues customers found include broken authorisation, IDORs, payment flaws and race conditions (vendor-reported). Issue-level micro-pentests automate triage and investigation of findings from Intruder's vulnerability scanners. Intruder's wider platform covers continuous vulnerability scanning, attack surface management, cloud security and a GregAI security analyst. The terms name Intruder Systems Ltd, registered in England with a London office. Pricing is published.", "pricing": "AI web-app pentests start from $3,500 per test; the scanning platform has a free-forever plan and paid monthly/annual tiers (intruder.io/pricing).", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pen-test-management", "appsec", "vulnerability-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.intruder.io/platform/ai-pentesting", "sources": [ "https://www.intruder.io/platform/ai-pentesting", "https://www.intruder.io/pricing", "https://www.intruder.io/legal/terms", "https://www.intruder.io/about-us" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "horizon3-nodezero", "name": "Horizon3.ai NodeZero (autonomous pentesting)", "vendor": "Horizon3.ai", "hq_country": "United States", "hq_region": "north-america", "url": "https://horizon3.ai/nodezero/", "category": "security", "categories": [ "security" ], "summary": "Autonomous pentesting platform that runs unlimited self-directed internal, external, cloud, Kubernetes and AD pentests, plans attack paths, guides remediation and re-tests to verify fixes.", "description": "NodeZero runs unlimited autonomous pentests that uncover exploitable attack paths, guide remediation and immediately verify that fixes worked, without installing persistent agents. Horizon3's AI page describes how NodeZero builds a cyber-terrain map of the environment, plans attack paths and makes decisions from what it observes, combining graph reasoning for attack planning, classical ML for classifying files and behaviours, and scoped GenAI for high-value targeting, executive narratives and data-compromise analysis. Use cases include internal, external, cloud, Kubernetes and web-app pentesting, Active Directory password audits, tripwires and rapid response to new CISA KEV exploits. Horizon3 markets a NodeZero Federal offering with FedRAMP High authorisation (vendor claim, not checked against the FedRAMP Marketplace in this run). The About page says Horizon3 is headquartered in San Francisco, CA. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "FedRAMP" ], "tasks": [ "pen-test-management", "attack-surface", "exposure-management", "vulnerability-management" ], "india_relevance": "", "featured": false, "source_url": "https://horizon3.ai/nodezero/", "sources": [ "https://horizon3.ai/nodezero/", "https://horizon3.ai/ai-in-horizon3-ai/", "https://horizon3.ai/about-us/", "https://horizon3.ai/vertical/federal/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "juro-ai-review", "name": "Juro AI Review", "vendor": "Juro", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://juro.com/ai-contract-review", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Agentic contract review in Juro's contract platform that triages, reviews and redlines contracts (including counterparty paper in Word) against legal-team playbooks.", "description": "Juro describes 'agentic AI to review & redline contracts': AI Review checks third-party contracts and counterparty redlines against playbooks the legal team controls and proposes redlines, in Juro or in Microsoft Word. Juro's April 2026 product update says AI Review graduated from beta and is available to all customers; an 'Operator' feature was released in beta at the same time. The help centre states the agent uses a playbook as its reference when generating redlines. The privacy policy names Juro Online Limited as the company; offices are listed in London and Boston.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://juro.com/ai-contract-review", "sources": [ "https://juro.com/ai-contract-review", "https://juro.com/product-updates/april-2026", "https://intercom.help/juro/en/articles/12691465-ai-review-in-juro", "https://juro.com/privacy", "https://juro.com/contact-us", "https://juro.com/pricing" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "spotdraft-sidebar-agents", "name": "SpotDraft Sidebar AI agents and VerifAI", "vendor": "SpotDraft", "hq_country": "India", "hq_region": "india", "url": "https://www.spotdraft.com/products/sidebar", "category": "business-ops", "categories": [ "business-ops", "risk", "compliance" ], "summary": "AI agents in SpotDraft's contract platform for contract review, contract queries, clause drafting and regulatory tracking, plus VerifAI playbook review inside Microsoft Word.", "description": "SpotDraft's Sidebar is marketed as 'AI Agents for Legal Teams': it reviews and answers questions on contracts, drafts clauses, researches, and monitors official regulatory sources and summarises changes ('When work repeats, agents take over'). The help centre documents specialised agents: pre-configured versions of Sidebar, each with its own instructions, knowledge and tools for a recurring task, such as a contract-review agent set up with the team's playbook. VerifAI reviews contracts against custom guides in Microsoft Word. Some Sidebar features (Sidebar V2, VerifAI-triggered approvals) are labelled beta in the help centre. The privacy notice names Draftspotting Technologies Private Limited (Bangalore) as the parent, with subsidiaries Draftspotting Inc. and Draftspotting Limited.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "India-headquartered (Draftspotting Technologies Pvt. Ltd., Bangalore). The privacy notice covers DPDP-style rights handling. Confirm India data-residency options with the vendor.", "featured": false, "source_url": "https://www.spotdraft.com/products/sidebar", "sources": [ "https://www.spotdraft.com/products/sidebar", "https://help.spotdraft.com/articles/7781951540-using-and-creating-specialized-ai-agents", "https://help.spotdraft.com/articles/4722792337-welcome-to-verifai", "https://www.spotdraft.com/privacy-policy", "https://www.spotdraft.com/pricing" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "definely-enhance", "name": "Definely Enhance", "vendor": "Definely", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.definely.com/products/enhance", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Agentic AI system inside Microsoft Word that plans contract drafting and review tasks and hands them to specialised agents, with lawyer oversight.", "description": "Definely launched Enhance (London, 22 May) as 'powered by a proprietary agentic AI system'. Each agent specialises in a task such as summarisation or drafting support. The system analyses the task, creates a plan and assigns agents that collaborate until completion, under lawyer oversight. It runs inside Word alongside Definely's Read, Proof, Cascade and Vault tools for complex contract review. The site footer gives Aldgate Tower, 2 Leman St, London E1 8FA.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.definely.com/products/enhance", "sources": [ "https://www.definely.com/blogs/definely-launches-agentic-ai-system-to-supercharge-both-accuracy-and-speed-for-lawyers", "https://www.definely.com/products/enhance", "https://www.definely.com/about", "https://www.definely.com/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "genie-ai-agents", "name": "Genie AI legal agents", "vendor": "Genie AI", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.genieai.co/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Legal AI agents that draft, review, redline and negotiate agreements against company rules, playbooks and negotiation guardrails, with published self-serve plans.", "description": "Genie AI says its agents 'draft, review and negotiate your agreements' once you set your rules and connect organisational knowledge. Example tasks include reviewing an MSA against a playbook and comparing a redlined MSA with a standard template. Paid plans add a team playbook and negotiation rules, company templates and organisation-wide training on risk positions. Its marketing claims of beating general-purpose models are the vendor's own and are not repeated here as fact. The privacy policy names Genie AI Limited (company no. 11080520), registered at 241 Southwark Bridge Road, London.", "pricing": "Free plan (limited AI tokens); Pro $59/user/month billed annually ($75 monthly); Business $259/month billed annually for 5 users ($320 monthly); Enterprise custom quote (USD prices from the US pricing page)", "pricing_model": "freemium", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.genieai.co/", "sources": [ "https://www.genieai.co/", "https://www.genieai.co/pricing", "https://www.genieai.co/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "leah-agentic-ai", "name": "Leah (formerly ContractPodAi)", "vendor": "Leah (ContractPod Technologies Limited)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://leahai.com/", "category": "business-ops", "categories": [ "business-ops", "risk", "compliance" ], "summary": "Agentic AI platform, formerly ContractPodAi, that runs contract lifecycle, legal, procurement and finance work end to end, including drafting, redlining, negotiation and obligations.", "description": "Leah, formerly ContractPodAi, calls itself 'the agentic AI platform that unifies contract lifecycle management, legal transformation, and source-to-pay automation into a single autonomous system'. Modules cover Legal (risk intelligence, compliance, matter management), Contracting (drafting, redlining, negotiation, obligations), Procurement and Finance, and the vendor says Leah 'takes routine tasks from start to finish'. contractpodai.com now redirects to leahai.com. The footer reads '\u00a92026 Leah, a ContractPod Technologies Limited company' with 2 Kingdom Street, London W2 6BD.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://leahai.com/", "sources": [ "https://leahai.com/", "https://leahai.com/legal/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "harvey-agents", "name": "Harvey Agents", "vendor": "Harvey", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.harvey.ai/platform/agents", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Purpose-built legal AI agents that split large legal tasks, work in parallel and return cited, review-ready output for law firms and in-house teams.", "description": "Harvey's Agents page says the agents 'execute complex legal work end to end': they split large tasks, run in parallel in the background and return cited, review-ready output, with lawyers keeping judgment. The platform also includes Vault for bulk document analysis, Contract Intelligence, Horizon Scanning for regulatory change, Intake and Legal Work Orchestration, where work is assigned across agents and team members. The privacy policy states Harvey is headquartered in the United States. Harvey's October 2026 product notes (9 Oct) added an Agents tab in the Harvey mobile app for running, scheduling and starring custom agents, agentic search across SharePoint, OneDrive and Google Drive with cited answers, a connector library with admin controls over which actions run automatically, and import of executed contracts from Ironclad.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.harvey.ai/platform/agents", "sources": [ "https://www.harvey.ai/platform/agents", "https://www.harvey.ai/", "https://www.harvey.ai/legal/privacy-policy", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://www.harvey.ai/blog/the-brief-october-2026" ], "last_checked": "2026-10-20", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Harvey.ai", "id": "TX1988168", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2029-09-21" } ] }, { "slug": "caseware-verity-agents", "name": "Caseware Verity agents (Disclosure Checklist and Risk Suggestion)", "vendor": "Caseware", "hq_country": "Canada", "hq_region": "north-america", "url": "https://www.caseware.com/products/disclosure-checklist-agent", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Audit-engagement agents inside Caseware: the Disclosure Checklist Agent drafts cited Yes/No/N-A checklist responses from financial statements, and the Risk Suggestion Agent drafts engagement-specific risks for auditor review.", "description": "Caseware Verity brings agents into assurance engagements. The Disclosure Checklist Agent reads a firm's financial statements, scopes which checklist sections apply and drafts Yes/No/N-A responses with reasoning and cited evidence. Auditors accept, refine or override each one. On October 6, 2026 Caseware launched the Verity-powered Risk Suggestion Agent worldwide. It uses current and prior-year financials, existing risks, controls and selected documents to suggest engagement-specific risks, and it is included in existing Verity licences. The same release extended the Disclosure Checklist Agent from US-only (DAS Suite) to UK firms; the product page still says 'Only available in the US'. Engagement data is not used to train models. The privacy statement gives Caseware International Inc., 351 King Street East, Toronto.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "audit-management", "risk-assessment" ], "india_relevance": "", "featured": false, "source_url": "https://www.caseware.com/products/disclosure-checklist-agent", "sources": [ "https://www.caseware.com/products/disclosure-checklist-agent", "https://www.caseware.com/news/caseware-verity-powered-risk-suggestion-agent-launches-to-help-auditors-identify-engagement-specific-risks", "https://www.caseware.com/legal/privacy-statement", "https://www.caseware.com/contact" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "fieldguide-field-agents", "name": "Fieldguide Field Agents", "vendor": "Fieldguide", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.fieldguide.com/products/agents/overview", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Agent workforce for audit and advisory firms: agents plan engagements, run testing through to workpapers, review conclusions against evidence and draft financial statements, coordinated by Field Orchestrator.", "description": "Fieldguide's Field Agents 'execute engagement procedures end to end'. Field Planner ingests the trial balance, runs analytics and materiality and drafts a scoped audit program. Field Auditor reviews client submissions as they arrive and runs testing from population to workpaper, following firm-defined SOPs. Field Reviewer checks completed work against scope and evidence. Field Financials drafts financial statements and ties figures to source. Field Orchestrator (launched June 8, 2026) lets practitioners direct any phase in natural language while agents plan, execute and sequence the work, with checkpoints for practitioner approval. There are advisory variants for SOC-style control assessments.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "audit-management", "control-testing", "evidence-collection" ], "india_relevance": "", "featured": false, "source_url": "https://www.fieldguide.com/products/agents/overview", "sources": [ "https://www.fieldguide.com/products/agents/overview", "https://www.fieldguide.com/blog/fieldguide-launches-field-orchestrator-marking-the-next-phase-of-agentic-ai-in-audit", "https://www.fieldguide.com/privacy-policy", "https://www.fieldguide.com/about", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Fieldguide", "id": "TX1906508", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2029-06-04" } ] }, { "slug": "leena-ai-colleagues", "name": "Leena AI Colleagues", "vendor": "Leena AI", "hq_country": "United States", "hq_region": "north-america", "url": "https://leena.ai/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Agentic AI platform with pre-built 'AI Colleagues' that auto-resolve employee IT, HR, finance and procurement back-office requests through 200+ enterprise connectors.", "description": "Leena AI sells an 'agentic AI platform with pre-built AI Colleagues for the back-office'. The colleagues are pre-integrated with systems such as Workday, ServiceNow and SAP (200+ connectors, MCP and A2A built in) and the vendor reports 70%+ of tickets auto-resolved. Pricing is by quote: a Universal Assistant licence per employee per year, and an AI Colleagues platform fee plus audited token usage. The privacy policy says the company is headquartered in Wilmington, Delaware, with a regional office in Gurugram, India; the contact page also lists New York, San Francisco and Bengaluru.", "pricing": "Not published (quote: Universal Assistant per-employee annual licence; AI Colleagues platform fee + token usage)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "employee-support", "it-service", "workflow-automation" ], "india_relevance": "India regional offices (Gurugram, Bengaluru) listed by the vendor; privacy policy references the DPDP Act.", "featured": false, "source_url": "https://leena.ai/", "sources": [ "https://leena.ai/", "https://leena.ai/about-us", "https://leena.ai/privacy-policy", "https://www.leena.ai/contact-us", "https://leena.ai/pricing" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "appian-agent-studio", "name": "Appian Agent Studio (AI agents)", "vendor": "Appian", "hq_country": "United States", "hq_region": "north-america", "url": "https://appian.com/products/platform/artificial-intelligence/ai-agents", "category": "business-ops", "categories": [ "business-ops", "compliance" ], "summary": "Generally available Agent Studio for deploying AI agents inside Appian processes that reason over enterprise data and act under platform guardrails; Appian Government Cloud is FedRAMP High authorized.", "description": "Appian announced on November 12, 2025 that Agent Studio is generally available. Business users set high-level goals in natural language, and agents use Appian's data fabric and tools to choose a path, handle unexpected conditions and act on enterprise data. Agents inherit platform data access, process context and guardrails, so their behaviour can be governed and audited within the process. Appian's AI security docs say AI capabilities run inside its certified cloud and inherit its certifications, including FedRAMP for GovCloud environments. On the FedRAMP Marketplace, Appian Government Cloud - High (FR2318051429) has been FedRAMP Authorized since 2025-04-03, and Appian Government Cloud - Moderate (F1210011608) is also listed as authorized.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "hipaa", "fedramp" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "HIPAA", "PCI DSS", "FedRAMP" ], "tasks": [ "process-automation", "agentic-ops", "workflow-automation", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://appian.com/products/platform/artificial-intelligence/ai-agents", "sources": [ "https://appian.com/products/platform/artificial-intelligence/ai-agents", "https://appian.com/about/explore/press-releases/2025/appian-launches-new-ai-capabilities-to-automate-complex-work", "https://docs.appian.com/suite/help/26.9/security-compliance.html", "https://docs.appian.com/suite/help/26.9/appian-government-cloud-overview.html", "https://www.fedramp.gov/marketplace/products/FR2318051429/", "https://appian.com/about/contact-us", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://govramp.org/program-participants" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Appian Government Cloud - High", "id": "FR2318051429", "impact": "High", "date": "2025-04-03", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR2318051429/", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "Appian Cloud", "id": "TX985366", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" }, { "program": "govramp", "status": "Authorized", "product": "Appian Cloud", "impact": "Moderate", "scope": "platform-only", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "regscale-regml", "name": "RegScale RegML AI agents (RegScale CCM)", "vendor": "RegScale", "hq_country": "United States", "hq_region": "north-america", "url": "https://regscale.com/ai-driven-compliance-automation-with-regml/", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Continuous controls monitoring platform whose RegML AI agents monitor controls, collect evidence, draft control documentation and trigger remediation for FedRAMP, CMMC and NIST programmes; RegScale CCM is FedRAMP High authorized.", "description": "RegScale's RegML engine drafts control implementations from existing policies and produces control-gap scorecards with recommendations; RegML Auditor evaluates controls on demand. In its FY26 update (May 13, 2026) RegScale said it 'launched RegML AI agents in production: continuously monitoring controls, automating evidence collection, and triggering remediation without human intervention'. It also said it would extend the agents into autonomous audit workflows and AI governance. RegML can also run on-premises. The use-case pages cover FedRAMP ATO acceleration and the path from CMMC scoping to certification, and RegScale says it earned CMMC Level 2 using its own platform. On the FedRAMP Marketplace, RegScale CCM (FR2414158717) has been FedRAMP Authorized at High since 2025-06-24. TX-RAMP Level 2 certified (TX1793477) on the Texas DIR list updated 13 Oct 2026.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "fedramp", "tx-ramp", "cmmc" ], "frameworks_claimed": [ "FedRAMP", "CMMC", "NIST SP 800-53", "NIST SP 800-171", "ISO 27001", "SOC 2" ], "tasks": [ "control-monitoring", "evidence-collection", "remediation", "gap-analysis", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://regscale.com/ai-driven-compliance-automation-with-regml/", "sources": [ "https://regscale.com/ai-driven-compliance-automation-with-regml/", "https://regscale.com/blog/regscale-tripled-revenue-as-the-ccm-category-arrives/", "https://regscale.readme.io/docs/ai-regml", "https://regscale.com/contact/", "https://www.fedramp.gov/marketplace/products/FR2414158717/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "RegScale CCM", "id": "FR2414158717", "impact": "High", "date": "2025-06-24", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR2414158717/", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "RegScale CCM", "id": "TX1793477", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" } ] }, { "slug": "intelligrc-evan-alfie", "name": "IntelliGRC Evan and Alfie AI agents", "vendor": "IntelliGRC", "hq_country": "United States", "hq_region": "north-america", "url": "https://intelligrc.com/insights/blog/introducing-evan-and-alfie/", "category": "compliance", "categories": [ "compliance" ], "summary": "CMMC- and NIST 800-171-focused GRC platform whose AI agents auto-map evidence to assessment objectives (Evan) and run automated control gap assessments with remediation steps (Alfie); FedRAMP 20x Low authorized.", "description": "IntelliGRC's Evan (Evidence Analyzer) scans uploaded files against target frameworks such as CMMC Level 2, SOC 2 and ISO 27001. It identifies which assessment objectives each file may satisfy, gives confidence ratings and rationale, and can be set to auto-map evidence above a chosen confidence threshold at upload. Alfie (Automated Logic for Intelligent Evaluations) runs automated gap assessments: it evaluates whole controls, recommends implementation status with findings, remediation steps and validation methods, and pulls in Evan to suggest supporting evidence. Users choose whether Alfie's output appends to, overwrites or skips existing notes. The platform targets defence-industrial-base contractors and MSPs/MSSPs. On the FedRAMP Marketplace, IntelliGRC (FR2605341343) is FedRAMP Authorized at '20x Low' (2025-12-05); the vendor calls it a limited FedRAMP 20x Low authorization under the Phase One pilot. A separate Moderate listing (FR2532766956) is FedRAMP Ready only.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "fedramp", "soc2", "iso27001", "cmmc" ], "frameworks_claimed": [ "CMMC", "NIST SP 800-171", "NIST SP 800-53", "SOC 2", "ISO 27001", "HIPAA", "CJIS", "NIST CSF", "CIS Controls" ], "tasks": [ "evidence-collection", "gap-analysis", "control-mapping", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://intelligrc.com/insights/blog/introducing-evan-and-alfie/", "sources": [ "https://intelligrc.com/insights/blog/introducing-evan-and-alfie/", "https://intelligrc.com/insights/announcement-and-press-releases/intelligrc-receives-limited-fedramp-20x-low-authorization/", "https://intelligrc.com/contact-us/", "https://intelligrc.com/", "https://www.fedramp.gov/marketplace/products/FR2605341343/" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "IntelliGRC", "id": "FR2605341343", "impact": "20x Low", "date": "2025-12-05", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR2605341343/", "checked": "2026-10-18" } ] }, { "slug": "andesite-human-ai-soc", "name": "Andesite Human-AI SOC (Azimuth for Government)", "vendor": "Andesite", "hq_country": "United States", "hq_region": "north-america", "url": "https://andesite.ai/product/", "category": "security", "categories": [ "security", "compliance" ], "summary": "Agentic SOC platform with configurable agents for alert triage, enrichment, investigation and remediation under analyst oversight; its government offering is FedRAMP High authorized.", "description": "Andesite sells a 'Human-AI SOC': SOC teams configure agents for use cases such as phishing or alert triage, or for set workflows like network anomaly hunting, and the agents automate triage, enrichment, investigation and remediation launched from findings while analysts keep critical decisions. It connects to existing security data without ETL and says customer data is not used to train its AI. On March 31, 2026 Andesite announced FedRAMP High Authorized status. On the FedRAMP Marketplace, Andesite Azimuth for Government AAG (FR2520950455) has been FedRAMP Authorized at High since 2026-02-26. The vendor also lists SOC 2 Type II, NIST 800-53 (High), ISO 27001/27701/42001, PCI DSS, HIPAA, CSA STAR and HITRUST. TX-RAMP Level 2 certified (TX1890122) on the Texas DIR list updated 13 Oct 2026.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "fedramp", "soc2", "iso27001", "hipaa", "tx-ramp" ], "frameworks_claimed": [ "NIST SP 800-53", "NIST CSF", "ISO 42001", "PCI DSS", "HITRUST", "CSA STAR" ], "tasks": [ "security-operations", "alert-triage", "incident-response", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://andesite.ai/product/", "sources": [ "https://andesite.ai/product/", "https://andesite.ai/press-releases/andesite-achieves-fedramp-high-authorized-status/", "https://andesite.ai/why-andesite/", "https://andesite.ai/contact-us/", "https://andesite.ai/privacy/", "https://www.fedramp.gov/marketplace/products/FR2520950455/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Andesite Azimuth for Government", "id": "FR2520950455", "impact": "High", "date": "2026-02-26", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR2520950455/", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "Andesite Azimuth for Government AAG", "id": "TX1890122", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" } ] }, { "slug": "salesforce-agentforce-public-sector", "name": "Agentforce for Public Sector", "vendor": "Salesforce", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.salesforce.com/government/artificial-intelligence/", "category": "business-ops", "categories": [ "business-ops", "compliance" ], "summary": "Pre-built Agentforce agents for federal, state and local government, covering complaint management, benefits and licensing, code-violation compliance and internal IT compliance; Salesforce says Agentforce is FedRAMP High authorized in Government Cloud Plus.", "description": "Salesforce offers pre-built Agentforce templates and subagents for government. Complaint Management resolves cases end to end and turns complaints into structured case records. Benefit and Licensing Assistance assesses eligibility. A Compliance subagent detects code violations, captures enforcement details, calculates regulatory fees and drafts visit summaries. Regulatory Compliance alerts on code violations and enforces actions, and Internal Compliance Management runs service-catalog flows and creates incidents. Agents are customised with Agentforce Builder and Agentforce Script. Salesforce announced on June 4, 2025 that Agentforce, Data Cloud, Marketing Cloud and Tableau Next achieved FedRAMP High authorization. On the FedRAMP Marketplace, Salesforce Government Cloud Plus (FR2003061248) is FedRAMP Authorized at High. TX-RAMP Level 2 certified (TX985547) on the Texas DIR list updated 13 Oct 2026.", "pricing": "Not published for Public Sector editions (30-day Public Sector Solutions trial offered)", "pricing_model": "quote", "frameworks": [ "fedramp", "tx-ramp" ], "frameworks_claimed": [ "FedRAMP" ], "tasks": [ "workflow-automation", "case-investigation", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://www.salesforce.com/government/artificial-intelligence/", "sources": [ "https://www.salesforce.com/government/artificial-intelligence/", "https://www.salesforce.com/news/stories/fedramp-high-agentforce-salesforce-platform/", "https://www.salesforce.com/company/locations/", "https://www.fedramp.gov/marketplace/products/FR2003061248/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Salesforce Government Cloud Plus", "id": "FR2003061248", "impact": "High", "date": "2020-05-27", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR2003061248/", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "Salesforce Government Cloud Plus", "id": "TX985547", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" } ] }, { "slug": "vivox-ai-compliance-agents", "name": "Vivox AI compliance agents (Rachel, AI compliance analyst)", "vendor": "Vivox AI (Digital Intelligent Solutions Ltd)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.vivox.ai/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Pre-trained AI agents for AML, KYB/KYC and financial crime that take on Level 1 analyst work: sanctions and PEP alert reviews, adverse media monitoring, corporate registry and UBO analysis, and narrative report writing.", "description": "Vivox AI describes 'Rachel', an AI compliance analyst, as a digital compliance workforce of agents that run 24/7 and automate manual, repetitive Level 1 tasks: adverse media monitoring, sanctions and PEP alert reviews, AI website analysis, corporate registry data analysis across 150+ jurisdictions, incorporation and UBO document analysis, ongoing monitoring, narrative report writing and requests for information. It says it resolves the majority of screening alerts automatically with explainable decisions and full audit trails, with governance aligned to FCA requirements and the EU AI Act (vendor claims). Customer quotes on the site stress that analysts still review outputs and make the decisions. The site footer names Digital Intelligent Solutions Ltd, registered in England and Wales (company number 15567874), London. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "kyc", "case-investigation", "sar-narratives" ], "india_relevance": "", "featured": false, "source_url": "https://www.vivox.ai/", "sources": [ "https://www.vivox.ai/", "https://www.vivox.ai/about-us" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "zenoo-ai-investigation-agents", "name": "Zenoo AI investigation agents (Screening Resolver, Case Narrator and others)", "vendor": "Zenoo", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.zenoo.com/ai-agents", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Ten specialised AML investigation agents that screen, research, analyse and validate each onboarding or transaction alert, write a cited case narrative and hand the decision to a human analyst; a Red Team Agent challenges every finding.", "description": "Zenoo runs each alert through a pipeline of six core agents: Screening Resolver (screens entities and, per the vendor, auto-resolves about 80% of alerts), Entity Intelligence (ownership, media and jurisdiction research), Document Intelligence (forensic checks on 30+ document types), Risk Model Copilot (scores risk across four FATF dimensions), Case Narrator (writes the investigation summary with every source cited) and Perpetual Monitor (continuous monitoring that loops back on new alerts). Four supporting workers cover KYB research, KYC research, drafting customer communications and building data connectors, and a Red Team Agent challenges findings before they reach the analyst, who approves, escalates or rejects. The agents sit on Zenoo's Compliance Hub (case management) and Zenoo Studio (no-code orchestration). Performance figures on the page are vendor claims. Zenoo Ltd states 'We are UK based'. Pricing is not published (a pricing range is shared after a call).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "kyc", "case-investigation", "sar-narratives", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.zenoo.com/ai-agents", "sources": [ "https://www.zenoo.com/ai-agents", "https://www.zenoo.com/contact-us", "https://www.zenoo.com/pricing", "https://www.zenoo.com/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "sardine-agentic-fraud-aml-ops", "name": "Sardine agentic fraud and AML ops agents", "vendor": "Sardine (SardineAI Corp.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.sardine.ai/agentic-ai-for-aml", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Fraud and AML platform with named agents that disposition screening alerts, run enhanced due diligence and business verification, analyse networks, draft SAR narratives, tune monitoring rules and build dispute packages.", "description": "Sardine's agentic AML ops agents include a Doc KYC Agent, PEP and Sanctions Screening Agents, an OSINT Search Agent, a Business Due Diligence Agent, Graph Analyst and Data Analyst Agents, a Rule Assistant Agent and a SAR Generation Agent. They clear obvious screening false positives with a disposition recommendation and rationale for human review, complete EDD from online sources and public databases, research businesses and beneficial owners for KYB onboarding, surface mule rings through link analysis, turn plain-language rule descriptions into monitoring logic, and draft SAR narratives aligned to the team's SOPs. On the fraud side, an Anomaly Detection Agent investigates attacks and recommends rules, and a Dispute Filing Agent assembles chargeback evidence packages. The agents run on Sardine's device/behaviour, transaction monitoring and case management platform. The privacy policy gives SardineAI Corp.'s contact address in Miami, Florida. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "fraud-detection", "kyc", "case-investigation", "sar-narratives" ], "india_relevance": "", "featured": false, "source_url": "https://www.sardine.ai/agentic-ai-for-aml", "sources": [ "https://www.sardine.ai/agentic-ai-for-aml", "https://www.sardine.ai/agentic-ai-for-fraud", "https://www.sardine.ai/", "https://www.sardine.ai/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "workfusion-ai-agents", "name": "WorkFusion AI Agents (Evelyn, Tara, Evan, Isaac, Edward, Kayla)", "vendor": "WorkFusion", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.workfusion.com/ai-agents/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Named AI agents that act as L1/L2 AML analysts: they review and disposition sanctions, PEP and watchlist alerts, transaction screening and monitoring alerts, adverse media, EDD and KYC work, escalating or closing cases with justification.", "description": "WorkFusion sells 'digital AML analysts': Evelyn (name screening alert review), Tara (transaction screening alert review), Evan (adverse media monitoring), Isaac (AML transaction monitoring and fraud alert review), Edward (enhanced due diligence and high-risk reviews) and Kayla (KYC). Evelyn's page says she completes L1/L2 adjudication of sanctions, PEP and watchlist alerts, integrates with existing screening systems rather than replacing them, decides whether to escalate or close each case, and records full auditability and justification for each decision; the 80% less manual work and 60%+ hit-level straight-through processing figures are vendor claims. WorkFusion's privacy policy says it is headquartered in New York City (offices also listed in Warsaw and Hyderabad). Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "kyc", "case-investigation", "alert-triage" ], "india_relevance": "WorkFusion lists an office in Hyderabad, India.", "featured": false, "source_url": "https://www.workfusion.com/ai-agents/", "sources": [ "https://www.workfusion.com/ai-agents/", "https://www.workfusion.com/ai-agents/evelyn/", "https://www.workfusion.com/privacy-policy/", "https://www.workfusion.com/contact-us/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "bretton-ai-agents", "name": "Bretton AI agentic back-office platform (formerly Greenlite AI)", "vendor": "Bretton AI", "hq_country": "United States", "hq_region": "north-america", "url": "https://www2.bretton.com/platform", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Agent platform for bank and fintech financial-crime operations: pre-built and custom agents gather evidence, apply the institution's policy and draft full cases for EDD, monitoring alerts, sanctions, SAR drafting and KYB, with every action logged.", "description": "Bretton AI positions itself as an agentic platform for the financial back office, layered over existing systems. Templates provide pre-built skills and agents for EDD, monitoring, sanctions, SAR drafting, KYB, HMDA, CRA and more; a Builder turns SOPs into custom agents in natural language; and a Workbench lets analysts work each case alongside the agents. The vendor says agents gather evidence, apply your policy and draft the full case for the team to approve, with every action logged, cited and explainable, plus evaluations, model risk management and QA ('agent-as-a-judge'). It also sells AI-native managed services. greenlite.ai now redirects to bretton.com, and the site is published by Bretton AI, Inc. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "kyc", "case-investigation", "sar-narratives", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www2.bretton.com/platform", "sources": [ "https://www2.bretton.com/platform", "https://www2.bretton.com/", "https://www2.bretton.com/company", "https://www2.bretton.com/legal/terms", "https://www2.bretton.com/legal/privacy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "akitra-andromeda-ai-agents", "name": "Akitra Andromeda AI compliance agents", "vendor": "Akitra", "hq_country": "United States", "hq_region": "north-america", "url": "https://akitra.com/andromeda/", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "AI-native GRC platform whose agents monitor controls, collect evidence, map controls, flag gaps, draft security-questionnaire responses and remediate gaps across 40+ frameworks, with a dedicated compliance expert per customer.", "description": "Akitra's Andromeda platform covers compliance automation, security, risk (enterprise and vendor), trust center, pentest and eQMS. Its pages describe autonomous AI agents that monitor controls, collect evidence, map controls and flag gaps automatically across 40+ frameworks and 325+ integrations; the FAQ says the agents 'don't just monitor and alert' but collect evidence, map controls, draft questionnaire responses and remediate gaps autonomously. For security questionnaires, agents read each question in an uploaded XLSX/CSV/DOCX file and draft answers from policies, compliance data and previous answers for the team to review and submit. Every customer also gets a dedicated compliance expert. The Andromeda product page lists SOC 2, ISO 27001, HIPAA, PCI DSS, CMMC, SOC 1, GDPR and NIST 800-53 among supported frameworks (support claims, not certifications). Akitra also publishes a DPDPA compliance page describing how the platform can help with India's Digital Personal Data Protection Act; DPDPA is not in the Andromeda product-page framework list, so it is recorded as vendor-claimed only. The About page says Akitra is headquartered in Silicon Valley. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "hipaa", "cmmc" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "HIPAA", "PCI DSS", "CMMC", "DPDP", "SOC 1", "GDPR", "NIST SP 800-53" ], "tasks": [ "evidence-collection", "control-monitoring", "control-mapping", "gap-analysis", "questionnaire-automation" ], "india_relevance": "Akitra publishes a DPDPA compliance page (akitra.com/dpdpa-compliance/) describing how its AI-powered platform can help with India's DPDP Act. That is a vendor claim, not a framework tag on the Andromeda product page.", "featured": false, "source_url": "https://akitra.com/andromeda/", "sources": [ "https://akitra.com/andromeda/", "https://www.akitra.com/", "https://akitra.com/about/", "https://akitra.com/privacy/", "https://akitra.com/terms/", "https://akitra.com/dpdpa-compliance/", "https://akitra.com/integrations/" ], "last_checked": "2026-10-20", "added": "2026-10-18", "integrations": [ "azure", "jira" ] }, { "slug": "complyance-ai-agents", "name": "Complyance GRC AI Agents", "vendor": "Complyance (Securely Technology Limited)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.complyance.com/ai-agents/evidence-review", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Enterprise GRC platform with a fleet of task-specific AI agents for evidence review, control advice and remediation, policy drafting, risk treatment planning, vendor questionnaire review and risk scoring, and customer security questionnaires.", "description": "Complyance's agent catalogue includes Evidence Review, Evidence Suggestion, Control Advice and Control Remediation agents; Policy Drafting and Policy Summarization agents; Risk Details and Risk Treatment Planning agents; Vendor Questionnaire Review, Vendor Risk Creation and Vendor Risk Scoring agents; and a Customer Trust agent that answers security questionnaires. The Evidence Review agent checks evidence against control criteria as soon as it is uploaded, flagging missing attachments, outdated files and insufficient evidence with a rationale for each item; the Vendor Questionnaire Review agent scans vendor answers on receipt against the customer's own criteria and flags risky or missing responses for deeper review. The vendor says outputs stay under human oversight and quotes 60\u201370% time savings (vendor claims). Frameworks shown include HIPAA, ISO 27001, SOC 2, PCI DSS, NIST CSF 2.0 and CMMC among 100+. Complyance is the trading name of Securely Technology Limited (England and Wales) with a US subsidiary, Complyance US Inc. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "soc2", "iso27001", "hipaa", "cmmc" ], "frameworks_claimed": [ "SOC 2", "ISO 27001", "HIPAA", "PCI DSS", "NIST CSF 2.0", "CMMC" ], "tasks": [ "evidence-collection", "control-monitoring", "policy-management", "risk-management", "vendor-risk", "questionnaire-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.complyance.com/ai-agents/evidence-review", "sources": [ "https://www.complyance.com/ai-agents/evidence-review", "https://www.complyance.com/ai-agents/vendor-questionnaire-review", "https://www.complyance.com/", "https://www.complyance.com/privacy-notice", "https://www.complyance.com/about", "https://www.complyance.com/integrations" ], "last_checked": "2026-10-20", "added": "2026-10-18", "integrations": [ "aws", "azure", "gcp", "github", "gitlab", "okta", "google-workspace", "microsoft-365-entra", "jira", "slack" ] }, { "slug": "fidureon-compliance-agents", "name": "Fidureon compliance agents", "vendor": "Fidureon (CShift AB)", "hq_country": "Sweden", "hq_region": "europe", "url": "https://fidureon.com/", "category": "compliance", "categories": [ "compliance" ], "summary": "EU-hosted compliance platform for European companies whose agents read documents and GitHub evidence, watch security advisories, flag gaps and propose actions, with per-agent autonomy set to Propose & Wait, Hybrid or Full.", "description": "Fidureon covers the EU AI Act, GDPR, NIS2 (Sweden's Cybers\u00e4kerhetslagen), DORA and ISO 27001, 42001 and 9001, with CRA, EU Data Act, PCI DSS 4.0.1, TISAX and MVSP also available. Its agents read customers' documents and GitHub evidence, watch security advisories and flag gaps, then hand over a concrete proposed action with a one-sentence reason and supporting arguments. Autonomy is set agent by agent: at Propose & Wait a person approves each proposal before it executes and lands on the Action Center as an owned, dated action; Hybrid and Full give the agent more room. Every agent action is logged. There is also an in-app AI assistant and a built-in MCP server (200+ tools) for Claude, ChatGPT and IDE agents. The platform and its AI models are hosted in the EU (Google Cloud Finland/Stockholm; Vertex AI in the EU and Mistral). It is built and operated by CShift AB in G\u00f6teborg, Sweden.", "pricing": "Essentials from SEK 7,495/month excluding VAT (up to 3 frameworks); Enterprise on request; free ISO 27001 readiness check; partner pricing for consultancies (fidureon.com/pricing). AI agents included on every plan.", "pricing_model": "published-tiers", "frameworks": [ "iso27001", "dora" ], "frameworks_claimed": [ "EU AI Act", "GDPR", "NIS2", "DORA", "ISO 27001", "ISO 42001", "ISO 9001", "PCI DSS" ], "tasks": [ "gap-analysis", "evidence-collection", "control-monitoring", "policy-management" ], "india_relevance": "", "featured": false, "source_url": "https://fidureon.com/", "sources": [ "https://fidureon.com/", "https://fidureon.com/pricing", "https://fidureon.com/about" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "safe-tprm-ai-co-worker", "name": "SAFE TPRM AI Co-Worker", "vendor": "SAFE (SAFE Securities, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://safe.security/third-party-risk-management/", "category": "risk", "categories": [ "risk", "security" ], "summary": "Agentic third-party risk management: a swarm of 100+ specialised agents runs the vendor lifecycle from intake and due diligence through remediation, continuous monitoring and offboarding.", "description": "SAFE describes its TPRM AI Co-Worker as autonomously managing the vendor lifecycle in five looping stages. Intake validates and enriches requests (cyber, financial, compliance and fourth-party intelligence) and calculates inherent risk. Due diligence combines outside-in intelligence, questionnaires, contracts, SaaS posture and inside-out telemetry; a Document Analyzer Agent parses vendor policies and attestations, an Inline Review Agent checks answers against the customer's standards while the assessment is underway, and a Vendor Interaction Agent follows up with vendors automatically and logs every action. Remediation tasks are created and chased until closure is verified. Monitoring uses a Threat Intel Agent, a Contract Analysis Agent (expiry and SLAs) and a Fourth-Party Discovery Agent, followed by automated offboarding workflows. SAFE's privacy policy gives its address in Palo Alto, California. Pricing is not published on the vendor site.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "vendor-risk", "risk-assessment", "questionnaire-automation", "remediation" ], "india_relevance": "", "featured": false, "source_url": "https://safe.security/third-party-risk-management/", "sources": [ "https://safe.security/third-party-risk-management/", "https://safe.security/ai-co-workers/", "https://safe.security/privacy-policy/", "https://safe.security/about-us/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "SAFE", "id": "TX1741314", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2028-07-06" } ] }, { "slug": "trustcloud-trustlens", "name": "TrustCloud TrustLens (agentic third-party risk assessments)", "vendor": "TrustCloud", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.trustcloud.ai/trustlens/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Agentic third-party cyber risk assessments that scope each vendor by inherent risk, analyse outside-in ratings, inside-out control evidence and vendor artifacts, and produce cited risk summaries with continuous drift monitoring.", "description": "TrustLens is TrustCloud's agentic TPRM product. It captures inherent risk from the procurement workflow and dynamically scopes each assessment by risk tier instead of sending one-size-fits-all questionnaires. A Third-Party Risk Management AI Agent analyses outside-in security ratings, inside-out control evidence and vendor-provided artifacts (with AI forensic review of every artifact) to complete assessments with deterministic, cited risk summaries; continuous monitoring tracks drift and new risks after an assessment; and a Business Impact of Risk Q&A Agent lets anyone ask about a vendor's gaps and their business impact. TrustCloud says its agents are each purpose-built for one job, cite their answers with confidence scores and require human approval before they act. Turnaround and cost-per-assessment figures on the page are aggregate vendor claims. TrustCloud's privacy policy states it is headquartered in the United States. Pricing is quote-based.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "vendor-risk", "risk-assessment", "questionnaire-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.trustcloud.ai/trustlens/", "sources": [ "https://www.trustcloud.ai/trustlens/", "https://www.trustcloud.ai/", "https://www.trustcloud.ai/legal/privacy/", "https://www.trustcloud.ai/pricing/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 1", "product": "TrustCloud Platform", "id": "TX1583514", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2027-10-28" } ] }, { "slug": "osapiens-agent-factory", "name": "osapiens Agent Factory (supplier and supply-chain compliance agents)", "vendor": "osapiens", "hq_country": "Germany", "hq_region": "europe", "url": "https://www.osapiens.com/en/platform/agent-factory", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Agent layer across the osapiens HUB that runs supplier onboarding, record validation, questionnaire pre-fill, supplier case management and risk-trend analysis for supply-chain due diligence (LkSG, CSDDD, EUDR and more), within customer-set guardrails.", "description": "osapiens' Agent Factory orchestrates and monitors AI agents across its HUB solution suites. Named Supplier Intelligence agents include a Business Partner Onboarding Agent (links, enriches, scans certificates and dispatches questionnaires, then emails a summary), a Supplier Risk Trend Agent (ranks the biggest movements in supplier risk scores), a Record Validation Agent, a Task Assignment Agent, a Questionnaire Auto-Fill Agent (pre-fills supplier questionnaires from uploaded documents), a Case Management Agent (collects and validates supplier information autonomously and delivers a summary for human decision), a Case Enrichment Agent (adds assignees, resolution steps and risk assessment and resolves clear-cut cases without human effort) and a Business Partner Deduplication Agent; Reporting & Disclosures agents turn certificates and policies into disclosure content. Agents stop, ask and wait when a guardrail is reached, every action is logged, and by default they use open-source models hosted inside the HUB. osapiens' compliance suites cover LkSG, CSDDD, EUDR, the EU Forced Labour Regulation, CSRD, PPWR and the Digital Product Passport (vendor claims). The imprint names osapiens Services GmbH in Mannheim, Germany. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "LkSG", "CSDDD", "EUDR", "EU Forced Labour Regulation", "CSRD" ], "tasks": [ "vendor-risk", "risk-assessment", "questionnaire-automation", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.osapiens.com/en/platform/agent-factory", "sources": [ "https://www.osapiens.com/en/platform/agent-factory", "https://www.osapiens.com/", "https://www.osapiens.com/en/imprint" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "d3-morpheus-ai-soc", "name": "D3 Morpheus (agentic AI SOC platform)", "vendor": "D3 Security", "hq_country": "Canada", "hq_region": "north-america", "url": "https://d3security.com/", "category": "security", "categories": [ "security" ], "summary": "Agentic SOC platform that autonomously triages, investigates and responds across the full alert lifecycle, grading every verdict by its evidence and deferring to a human when uncertain.", "description": "D3 Security, headquartered in Vancouver, sells Morpheus, which it calls an accountable agentic SOC platform. Its site says Morpheus autonomously triages, investigates and responds to alerts: the Attack Path Discovery engine traces each alert across identities, endpoints, cloud and email, maps blast radius, validates IOCs and drafts remediation before an analyst opens the case. Every finding is graded Confirmed, Inferred or Gap with the evidence attached, and Morpheus defers to a human when uncertain. The platform also bundles a deterministic SOAR playbook engine with approval gates, case management, vulnerability triage, threat hunting and 800+ self-healing integrations, and is marketed to enterprise SOCs and MSSPs. D3 claims L1/L2 investigation of up to 95% of alerts in under two minutes (vendor claim). Pricing is a fixed annual subscription by daily alert-volume tier with AI token costs included; list prices are not published.", "pricing": "Not published as list prices. D3's pricing page describes a fixed annual subscription tied to a daily alert-volume tier (500 to 10,000 alerts/day, custom above), named-user licences and a flat per-alert overage rate, with all AI token costs included; request pricing.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "incident-response", "threat-detection" ], "india_relevance": "Relevant to CERT-In incident detection and response capability building; not a CERT-In compliance product by itself.", "featured": false, "source_url": "https://d3security.com/", "sources": [ "https://d3security.com/", "https://d3security.com/morpheus/pricing/", "https://d3security.com/company/contact/", "https://d3security.com/company/about-d3-security/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "imperum-virtus-ai-soc-agents", "name": "Imperum Virtus AI SOC agents (Triage, Pilot, Email Phishing)", "vendor": "Imperum", "hq_country": "Netherlands", "hq_region": "europe", "url": "https://www.imperum.io/autonomous-soc/virtus-triage", "category": "security", "categories": [ "security" ], "summary": "Amsterdam-built autonomous SOC platform whose Virtus agents triage every alert through a 7-stage pipeline, return a verdict with confidence and evidence, and hand cases to an investigation agent, with sovereign/on-prem AI options.", "description": "Imperum, founded in Amsterdam in 2022 (Imperum B.V.), offers an autonomous SOC and agentic SecOps platform for in-house SOCs and MSSPs. Its Virtus Triage agent runs every incoming alert through a seven-stage pipeline: normalisation, enrichment from connectors, customer policy gates, retrieval of similar past analyst decisions, threat intel and graph context, then an LLM verdict with a confidence score and reason codes. Alerts are auto-closed, escalated into cases or queued for analyst approval according to customer-set thresholds, and every decision is written to an audit index and can be overridden. Other agents include Virtus Pilot (full investigation), Virtus Email Phishing, a case router and prioritiser, and an Agent Studio for building and governing custom agents. Imperum also sells a sovereign AI appliance so models, data and inference stay under customer control. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "phishing-triage", "email-security", "security-operations", "alert-triage", "incident-response", "case-investigation" ], "india_relevance": "", "featured": false, "source_url": "https://www.imperum.io/autonomous-soc/virtus-triage", "sources": [ "https://www.imperum.io/", "https://www.imperum.io/autonomous-soc/virtus-triage", "https://www.imperum.io/about-us", "https://www.imperum.io/contact-us", "https://www.imperum.io/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "prophet-ai-soc-agents", "name": "Prophet AI (AI SOC Analyst, Threat Hunter and Detection Engineer agents)", "vendor": "Prophet Security", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.prophetsecurity.ai/", "category": "security", "categories": [ "security" ], "summary": "Agentic AI SOC platform whose agents investigate every alert end to end, respond through scoped Agent Actions autonomously or with sign-off, hunt threats and tune detections.", "description": "Prophet Security, headquartered in Palo Alto, California, sells Prophet AI, described as a constellation of AI agents across the security operations lifecycle. The AI SOC Analyst investigates every alert with what the vendor calls senior-analyst depth, delivers auditable determinations and responds through scoped Agent Actions, autonomously or with the customer's sign-off. The AI Threat Hunter answers plain-language questions about the environment and researches emerging threats to produce ready-to-run hunts, and the AI Detection Engineer maps real MITRE ATT&CK coverage from the customer's own investigations and ships tuned, backtested detections for approval. An optional Prophet AI Watchtower service adds 24x7 human experts reviewing malicious determinations. Prophet AI deploys single-tenant with a bring-your-own-key option and 200+ integrations. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "incident-response", "threat-detection" ], "india_relevance": "Relevant to CERT-In incident detection and response capability building; not a CERT-In compliance product by itself.", "featured": false, "source_url": "https://www.prophetsecurity.ai/", "sources": [ "https://www.prophetsecurity.ai/", "https://www.prophetsecurity.ai/contact-us", "https://www.prophetsecurity.ai/about-us" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "7ai-agentic-security-platform", "name": "7AI agentic security platform", "vendor": "7AI", "hq_country": "United States", "hq_region": "north-america", "url": "https://7ai.com/platform", "category": "security", "categories": [ "security" ], "summary": "Boston-based agentic security platform where swarms of specialised AI agents categorise, investigate and reach a determination on every alert, escalating only what needs a person, with optional managed service (PLAID ELITE).", "description": "7AI, headquartered in Boston, runs the SOC lifecycle (detect, investigate, respond, hunt) as one agentic system. Per its launch release, AI agents categorise each alert by type (EDR, cloud, email, identity), dozens of specialised agents investigate components in parallel by querying the customer's data sources, and findings are compiled into conclusions for analysts, ticketing systems or playbooks, with further agents calculating blast radius. Its platform page says 7AI groups, triages and reaches a determination on each alert and escalates only what needs a person, with response 'guided or automatic, with humans on the loop'. Skills let teams teach agents their procedures. The vendor reports more than 7 million investigations processed in production (vendor claim). PLAID ELITE is a fully managed offering in which 7AI experts run the platform 24x7. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "incident-response", "threat-detection" ], "india_relevance": "Relevant to CERT-In incident detection and response capability building; not a CERT-In compliance product by itself.", "featured": false, "source_url": "https://7ai.com/platform", "sources": [ "https://7ai.com/", "https://7ai.com/platform", "https://7ai.com/press/7ai-launches-agentic-security-platform", "https://7ai.com/press/7ai-widens-gap-in-agentic-security-with-plaid-elite" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "endor-labs-security-agents", "name": "Endor Labs security agents (agentic triage and remediation)", "vendor": "Endor Labs", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.endorlabs.com/platform/agentic-workflows", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Pre-built AppSec agents that read Endor findings against your source, write SAST fixes or file exceptions, pick safe dependency upgrades and open PRs, and answer malware-exposure and CI/CD posture questions inside your coding agents.", "description": "Endor Labs, founded in Palo Alto, sells an application security platform covering AI SAST, SCA, secrets, containers and supply chain. Its agentic-workflows page lists pre-built security agents that run in the coding agents developers already use. The AI SAST Remediation agent reads each finding's case file (data flow, exploit reproduction, severity) against the source at the pinned commit and either writes the fix or files the exception. The SCA Remediation agent uses call graphs and upgrade-impact analysis to choose a non-breaking fixed version, makes the change, runs the build and opens the PR. Other agents cover malware response (exposure to live supply-chain malware), CI/CD posture scoring, OSS upgrade investigation and remediation planning. A free Developer tier ('AURI') helps agents scan and fix vulnerabilities and exposed secrets; Core and Pro tiers are sold via sales.", "pricing": "Free Developer tier (AURI, no account required); Core and Pro tiers and add-on products are 'Get started' / 'Get pricing' with no list prices on endorlabs.com/pricing.", "pricing_model": "freemium", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "sca", "remediation", "vulnerability-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.endorlabs.com/platform/agentic-workflows", "sources": [ "https://www.endorlabs.com/platform/agentic-workflows", "https://www.endorlabs.com/pricing", "https://www.endorlabs.com/about" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "black-duck-signal", "name": "Black Duck Signal (agentic AI AppSec)", "vendor": "Black Duck", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.blackduck.com/signal-ai-appsec.html", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Agentic AI application security tool (GA March 2026) with role- and task-based agents that analyse new code in any language, filter findings by exploitability and apply verified fixes, callable from Claude Code, Gemini and GitHub Copilot via MCP.", "description": "Black Duck (Burlington, Massachusetts) announced general availability of Black Duck Signal on March 23, 2026, describing it as an agentic AI application security solution purpose-built to secure AI-generated code in autonomous development workflows. Signal's product page says role- and task-based agents find and fix security issues and defects in human- and AI-generated code, built-in exploitability analysis removes false positives and low-risk findings, and developers or coding assistants can review and apply verified fixes before check-in. Analysis is LLM-based and language-agnostic (COBOL to Rust) and is checked against Black Duck's ContextAI knowledge base of human-curated security intelligence. Signal connects to AI coding assistants such as Claude Code, Google Gemini and GitHub Copilot through MCP so scans can be triggered by natural-language prompts. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "remediation", "vulnerability-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.blackduck.com/signal-ai-appsec.html", "sources": [ "https://www.blackduck.com/signal-ai-appsec.html", "https://news.blackduck.com/2026-03-23-Black-Duck-Signal-Sets-a-New-Standard-for-Securing-AI-Generated-Code", "https://www.blackduck.com/company/locations.html", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Black Duck Polaris", "id": "TX1910179", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2029-06-23" } ] }, { "slug": "hcl-appscan-rapidfix", "name": "HCL AppScan RapidFix", "vendor": "HCLSoftware (HCLTech)", "hq_country": "India", "hq_region": "india", "url": "https://www.hcl-software.com/appscan/products/rapidfix", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Agentic AI triage and auto-fix for SAST findings in HCL AppScan: an LLM pass reviews each finding's accuracy and severity, filters false positives, and a deterministic codemod framework writes fixes in repos and pull requests.", "description": "HCL AppScan RapidFix is sold by HCLSoftware, the software division of Noida-headquartered HCLTech. HCLSoftware's launch release (Noida, Apr 30, 2025) says RapidFix was built in collaboration with Pixee and has two agentic components, AI-powered auto-triage and auto-fix, relying on the deterministic open-source Codemodder framework. The product page says the triage step uses source-code context and an LLM to review each SAST finding's accuracy and severity, pre-filter false positives and explain recommendations with code snippets. Fixes can be applied with one click using deterministic code changes, with AI assistance for new languages, and RapidFix runs in the background scanning repositories and pull requests while engineers or AI copilots code. It is part of the HCL AppScan application-security portfolio. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "remediation", "vulnerability-management" ], "india_relevance": "India-headquartered vendor (HCLSoftware is the software division of HCLTech, Noida). Supports secure-development and vulnerability-remediation practices relevant to CERT-In-oriented programs; no CERT-In-specific module is claimed.", "featured": false, "source_url": "https://www.hcl-software.com/appscan/products/rapidfix", "sources": [ "https://www.hcl-software.com/appscan/products/rapidfix", "https://www.hcl-software.com/news/30-4-25-hclsoftware-launches-hcl-appscan-rapidfix" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "openhands-vulnerability-fixer", "name": "OpenHands Vulnerability Fixer (agent platform with security integrations)", "vendor": "All Hands AI (OpenHands)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.openhands.dev/blog/20260303-vulnerability-fixer", "category": "code-security", "categories": [ "code-security", "business-ops" ], "summary": "Agent platform with security integrations, not a dedicated AppSec scanner: OpenHands' open-source Vulnerability Fixer runs Trivy scans or ingests Snyk, Veracode or Checkmarx reports, then has OpenHands agents write and test fixes and open GitHub PRs.", "description": "OpenHands is an open-source, model-agnostic coding-agent platform from All Hands AI (Cambridge, Massachusetts). It's listed here as an agent platform with security integrations, not a dedicated security product. On Mar 3, 2026 OpenHands released Vulnerability Fixer, an open-source app with a hosted version on OpenHands Hub. It runs Trivy security scans on a GitHub repository or accepts uploaded reports from other scanners such as Snyk, Veracode and Checkmarx, converts findings to a common schema and prioritises them. For each selected vulnerability, a separate OpenHands agent generates and tests a fix and opens a GitHub pull request, with progress and logs streamed in a web UI. It works against OpenHands Cloud or a local agent server, and OpenHands also presents it as a reference implementation for building apps on the OpenHands Cloud API. OpenHands itself is free to run locally and on the individual SaaS tier (bring your own key or at-cost models); Enterprise is custom-priced.", "pricing": "Open-source local OpenHands: free. Individual SaaS: free (bring your own LLM key or use OpenHands models at cost). Enterprise (SaaS or self-hosted in your VPC): custom pricing (openhands.dev/pricing).", "pricing_model": "freemium", "frameworks": [], "frameworks_claimed": [], "tasks": [ "agent-platform-security-integrations", "remediation", "sca", "vulnerability-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.openhands.dev/blog/20260303-vulnerability-fixer", "sources": [ "https://www.openhands.dev/blog/20260303-vulnerability-fixer", "https://docs.openhands.dev/openhands/usage/use-cases/vulnerability-remediation", "https://www.openhands.dev/pricing", "https://www.openhands.dev/privacy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "upwind-ai-agentic-pack", "name": "Upwind AI Agentic Pack (Choppy, Blue, Red and Green agents)", "vendor": "Upwind", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.upwind.io/agentic-security", "category": "security", "categories": [ "security" ], "summary": "Specialised AI agents inside Upwind's runtime-first cloud security platform: Blue investigates threats to a verdict, Red proves which risks are exploitable, Green finds root-cause fixes and opens PRs, coordinated by Choppy.", "description": "Upwind is a runtime-first cloud and AI security (CNAPP) vendor headquartered in San Francisco. Its AI Agentic Pack, launched May 13, 2026, adds specialised agents built into the platform and grounded in runtime context. Choppy maps services and relationships across cloud, code and runtime, answers plain-language questions with evidence, and dispatches the other agents. Blue investigates every threat from first signal to verdict, correlating runtime, cloud and identity signals into a timeline with prioritised response actions. Red safely tests the live environment like an adversary to prove which vulnerabilities, exposures and permissions are reachable and chains findings into attack paths. Green analyses the whole finding set for shared root causes and delivers implementation-ready fixes across code, IaC, packages, images and cloud configuration as pull requests. Upwind says the pack is available to customers as part of its Cloud & AI Security Platform. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "cloud-security", "incident-response", "exposure-management", "remediation" ], "india_relevance": "", "featured": false, "source_url": "https://www.upwind.io/agentic-security", "sources": [ "https://www.upwind.io/agentic-security", "https://www.globenewswire.com/news-release/2026/05/13/3294050/0/en/upwind-launches-ai-agentic-pack-introducing-an-agentic-security-workforce-built-on-runtime-context.html" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "runsybil-sybil", "name": "RunSybil Sybil (AI offensive security / autonomous pentesting)", "vendor": "RunSybil", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.runsybil.com/solutions/autonomous-penetration-testing", "category": "security", "categories": [ "security", "code-security" ], "summary": "AI offensive security platform whose agents run black- or white-box autonomous pentests, chain vulnerabilities across code, APIs, cloud and infrastructure, reproduce every finding, and re-test on each deployment.", "description": "RunSybil, a US company with hubs in San Francisco and New York City, sells Sybil, an AI-powered offensive security platform. Its pages say Sybil runs autonomous penetration-testing engagements (black box or white box, where the agents are given source access) and tests live systems with AI agents that learn about the target. It explores authentication boundaries, finds forgotten endpoints and chains weaknesses such as broken authorisation, cross-tenant access and privilege escalation into exploitable paths. Every finding is independently reproduced before delivery and ships with a CWE ID and remediation guidance precise enough to hand to an autonomous coding assistant, with retesting available. Sybil keeps a model of the application and infrastructure and re-evaluates what changed on every deployment, and RunSybil positions it for continuous testing, adversarial exposure validation and SOC 2 penetration-testing reports. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pen-test-management", "attack-surface", "appsec", "vulnerability-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.runsybil.com/solutions/autonomous-penetration-testing", "sources": [ "https://www.runsybil.com/", "https://www.runsybil.com/solutions/autonomous-penetration-testing", "https://www.runsybil.com/company" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "aws-continuum-penetration-testing", "name": "AWS Continuum for penetration testing (formerly AWS Security Agent)", "vendor": "Amazon Web Services", "hq_country": "United States", "hq_region": "north-america", "url": "https://aws.amazon.com/continuum/", "category": "security", "categories": [ "security", "code-security" ], "summary": "AWS frontier agent (formerly AWS Security Agent) that runs on-demand penetration tests of your applications with tailored multi-step attack scenarios, reproducible proof and ready-to-implement fixes, billed per task-hour.", "description": "AWS Continuum is Amazon Web Services' agentic security service. Its frontier agent, formerly known as AWS Security Agent, secures applications through the development lifecycle. Continuum for penetration testing runs on-demand pentests that AWS says cut testing from weeks to hours: it identifies validated vulnerabilities through tailored multi-step attack scenarios, with reproducible proof and ready-to-implement fixes. Customers set graduated trust, from Continuum proposing actions for human approval to actions it may take on its own within customer-defined guardrails. Related Continuum capabilities for code scanning and STRIDE threat modelling are in preview, and Continuum for code vulnerabilities is a gated preview with design partners, so this listing covers the penetration-testing capability only. Pentesting is priced at $50 per task-hour, metered per second, with the first three revalidations per finding free.", "pricing": "$50.00 per task-hour (metered per second; concurrent tasks add up, so billable task-hours usually exceed wall-clock time). First three revalidations per finding are free; a free trial is offered (aws.amazon.com/continuum/pricing).", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pen-test-management", "appsec", "vulnerability-management", "remediation" ], "india_relevance": "", "featured": false, "source_url": "https://aws.amazon.com/continuum/", "sources": [ "https://aws.amazon.com/continuum/", "https://aws.amazon.com/continuum/pricing/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "yeswehack-agentic-pentest", "name": "YesWeHack Agentic Pentest", "vendor": "YesWeHack", "hq_country": "France", "hq_region": "europe", "url": "https://www.yeswehack.com/product/agentic-pentest", "category": "security", "categories": [ "security" ], "summary": "On-demand pentests of external attack surface run by AI agents shaped by YesWeHack's bug-hunting expertise, with dedicated verification agents, a Pentest Manager, same-day results and reports in its vulnerability-management platform.", "description": "YesWeHack, a Paris-headquartered bug bounty and offensive security company, offers Agentic Pentest: on-demand pentests in which AI agents find vulnerabilities, validate exploitability and prove real-world impact on externally exposed assets. Black, grey or white box testing returns same-day results. The vendor says its agents draw on YesWeHack's bug-hunting experience, including community guides and its Vulnerability Vectors articles, and chain the latest bug-hunting techniques to find issues such as IDOR, broken access control, RCE and SQL injection, with full OWASP Top 10 coverage. Built-in validation workflows and dedicated verification agents ensure only qualified, reproducible vulnerabilities reach the customer. Testing uses state-of-the-art LLMs, including open-weight models, with in-house guardrails. A dedicated Pentest Manager guides each campaign, and findings arrive as enriched reports in YesWeHack's vulnerability-management platform. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pen-test-management", "attack-surface", "appsec", "vulnerability-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.yeswehack.com/product/agentic-pentest", "sources": [ "https://www.yeswehack.com/product/agentic-pentest", "https://www.yeswehack.com/page/legal-notices" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "patrowl-agentic-ai-pentesting", "name": "Patrowl Agentic AI Penetration Testing", "vendor": "Patrowl", "hq_country": "France", "hq_region": "europe", "url": "https://patrowl.io/en/agentic-ai-penetration-testing", "category": "security", "categories": [ "security" ], "summary": "Continuous external pentesting in which Patrowl's AI agents correlate assets, threats and past evidence, choose the next test step every day, and route every finding through a certified pentester before it reaches you.", "description": "Patrowl (Patrowl SAS, Paris) sells continuous external attack-surface management and automated penetration testing. Its agentic AI penetration-testing page says its AI agents test the customer's entire external attack surface every day, linking assets, technologies, vulnerability and exploit intelligence and previous test evidence, then deciding the next step: automate, gather more context or escalate. Repeatable tests run on every asset daily through Patrowl's engine, complex business-logic or attack-path cases go to a pentester, and a certified pentester validates every finding before it is delivered. Patrowl separates AI analysis from offensive execution, runs AI on internal infrastructure without exposing customer data to third parties, and says its research agents have found CVEs in open-source components. It connects to existing tools such as Jira and GLPI. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pen-test-management", "attack-surface", "vulnerability-management", "exposure-management" ], "india_relevance": "", "featured": false, "source_url": "https://patrowl.io/en/agentic-ai-penetration-testing", "sources": [ "https://patrowl.io/en/agentic-ai-penetration-testing", "https://patrowl.io/en/contact", "https://patrowl.io/en/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "legalfly-agents", "name": "LEGALFLY agents (Review, Legal Radar and Agent Studio)", "vendor": "LEGALFLY (LegalFly BV)", "hq_country": "Belgium", "hq_region": "europe", "url": "https://www.legalfly.com/products/agent-studio", "category": "business-ops", "categories": [ "business-ops", "compliance" ], "summary": "Legal AI platform with contracting, research and compliance agents, plus an Agent Studio that runs whole legal workflows from intake to approval against the organisation's playbooks.", "description": "LEGALFLY groups its product into Research Agents (Discovery: legal research and data-room analysis), Contracting Agents (Review: contract review and negotiation against customisable playbooks, with clause extraction, risk summaries and redlines in a Word add-in; Draft: document drafting) and Compliance Agents (Legal Radar: regulatory monitoring and horizon scanning; Multi review: due diligence). Agent Studio lets teams build custom agents and end-to-end workflows that trigger automatically from email, Slack or Teams, with approval and review steps set where a decision is needed. The vendor states it automates 'the entire workflow and the tasks inside it' while legal stays in control. The privacy policy and terms name LegalFly BV, registered in Ghent, Belgium; a London office is also listed.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation", "policy-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.legalfly.com/products/agent-studio", "sources": [ "https://www.legalfly.com/", "https://www.legalfly.com/products/agent-studio", "https://www.legalfly.com/products/review", "https://www.legalfly.com/products/legal-radar", "https://www.legalfly.com/legal/privacy-policy", "https://www.legalfly.com/legal/terms-conditions", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "LEGALFLY", "id": "TX1845403", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2029-04-27" } ] }, { "slug": "flank-legal-agents", "name": "Flank (autonomous legal agents)", "vendor": "Flank (Legal OS GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://flank.ai/product", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Supervised AI agents for enterprise in-house legal teams that run high-volume contracting work end-to-end (drafting, playbook review and redlining of counterparty paper, NDAs, infosec forms), with lawyers approving high-risk steps.", "description": "Flank describes 'AI agents for enterprise legal': work arrives from the business, agents run it against the legal team's playbooks, and lawyers approve what matters. Its product page covers agentic drafting (complex, conditional documents and packs), agentic review (counterparty paper redlined to the playbook, with held checks decided by a lawyer) and Flank Record (executed contracts filed at signature and kept current by agents). The vendor says agents handle high-volume contracting workflows end-to-end and that lawyers only touch finished work and high-risk moments; demo use cases include SoW drafting, NDA review and completing infosec forms. The imprint names Legal OS GmbH, Berlin.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation", "questionnaire-automation" ], "india_relevance": "", "featured": false, "source_url": "https://flank.ai/product", "sources": [ "https://flank.ai/", "https://flank.ai/product", "https://flank.ai/legals/impressum.html" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "wordsmith-ai-legal-agents", "name": "Wordsmith AI legal agents", "vendor": "Wordsmith AI", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.wordsmith.ai/products/agents", "category": "business-ops", "categories": [ "business-ops", "risk", "privacy" ], "summary": "AI agents for in-house legal teams that take inbound requests in Slack, Teams or email, apply the team's playbooks and return ready-to-send work, escalating non-standard matters with reasoning.", "description": "Wordsmith's agents respond to inbound legal requests in Teams, Slack, email or elsewhere, and can also run on a schedule. Each agent is assembled by the legal team from instructions, knowledge, skills and memory, and escalations come back with reasoning. Named agents include a Sales Contract Agent (reviews incoming sales contracts against the negotiation playbook and drafts the counter-position), an NDA Agent, a Procurement Agent (triages tool requests, checks existing licences, reviews vendor contracts against the procurement playbook), a Privacy Agent (privacy reviews of new vendors, products and data flows; drafts DPIAs and flags cross-border transfers), an HR Agent and a Matter Triage Agent. The privacy policy names Wordsmith AI Ltd and refers complaints to the UK Information Commissioner's Office.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation", "privacy-management", "vendor-risk" ], "india_relevance": "", "featured": false, "source_url": "https://www.wordsmith.ai/products/agents", "sources": [ "https://www.wordsmith.ai/products/agents", "https://www.wordsmith.ai/", "https://www.wordsmith.ai/privacy-policy" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "thomson-reuters-cocounsel-legal", "name": "CoCounsel Legal (agentic legal AI)", "vendor": "Thomson Reuters", "hq_country": "Canada", "hq_region": "north-america", "url": "https://legal.thomsonreuters.com/en/products/cocounsel-legal", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Agentic legal AI from Thomson Reuters that plans and executes multi-step legal work (research, document analysis, drafting and verification) grounded in Westlaw and Practical Law, including a Drafting Agent in Word that reviews agreements against playbooks.", "description": "Thomson Reuters announced general availability of the next generation of CoCounsel Legal on August 20, 2026, describing it as 'a fully agentic AI experience' that can 'plan, reason, and execute across complex legal workflows', built on Anthropic's Claude Agent SDK and grounded in Westlaw, Practical Law and the customer's documents. Capabilities named by the vendor include Deep Research, litigation document analysis and a Drafting Agent in CoCounsel for Word that drafts, edits and reviews agreements using natural-language instructions and an organisation's playbooks. Per the release, the new experience is available in the United States first, with Canada, the UK and Australia expected later in 2026. Thomson Reuters Corporation is a Canadian corporation and datelines its releases from Toronto. On the FedRAMP Marketplace, two Thomson Reuters packages are 'Agency In Process' (not authorized), and Westlaw is TX-RAMP certified (Level 2); neither is claimed here for CoCounsel itself.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://legal.thomsonreuters.com/en/products/cocounsel-legal", "sources": [ "https://legal.thomsonreuters.com/en/products/cocounsel-legal", "https://www.thomsonreuters.com/en/press-releases/2026/august/thomson-reuters-launches-next-generation-of-cocounsel-legal-the-ai-ecosystem-built-for-legal-professionals", "https://www.thomsonreuters.com/en/contact-us" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "hypatos-agentic-gbs-workforce", "name": "Hypatos agentic GBS workforce (finance back-office agents)", "vendor": "Hypatos", "hq_country": "Germany", "hq_region": "europe", "url": "https://www.hypatos.ai/agents", "category": "business-ops", "categories": [ "business-ops", "compliance" ], "summary": "Teams of AI agents for finance shared services that capture, code, tax-validate and PO-match invoices, process order confirmations, delivery notes and dunning letters, and post validated results to the ERP with traceable reasoning.", "description": "Hypatos sells 'GBS Agents' for the transactional layer of global business services. Per its site, agents capture invoices on arrival, code and validate tax, match every PO line, catch duplicates and route exceptions; other agents handle order confirmations, delivery notes (posting validated receipts to the ERP), dunning letters and order management. The vendor says agents collaborate and escalate to each other or to a human operator, take actions such as contacting suppliers and sending items for approval, and that each agentic decision is backed by clear reasoning for traceability and audit readiness. Pricing is per completed transaction. The imprint names Hypatos GmbH, registered in Potsdam (Amtsgericht Potsdam HRB 33671), with a Berlin office.", "pricing": "Per completed transaction: invoice processing from EUR 0.25, order confirmations, delivery notes and order management from EUR 0.20 each (hypatos.ai/pricing; for a full-scope standard workforce at up to 5M documents/year; volume discounts).", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "agentic-ops", "workflow-automation", "audit-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.hypatos.ai/agents", "sources": [ "https://www.hypatos.ai/", "https://www.hypatos.ai/agents", "https://www.hypatos.ai/pricing", "https://www.hypatos.ai/imprint" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "payhawk-ai-agents", "name": "Payhawk AI agents (Financial Controller, Procurement, Payments and more)", "vendor": "Payhawk", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://payhawk.com/en-us/platform/ai-agents", "category": "business-ops", "categories": [ "business-ops", "compliance" ], "summary": "Spend-management AI agents that enforce spend policy, collect and match receipts, chase approvals, code transactions for month-end close and handle procurement, travel and payment requests.", "description": "Payhawk lists five agents: a Financial Controller Agent (collects receipts, matches documents, chases approvals and codes transactions automatically to speed up month-end close), a Procurement Agent (spend requests), a Travel Agent, a Payments Agent and an Implementation Agent (sets up the finance layer alongside an existing ERP), plus prebuilt agentic workflows. The vendor says agents enforce the company's spend policy, chase approvals and fill gaps while finance stays in control. The legal page names Payhawk Limited, registered in England (company number 11747263, Chancery House, London), with offices across Europe and New York.", "pricing": "Platform plans on payhawk.com (US pricing page): Travel from $299/month, Accounts Payable from $349/month, Cards & Expenses from $449/month; agent inclusion per plan not stated.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "policy-management" ], "india_relevance": "", "featured": false, "source_url": "https://payhawk.com/en-us/platform/ai-agents", "sources": [ "https://payhawk.com/en-us/platform/ai-agents", "https://payhawk.com/en-us/platform/ai-agents/financial-controller-ai-agent", "https://payhawk.com/en-us/platform/ai-agents/procurement-ai-agent", "https://payhawk.com/en-us/pricing-and-plans", "https://payhawk.com/legal" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "appzen-autonomous-ap-agents", "name": "AppZen AI agents (Autonomous AP, Expense Audit, VAT Reclaim Agents and AI Agent Studio)", "vendor": "AppZen", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.appzen.com/ai-agent-studio", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Agentic AI for accounts payable, expense audit and card spend: AI agents built from finance SOPs audit expenses and cards, process invoices and escalate uncertain decisions to humans, with explainable, auditable actions.", "description": "AppZen positions itself as 'Agentic AI for Accounts Payable and Expense Management', with Autonomous AP, Expense Audit (automated AI expense-report auditing), Autonomous Cards (auditing and resolving non-T&E card transactions) and fraud and risk detection. Its AI Agent Studio turns uploaded standard operating procedures or templates into AI agents, lets teams test each agent against historical or live data before go-live, makes all agent actions visible, explainable and auditable, and has agents escalate to human teammates when they lack certainty. On the Texas DIR TX-RAMP certified list, AppZen 'Expense Audit, Autonomous AP' is certified at Level 2 (TX1331575). The contact page lists AppZen Headquarters in Santa Clara, California. On 20 Oct 2026 AppZen announced VAT Reclaim Agents, built on its Mastermind platform and working with Autonomous AP and Expense Audit. VAT Extraction Agents read VAT details from receipts and invoices. VAT Reclaim Adjudication Agents decide, per jurisdiction, whether VAT is fully, partly or not recoverable and record the reasoning and legal basis. VAT Reclaim Action Agents ask employees for documentation, contact suppliers for corrected invoices and send reminders, then return each transaction for re-adjudication. AppZen says the agents will be generally available from January 2027.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "tx-ramp" ], "frameworks_claimed": [ "TX-RAMP" ], "tasks": [ "workflow-automation", "fraud-detection", "audit-management", "process-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.appzen.com/ai-agent-studio", "sources": [ "https://www.appzen.com/", "https://www.appzen.com/ai-agent-studio", "https://www.appzen.com/contact", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://www.prnewswire.com/news-releases/appzen-launches-specialized-ai-agents-to-make-vat-reclaim-an-always-on-autonomous-finance-workflow-302911669.html", "https://www.appzen.com/vat-reclaim-agents" ], "last_checked": "2026-10-20", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Expense Audit, Autonomous AP", "id": "TX1331575", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2027-05-22" } ] }, { "slug": "workiva-agent-studio", "name": "Workiva Agent Studio (finance, audit and GRC agents)", "vendor": "Workiva", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.workiva.com/platform/agent-studio", "category": "compliance", "categories": [ "compliance", "business-ops", "risk" ], "summary": "No-code agent builder and prebuilt agents on Workiva's reporting, audit and GRC platform, used for finance tie-outs and roll-forwards and for evidence collection, control testing and remediation, with configurable review and approval steps.", "description": "Workiva's Agent Studio lets finance, risk and sustainability practitioners build agents in plain language or start from prebuilt templates. Agents are assembled from capabilities such as reading documents, pulling data, searching files and writing content, follow guardrails set in the build, and can be required to ask for input or approval before actions. Per Workiva, agents inherit the platform's security, permissions, traceability and audit trail. The homepage describes finance agents that automate tie-outs and roll-forwards and agentic AI that automates evidence collection, testing and remediation; the GRC page describes AI-driven evidence testing. Registry status (platform level): Workiva Platform FR1726564822 is FedRAMP Authorized (Moderate, 2019-10-09), Workiva Platform is GovRAMP Authorized (Moderate) and TX-RAMP Level 2 (TX985589). Workiva's pages do not say whether Agent Studio runs inside the FedRAMP boundary, so FedRAMP is not set as a verified framework for this agent.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "FedRAMP", "GovRAMP", "TX-RAMP", "SOC 2", "ISO 27001", "HIPAA" ], "tasks": [ "audit-management", "evidence-collection", "control-testing", "remediation", "workflow-automation", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://www.workiva.com/platform/agent-studio", "sources": [ "https://www.workiva.com/platform/agent-studio", "https://www.workiva.com/", "https://www.workiva.com/ai-powered-grc", "https://www.workiva.com/solutions/government", "https://www.workiva.com/contact", "https://www.fedramp.gov/marketplace/products/FR1726564822/", "https://govramp.org/program-participants", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Workiva Platform", "id": "FR1726564822", "impact": "Moderate", "date": "2019-10-09", "scope": "platform-only", "source_url": "https://www.fedramp.gov/marketplace/products/FR1726564822/", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "Workiva Platform", "id": "TX985589", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" }, { "program": "govramp", "status": "Authorized", "product": "Workiva Platform", "impact": "Moderate", "scope": "platform-only", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "unique-ai-financial-agents", "name": "Unique AI financial agents (KYC, due diligence and research agents)", "vendor": "Unique (Unique AG)", "hq_country": "Switzerland", "hq_region": "europe", "url": "https://www.unique.ai/en/platform", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Agentic AI platform for banks, asset and wealth managers with prebuilt financial agents for KYC, due diligence, RFP analysis and research, plus custom agents with governed tool and data access and audit logs.", "description": "Unique describes a modular agentic platform for financial services. It offers ready-made finance agents for workflows such as KYC, RFP analysis, investment insights and due diligence, and 'Spaces' for building task-specific agents with defined steps, inputs, constraints and outputs. Its homepage describes compliance, legal and operations agents for counterparty management, reconciliation and legal KYC that 'run continuously'. Admins control which systems, tools and datasets each agent can access, and orchestration keeps audit logs and compliance guardrails in place; an MCP Hub connects agents to internal systems. The site carries a BNP Paribas Wealth Management case study and a Standard Chartered partnership announcement. The contact page lists Z\u00fcrich first (with London, New York and Singapore offices), and the site is operated by Unique AG.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "kyc", "workflow-automation", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://www.unique.ai/en/platform", "sources": [ "https://www.unique.ai/", "https://www.unique.ai/en/platform", "https://www.unique.ai/contact-us", "https://www.unique.ai/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "beam-ai-agents", "name": "Beam AI self-learning agents (finance and operations agent suites)", "vendor": "Beam AI (Beam Technologies GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://beam.ai/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Agentic automation platform that turns SOPs into self-learning production agents, with prebuilt finance agents for invoice reconciliation, accounts receivable and financial compliance and reporting.", "description": "Beam AI says customers can upload processes or SOPs ('your 200-page SOP becomes a working agent') and deploy self-learning production agents, and claims more than 10 million agent tasks processed for Fortune 500 companies and scale-ups (vendor figure). Its finance suite includes an Invoice Reconciliation AI Agent, an Accounts Receivable AI Agent and a Financial Compliance & Reporting AI Agent, alongside HR and other suites. Plans include output evaluation and 'self-healing' outputs. The imprint lists Beam Technologies GmbH (Berlin) first, then Beam AI Inc. (New York) and Beam AI Ltd (Abu Dhabi); the About page lists teams in Berlin, Abu Dhabi, New York and Karachi.", "pricing": "Published on beam.ai/pricing: Free (20 tasks/month), Pro $50/month (200 tasks/month), Scale $3,990/month, Custom plan on request.", "pricing_model": "freemium", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "agentic-ops", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://beam.ai/", "sources": [ "https://beam.ai/", "https://beam.ai/pricing", "https://beam.ai/legal/imprint", "https://beam.ai/about" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "pega-agentic-ai-government", "name": "Pega AI agents (Pega Cloud for Government)", "vendor": "Pegasystems", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.pega.com/technology/agentic-workflows", "category": "business-ops", "categories": [ "business-ops", "compliance" ], "summary": "Enterprise workflow platform whose AI agents (Coach, Knowledge Buddy, Automate, developer agents and the Blueprint design agent) run on Pega's trusted workflows; Pega Cloud for Government, including these gen AI agents, is FedRAMP High authorized.", "description": "Pega says its 'Predictable AI' agents take their cues from customers' workflows via Pega Agentic Fabric, and that its design agent, Pega Blueprint, builds apps aligned to business rules. In June 2025 Pega announced a FedRAMP High ATO covering its gen AI suite in Pega Cloud for Government: Pega Coach (AI agent mentors), Pega Knowledge Buddy (AI agents answering from internal knowledge), Pega Automate (automation agents that automate workflow and process steps such as document analysis and research summarisation) and Pega developer agents. Pega Blueprint for Government launched in April 2026 as a FedRAMP High and DoD IL5 environment, and in August 2026 Pega expanded the certified capabilities in Pega Cloud for Government. Registry: Pega Cloud for Government (F1306282198A) is FedRAMP Authorized at High (2025-03-18) in the official Marketplace dataset, GovRAMP Authorized (High) and TX-RAMP Level 2 (TX985524). Pegasystems' privacy notice gives its address in Waltham, Massachusetts.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "fedramp", "govramp", "tx-ramp" ], "frameworks_claimed": [ "FedRAMP", "GovRAMP", "TX-RAMP", "DoD IL5" ], "tasks": [ "process-automation", "agentic-ops", "workflow-automation", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://www.pega.com/technology/agentic-workflows", "sources": [ "https://www.pega.com/technology/agentic-workflows", "https://www.pega.com/about/news/press-releases/pega-achieves-fedramp-high-status-its-gen-ai-solutions-us-federal", "https://www.pega.com/about/news/press-releases/pega-expands-fedramp-class-d-certified-capabilities-pega-cloud-government", "https://www.pega.com/about/news/press-releases/pega-helps-federal-government-modernize-legacy-it-systems-launch-pega", "https://www.pega.com/industries/government/cloud", "https://www.pega.com/privacy", "https://www.fedramp.gov/marketplace/products/F1306282198A/", "https://govramp.org/program-participants", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Pega Cloud for Government", "id": "F1306282198A", "impact": "High", "date": "2025-03-18", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/F1306282198A/", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "Pega Cloud for Government", "id": "TX985524", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" }, { "program": "govramp", "status": "Authorized", "product": "PEGA Cloud for Government", "impact": "High", "scope": "listing", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "reliaquest-greymatter-agentic-teammates", "name": "ReliaQuest GreyMatter Agentic Teammates (GreyMatter for Government)", "vendor": "ReliaQuest", "hq_country": "United States", "hq_region": "north-america", "url": "https://reliaquest.com/security-operations-platform/greymatter-agentic-teammates/", "category": "security", "categories": [ "security", "compliance" ], "summary": "Agentic AI security operations platform whose six persona-based Agentic Teammates investigate and triage alerts and execute approved containment actions; GreyMatter for Government is FedRAMP Authorized (Moderate).", "description": "ReliaQuest describes GreyMatter as 'an agentic AI security operations platform' with six persona-based agentic systems ('Agentic Teammates') that use 200+ agent skills and 400+ AI tools. Per the vendor, the teammates automate investigation by gathering context across the customer's technologies, execute approved response actions to contain threats, autonomously triage system-health alerts and handle Tier 1 and Tier 2 work; the vendor claims 99.4% investigation accuracy across 300+ technologies. GreyMatter for Government applies agentic AI to Tier 1 and Tier 2 triage, investigation and response for agencies and says it helps meet FedRAMP, FISMA, CMMC and NIST requirements. Registry: GreyMatter for Government (FR2428740308) is FedRAMP Authorized at Moderate since 2026-07-08 (agency: Drug Enforcement Administration), and its Marketplace description itself describes the agentic AI. ReliaQuest GreyMatter is also TX-RAMP certified at Level 2 (TX1443548). Pricing is based on endpoint count with no AI usage meter (vendor), but figures are not published.", "pricing": "Not published (vendor says pricing is based on endpoint count with no AI usage meter).", "pricing_model": "quote", "frameworks": [ "fedramp", "tx-ramp" ], "frameworks_claimed": [ "FedRAMP", "TX-RAMP", "FISMA", "CMMC", "SOC 2", "ISO 27001", "HIPAA", "PCI DSS" ], "tasks": [ "security-operations", "alert-triage", "incident-response", "threat-detection", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://reliaquest.com/security-operations-platform/greymatter-agentic-teammates/", "sources": [ "https://reliaquest.com/security-operations-platform/greymatter-agentic-teammates/", "https://reliaquest.com/greymatter-for-government/", "https://reliaquest.com/blog/greymatter-for-government-fedramp/", "https://reliaquest.com/solution-briefs/greymatter-ai-pricing/", "https://reliaquest.com/contact-us/", "https://www.fedramp.gov/marketplace/products/FR2428740308/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "GreyMatter for Government", "id": "FR2428740308", "impact": "Moderate", "date": "2026-07-08", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR2428740308/", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "ReliaQuest GreyMatter", "id": "TX1443548", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2027-03-25" } ] }, { "slug": "sentinelone-purple-ai", "name": "SentinelOne Purple AI (agentic AI security analyst)", "vendor": "SentinelOne", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.sentinelone.com/platform/purple/", "category": "security", "categories": [ "security", "compliance" ], "summary": "Agentic AI security analyst in the Singularity platform that runs alert investigations to a verdict and, with Singularity Hyperautomation, triggers response within pre-approved policies; SentinelOne says Purple AI is FedRAMP High authorized.", "description": "SentinelOne describes Purple AI as 'The Agentic Security Analyst': its Agentic Investigation runs the analysis from alert to verdict, surfaces evidence and recommends next steps, with an explainable Verdict Justification for every decision. Automated actions fire only within pre-approved policies and every action is logged; Singularity Hyperautomation executes the response automatically. A Purple AI MCP server extends the data and workflows to customers' own agents. SentinelOne announced on May 15, 2025 that Purple AI is available as a FedRAMP High authorized service in GovCloud, and its federal page calls Purple AI 'the first AI security analyst authorized at FedRAMP High'. Registry: SentinelOne Singularity Platform High (FR1919071020A) is FedRAMP Authorized at High (2024-09-10); SentinelOne Singularity Platform is GovRAMP Authorized (High) and TX-RAMP Level 2 (TX1266599). Purple AI pricing is not published separately; Singularity endpoint tiers are listed from $179.99 per endpoint per year on sentinelone.com/pricing. On Oct 21, 2026 SentinelOne introduced Singularity ASOC (Autonomous Security Operations Center), a suite powered by Purple AI that combines agentic investigation, hyperautomation response, AI data pipelines and AI SIEM, with analysts setting the limits on what the system can do.", "pricing": "Purple AI pricing not published; Singularity platform tiers listed from $179.99 per endpoint/year (Complete) and $229.99 (Commercial) on sentinelone.com/pricing.", "pricing_model": "quote", "frameworks": [ "fedramp", "govramp", "tx-ramp" ], "frameworks_claimed": [ "FedRAMP", "GovRAMP", "TX-RAMP" ], "tasks": [ "security-operations", "alert-triage", "case-investigation", "threat-detection", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://www.sentinelone.com/platform/purple/", "sources": [ "https://www.sentinelone.com/platform/purple/", "https://www.sentinelone.com/platform/federal-government-civilian/", "https://www.sentinelone.com/press/sentinelone-achieves-fedramp-high-authorization-for-purple-ai-cnapp-and-hyperautomation-solutions/", "https://www.sentinelone.com/pricing/", "https://www.sentinelone.com/contact/", "https://www.sentinelone.com/legal/privacy-notice/", "https://www.fedramp.gov/marketplace/products/FR1919071020A/", "https://govramp.org/program-participants", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://www.sentinelone.com/press/sentinelone-brings-security-superintelligence-to-the-soc-with-singularity-asoc/" ], "last_checked": "2026-10-23", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "SentinelOne Singularity Platform High", "id": "FR1919071020A", "impact": "High", "date": "2024-09-10", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR1919071020A/", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "SentinelOne Singularity Platform High", "id": "TX1266599", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" }, { "program": "govramp", "status": "Authorized", "product": "SentinelOne Singularity Platform", "impact": "High", "scope": "listing", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "abnormal-ai-security-mailbox", "name": "Abnormal AI Security Mailbox (Abnormal AI for Government)", "vendor": "Abnormal AI", "hq_country": "United States", "hq_region": "north-america", "url": "https://abnormal.ai/products/ai-security-mailbox", "category": "security", "categories": [ "security", "compliance" ], "summary": "Autonomous agent for email security operations that triages user-reported emails, removes related malicious campaign messages across the organisation and replies to reporters; included in Abnormal AI for Government, which is FedRAMP and GovRAMP Moderate authorized.", "description": "Abnormal calls AI Security Mailbox 'your AI co-worker for email security operations': it autonomously triages user-reported emails, remediates malicious campaigns and closes the loop with every reporter with policy-aligned guidance. Per the vendor, it identifies related messages from the same campaign and autonomously removes them. Abnormal's public-sector page says its platform is 'FedRAMP and GovRAMP Moderate authorized'. Registry: Abnormal AI for Government (FR2425960757) is FedRAMP Authorized at Moderate (2025-04-11); its Marketplace description lists AI Security Mailbox in the Abnormal Gov suite and describes fully automated triage and remediation of user-reported emails. Abnormal AI for Government is also GovRAMP Authorized (Moderate) and TX-RAMP Level 2 (TX1890118). The privacy notice names Abnormal AI, Inc. with a Las Vegas, Nevada mailing address.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "fedramp", "govramp", "tx-ramp" ], "frameworks_claimed": [ "FedRAMP", "GovRAMP", "TX-RAMP" ], "tasks": [ "phishing-triage", "email-security", "security-operations", "alert-triage", "incident-response", "remediation", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://abnormal.ai/products/ai-security-mailbox", "sources": [ "https://abnormal.ai/products/ai-security-mailbox", "https://abnormal.ai/solutions/industry/public-sector", "https://abnormal.ai/solutions/industry/public-sector/federal-government", "https://abnormal.ai/legal/privacy", "https://www.fedramp.gov/marketplace/products/FR2425960757/", "https://govramp.org/program-participants", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Abnormal AI for Government", "id": "FR2425960757", "impact": "Moderate", "date": "2025-04-11", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR2425960757/", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "Abnormal AI for Government", "id": "TX1890118", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "Abnormal AI", "id": "TX1227626", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2029-03-25" }, { "program": "govramp", "status": "Authorized", "product": "Abnormal AI for Government", "impact": "Moderate", "scope": "listing", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "castellum-ai-arbiter-agents", "name": "Castellum.AI Arbiter AI agents (alert resolution, transaction and fraud monitoring agents)", "vendor": "Castellum.AI", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.castellum.ai/products/aml-kyc-ai-agent-arbiter", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "AML/KYC agents that resolve L1 and L2 screening alerts (sanctions, PEPs, adverse media) against the institution's own policies, plus transaction-monitoring and fraud-monitoring agents, with a documented rationale for every decision.", "description": "Castellum.AI's Arbiter is a suite of AI agents for AML alert review. Its product page says the agents auto-adjudicate routine L1 and L2 alerts across onboarding, payments and perpetual KYC and escalate to human analysts only when more expertise is needed. There are specialised agents for sanctions and PEPs, adverse media, and policies and procedures (applying the institution's own escalation rules). Each decision is logged with input data and a human-readable narrative for audits and exams. Arbiter deploys as a layer inside existing case-management, core-banking or screening systems. Castellum also lists a transaction-monitoring agent (Sift) that flags and adjudicates suspicious activity, and a fraud-monitoring agent (Sentinel) that can pause high-risk transactions and draft risk assessments and SAR-ready narratives. Speed and false-positive figures on the pages are vendor claims. The company is in New York (privacy-policy postal address; terms governed by New York law). Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "kyc", "alert-triage", "case-investigation", "fraud-detection", "sar-narratives" ], "india_relevance": "", "featured": false, "source_url": "https://www.castellum.ai/products/aml-kyc-ai-agent-arbiter", "sources": [ "https://www.castellum.ai/products/aml-kyc-ai-agent-arbiter", "https://www.castellum.ai/products/transaction-monitoring-agent", "https://www.castellum.ai/products/fraud-monitoring-agent", "https://www.castellum.ai/about", "https://www.castellum.ai/privacy-policy", "https://www.castellum.ai/terms-of-service", "https://www.castellum.ai/pricing" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "symphonyai-sri-agents", "name": "SymphonyAI SRI Agents (Symphony Risk Intelligence)", "vendor": "SymphonyAI", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.symphonyai.com/financial-services/sri-agents", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Financial-crime agents on SymphonyAI's agent-native Symphony Risk Intelligence platform: manager and specialist agents that prepare TM and screening investigations, enrich watchlist records, track threat and regulatory intelligence, and run KYC/EDD workflows.", "description": "SRI Agents run on Symphony Risk Intelligence (SRI), which SymphonyAI introduced on Sept 24, 2026 as an agent-native risk and compliance platform. On the SRI Agents page, a Manager Agent coordinates specialist worker agents to assemble customer information, assess transactions, research external sources, and draft evidence, risk indicators and narratives before an investigator opens a transaction-monitoring alert. Agents also compare records and apply institutional policy to sanctions and name-screening matches. A Watchlist Enrichment Agent adds identity and ownership context to sparse records. Other agents watch threat and regulatory sources and recommend changes to detection logic and policies, with approval before deployment, and coordinate KYC onboarding and EDD evidence gathering. Governance features include policy controls, least-privilege access, human checkpoints, the ability to pause or stop agents, and evaluation and drift monitoring. Autonomy is configurable from semi- to fully autonomous. SymphonyAI is headquartered in Palo Alto, California. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "kyc", "case-investigation", "alert-triage", "sar-narratives", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.symphonyai.com/financial-services/sri-agents", "sources": [ "https://www.symphonyai.com/financial-services/sri-agents", "https://www.symphonyai.com/news/introducing-symphony-risk-intelligence-sri", "https://www.symphonyai.com/about", "https://www.symphonyai.com/contact-us" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "dotfile-autonomy", "name": "Dotfile Autonomy (KYB/AML review agents)", "vendor": "Dotfile (Dotfile SAS)", "hq_country": "France", "hq_region": "europe", "url": "https://www.dotfile.com/platform/dotfile-autonomy", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Specialised AI agents that pre-investigate KYB cases end to end (documents, UBOs, AML screening hits, online reputation), auto-approve routine cases under the customer's policy and escalate edge cases with a full audit trail.", "description": "Dotfile Autonomy is the agent layer of Dotfile's business-verification (KYB) platform. Its product page describes specialised agents for AML screening, document analysis, UBO investigation and reputation checks. They pre-investigate each case from document collection to risk summary, resolve screening hits in context, and auto-approve routine cases (clean documents, no hits, simple ownership) under the customer's own policy logic. Edge cases escalate with AI recommendations and complete decision logs. Agents also run ongoing monitoring with automated false-positive resolution, and run in parallel for bulk reviews and remediation of whole customer populations. The policy engine is no-code and configurable by segment, country and risk, and the page states EU data residency. Review-time and false-positive figures are vendor claims. Dotfile SAS is registered in France, seated in Paris, with a San Francisco office. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "kyc", "aml", "case-investigation", "alert-triage", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.dotfile.com/platform/dotfile-autonomy", "sources": [ "https://www.dotfile.com/platform/dotfile-autonomy", "https://www.dotfile.com/", "https://www.dotfile.com/privacy", "https://www.dotfile.com/terms", "https://www.dotfile.com/about" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "themis-ai-investigator", "name": "Themis AI Investigator (AML/KYB due-diligence agents)", "vendor": "Themis (Themis International Services Ltd)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.wearethemis.com/uk/software/modules/ai-investigator", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "A coordinated team of AML-trained AI agents that runs enhanced due-diligence and KYB investigations in minutes: registry and web collection, officer/UBO screening, adverse-media analysis and transparent red/amber/green risk grading, with analysts keeping the final decision.", "description": "Themis AI Investigator automates financial-crime due-diligence investigations with multiple specialised AI agents. Per the product page, one agent collects entity data from registries and websites, another screens officers, UBOs and entities against global and proprietary watchlists, and others analyse general and adverse media, extract contextual intelligence and look for behavioural patterns. The agents run in parallel; users can spin up 10, 20 or more task-specific agents. Investigations are scored across ten risk tiers with weighted indicators (bribery, fraud, sanctions, modern slavery and more), and every flag carries rationale and evidence. A human-in-the-loop design leaves validation and judgment with analysts. AI Investigator is one module of Themis's wider financial-crime toolkit (screening, onboarding, monitoring). Themis International Services Ltd is incorporated in England (company 11733141) with its office in London; it also has a Dubai DIFC presence. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "kyc", "aml", "case-investigation", "risk-assessment" ], "india_relevance": "", "featured": false, "source_url": "https://www.wearethemis.com/uk/software/modules/ai-investigator", "sources": [ "https://www.wearethemis.com/uk/software/modules/ai-investigator", "https://www.wearethemis.com/uk", "https://www.wearethemis.com/uk/company/contact", "https://www.wearethemis.com/uk/legal/privacy-policy", "https://www.wearethemis.com/uk/legal/terms-conditions" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "behavox-digital-employees", "name": "Behavox Digital Employees (AI agents for compliance surveillance alert review)", "vendor": "Behavox (Behavox Limited)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.behavox.com/solutions/ai-agents-compliance", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "AI agents that close routine Level 1 communications and trade-surveillance alerts on their own, using three-model consensus (any disagreement escalates to a human), with a regulator-ready Bundle Log of every decision.", "description": "Behavox Digital Employees are AI agents for compliance operations, focused on routine Level 1 surveillance alert review. Per Behavox's pages, three independent frontier models evaluate each alert, and all three must agree before the agent closes it autonomously; any dissent goes to a human reviewer. Each autonomous decision is recorded in a Bundle Log (video replay, machine-readable decision trace, full action history) that can be produced to regulators. The agents work alongside Behavox Quantum and third-party platforms such as NICE Actimize, Nasdaq, Splunk and Palo Alto Cortex XSIAM. They act through any browser UI without API integration and follow predefined workflows, stopping and alerting on unexpected states. Roles include Alert Reviewer, QA Analyst, Data Admin, Power User, Platform Admin and SOC Analyst. Behavox reports a NYSE-listed institution replaced six L1 analysts (vendor claim). Behavox lists London as its global headquarters. Pricing is via sales. On Oct 8, 2026 Behavox announced it had acquired Apiax, a Zurich-based provider of embedded compliance software that converts financial regulation into machine-readable rules.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "alert-triage", "control-monitoring", "workflow-automation", "compliance-workflows" ], "india_relevance": "", "featured": false, "source_url": "https://www.behavox.com/solutions/ai-agents-compliance", "sources": [ "https://www.behavox.com/solutions/ai-agents-compliance", "https://www.behavox.com/digital-employees", "https://www.behavox.com/about", "https://www.behavox.com/contact", "https://www.behavox.com/privacy-policy", "https://www.behavox.com/news/2026-behavox-acquires-apiax" ], "last_checked": "2026-10-23", "added": "2026-10-18" }, { "slug": "surecloud-gracie-agents", "name": "SureCloud Gracie AI agents (virtual GRC team)", "vendor": "SureCloud (SureCloud Limited)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.surecloud.com/gracie/ai-skills-and-agents", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Persona-based GRC agents in the SureCloud platform that run continuous risk, compliance, third-party and audit work on schedule or trigger, chaining reusable no-code Skills, with human approval gates and separate logging of AI and human actions.", "description": "Gracie AI is SureCloud's agentic layer for its GRC platform, which SureCloud calls a virtual GRC team ('not a chatbot'). Per the Skills and Agents page, agents take ownership of continuous activities. They run on a schedule or trigger, inside existing SureCloud workflows or independently, and chain natural-language Skills (pre-built or customer-built, no code) under role-based Personas such as Risk SME, Compliance SME or Vendor SME. Personas define each agent's scope of authority and where a human must approve. In SureCloud's example vendor-onboarding flow, agents create the vendor record, run a contract-review Skill against standard terms, propose tiering, build follow-up questions for evidence and draft notices, with humans validating at key stages. Every Gracie action is logged separately from human edits. The platform covers ISO 27001, SOC 2, DORA, NIS2, GDPR, ISO 42001 and more. Productivity figures are vendor claims. SureCloud is headquartered in London, with US headquarters in Plano, Texas. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "iso27001", "soc2" ], "frameworks_claimed": [], "tasks": [ "workflow-automation", "risk-assessment", "vendor-risk", "evidence-collection", "audit-management", "contract-review" ], "india_relevance": "", "featured": false, "source_url": "https://www.surecloud.com/gracie/ai-skills-and-agents", "sources": [ "https://www.surecloud.com/gracie/ai-skills-and-agents", "https://www.surecloud.com/", "https://www.surecloud.com/about-us/our-story", "https://www.surecloud.com/contact-us" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "athereon-laika", "name": "Athereon LAiKA (AI agent for ISMS, risk and questionnaires)", "vendor": "Athereon GRC GmbH", "hq_country": "Germany", "hq_region": "europe", "url": "https://www.athereon.de/en/product/ai", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "German, EU-hosted AI agent in the Athereon GRC platform that identifies risks, captures assets, maps gaps against NIS2/ISO 27001/DORA/TISAX/CRA, and sends and fills security questionnaires, asking for approval before it changes anything.", "description": "LAiKA is the AI agent built into Athereon GRC. Athereon says LAiKA 'identifies risks, captures assets, answers questionnaires, derives measures \u2014 not as a proposal, but as a result' under user control. Its components are: LAiKA Assist, which prioritises, assigns, reminds and follows up on tasks independently inside Microsoft Teams and asks for approval before making changes; Infrastructure Mapper, which builds a structured IT and asset map from existing lists, with web research on end-of-life dates and known vulnerabilities; Compliance Assistant, which compares NIS2, ISO 27001, DORA, TISAX and CRA requirements with the current state, finds gaps and prioritises measures through to audit; and Questionnaire Assistant, which sends questionnaires to suppliers, tracks and evaluates responses, moves results into risk management, auto-fills incoming security questionnaires from existing compliance data and researches supplier certificates. LAiKA is hosted in sovereign EU data centres, and customers can connect European, US or their own AI infrastructure. Pricing packages are by organisation size, priced on request.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "iso27001" ], "frameworks_claimed": [], "tasks": [ "gap-analysis", "risk-assessment", "questionnaire-automation", "vendor-risk", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.athereon.de/en/product/ai", "sources": [ "https://www.athereon.de/en/product/ai", "https://www.athereon.de/en/legal-notice", "https://www.athereon.de/impressum", "https://www.athereon.de/en/pricing" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "riskonnect-ai-agent-library", "name": "Riskonnect AI Agent Library (Agentforce 360 for Riskonnect)", "vendor": "Riskonnect", "hq_country": "United States", "hq_region": "north-america", "url": "https://riskonnect.com/agentforce-for-riskonnect-ai-agent-library/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Library of prebuilt risk and GRC agents on Salesforce Agentforce inside Riskonnect: risk-register signal, risk builder, regulatory mapping, policy impact and horizon-monitoring agents, plus claims and incident intake/audit agents.", "description": "Riskonnect's AI Agent Library ships prebuilt agents on Salesforce's Agentforce platform inside a customer's Riskonnect environment. Customers can also build their own. GRC agents listed: Risk Register Signal Agent (detects meaningful changes across the risk register and recommends updated ratings, with expert oversight), Risk Builder Agent (proposes causes, consequences and controls), Regulatory Mapping Agent (suggests controls for regulatory requirements), Policy Impact Agent (judges whether new or changed regulations require policy changes) and Horizon Monitoring Agent (tracks regulatory developments and coverage gaps). Policy translation and summarisation agents are also listed. RMIS agents cover incident and claim intake, claims risk signals, claims audit and assessment, and email-to-claim intake, and there are safety and healthcare patient-event agents. The page says these are available today, with new agents added regularly. Usage is billed through AI usage credits; prices are not published. Riskonnect is headquartered in Atlanta, Georgia.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "risk-management", "control-mapping", "policy-management", "workflow-automation", "risk-assessment" ], "india_relevance": "Riskonnect lists offices in Bengaluru, Pune, Noida and Mangalore.", "featured": false, "source_url": "https://riskonnect.com/agentforce-for-riskonnect-ai-agent-library/", "sources": [ "https://riskonnect.com/agentforce-for-riskonnect-ai-agent-library/", "https://riskonnect.com/contact-us/", "https://riskonnect.com/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "new-odyssey-pegasus-compliance-agent", "name": "New Odyssey Pegasus Compliance Agent (DSAR agent)", "vendor": "New Odyssey (New Odyssey Ltd)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.new-odyssey.com/pegasus/compliance", "category": "risk", "categories": [ "risk", "compliance", "privacy" ], "summary": "Packaged DSAR agent that handles intake, jurisdiction deadlines, identity checkpoints, discovery across connected HRIS/CRM/ticketing/file systems, third-party PII redaction and response drafting, with a person approving the release.", "description": "The Pegasus Compliance Agent is one of New Odyssey's packaged Pegasus AI agents, aimed at privacy, legal and compliance teams answering data subject access requests. Per the product page, it logs each request at intake, matches it to its jurisdiction and statutory deadline (GDPR/UK GDPR, CCPA/CPRA, PIPEDA, LGPD) and holds it at an identity checkpoint before touching data. Through Merge it discovers the requester's data across around 200 connected platforms (for example BambooHR, Workday, Salesforce, HubSpot, Zendesk, ServiceNow, Jira, SharePoint, Google Drive). It proposes redactions of third-party personal data and prepares an audit-logged response pack. A person reviews flagged items, decides exemptions and approves the release; nothing is sent automatically unless configured. Access, deletion, correction and opt-out requests run through the same workflow. Each deployment starts with a pilot on one real request, and the page says headline percentages are workflow benchmarks, not customer results. The agent runs on New Odyssey's MIT-licensed CIP governance control plane. New Odyssey is headquartered in London, with US operations in Dallas. Pricing is quoted per engagement.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "dsr-automation", "privacy-management", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.new-odyssey.com/pegasus/compliance", "sources": [ "https://www.new-odyssey.com/pegasus/compliance", "https://www.new-odyssey.com/company/about", "https://www.new-odyssey.com/privacy", "https://www.new-odyssey.com/contact" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "wolfia-questionnaire-agent", "name": "Wolfia Questionnaire Agent (security questionnaires and trust center)", "vendor": "Wolfia (Wolfia Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://wolfia.com/products/questionnaire-automation", "category": "security", "categories": [ "security", "compliance", "risk" ], "summary": "Security-questionnaire agent that drafts every answer with a citation from the company's own corpus, routes ungrounded questions to the owning expert, returns the file in its original format, and fills portal-only questionnaires via a Chrome extension.", "description": "Wolfia's Questionnaire Agent handles inbound security questionnaires (SIG, CAIQ, RFP security sections, portal exports). Per the product page, it reads the customer's corpus first: policies, prior questionnaires, the SOC 2 report and live syncs from Confluence, Google Drive, Notion, Slack and Drata. It parses Excel, Word, PDF and screenshots, drafts each answer with a link to its source, and routes anything it cannot ground to the subject-matter expert who owns the topic instead of guessing. Completed files go back in the original format, and the Chrome extension fills portal-only questionnaires (for example OneTrust, ServiceNow, ProcessUnity, UpGuard, Zip). The same knowledge base powers Wolfia's Trust Center, Contract Review Agent, Knowledge Base Agent and Slack agent. Customer figures on the page (Handshake, Amplitude) are vendor claims. Pricing is volume-based with unlimited users and is scoped on a call; no prices are published. Wolfia Inc.'s principal place of business is Austin, Texas.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "questionnaire-automation", "trust-center", "contract-review" ], "india_relevance": "", "featured": false, "source_url": "https://wolfia.com/products/questionnaire-automation", "sources": [ "https://wolfia.com/products/questionnaire-automation", "https://wolfia.com/", "https://wolfia.com/pricing", "https://wolfia.com/terms", "https://wolfia.com/privacy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "zip-risk-orchestration-agents", "name": "Zip risk agents (Risk Orchestration and procurement Superagents)", "vendor": "Zip (ZipHQ, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://zip.com/products/risk-orchestration", "category": "risk", "categories": [ "risk", "business-ops" ], "summary": "Procurement-embedded third-party risk agents that screen and score vendors, fast-track low-risk ones, route high-risk ones for deeper review, analyse surveys and documents for key risks, and schedule re-assessments by risk tier.", "description": "Zip's Risk Orchestration product uses risk agents inside its procurement orchestration platform. Zip says they cut 90% of manual work (vendor claim). Per the product page, the agents automatically screen and score vendors for risk, fast-track reviews of low-risk vendors and route high-risk ones for deeper review. They analyse surveys, documents and external intelligence to surface key risks and outline mitigations, and recommend re-assessment dates and review workflows by risk tier. The platform also runs third-party checks (TIN, VAT, OFAC, D&B, bank verification), sizes approval workflows to risk, spend and regulatory requirements, monitors cyber and sanctions feeds (for example Black Kite and LSEG World-Check), and keeps searchable audit logs. Zip's wider Superagents (Intake, Procurement, Contract, AP and Config, which identifies process inefficiencies and adapts workflows) carry out procurement work end to end. ZipHQ, Inc. is based in San Francisco. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "vendor-risk", "risk-assessment", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://zip.com/products/risk-orchestration", "sources": [ "https://zip.com/products/risk-orchestration", "https://zip.com/capabilities/superagents", "https://zip.com/zip-privacy-notice", "https://zip.com/about" ], "last_checked": "2026-10-20", "added": "2026-10-18" }, { "slug": "google-secops-triage-investigation-agent", "name": "Google Security Operations Triage and Investigation Agent", "vendor": "Google Cloud", "hq_country": "United States", "hq_region": "north-america", "url": "https://docs.cloud.google.com/chronicle/docs/secops/triage-investigation-agent", "category": "security", "categories": [ "security" ], "summary": "AI agent in Google Security Operations that autonomously investigates SIEM alerts and returns a verdict, confidence score, timeline and next steps.", "description": "The Triage and Investigation Agent (TIN) in Google Security Operations investigates alerts automatically or on demand. Google's documentation says it runs dynamic SecOps searches, enriches with Google Threat Intelligence, analyses command lines and reconstructs process trees, then returns a disposition with a confidence level, an investigation timeline and suggested next steps. Investigations average about 60 seconds, with a 20-minute maximum. It works only on alerts ingested through Google SecOps SIEM, not on alerts that come in through SOAR connectors. Google's Cloud blog describes the agent as generally available. Google SecOps SIEM and SOAR are listed in the Google Services FedRAMP High boundary (FR1805751477), but the agent itself is not named there, so FedRAMP is not set as a verified framework for this listing.", "pricing": "No standalone list price. Agent usage is metered in Google SecOps Security Tokens. Google's docs describe complimentary daily tokens for some Enterprise Plus customers and token purchases for Enterprise customers. Token prices are not published.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "FedRAMP" ], "tasks": [ "security-operations", "alert-triage", "incident-response", "threat-detection" ], "india_relevance": "Relevant to CERT-In incident detection and response capability building; not a CERT-In compliance product by itself.", "featured": false, "source_url": "https://docs.cloud.google.com/chronicle/docs/secops/triage-investigation-agent", "sources": [ "https://docs.cloud.google.com/chronicle/docs/secops/triage-investigation-agent", "https://docs.cloud.google.com/chronicle/docs/agentic-soc/security-tokens", "https://cloud.google.com/blog/products/identity-security/detecting-and-containing-powered-threats-with-google-security-operations-agents", "https://policies.google.com/terms" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Google Services (Google Cloud Platform Products and underlying Infrastructure)", "id": "FR1805751477", "impact": "High", "date": "2019-12-04", "scope": "platform-only", "source_url": "https://www.fedramp.gov/marketplace/products/FR1805751477/", "checked": "2026-10-18" } ] }, { "slug": "microsoft-security-copilot-phishing-triage-agent", "name": "Microsoft Security Copilot Phishing Triage Agent (Defender)", "vendor": "Microsoft", "hq_country": "United States", "hq_region": "north-america", "url": "https://learn.microsoft.com/en-us/defender-xdr/phishing-triage-agent", "category": "security", "categories": [ "security" ], "summary": "Security Copilot agent in Microsoft Defender that autonomously triages user-reported phishing, resolves false positives and explains each verdict.", "description": "The Phishing Triage Agent (Microsoft Learn says it is the same agent as the Security Alert Triage Agent in Microsoft Defender) autonomously triages user-reported phishing submissions. According to Microsoft Learn, it classifies each alert, resolves false positives, leaves true positives open for analysts, gives a natural-language rationale for its verdict and learns from analyst feedback. Its tools include email content analysis, file and URL detonation, screenshot analysis, threat intelligence and advanced hunting. Email and collaboration alerts are generally available. Identity and cloud alert types are in preview.", "pricing": "No standalone price. Requires Microsoft Defender for Office 365 Plan 2 plus Security Copilot security compute units (SCUs). Microsoft says Security Copilot agents are also made available to Microsoft 365 E5 customers. Check Microsoft's Security Copilot pricing for SCU rates.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "phishing-triage", "email-security", "security-operations", "alert-triage", "incident-response", "threat-detection" ], "india_relevance": "Relevant to CERT-In incident detection and response capability building; not a CERT-In compliance product by itself.", "featured": false, "source_url": "https://learn.microsoft.com/en-us/defender-xdr/phishing-triage-agent", "sources": [ "https://learn.microsoft.com/en-us/defender-xdr/phishing-triage-agent", "https://learn.microsoft.com/en-us/defender-xdr/security-alert-triage-agent", "https://www.microsoft.com/en-us/security/business/ai-machine-learning/microsoft-security-copilot", "https://privacy.microsoft.com/en-us/privacystatement" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "wedgex-ai-soc-agent", "name": "WedgeX AI SOC Agent", "vendor": "WedgeX", "hq_country": "Australia", "hq_region": "australia-new-zealand", "url": "https://wedgex.ai/product/agent/", "category": "security", "categories": [ "security" ], "summary": "Australian AI SOC agent that enriches, investigates and recommends escalate/close actions on alerts, proposing containment for human approval.", "description": "WedgeX's agent works in three phases: deterministic enrichment, hypothesis-driven investigation, and a recommendation (escalate, close, verification required or monitor) with risk and confidence scores. It proposes containment actions for human approval, and the product page says it never closes or contains on its own. It connects to SIEMs (Splunk, Microsoft Sentinel, QRadar), EDRs (CrowdStrike, SentinelOne, Defender), threat-intel feeds (OTX, MISP, AbuseIPDB), identity providers (Azure AD, Okta) and MCP servers. It learns from analyst verdicts and keeps a full audit trace. It is offered as an AI SOC platform or as a managed SOC, and WedgeX says it is built and supported in Australia.", "pricing": "Not published (the pricing page says 'Talk to us').", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "incident-response", "threat-detection" ], "india_relevance": "Relevant to CERT-In incident detection and response capability building; not a CERT-In compliance product by itself.", "featured": false, "source_url": "https://wedgex.ai/product/agent/", "sources": [ "https://wedgex.ai/product/agent/", "https://wedgex.ai/contact/", "https://wedgex.ai/pricing/", "https://wedgex.ai/terms/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "attic-ivon-agentic-mdr", "name": "Attic IVON (Agentic MDR for Microsoft 365)", "vendor": "Attic Security", "hq_country": "Netherlands", "hq_region": "europe", "url": "https://atticsecurity.com/en/agentic-mdr/", "category": "security", "categories": [ "security" ], "summary": "Dutch AI SOC agent for Microsoft 365 SMBs that triages, investigates and contains identity alerts across Defender, Sentinel and Entra ID with human sign-off.", "description": "IVON is Attic Security's AI SOC agent inside its agentic MDR service for Microsoft 365. Attic says IVON triages, investigates and contains identity signals across Microsoft Defender, Sentinel and Entra ID. Each alert gets a verdict (true positive, false alarm, benign or undetermined) with confidence and evidence. IVON proposes remediation, which Attic executes after customer sign-off, or immediately for action types the customer has pre-approved. Cases are escalated to human analysts, and there is a full audit trail. Attic claims mitigation in about 6 minutes on average (vendor figure). The service targets SMBs and offers a 14-day free trial.", "pricing": "Published: the agentic MDR page lists \u20ac6 per user per month, decreasing with more users. The pricing page lists plans from \u20ac27/month on annual billing, with incident-handling add-ons (+2x IVON incident handling from \u20ac30.15, +5x from \u20ac34.20). Prices exclude VAT. Check the pricing page for current amounts.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "incident-response", "threat-detection", "remediation" ], "india_relevance": "Relevant to CERT-In incident detection and response capability building; not a CERT-In compliance product by itself.", "featured": false, "source_url": "https://atticsecurity.com/en/agentic-mdr/", "sources": [ "https://atticsecurity.com/en/agentic-mdr/", "https://atticsecurity.com/en/ivon/", "https://atticsecurity.com/en/blog/attic-launches-ivon/", "https://atticsecurity.com/en/pricing/", "https://atticsecurity.com/en/about/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "reliance-radar-agentic-secops", "name": "Reliance Cyber RADAR", "vendor": "Reliance Cyber", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.reliancecyber.com/radar", "category": "security", "categories": [ "security" ], "summary": "UK agentic MDR platform on Google Security Operations with specialist AI agents for detection engineering, triage, response and self-healing, under human oversight.", "description": "Reliance Cyber launched RADAR in September 2026 as an agentic MDR platform built on Google Security Operations. The launch release describes four specialist agents for detection engineering, threat triage, response orchestration and autonomous self-healing, all working under human oversight. Reliance claims 99.3% precision across more than 18,000 cases (vendor figure). The RADAR page describes the RADAR AI agent fleet, the RADAR Command natural-language portal, RADAR Detect and RADAR Control, and says sensitive actions always pass through a human analyst. It is delivered as part of Reliance Cyber's managed detection and response service.", "pricing": "Not published.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "incident-response", "threat-detection" ], "india_relevance": "Relevant to CERT-In incident detection and response capability building; not a CERT-In compliance product by itself.", "featured": false, "source_url": "https://www.reliancecyber.com/radar", "sources": [ "https://www.reliancecyber.com/radar", "https://www.reliancecyber.com/reliance-cyber-launches-reliance-radar/", "https://www.reliancecyber.com/contact", "https://www.reliancecyber.com/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "cycode-ai-teammates", "name": "Cycode AI Teammates (Exploitability, Remediation and Change Impact agents)", "vendor": "Cycode", "hq_country": "Israel", "hq_region": "middle-east", "url": "https://cycode.com/maestro/", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Cycode's AppSec AI agents that assess the exploitability of findings, generate fixes, analyse change impact and query the risk graph inside the Cycode platform.", "description": "Cycode markets a set of AI 'teammates' for application security: an Exploitability Agent (released August 2025) that judges whether a finding is actually exploitable in context, a Fix and Remediation agent, a Change Impact Analysis Agent, a Risk Intelligence Graph Agent, a CVE Agent and a Repository Agent. Cycode's March 2026 blog described Maestro, which orchestrates these agents, as in early access at the time. The agents run on Cycode's ASPM platform (SAST, SCA, secrets, IaC and pipeline security).", "pricing": "Not published (the pricing page shows no amounts).", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "vulnerability-management", "remediation", "sast", "sca" ], "india_relevance": "Agent-assisted triage and fixes can support CERT-In-oriented vulnerability handling. Cycode does not market a CERT-In module.", "featured": false, "source_url": "https://cycode.com/maestro/", "sources": [ "https://cycode.com/maestro/", "https://cycode.com/blog/introducing_ai_exploitability_agent/", "https://cycode.com/blog/the-future-of-agentic-ai-appsec-introducing-ai-teammates/", "https://cycode.com/terms-of-use/", "https://cycode.com/about-us/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "phoenix-security-purple", "name": "Phoenix Purple (Phoenix Security)", "vendor": "Phoenix Security", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://phoenix.security/phoenix-purple_ai_code_security/", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "UK AI code-security agent platform with reachability-validated scanning, PR scanning, IDE/agent integrations and an agent that writes risk-tiered fix PRs.", "description": "Phoenix Purple launched in London in July 2026 and was described as generally available at launch. It combines graph-based SAST, SCA, IaC, container and secrets scanning with reachability validation, pipeline-free PR scanning through a GitHub App, integrations for Cursor, VS Code, Claude Code and Windsurf, and an MCP server. An Agentic Code Triager handles findings, and Phoenix Green writes fixes as pull requests with risk tiering. Phoenix says nothing auto-merges without the right signal, and a human makes the final decision.", "pricing": "Not published for Phoenix Purple specifically. The Phoenix pricing page lists platform plans (Free; Professional \u00a31,495/month; Enterprise on request) but does not say which plan includes Purple.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "sca", "secrets-detection", "iac", "pr-review", "remediation" ], "india_relevance": "Reachability-validated scanning and fix PRs can support CERT-In-oriented secure development. Phoenix does not market a CERT-In module.", "featured": false, "source_url": "https://phoenix.security/phoenix-purple_ai_code_security/", "sources": [ "https://phoenix.security/phoenix-purple_ai_code_security/", "https://phoenix.security/phoenix-purple-launch-ai-agent-security-platform/", "https://phoenix.security/privacy-policy/", "https://phoenix.security/about-us/", "https://phoenix.security/pricing/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "kalpita-codeguard", "name": "Kalpita CodeGuard", "vendor": "Kalpita Technologies", "hq_country": "India", "hq_region": "india", "url": "https://www.kalpitatechnologies.com/products/kalpita-codeguard", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Indian autonomous DevSecOps agent that scans each commit, generates a secure patch and opens a human-approved pull request.", "description": "Kalpita CodeGuard runs as a GitHub App. It scans every commit, generates a secure patch for each finding and opens a pull request with an explanation for developers to review and merge. Kalpita claims this takes under 3 minutes. Kalpita says CodeGuard runs asynchronously and never blocks the build. The product page also lists multi-language SAST, import of reports from other scanners, IDE, Azure DevOps and GitLab support, and IaC, container, SBOM and secret scanning. CodeGuard is a newer product from Kalpita, an IT services company.", "pricing": "Not published (demo request).", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "remediation", "pr-review", "secrets-detection", "iac" ], "india_relevance": "Indian vendor (Bengaluru). Automated fix PRs can support CERT-In-oriented vulnerability handling. CodeGuard is not marketed as a CERT-In compliance product.", "featured": false, "source_url": "https://www.kalpitatechnologies.com/products/kalpita-codeguard", "sources": [ "https://www.kalpitatechnologies.com/products/kalpita-codeguard", "https://www.kalpitatechnologies.com/kalpita-case-studies/kalpita-codeguard-devsecops", "https://www.kalpitatechnologies.com/aboutcompany/company-facts" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "kiro-agent-platform-security-integrations", "name": "Kiro (agent platform with security integrations)", "vendor": "Amazon Web Services", "hq_country": "United States", "hq_region": "north-america", "url": "https://kiro.dev/powers/", "category": "code-security", "categories": [ "code-security" ], "summary": "Agent platform with security integrations: AWS's agentic IDE and autonomous agent, with Kiro Powers for Snyk, Aikido, SonarQube and Sonatype scanning.", "description": "Kiro is AWS's agentic development environment. In autonomous mode, its agent plans work, delegates to sub-agents and opens pull or merge requests. The Kiro Powers directory, on Kiro's own site, includes security powers for Snyk (Secure at Inception), Aikido Security code scanning, SonarQube Code Quality & Security, and Sonatype. Kiro's docs explain that powers load dynamically to give the agent those tools. Kiro is listed as an agent platform with security integrations, not as a dedicated security scanner. AWS documents that Kiro is FedRAMP High and DoD IL-4/5 authorized in AWS GovCloud (US); Kiro is marked in-scope for FedRAMP Class C (East/West) and Class D (GovCloud) on AWS's services-in-scope list (updated 15 Oct 2026). The Marketplace package for AWS GovCloud is F1603047866 (FedRAMP Authorized, High).", "pricing": "Published: Free $0 (50 credits); Pro $20/user/month (1,000 credits); Pro+ $40 (2,000 credits); Pro Max $100 (5,000 credits); Power $200; extra credits $0.04 each (kiro.dev/pricing at last check).", "pricing_model": "freemium", "frameworks": [ "fedramp" ], "frameworks_claimed": [ "FedRAMP" ], "tasks": [ "agent-platform-security-integrations", "appsec", "pr-review" ], "india_relevance": "", "featured": false, "source_url": "https://kiro.dev/powers/", "sources": [ "https://kiro.dev/powers/", "https://kiro.dev/docs/powers/", "https://kiro.dev/docs/web/autonomous-mode/", "https://kiro.dev/pricing/", "https://aws.amazon.com/agreement/", "https://www.fedramp.gov/marketplace/products/F1603047866/", "https://aws.amazon.com/compliance/services-in-scope/FedRAMP/", "https://aws.amazon.com/about-aws/whats-new/2026/06/kiro-fedramp-high-dod-il-4-5-govcloud-us/", "https://kiro.dev/changelog/general/kiro-authorized-for-fedramp-high-and-dod-il-4-5-in-aws-govcloud-us/" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "AWS GovCloud (Kiro in scope)", "id": "F1603047866", "impact": "High", "date": "2016-06-21", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/F1603047866/", "checked": "2026-10-18" } ] }, { "slug": "maze-ai-agents", "name": "Maze AI Agents (Maze Cloud and Maze Code)", "vendor": "Maze", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://mazehq.com/platform/cloud", "category": "security", "categories": [ "security", "code-security" ], "summary": "UK AI agents that investigate every cloud and code vulnerability with code-to-cloud context, decide exploitability and deliver fixes.", "description": "Maze's AI agents map cloud and container environments and investigate each vulnerability with code-to-cloud context to decide whether it is actually exploitable, then deliver fixes (including fix-ready Jira tickets). Maze Code extends the agents to code security with AI-driven SCA and SAST that investigate each dependency and finding.", "pricing": "Not published.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "cloud-security", "vulnerability-management", "remediation", "sca", "sast" ], "india_relevance": "", "featured": false, "source_url": "https://mazehq.com/platform/cloud", "sources": [ "https://mazehq.com/platform/cloud", "https://mazehq.com/", "https://mazehq.com/platform/code", "https://mazehq.com/blog/maze-code", "https://mazehq.com/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "datadog-bits-security-analyst", "name": "Datadog Bits AI Security Analyst", "vendor": "Datadog", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.datadoghq.com/product/ai/bits-security-analyst/", "category": "security", "categories": [ "security" ], "summary": "AI agent in Datadog Cloud SIEM that autonomously investigates security signals and returns evidence-backed Benign or Suspicious verdicts.", "description": "Bits AI Security Analyst is part of Datadog Cloud SIEM. It autonomously investigates Cloud SIEM signals and returns evidence-backed Benign or Suspicious verdicts with recommendations. Datadog announced general availability on March 23, 2026. Datadog for Government is FedRAMP Authorized at High (FR2023864279A, 2026-05-05) with Cloud SIEM in scope, and is GovRAMP Authorized (High) and TX-RAMP Level 2 (TX985429). Datadog's pages do not say whether Bits AI Security Analyst runs inside that boundary, so FedRAMP, GovRAMP and TX-RAMP are not set as verified frameworks for this agent.", "pricing": "Published: Cloud SIEM starts at $5 per GB analysed per month (billed annually) or $7.50 on-demand. Datadog includes 100 free Bits AI Security Analyst investigations per month per 1 TB analysed (minimum 50). Check the Datadog pricing page for current amounts.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [ "FedRAMP", "GovRAMP", "TX-RAMP" ], "tasks": [ "cloud-security", "alert-triage", "security-operations", "threat-detection" ], "india_relevance": "Relevant to CERT-In incident detection and response capability building; not a CERT-In compliance product by itself.", "featured": false, "source_url": "https://www.datadoghq.com/product/ai/bits-security-analyst/", "sources": [ "https://www.datadoghq.com/product/ai/bits-security-analyst/", "https://www.datadoghq.com/about/latest-news/press-releases/bits-ai-security-analyst-reduces-threat-investigation-time/", "https://www.datadoghq.com/pricing/", "https://www.datadoghq.com/about/contact/" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Datadog for Government", "id": "FR2023864279A", "impact": "High", "date": "2026-05-05", "scope": "platform-only", "source_url": "https://www.fedramp.gov/marketplace/products/FR2023864279A/", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "Datadog for Government", "id": "TX985429", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" }, { "program": "govramp", "status": "Authorized", "product": "Datadog for Government", "impact": "High", "scope": "platform-only", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" } ] }, { "slug": "opal-paladin", "name": "Opal Paladin", "vendor": "Opal Security", "hq_country": "United States", "hq_region": "north-america", "url": "https://docs.opal.dev/docs/paladin/access-request", "category": "security", "categories": [ "security" ], "summary": "AI identity agent in Opal that reviews access requests, investigates context and approves, denies or escalates with recorded reasoning.", "description": "Paladin is Opal Security's AI agent for access governance. Opal said Paladin became generally available for cloud customers in August 2026. A Paladin agent can be assigned as a reviewer: for each access request it gathers context from Opal's access graph and connected systems (Notion, Confluence and Slack are used as guidance only), weighs the requester, the asset, the stated need and alternatives, and then approves, denies or escalates, recording its reasoning. Its actions are limited by the agent's assigned role. It is opt-in, has a monitor mode, and also supports access reviews.", "pricing": "Not published for Paladin.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "identity-governance", "access-reviews" ], "india_relevance": "", "featured": false, "source_url": "https://docs.opal.dev/docs/paladin/access-request", "sources": [ "https://docs.opal.dev/docs/paladin/access-request", "https://opal.dev/blog/new-in-opal-august-roundup", "https://www.opal.dev/legal/terms-of-service", "https://www.opal.dev/legal/privacy-policy", "https://www.opal.dev/careers" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "synack-sara-ai-pentesting", "name": "Synack Sara AI Pentesting", "vendor": "Synack", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.synack.com/platform/ai-pentesting/", "category": "security", "categories": [ "security" ], "summary": "Synack's Autonomous Red Agent (Sara) for agentic pentesting, with exploitable findings validated by the Synack Red Team.", "description": "Sara (Synack Autonomous Red Agent) runs AI-driven discovery, prioritisation and analysis across the enterprise attack surface. Synack calls Sara its fully autonomous AI pentester. Exploitable findings are validated by the Synack Red Team, a community of more than 1,500 vetted researchers. Synack sells it as a 'Sara Pentest' package and offers a trial. Synack's On-Demand Security Testing Platform is FedRAMP Authorized (Moderate, FR2134635186, 2023-12-19) and Synack is TX-RAMP Level 2 certified (TX1009325). Synack's pages do not say whether Sara runs inside that boundary, so neither is set as a verified framework for this agent.", "pricing": "Published: Synack's pricing page lists pricing starting at $4,181 for one AI Sara Pentest (standard pricing; check the vendor page for current amounts).", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [ "FedRAMP", "TX-RAMP" ], "tasks": [ "pen-test-management", "attack-surface", "vulnerability-management", "exposure-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.synack.com/platform/ai-pentesting/", "sources": [ "https://www.synack.com/platform/ai-pentesting/", "https://www.synack.com/pricing/", "https://www.synack.com/sara-pentest-trial", "https://www.synack.com/contact/", "https://www.synack.com/privacy-policy/" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "On-Demand Security Testing Platform", "id": "FR2134635186", "impact": "Moderate", "date": "2023-12-19", "scope": "platform-only", "source_url": "https://www.fedramp.gov/marketplace/products/FR2134635186/", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "On-Demand Security Testing Platform", "id": "TX1009325", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" } ] }, { "slug": "aikido-attack-ai-pentest", "name": "Aikido Attack AI Pentesting", "vendor": "Aikido Security", "hq_country": "Belgium", "hq_region": "europe", "url": "https://www.aikido.dev/attack/aipentest", "category": "security", "categories": [ "security", "code-security" ], "summary": "Belgian autonomous AI pentest: many agents map the app, test attack paths and re-exploit each finding to confirm it, with a same-day audit-grade report.", "description": "Aikido Attack's AI pentesting runs hundreds of autonomous agents that map the attack surface, either white-box (using code or an OpenAPI spec) or black-box, and test attack paths. Separate agents then re-exploit each finding to confirm it before it is reported. Aikido says the output is a same-day, audit-grade PDF report usable for SOC 2 and ISO 27001 evidence. This is a different product from Aikido AI AutoFix, which is already listed.", "pricing": "Published: aikido.dev/pricing lists a free Developer tier and paid tiers that include monthly credits (for example 100 or 200 per month) usable for AI pentesting, plus a separate Pentest pricing tab. Check the vendor page for current amounts.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pen-test-management", "appsec", "attack-surface", "vulnerability-management" ], "india_relevance": "Pentest reports can support CERT-In-oriented security assessments. Aikido does not market a CERT-In module, and these reports do not replace a CERT-In-empanelled auditor's audit.", "featured": false, "source_url": "https://www.aikido.dev/attack/aipentest", "sources": [ "https://www.aikido.dev/attack/aipentest", "https://www.aikido.dev/pricing", "https://www.aikido.dev/company/about", "https://www.aikido.dev/company/europe-office" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "avokaado-avo-ai-agents", "name": "Avokaado Avo AI (governed contract agents)", "vendor": "Avokaado (Avokaado.com O\u00dc)", "hq_country": "Estonia", "hq_region": "europe", "url": "https://avokaado.io/features/avo-ai", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Contract lifecycle platform whose Avo AI turns each contract type into a governed agent (NDA, Vendor, Procurement and KYC Agents) that drafts, negotiates, approves and analyses within your playbooks, with every action scored and logged.", "description": "Avokaado's Avo AI page says customers can turn existing contracts into governed AI agents in about 24 hours. Each contract type (NDA, MSA, DPA and so on) becomes an agent built from five layers (Deal Context, Document Map, Data Model, Decision Rules and Dialogue Strategy), and agents run across drafting, negotiation, approval and analysis while acting 'strictly within defined playbooks'. Every action is tracked and explained through a Scorecard. Example agents on the page include an NDA Agent, KYC Agent, Vendor Agent and Procurement Agent; the wider platform also covers e-signing, a parties registry, a compliance center and board governance. The terms of service name Avokaado.com O\u00dc at Tatari 25, Tallinn (Estonian commercial register code 14015962), governed by Estonian law. The pricing page offers custom pricing only ('No fixed plans').", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation", "kyc" ], "india_relevance": "", "featured": false, "source_url": "https://avokaado.io/features/avo-ai", "sources": [ "https://avokaado.io/features/avo-ai", "https://avokaado.io/", "https://avokaado.io/terms-of-service", "https://avokaado.io/pricing" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "legartis-legal-agent", "name": "Legartis Legal Agent (agentic Legal AI Workspace)", "vendor": "Legartis (Legartis Technology AG)", "hq_country": "Switzerland", "hq_region": "europe", "url": "https://www.legartis.ai/legal-agent", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Swiss legal AI workspace whose Legal Agent triages incoming contracts, reviews them against company playbooks, routes deviations above set limits to the business, Legal or Finance, and takes contracts from template draft through approvals and negotiation to signature.", "description": "Legartis describes its product as an agentic Legal AI Workspace built in Switzerland. Its Legal Agent page says the agent 'researches, drafts, reviews, analyses and reports' to company standards: when a contract arrives it works out the department, document type and playbook, reviews and prepares it for the decision-maker, assesses deviations and sends those that exceed defined limits to the business unit, Legal or Finance. It can also draft from a template, collect the approvals it needs, see negotiation rounds through and take the contract to signature, with people stepping in where a decision is needed. A Contract Playbook Creator builds playbooks per contract type. The legal notice names Legartis Technology AG, Hohlstrasse 216, 8004 Zurich, Switzerland. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.legartis.ai/legal-agent", "sources": [ "https://www.legartis.ai/legal-agent", "https://www.legartis.ai/", "https://www.legartis.ai/legal-notice" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "ironclad-agent", "name": "Ironclad Agent and specialized contracting agents", "vendor": "Ironclad", "hq_country": "United States", "hq_region": "north-america", "url": "https://ironcladapp.com/product/ironclad-ai", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "CLM platform with Ironclad Agent, a conversational front door that routes requests to specialized agents (Intake, Contract Review, Playbook, Renewal, Search, Analytics, Workflow Designer and others) working inside live contracting workflows with human-in-the-loop review.", "description": "Ironclad's AI page calls its approach 'agentic contracting': AI that works inside live contracting workflows (intake, approval, signature, renewal) and takes the next step, with humans keeping the final call. Ironclad Agent is a single conversational interface that finds contracts and workflows and invokes specialized agents. Ironclad's launch article lists Ironclad Agent, Search Agent, Analytics Agent, Workflow Designer Agent and Contract Family Agent, plus Intake Agent (routes a new agreement into the right workflow), Contract Review Agent (playbook- and precedent-based redlining), Archive Agent, Renewal Agent and Playbook Agent (generates a first-pass playbook from historical precedents). Ironclad also offers MCP connectors. Ironclad CLM is listed as FedRAMP Ready (Moderate, FR2614247985) on the FedRAMP Marketplace, which is not an authorization, so FedRAMP Ready is recorded as vendor-claimed only and is not a verified framework tag. The privacy policy names Ironclad, Inc., 650 California Street, San Francisco. Pricing is not published. Ironclad's 8 Oct 2026 release introduced Ironclad Agent as the conversational front door to its AI platform. It runs on a new Contract Knowledge Graph that connects clauses, obligations, past negotiation decisions and approved positions across a customer's contracts and workflows. Ironclad Agent calls the Contract Review Agent to redline against those positions. The release also announced Policy-Based Access Control (PBAC) for AI access and a conversational Workflow Designer Agent that edits workflows in bulk. Customer time savings quoted in the release are vendor claims.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "FedRAMP Ready" ], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://ironcladapp.com/product/ironclad-ai", "sources": [ "https://ironcladapp.com/product/ironclad-ai", "https://ironcladapp.com/resources/articles/meet-ironclad-agent", "https://ironcladapp.com/about-us", "https://legal.ironcladapp.com/privacy-policy", "https://www.fedramp.gov/marketplace/products/FR2614247985/", "https://ironcladapp.com/news/press-releases/ironclad-launches-new-ai-agents-grounded-in-commercial-context" ], "last_checked": "2026-10-20", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Ready", "product": "Ironclad CLM", "id": "FR2614247985", "impact": "Moderate", "date": "2026-02-25", "scope": "platform-only", "source_url": "https://www.fedramp.gov/marketplace/products/FR2614247985/", "checked": "2026-10-18" } ] }, { "slug": "litera-lito", "name": "Lito (Litera's legal AI agent)", "vendor": "Litera", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.lito.app/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Litera's legal AI agent for law firms: it reviews and redlines contracts against the firm's playbook, applies changes across closing sets and chains Litera's deterministic engines (comparison and others) as skills at workflow milestones.", "description": "Litera describes Lito as an 'always-on agent' and agentic layer that calls the right capability at the right moment. It routes each task either to Litera's deterministic legal engines (exposed as composable skills and 'chained automatically at workflow milestones') or to generative skills built by Litera's in-house lawyers, and it is grounded in the firm's own precedents, matter data and client relationships. Examples on the product page: flagging risk clauses and redlining against the firm playbook, grid review, version comparison, triaging a redline and pushing a change across a closing set, plus firm AI search, an inbox and pitch drafting from the firm's records. MCP connectors are governed centrally, and generative AI can be switched off while the rules-based engines keep working. Litera's site lists 227 W Monroe St, Chicago, IL as its address, with a London office. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.lito.app/", "sources": [ "https://www.lito.app/", "https://www.litera.com/", "https://www.litera.com/contact-us", "https://www.litera.com/privacy-notice" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "lexisnexis-protege", "name": "Lexis+ with Prot\u00e9g\u00e9 (agentic legal AI)", "vendor": "LexisNexis Legal & Professional", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.lexisnexis.com/en-us/products/lexis-plus-protege.page", "category": "business-ops", "categories": [ "business-ops" ], "summary": "LexisNexis's legal AI platform: Prot\u00e9g\u00e9 Work presents a plan and then executes skills and workflows (contract comparison, playbook-based review, due diligence, compliance review), and purpose-built drafting agents produce review-ready contracts, motions and briefs grounded in LexisNexis content.", "description": "LexisNexis says Lexis+ with Prot\u00e9g\u00e9 (generally available from February 2026, replacing Lexis+ AI) combines generative and agentic AI. In its May 2026 release, Prot\u00e9g\u00e9 Work routes a natural-language legal goal to the right skill or workflow, 'presents a structured plan for the work' and executes the tasks to produce review-ready work product; skills include contract comparison, complaint analysis, due diligence, compliance review and playbook-based review. Prot\u00e9g\u00e9 Agentic Drafting uses purpose-built drafting agents for contracts, motions, briefs and deal documents. An August 2026 update joined models, agents, skills and sources into one experience that carries context from research through drafting and review. The product page describes Prot\u00e9g\u00e9 as 'the AI assistant layer' across LexisNexis solutions, so buyers should check which agentic features are live in their market (LexisNexis said the platform rolls out globally through 2026). LexisNexis Legal & Professional is part of RELX; its US privacy notice names 'LexisNexis, a division of RELX Inc.', and its releases are datelined New York. Lexis+ for Government (FR2510634052) is FedRAMP Authorized (Moderate), but its Marketplace description covers legal research and does not mention Prot\u00e9g\u00e9, so FedRAMP is recorded as vendor-claimed only and is not a verified framework tag. Pricing is by quote.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "FedRAMP" ], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.lexisnexis.com/en-us/products/lexis-plus-protege.page", "sources": [ "https://www.lexisnexis.com/en-us/products/lexis-plus-protege.page", "https://www.lexisnexis.com/en-us/products/protege.page", "https://www.lexisnexis.com/community/pressroom/b/news/posts/lexisnexis-launches-next-evolution-of-lexis-with-protege-the-legal-ai-platform-built-on-the-authority-legal-work-demands", "https://www.lexisnexis.com/community/pressroom/b/news/posts/lexis-with-protege-accelerates-frictionless-agentic-productivity-from-first-idea-to-review-ready-legal-work-product", "https://www.lexisnexis.com/community/pressroom/b/news/posts/general-availability-of-lexis-with-protege-sets-new-standard-for-automating-legal-work-with-easy-to-use-authoritative-ai-workflows", "https://www.lexisnexis.com/en-us/about-us/about-us.page", "https://www.lexisnexis.com/global/privacy/en/privacy-policy.page", "https://www.fedramp.gov/marketplace/products/FR2510634052/" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Lexis+ for Government", "id": "FR2510634052", "impact": "Moderate", "date": "2026-07-06", "scope": "platform-only", "source_url": "https://www.fedramp.gov/marketplace/products/FR2510634052/", "checked": "2026-10-18" } ] }, { "slug": "light-agentic-erp-agents", "name": "Light agents (Internal Audit, Bill, Contract and Accrual Agents)", "vendor": "Light (Light Company ApS)", "hq_country": "Denmark", "hq_region": "europe", "url": "https://light.inc/workforce", "category": "business-ops", "categories": [ "business-ops", "compliance" ], "summary": "Agentic ERP for multi-entity finance teams: executive agents (Bill, Contract, Accrual) do accounting work, audit agents check their output and instructions against written accounting and approval policies, and materiality-based approval controls decide what needs a controller or CFO.", "description": "Light, a Copenhagen-based ERP for multi-entity companies, says 'agents do the work, your team approves'. Its agents page describes executive agents such as the Bill Agent (reads a forwarded supplier invoice and codes the draft bill using your instructions and that vendor's history), Contract Agent and Accrual Agent, and audit agents (an Internal Audit Agent prepares a monthly control report) that verify every output against your policies and check the instructions executive agents run on, not only their results. Accounting and approval policies define what 'right' looks like, and materiality-based approval controls set what can run automatically versus what needs controller or CFO approval. Custom agents can also be built. The privacy policy and terms name Light Company ApS, Skelb\u00e6kgade 2, 1717 Copenhagen, Denmark (business reg. no. 43523503). Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "audit-management", "control-monitoring", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://light.inc/workforce", "sources": [ "https://light.inc/workforce", "https://light.inc/", "https://light.inc/privacy", "https://light.inc/terms" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "medius-autonomous-ap", "name": "Medius autonomous AP (agentic AI and Supplier Conversations)", "vendor": "Medius (Medius Sverige AB)", "hq_country": "Sweden", "hq_region": "europe", "url": "https://www.medius.com/ai-innovation/autonomous-accounts-payable/", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Accounts payable platform that uses agentic AI to capture and code invoices, decide matches, routing and approvals, approve payments for trusted vendors, check for fraud (including AI-generated receipts) and answer supplier invoice and payment emails automatically.", "description": "Medius says its autonomous AP 'understands, decides, and acts': agentic AI and machine learning capture and classify invoices across formats, code PO and non-PO invoices, make decisions on matches, routing and approvals, surface only the exceptions that need human judgment and recommend what to pay and when with the reason and source. Listed capabilities include anomaly and fraud detection (including AI-generated receipts), payment approvals for trusted vendors and expense reviews with fraud and policy checks; every action is logged for auditability. Supplier Conversations combines generative AI with 'governed, agentic workflows' to read supplier emails, pull the right data and reply automatically to invoice and payment inquiries. Medius Copilot is a separate assistant. Medius says it is headquartered in Link\u00f6ping, Sweden; its privacy notice names Medius Sverige AB (registration 556820-2765), Platensgatan 8, Link\u00f6ping. Pricing is by quote; the pricing page shows two AP packages without prices.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "fraud-detection", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.medius.com/ai-innovation/autonomous-accounts-payable/", "sources": [ "https://www.medius.com/ai-innovation/autonomous-accounts-payable/", "https://www.medius.com/", "https://www.medius.com/contact-us/office-locations/", "https://www.medius.com/legal/privacy/", "https://www.medius.com/pricing/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "numeric-agentic-subledgers", "name": "Numeric agentic subledgers (close and accounting agents)", "vendor": "Numeric (Velocity Labs Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.numeric.io/product/agentic-subledgers", "category": "business-ops", "categories": [ "business-ops", "compliance" ], "summary": "Close-management and accounting platform whose agents turn source records (leases, commission plans, card spend, payables) into subledgers, propose the accounting treatment for approval, build schedules and derive journal entries automatically.", "description": "Numeric's Agentic Subledgers page says that when a financial record arrives, agents 'determine the right accounting treatment, build a schedule, update balances, and link the support to it'. For records in a PDF or spreadsheet, such as a lease or a sales commission plan, an agent identifies the document, builds a schedule if there isn't one and proposes the accounting treatment for your approval. Journal entries then derive automatically for fixed assets, leases, prepaids, accruals, deferred commissions, card spend, payables and equity payouts, and Numeric says this removes most manual reconciliations. The pricing page describes in-app AI (Prism) that surfaces daily agent items needing review, alongside close management, reconciliation, flux analysis and an ERP-replacement option. Its privacy policy names Velocity Labs Inc. DBA Numeric and is written for US visitors, and the About page lists offices in San Francisco, New York and London. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "audit-management", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.numeric.io/product/agentic-subledgers", "sources": [ "https://www.numeric.io/product/agentic-subledgers", "https://www.numeric.io/pricing", "https://www.numeric.io/about", "https://www.numeric.io/legal/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "sap-joule-agents", "name": "SAP Joule Agents and Joule Studio", "vendor": "SAP (SAP SE)", "hq_country": "Germany", "hq_region": "europe", "url": "https://www.sap.com/products/artificial-intelligence/ai-agents.html", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Prebuilt SAP AI agents that execute multistep finance, HR, procurement and service tasks across SAP and non-SAP systems, coordinated by role-based Joule Assistants, with custom agents built in Joule Studio and governed in SAP AI Agent Hub.", "description": "SAP says Joule Agents are AI agents with business-process expertise that 'reliably execute multistep tasks across SAP and non-SAP systems'; they choose from tools (Joule skills, other agents and third-party apps), act on their plans and reflect on results, grounded in SAP Knowledge Graph and SAP Business Data Cloud. Joule Assistants coordinate agents by role. Joule Studio builds custom agents in low-code or pro-code (including LangChain and LlamaIndex), and SAP AI Agent Hub inventories and governs SAP, custom and third-party agents. SAP states that agents only execute within the user's permissions (each agent has its own identity and traffic goes through one agent gateway), run in a hardened sandbox, log all activity and need explicit approval for high-risk processes. Examples on the page include a Sourcing Agent in SAP Ariba and a classification agent routing service cases. SAP's German imprint gives SAP SE's registered office as Walldorf, Germany. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "agentic-ops", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.sap.com/products/artificial-intelligence/ai-agents.html", "sources": [ "https://www.sap.com/products/artificial-intelligence/ai-agents.html", "https://www.sap.com/germany/about/legal/impressum.html" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "n8n-ai-agents", "name": "n8n AI agents (agentic workflow automation)", "vendor": "n8n (n8n GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://n8n.io/ai-agents/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Workflow automation platform where agents are first-class: you describe an agent, n8n drafts its instructions and tools, and agents with triggers and memory call 500+ integrations and existing workflows, alone or as coordinated multi-agent systems. It can be self-hosted.", "description": "n8n's AI agents page says 'agents are now first-class in n8n': describe the agent you want and n8n drafts its instructions, tools and setup, which you then test, refine and publish. Agents get triggers and memory, can be reached through chat, Slack, Telegram, Linear, a schedule or any workflow, and use existing workflows and 500+ integrations as tools. n8n also supports multi-agent systems in which specialised agents (for example research, writing and QA) coordinate on a workflow. Agents are built by the customer; n8n does not ship prebuilt compliance agents. The imprint names n8n GmbH, Novalisstr. 10, 10115 Berlin, Germany (HRB 212509 B). The pricing page lists cloud plans billed annually: Starter \u20ac20/month, Pro \u20ac50/month, Business \u20ac667/month and custom Enterprise, priced on workflow executions.", "pricing": "Published on n8n.io/pricing (billed annually): Starter \u20ac20/month, Pro \u20ac50/month, Business \u20ac667/month; Enterprise custom. Plans are priced by monthly workflow executions.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "agentic-ops", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://n8n.io/ai-agents/", "sources": [ "https://n8n.io/ai-agents/", "https://n8n.io/imprint/", "https://n8n.io/pricing/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "automation-anywhere-ai-agent-studio", "name": "Automation Anywhere AI Agent Studio (agentic process automation)", "vendor": "Automation Anywhere", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.automationanywhere.com/products/ai-agent-studio", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Agentic process automation platform for building goal-driven AI agents that use the Process Reasoning Engine to reason, bring in a human where needed and orchestrate bots, APIs, documents and other agents, with built-in governance and guardrails.", "description": "Automation Anywhere's AI Agent Studio page describes 'goal-driven AI agents' powered by its Process Reasoning Engine (PRE) that handle reasoning and human-in-the-loop steps and orchestrate across bots, APIs, documents and other agents in real time. Each agent is given a role, goal and tool access, uses a model from your approved list grounded in company data, and is orchestrated into end-to-end workflows with drag-and-drop tools. Built-in governance and guardrails let teams monitor every agent action. The page cites The Washington Post using an AI agent to read, extract and analyse tax billed on payable invoices and to validate and issue tax corrections. Automation Anywhere's pages list its USA headquarters in San Jose, CA, and the privacy policy is issued by Automation Anywhere, Inc. Pricing is not published. On 7 Oct 2026 Automation Anywhere signed a definitive agreement to acquire Boost.ai, an enterprise conversational and voice AI company, from Nordic Capital. Closing is expected in Q4 2026, subject to regulatory approvals and closing conditions. It follows Automation Anywhere's acquisition of Aisera in late 2025.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "agentic-ops", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.automationanywhere.com/products/ai-agent-studio", "sources": [ "https://www.automationanywhere.com/products/ai-agent-studio", "https://www.automationanywhere.com/company/about-us", "https://www.automationanywhere.com/legal/privacy", "https://www.automationanywhere.com/company/press-room/conversational-ai-finally-connected-work-automation-anywhere-acquire-boostai" ], "last_checked": "2026-10-20", "added": "2026-10-18" }, { "slug": "cav-compliance-os-agents", "name": "Cav Compliance OS agents (formerly Caveonix)", "vendor": "Cav (Caveonix Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://cavhq.ai/", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Agentic cyber assurance and continuous compliance platform whose AI agents collect evidence, test controls, find gaps against 50+ frameworks (FISMA, NIST 800-53, FedRAMP, CMMC) and generate ATO artifacts; the platform is FedRAMP High authorized.", "description": "Cav (Caveonix Inc., DBA Cav) describes Compliance OS as an 'open-architecture agentic AI platform' that automates, validates and monitors cyber controls. Its AI agents 'continuously collect evidence, identify gaps against any framework, and assist with remediation', plug into corporate data and tools through MCP to automate collection, mapping, documentation and monitoring, and support continuous ATO with automated control mapping, real-time evidence ingestion and AI-generated artifacts. Cav says its agents are supervised by the customer's team members and mix deterministic and non-deterministic methods. The public-sector page says 'Cav is authorized to protect government workloads at the FedRAMP High level' and links to the Marketplace listing. Registry: Caveonix (FR2530025267) is FedRAMP Authorized at High (2026-04-06) in the official Marketplace dataset; it is not on the GovRAMP or TX-RAMP lists. CMMC and NIST frameworks are vendor-supported, not certified. Cav's privacy policy and About page give Cav Inc., 1775 Tysons Blvd., 5th Floor, Tysons, Virginia. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "fedramp" ], "frameworks_claimed": [ "FedRAMP", "CMMC", "NIST SP 800-53", "FISMA" ], "tasks": [ "evidence-collection", "control-monitoring", "gap-analysis", "remediation", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://cavhq.ai/", "sources": [ "https://cavhq.ai/", "https://cavhq.ai/solutions-by-industry/public-sector", "https://cavhq.ai/about-us", "https://cavhq.ai/privacy-policy", "https://www.fedramp.gov/marketplace/products/FR2530025267/", "https://govramp.org/program-participants", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Caveonix", "id": "FR2530025267", "impact": "High", "date": "2026-04-06", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR2530025267/", "checked": "2026-10-18" } ] }, { "slug": "knowbe4-aida-ai-defense-agents", "name": "KnowBe4 AIDA (AI Defense Agents)", "vendor": "KnowBe4", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.knowbe4.com/products/aida", "category": "security", "categories": [ "security", "compliance" ], "summary": "Suite of AI agents for human risk management that automatically generate and deliver personalised phishing simulations, training, remedial and policy-quiz content per user; the FedRAMP Moderate KnowBe4 Platform covers AIDA (except AIDA Deepfakes).", "description": "KnowBe4 says AIDA is 'a suite of AI Agents that continuously automates administration and content personalization' for security awareness programmes. The agents work individually and together under a goal-driven model that continuously assesses risk and automatically delivers personalised phishing tests and training to each user. Named agents include an Orchestration Agent (fully automated phishing simulation, with sub-agents that create and deliver personalised simulations and assign tailored training), Phishing, Recommended Landing Pages, Template Generation, Callback Template Generation, Content Creation, Ongoing Training, Remedial Training, Knowledge Refresher, Policy Quiz, Custom SAPA and Deepfake Training Content agents. AIDA is included with KnowBe4 SAT Advanced. Registry: the KnowBe4 Platform (FR2201340492) is FedRAMP Authorized at Moderate (2023-11-14), and its Marketplace description lists AI Defense Agents (AIDA) in scope, excluding AIDA Deepfakes. The KnowBe4 Platform is also TX-RAMP Level 2 (TX1009295); it is not on the GovRAMP list. KnowBe4, Inc.'s first-listed location is 33 N Garden Ave, Clearwater, Florida. List pricing is published per seat.", "pricing": "Published MSRP on knowbe4.com (May 2026 list, per seat per month, 3-year term): SAT Advanced, which includes AIDA, from $3.75 (25\u201350 seats) down to $2.79 (501\u20131,000 seats); 1,001+ seats by quote.", "pricing_model": "published-tiers", "frameworks": [ "fedramp", "tx-ramp" ], "frameworks_claimed": [ "FedRAMP", "TX-RAMP" ], "tasks": [ "email-security", "policy-management", "workflow-automation", "risk-assessment", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://www.knowbe4.com/products/aida", "sources": [ "https://www.knowbe4.com/products/aida", "https://www.knowbe4.com/products/security-awareness-training/pricing", "https://www.knowbe4.com/contact-us", "https://www.knowbe4.com/legal/website-privacy-notice", "https://www.fedramp.gov/marketplace/products/FR2201340492/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://govramp.org/program-participants" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "KnowBe4 Platform", "id": "FR2201340492", "impact": "Moderate", "date": "2023-11-14", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR2201340492/", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "KnowBe4 Platform", "id": "TX1009295", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" } ] }, { "slug": "ibm-watsonx-orchestrate-government", "name": "IBM watsonx Orchestrate (incl. watsonx Orchestrate for Government)", "vendor": "IBM", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.ibm.com/products/watsonx-orchestrate", "category": "business-ops", "categories": [ "business-ops", "compliance" ], "summary": "IBM's agent platform to build, deploy, orchestrate and govern AI agents (IBM, custom and partner agents for HR, procurement and other domains); watsonx Orchestrate for Government is in scope of IBM Data Services for Government, FedRAMP Moderate.", "description": "IBM describes watsonx Orchestrate as an agent management platform to 'build, deploy, orchestrate, manage and govern AI agents' wherever they are built or run, with one view of agents, owners, dependencies, activity and cost, and consistent access, policy and guardrails across agents, tools and workflows. Prebuilt domain agents cover areas such as HR and employee service (policy questions, onboarding, access requests) and procurement (reconciliation, supplier checks, approvals and exception handling), and external agents connect through APIs, A2A and MCP. Registry: IBM Data Services for Government (FR2524349489) is FedRAMP Authorized at Moderate (2026-02-10), and its Marketplace description includes 'IBM watsonx Orchestrate for Government', which 'enables AI agents to plan, coordinate and take action together'. The same offering is TX-RAMP Level 2 (TX1890127); it is not on the GovRAMP list. IBM's corporate address is 1 New Orchard Road, Armonk, New York. Commercial SaaS pricing is published; government pricing is not.", "pricing": "Published on ibm.com (commercial SaaS): 30-day free trial; Essentials from $530/month; Standard from $6,360/month. Government offering pricing not published.", "pricing_model": "published-tiers", "frameworks": [ "fedramp", "tx-ramp" ], "frameworks_claimed": [ "FedRAMP", "TX-RAMP" ], "tasks": [ "process-automation", "agentic-ops", "workflow-automation", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://www.ibm.com/products/watsonx-orchestrate", "sources": [ "https://www.ibm.com/products/watsonx-orchestrate", "https://www.ibm.com/products/watsonx-orchestrate/pricing", "https://www.ibm.com/contact/global", "https://www.fedramp.gov/marketplace/products/FR2524349489/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://govramp.org/program-participants", "https://newsroom.ibm.com/2026-04-01-IBM-Expands-FedRAMP-Portfolio-with-Authorization-of-11-Software-Solutions,-Including-watsonx" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "IBM Data Services for Government (watsonx Orchestrate for Government)", "id": "FR2524349489", "impact": "Moderate", "date": "2026-02-10", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR2524349489/", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "IBM Data Services for Government", "id": "TX1890127", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" } ] }, { "slug": "halo-ai-agents", "name": "Halo AI Agents (service management with FedRAMP GRC module)", "vendor": "Halo (Halo Service Solutions Limited)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.usehalo.com/halo-ai", "category": "business-ops", "categories": [ "business-ops", "compliance" ], "summary": "ITSM/ESM platform (formerly HaloITSM) with AI agents: conversational agents for end users and fulfillers, and process agents (Dispatch, 1st Line Support, Major Incident, Knowledge, Change Management) that act on their own within role-based permissions. The platform, including a FedRAMP/CMMC GRC module, is FedRAMP 20x Moderate.", "description": "Halo says its AI Agents 'execute governed actions across service workflows, operating within permission boundaries you define' and are included across all plans. Conversational agents (End-User Virtual Agent, Fulfiller Operations Agent) triage and log requests across web chat, Teams, Slack and the portal and escalate with context. Process agents (Dispatch, 1st Line Support, Major Incident, Knowledge and Change Management Agents) run on events or schedules: they auto-resolve known issues, flag service degradation and coordinate multi-step changes from request to release, each under the platform's role-based access controls. Registry: Halo (FR2621445678) is FedRAMP Authorized at 20x Moderate (2026-05-06). Its Marketplace description covers the multi-tenant platform, including a GRC module for FedRAMP, CMMC and DoD programmes (POA&M tracking, OSCAL documentation, control mapping, continuous monitoring). Halo's own announcement says the certification covers its multi-tenant cloud platform but doesn't say whether the AI agents are inside the boundary, so FedRAMP is listed as platform-level only. Halo's contact page lists its UK headquarters in Stowmarket, and the privacy policy names Halo Service Solutions Limited, with a Scottish contact address, as controller. Seat pricing is published.", "pricing": "Published on usehalo.com/pricing (UK view): \u00a366 per agent (service-desk seat) per month; AI Agents are included across all plans.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [ "FedRAMP", "CMMC" ], "tasks": [ "it-service", "incident-response", "workflow-automation", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://www.usehalo.com/halo-ai", "sources": [ "https://www.usehalo.com/halo-ai", "https://www.usehalo.com/news/halo-achieves-fedramp-certification", "https://www.usehalo.com/contact-us", "https://www.usehalo.com/privacy-policy", "https://www.usehalo.com/pricing", "https://www.fedramp.gov/marketplace/products/FR2621445678/" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Halo", "id": "FR2621445678", "impact": "20x Moderate", "date": "2026-05-06", "scope": "platform-only", "source_url": "https://www.fedramp.gov/marketplace/products/FR2621445678/", "checked": "2026-10-18" } ] }, { "slug": "spektr-case-ai-agents", "name": "spektr AI agents (Case AI, KYB AI and compliance agents)", "vendor": "spektr (spektr ApS)", "hq_country": "Denmark", "hq_region": "europe", "url": "https://www.spektr.com/product/case-operations", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Compliance platform for onboarding, monitoring and case work where AI agents run sanctions, PEP, adverse-media and alert investigations, resolve ownership (UBO) gaps and review documents, returning a cited verdict and recommended action for an analyst to decide.", "description": "spektr is a Copenhagen-based compliance platform for banks, fintechs and marketplaces covering customer onboarding (KYC/KYB), customer monitoring, transaction monitoring and case operations. Its Case AI product puts AI agents on case work: the case-operations page says agents review the evidence, fill in what is missing and return a verdict with confidence, recommended action and citations, using only data vendors the customer has approved (for example ComplyAdvantage, Kyckr and OpenCorporates), while the final decision stays with the team. The AI overview lists pre-built agents (KYB AI for beneficial-ownership resolution, Doc Review AI, Website Checker AI, Network Discovery AI, Address AI, Source of Funds AI, Industry AI and License AI) and lets customers build their own. spektr 3.0 (announced 1 Sep 2026) added Policy Engine (policies turned into approved rules that agents must follow), Transaction Monitoring and Case AI. People, workflows and agents all write to one audit logbook. Handling-time claims are the vendor's. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "kyc", "aml", "case-investigation", "alert-triage", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.spektr.com/product/case-operations", "sources": [ "https://www.spektr.com/product/case-operations", "https://www.spektr.com/ai-overview", "https://www.spektr.com/ai-agent/kyb-ai", "https://www.spektr.com/blog/spektr-3-0-is-live", "https://www.spektr.com/privacy-policy", "https://www.spektr.com/terms-of-service" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "shufti-transaction-trust-monitoring-agents", "name": "Shufti Transaction Trust Monitoring (agentic FRAML engine)", "vendor": "Shufti (Shufti Pro Limited)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://shuftipro.com/press-release/shufti-transaction-trust-monitoring-agentic-framl-engine/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Agentic fraud and AML (FRAML) transaction monitoring in which governed AI agents score transactions, triage and investigate alerts and draft regulator-format SAR/STR reports, with the MLRO approving every filing.", "description": "Shufti is an identity-verification and compliance-lifecycle vendor. Transaction Trust Monitoring (TTM), launched 8 Sep 2026, is described on Shufti's own site as an agentic FRAML engine that carries a case from the first suspicious transaction through investigation to a regulator-ready report in one workflow. Each transaction is scored against the identity Shufti verified at onboarding; alerts are routed by score to L1 triage, L2 investigation or the MLRO, and every alert carries a case summary, tier, false-positive assessment and recommended next action. Reports are generated in FinCEN BSA XML or goAML format, and an AI triage co-pilot drafts narratives but never files on its own: the MLRO reviews and authorises each report. Shufti says four AI agents are live across the lifecycle, with three more (rule recommendation, data readiness, regulatory change monitoring) in development, plus a plain-language AI rule builder with 90-day backtesting. Speed and data-point figures are vendor claims. Shufti publishes per-verification identity plans, but TTM pricing is not published. On 15 Oct 2026 Shufti launched an AI suite across its identity and compliance products: Journey Builder (no-code verification journeys, with AI drafting journeys from an uploaded AML/KYC policy for MLRO approval), Shufti MCP (a Model Context Protocol server giving AI assistants 20+ tools across 13+ verification types, including KYC, KYB and AML screening) and an AI Compliance Co-Pilot that reviews every AML screening hit before an analyst opens the queue, assigning one of five fixed statuses with written reasoning and a 0\u2013100 confidence score; analysts can override and every change is logged, with the MLRO making the final decision.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "fraud-detection", "alert-triage", "case-investigation", "sar-narratives", "kyc" ], "india_relevance": "", "featured": false, "source_url": "https://shuftipro.com/press-release/shufti-transaction-trust-monitoring-agentic-framl-engine/", "sources": [ "https://shuftipro.com/press-release/shufti-transaction-trust-monitoring-agentic-framl-engine/", "https://shuftipro.com/transaction-monitoring/", "https://shuftipro.com/aml-case-management/", "https://shuftipro.com/about-us/", "https://shuftipro.com/website-business-interactions-privacy-notice/", "https://shuftipro.com/contact-us/", "https://shuftipro.com/pricing/", "https://shuftipro.com/press-release/shufti-launches-ai-suite-for-compliance-teams/", "https://www.globenewswire.com/news-release/2026/10/15/3381981/0/en/shufti-launches-ai-suite-to-help-compliance-teams-build-verification-journeys-run-checks-from-ai-assistants-and-review-aml-hits-faster.html" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "oracle-nexus-financial-crime-agents", "name": "Oracle Nexus for financial crime investigations (Nexus Case Flow and Nexus Reach agents)", "vendor": "Oracle (Oracle Financial Services)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.oracle.com/financial-services/aml-financial-crime-compliance/oracle-nexus/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Oracle's financial-crime case management with agentic AI that pre-investigates AML, fraud, sanctions and KYC cases unprompted, gathers evidence and entity context, runs adverse-media scans and drafts investigation narratives for human review.", "description": "Oracle Nexus is Oracle Financial Services' platform for financial-crime investigations across AML, fraud, sanctions and KYC. Oracle announced Nexus Case Flow and Nexus Reach as available on 29 Sep 2026. Oracle's release says the agents can autonomously pre-investigate cases for red or green flags and typology-aligned risk (for example possible human trafficking) and alert the investigator without being prompted. Nexus Case Flow is cloud case management where agentic AI gathers evidence, assembles entity context, generates recommendations and drafts narratives; Nexus Reach is a browser extension that brings the same AI investigation capabilities (adverse-media scans, autonomous AI Reviews and AI Investigations, narrative drafting) into existing Oracle, non-Oracle or on-premises case systems. Output is designed for human review and investigators keep final decisions. Oracle also lists a separate compliance agent that stress-tests scenarios in simulation. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "fraud-detection", "kyc", "case-investigation", "sar-narratives" ], "india_relevance": "", "featured": false, "source_url": "https://www.oracle.com/news/announcement/oracle-brings-new-agentic-capabilities-to-the-fight-against-financial-crime-2026-09-29/", "sources": [ "https://www.oracle.com/news/announcement/oracle-brings-new-agentic-capabilities-to-the-fight-against-financial-crime-2026-09-29/", "https://www.oracle.com/financial-services/aml-financial-crime-compliance/oracle-nexus/", "https://www.oracle.com/financial-services/aml-financial-crime-compliance/", "https://www.oracle.com/legal/privacy/privacy-policy.html" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "noru-agentic-compliance", "name": "Noru Agentic Compliance (GRC agents)", "vendor": "Noru (The GRC Company AB)", "hq_country": "Sweden", "hq_region": "europe", "url": "https://noru.tech/solutions/agentic-compliance", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "EU-hosted compliance platform where AI agents connected to your systems draft policies, map controls across frameworks, collect evidence daily, flag control drift and draft risk treatments, with every output a draft a human must accept.", "description": "Noru is a Stockholm-built GRC platform aimed at ISO 27001 certification and European frameworks (NIS2, DORA, EU AI Act, ISO 42001, Cyber Resilience Act) alongside SOC 2 and 25+ others. Its Agentic Compliance pages say agents connected to the customer's systems do the work a person would otherwise do by hand: drafting the policies a framework requires, mapping controls across frameworks, gathering evidence from connected systems (for example MFA status pulled daily from Microsoft Entra ID) and linking it to controls, drafting treatments in the risk assessment, flagging a control when it drifts and surfacing the next task. Every output is a reviewable draft; nothing enters the program or reaches the auditor until a human accepts it. Agent tools exposed over MCP are bound to domain-scoped permissions, and each evidence record carries a capture-time digest and provenance. Cortex is the in-app assistant. Customer timelines are vendor claims. Pricing is quoted per package (based on systems connected and work volume), not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "iso27001", "soc2", "dora" ], "frameworks_claimed": [ "ISO 27001", "SOC 2", "NIS2", "DORA", "EU AI Act", "ISO 42001", "GDPR", "EU Cyber Resilience Act" ], "tasks": [ "evidence-collection", "policy-management", "control-mapping", "control-monitoring", "risk-assessment" ], "india_relevance": "", "featured": false, "source_url": "https://noru.tech/solutions/agentic-compliance", "sources": [ "https://noru.tech/solutions/agentic-compliance", "https://noru.tech/pricing", "https://noru.tech/company", "https://noru.tech/terms-and-conditions" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "egerie-jerry-agentic-cyber-grc", "name": "Egerie Jerry (agentic Cyber GRC platform)", "vendor": "Egerie (EGERIE SOFTWARE SAS)", "hq_country": "France", "hq_region": "europe", "url": "https://www.egerie.com/en/plateforme/compliance", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "European Cyber GRC platform whose AI agent, Jerry, turns NIS2, ISO 27001 and DORA requirements into measures and tasks, assigns them to owners, follows up delays, collects and checks evidence freshness and escalates only what is blocked.", "description": "Egerie is a French Cyber GRC vendor (founded 2016) covering cyber risk analysis (EBIOS Risk Manager), financial risk quantification, compliance and third-party management. On 30 Sep 2026 it announced an agentic platform that combines its structured requirements library with specialised AI agents: 'The agents propose. The experts decide. The platform helps execute.' Egerie's compliance and platform pages say Jerry is already available in the Compliance module: it links documents, suggests the measures a target framework (for example DORA) requires, organises them into batches and assigns tasks to owners, follows up delays, collects uploaded evidence, checks its freshness, identifies unverified measures, prepares reports and only escalates what gets blocked; people validate priorities, evidence and risk acceptances. One measure maps across NIS2, ISO 27001, DORA, SecNumCloud and 100+ frameworks. The platform is EU-hosted and uses Mistral AI models. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "iso27001", "dora" ], "frameworks_claimed": [ "ISO 27001", "NIS2", "DORA", "SecNumCloud", "GDPR" ], "tasks": [ "control-mapping", "evidence-collection", "gap-analysis", "risk-assessment", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.egerie.com/en/plateforme/compliance", "sources": [ "https://www.egerie.com/en/plateforme/compliance", "https://www.egerie.com/en/platform", "https://www.egerie.com/en/resources/blog/annonce-nouvelle-plateforme-agentique-ia", "https://www.egerie.com/en/legal-information" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "indisec-dpdpa-agents", "name": "IndiSec DPDPA compliance agents (Veda AI privacy analyst)", "vendor": "IndiSec (Indisec Edge Private Limited)", "hq_country": "India", "hq_region": "india", "url": "https://indisec.com/", "category": "risk", "categories": [ "risk", "compliance", "privacy" ], "summary": "India DPDP Act compliance platform where assessment, obligation, consent, notification and evidence agents (plus the Veda AI privacy analyst) run gap assessments, track obligations, draft notices and assemble evidence, with lawyers and the customer approving every gate.", "description": "IndiSec is an Indian privacy-compliance company focused on the Digital Personal Data Protection Act. Its site says DPDPA compliance is run by AI agents, governed by lawyers and approved by the customer: assessment agents score 12 domains mapped to provisions of the Act; obligation agents turn each gap into a tracked legal obligation with an owner, schedule, reminders and escalation; evidence agents bind consent receipts and chained logs into Board- and Data Protection Board-ready evidence; and consent and notification agents handle the consent lifecycle (22 scheduled languages) and erasure or breach notices on approval. Veda, the AI privacy analyst, briefs itself on the organisation, runs the assessment, drafts notices, watches rulemaking and ranks priorities, pausing at every human gate. Agents run as code inside the customer's VPC, with recorded reasoning and full audit logs. IndiSec also sells a virtual DPO service with certified privacy professionals and counsel. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "dpdp" ], "frameworks_claimed": [ "DPDP Act 2023", "DPDP Rules 2025" ], "tasks": [ "privacy-management", "consent", "dsr-automation", "gap-analysis", "data-discovery" ], "india_relevance": "Indian company (Indisec Edge Private Limited, New Delhi office; privacy policy says Gurgaon, Haryana) built specifically for India's DPDP Act and Rules, with consent in all 22 scheduled languages and a virtual DPO service.", "featured": false, "source_url": "https://indisec.com/", "sources": [ "https://indisec.com/", "https://indisec.com/about", "https://indisec.com/contact", "https://indisec.com/terms-of-use", "https://indisec.com/privacy-policy", "https://indisec.com/virtual-dpo" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "veeam-privacyops-agents", "name": "Veeam PrivacyOps AI agents (Consent Agent, DSR and Assessment agents)", "vendor": "Veeam Software (Securiti AI, a Veeam company)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.veeam.com/company/press-release/veeam-advances-operational-privacy-and-ai-governance-for-the-agentic-era-on-the-dataai-command-platform.html", "category": "risk", "categories": [ "risk", "compliance", "privacy" ], "summary": "Privacy-operations agents on Veeam's DataAI Command Platform: a generally available Consent Agent that builds, tests, monitors and auto-remediates consent across sites and downstream systems, plus announced DSR intake-form and assessment-autofill agents.", "description": "Veeam's DataAI Command Platform (built with Securiti AI, now 'a Veeam company') added three PrivacyOps agents, announced at VeeamON London on 3 Jun 2026. The Consent Agent, generally available at launch, manages the consent lifecycle end to end: banner creation, automated testing, continuous monitoring and auto-remediation, then propagating and enforcing captured preferences (cookie choices, marketing opt-outs, AI-personalisation restrictions) across analytics, AI pipelines, ad tech, SaaS and third parties, with jurisdiction-aware risk scoring and audit evidence. The Data Subject Request Agent generates and maintains DSR intake forms for an organisation's regulatory footprint, and the Assessment Agent drafts DPIA, EU AI Act conformity and vendor-risk questionnaire responses from evidence; Veeam said those two were planned for Q3 2026, and their current availability was not confirmed on the pages checked. The agents work from the platform's data graph and connectors. The 50% DSR-form time saving is a vendor claim. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "GDPR", "CCPA/CPRA", "EU AI Act" ], "tasks": [ "consent", "dsr-automation", "privacy-management", "risk-assessment", "remediation" ], "india_relevance": "", "featured": false, "source_url": "https://www.veeam.com/company/press-release/veeam-advances-operational-privacy-and-ai-governance-for-the-agentic-era-on-the-dataai-command-platform.html", "sources": [ "https://www.veeam.com/company/press-release/veeam-advances-operational-privacy-and-ai-governance-for-the-agentic-era-on-the-dataai-command-platform.html", "https://www.veeam.com/blog/privacy-operations-agents-agentic-ai-scale.html" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "flowforma-assure-vendor-risk-agents", "name": "FlowForma Assure (AI agents for vendor risk assessment)", "vendor": "FlowForma", "hq_country": "Ireland", "hq_region": "europe", "url": "https://www.flowforma.com/flowassure", "category": "risk", "categories": [ "risk", "security" ], "summary": "Evidence-first vendor security assessment where AI agents read SOC 2 reports, ISO certificates, pen tests and questionnaires, validate controls, score risk with cited reasoning, auto-approve low-risk vendors and route high-risk ones to analysts with follow-up questions framed.", "description": "FlowForma Assure (launched as FlowAssure, opened to customers on 30 Jun 2026 after a beta) is the vendor-risk product of FlowForma, the Dublin-based no-code process-automation company. Its product page says specialist AI agents read the vendor evidence in their area (SOC 2 Type II, ISO 27001, NIST, pen-test reports, SIG and custom questionnaires, vulnerability scans), validate controls, classify findings and score risk against the customer's own profile, control library and audit history, with Pass/Partial/Fail findings, confidence indicators and links to the source text. Low-risk vendors can be auto-approved, high-risk ones land with the right analyst with questions already framed, and the middle tier gets a recommended decision. Clarifications to vendors are time-bound and tracked, and it integrates with Jira, ServiceNow and SharePoint (Microsoft Entra ID sign-in). It also assesses AI-governance risks. Time-saving figures are vendor claims from beta customers. A 30-day free trial is offered; Assure is priced separately by quote.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "ISO 27001", "SOC 2", "NIST CSF 2.0", "NIS2", "Cyber Essentials" ], "tasks": [ "vendor-risk", "questionnaire-automation", "risk-assessment", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.flowforma.com/flowassure", "sources": [ "https://www.flowforma.com/flowassure", "https://www.flowforma.com/pricing", "https://www.flowforma.com/contact-us", "https://www.prnewswire.com/news-releases/flowforma-launches-access-to-flowassure-an-evidence-first-ai-platform-for-vendor-risk-assessments-302813705.html" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "viso-trust-ai-agent", "name": "VISO TRUST AI Agent (agentic third-party risk management)", "vendor": "VISO TRUST (a Protecht company; Valente Sherman, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://visotrust.com/platform/agentic-tprm/", "category": "risk", "categories": [ "risk", "security" ], "summary": "TPRM agent that launches due diligence as soon as a vendor is added, requests and renews SOC 2, ISO and pen-test artifacts, sends focused follow-ups, monitors breach advisories and drafts impact reports, escalating only exceptions to the team.", "description": "VISO TRUST (a Protecht company as of April 2026) is a third-party risk management platform. Its Agentic TPRM page describes the VISO TRUST AI Agent, which handles autonomously: evidence collection and renewals (defining required artifacts by vendor tier, sending and tracking requests, managing expirations); focused follow-ups that replace long questionnaires with short asks only where proof is missing, with nudges, SLA tracking and auto-close; assessment orchestration (creating vendor relationships, launching Instant Assessments from public intelligence and submitted artifacts, enriching with BitSight or SecurityScorecard data and routing tasks to Jira or ServiceNow); and advisory response (monitoring breach advisories, news and SEC filings, mapping them to vendors and sub-processors, drafting impact reports and preparing bulk outreach and reassessments). Users can also instruct it in natural language ('Run assessments for these 25 vendors'). Customers set the guardrails and human review handles exceptions. Speed figures are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "vendor-risk", "questionnaire-automation", "risk-assessment", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://visotrust.com/platform/agentic-tprm/", "sources": [ "https://visotrust.com/platform/agentic-tprm/", "https://visotrust.com/", "https://visotrust.com/company/contact/", "https://visotrust.com/privacy-policy/", "https://visotrust.com/resources/protecht-acquires-viso-trust/" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "sphinx-ai-compliance-analysts", "name": "Sphinx AI compliance analysts (KYC, KYB and AML agents)", "vendor": "Sphinx (Sphinx Labs, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://sphinxhq.com/products/ai-agents", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "AI analyst agents for financial-crime compliance that run KYC and KYB onboarding reviews, disposition sanctions, PEP and adverse-media alerts, perform enhanced due diligence and rescreenings, and draft SAR/UAR filings with audit-ready decision logs.", "description": "Sphinx sells AI agents that work like fincrime compliance analysts for banks, fintechs, crypto firms and credit unions. Its AI Analysts page says one KYC agent handles ID-document verification, address confirmation, RFIs and screening alerts, and one KYB agent handles web-presence research, UBO mapping and onboarding logic. Other agents disposition sanctions, PEP and adverse-media alerts with a full audit trail, perform enhanced due diligence (deep research, red-flag detection, source-of-funds checks and RFIs written in the team's tone), generate transaction-monitoring risk scores from sparse data, run KYC/KYB rescreenings on a schedule and surface alerts only when something changes, and draft SARs and UARs with supporting evidence and sourced narratives. Every decision and action is logged for regulators. Sphinx also offers Frontline, an AI-native BPO for fincrime compliance, and document-fraud detection. Resolution and false-positive figures are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "kyc", "aml", "alert-triage", "case-investigation", "sar-narratives" ], "india_relevance": "", "featured": false, "source_url": "https://sphinxhq.com/products/ai-agents", "sources": [ "https://sphinxhq.com/products/ai-agents", "https://sphinxhq.com/legal/privacy-policy", "https://sphinxhq.com/legal/tos", "https://sphinxhq.com/company" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "manageengine-log360-zia-agents", "name": "ManageEngine Log360 Cloud Zia Agents (Investigation, Alert Correlation and User Activity Review agents)", "vendor": "ManageEngine (Zoho Corporation)", "hq_country": "India", "hq_region": "india", "url": "https://www.manageengine.com/log-management/ai-security/ai-agents-for-security-operations.html", "category": "security", "categories": [ "security" ], "summary": "AI agents inside ManageEngine's Log360 Cloud SIEM: an Investigation Agent that runs multi-stage alert investigations and writes an investigation report, prebuilt Alert Correlation and User Activity Review agents, and a no-code Agent Studio for custom SOC agents.", "description": "Log360 Cloud is ManageEngine's cloud SIEM. Its Zia layer includes an Investigation Agent (documented on the Log360 Cloud Zia help page, last updated 30 Apr 2026; Cloud What's new lists an Alert Investigation Agent on 12 May 2026) that runs a structured, multi-stage analysis across related alerts, entities and raw logs. It correlates events, checks entity risk with threat intelligence such as VirusTotal and Log360's Advanced Threat Analytics, reconstructs the attack chain and produces an export-ready report, and analysts can pause, resume or query it. The 20 May 2026 Cloud release added Zia Agent Studio, Ask Zia, MCP and the Zia Agent Store with two prebuilt agents: an Alert Correlation Agent that links alerts into a probable attack chain with MITRE ATT&CK stage labels, and a User Activity Review Agent that compiles a user's logons, file access and alerts for audits, pre-termination reviews and investigations. Zia Agent Studio lets teams build custom agents with their own instructions, knowledge base (SOPs, runbooks), Log360 and ManageEngine/Zoho API tools and guardrails, choosing Zoho or third-party LLMs. Agents can pull context from Endpoint Central, ServiceDesk Plus and Site24x7, and every session is logged with the tools called. Log360 Cloud also connects to external AI clients through the Zoho MCP Server. These features are documented for Log360 Cloud only, not the on-premises edition. ManageEngine is the IT management division of Zoho Corp. (same group as the Zoho Zia Agents platform listing); listed as India per the owner's Zoho/ManageEngine rule. Pricing is not published on the pages checked.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "case-investigation", "threat-detection", "incident-response" ], "india_relevance": "ManageEngine is part of the Chennai-based Zoho group, with a large Chennai campus and offices across India; ManageEngine products are widely used by Indian IT teams.", "featured": false, "source_url": "https://www.manageengine.com/log-management/ai-security/ai-agents-for-security-operations.html", "sources": [ "https://www.manageengine.com/log-management/ai-security/ai-agents-for-security-operations.html", "https://www.manageengine.com/log-management/help/zia/cloud-zia-overview.html", "https://www.manageengine.com/log-management/cloud/features-new.html", "https://www.manageengine.com/ai-agents.html", "https://www.manageengine.com/news/autonomous-ai-capabilities-manageengine-suite.html", "https://www.manageengine.com/about-us.html", "https://www.manageengine.com/contact.html" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "manageengine-endpoint-central-zia-agents", "name": "ManageEngine Endpoint Central Zia Agents (EDR Event Triage, Device Investigation and Patch Troubleshooting agents)", "vendor": "ManageEngine (Zoho Corporation)", "hq_country": "India", "hq_region": "india", "url": "https://www.manageengine.com/products/desktop-central/ai/", "category": "security", "categories": [ "security", "business-ops" ], "summary": "Prebuilt AI agents in ManageEngine Endpoint Central that triage EDR events (MITRE ATT&CK mapping, prioritized next steps), investigate device problems and diagnose failed patches, plus Agent Studio for custom endpoint agents.", "description": "Endpoint Central is ManageEngine's unified endpoint management and security product. ManageEngine's Zia Agents pages list three prebuilt agents for it. The EDR Event Triage Agent enriches each EDR alert with endpoint context, correlates telemetry, maps activity to MITRE ATT&CK and recommends prioritized next steps before an analyst steps in. The Device Investigation Agent correlates telemetry, inventory, logs and configuration to find the root cause of device performance, application and connectivity problems. The Patch Troubleshooting agent diagnoses failed patch deployments and gives fix steps. Endpoint Central also offers a Zia self-service companion for end users that can run fixes from a conversation, and custom agents can be built with Zia Agent Studio and Zoho MCP. The security agents mainly investigate and recommend; remediation runs through Endpoint Central's existing scripts and workflows. ManageEngine is the IT management division of Zoho Corp. (same group as the Zoho Zia Agents platform listing); listed as India per the owner's Zoho/ManageEngine rule. Endpoint Central editions are priced publicly, but the pages checked don't say which editions include the Zia agents; ManageEngine says Zia Agents carry no extra AI licence fee.", "pricing": "Not published for the agents (Endpoint Central editions are published from $795 per year for 50 endpoints; edition that includes Zia agents not stated)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "alert-triage", "threat-detection", "case-investigation", "remediation", "workflow-automation" ], "india_relevance": "ManageEngine is part of the Chennai-based Zoho group, with a large Chennai campus and offices across India; ManageEngine products are widely used by Indian IT teams.", "featured": false, "source_url": "https://www.manageengine.com/products/desktop-central/ai/", "sources": [ "https://www.manageengine.com/products/desktop-central/ai/", "https://www.manageengine.com/ai-agents.html", "https://www.manageengine.com/news/autonomous-ai-capabilities-manageengine-suite.html", "https://www.manageengine.com/products/desktop-central/pricing.html", "https://www.manageengine.com/about-us.html", "https://www.manageengine.com/contact.html" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "manageengine-servicedesk-plus-zia-agents", "name": "ManageEngine ServiceDesk Plus Zia Agents (L1 service desk, Entra ID user manager, PIR and KB agents, Agent Studio)", "vendor": "ManageEngine (Zoho Corporation)", "hq_country": "India", "hq_region": "india", "url": "https://www.manageengine.com/products/service-desk/ai/zia-agents.html", "category": "business-ops", "categories": [ "business-ops" ], "summary": "AI agents in ManageEngine ServiceDesk Plus (Enterprise edition) that pick up and resolve L1 tickets, manage Microsoft Entra ID users, draft post-incident reviews and publish KB articles, with a no-code Agent Studio and a multi-agent orchestrator. ManageEngine is Zoho Corp's IT-management division. ServiceDesk Plus Cloud is TX-RAMP Level 1; that registry row names the cloud help-desk product, not the Zia agents.", "description": "ServiceDesk Plus is ManageEngine's ITSM product. Zia Agents went generally available in ServiceDesk Plus Cloud in April 2026 (US, India, EU and Australia data centres; early access in Canada and China), and the on-premises version ships one-click prebuilt agents. Examples on ManageEngine's pages: an L1 Service Desk Specialist that picks up new tickets, categorizes them, sends a first response and works toward resolution, escalating to a human if needed; an Entra ID User Manager that creates users, manages groups, enables or disables accounts and resets passwords; a SecOps Assistant that checks known vulnerabilities and suspicious URLs during incident response; and PIR, KB-article, resolution and help-desk-coach agents. Agent Studio builds custom agents with chosen LLMs (Zoho-hosted or bring your own key), knowledge sources, ManageEngine/Zoho or custom API tools and guardrails, and a master agent can delegate to subagents (for example an employee-onboarding workflow). Sessions are logged with tool calls, LLM calls and token use, and human checkpoints can be added. Zia Agents are included in the Enterprise edition. ManageEngine is the IT management division of Zoho Corp. (same group as the separate Zoho Zia Agents platform listing); listed as India per the owner's Zoho/ManageEngine rule. Texas DIR lists ServiceDesk Plus Cloud (TX1539241, Level 1, expiry 2027-06-20) as a Zoho SaaS help-desk product; the row does not name Zia Agents, so TX-RAMP is recorded as platform-only.", "pricing": "Zia Agents are included in the Enterprise edition of ServiceDesk Plus Cloud at no added cost or metered pricing (per ManageEngine). ServiceDesk Plus edition pricing is published on manageengine.com (static capture showed on-premises Standard from US$13, Professional from US$27 and Enterprise from US$67 per technician/month); confirm current cloud prices on the pricing page.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [ "TX-RAMP" ], "tasks": [ "it-service", "employee-support", "workflow-automation", "identity-governance", "incident-response", "agentic-ops" ], "india_relevance": "ManageEngine is part of the Chennai-based Zoho group, with a large Chennai campus and offices across India; ManageEngine products are widely used by Indian IT teams.", "featured": false, "source_url": "https://www.manageengine.com/products/service-desk/ai/zia-agents.html", "sources": [ "https://www.manageengine.com/products/service-desk/ai/zia-agents.html", "https://pitstop.manageengine.com/portal/en/community/topic/introducing-zia-ai-agents-in-servicedesk-plus-cloud", "https://www.manageengine.com/products/service-desk/pricing.html", "https://www.manageengine.com/ai-agents.html", "https://www.manageengine.com/about-us.html", "https://www.manageengine.com/contact.html", "https://www.manageengine.com/products/service-desk/ai/plug-and-play-ai-agents.html", "https://www.manageengine.com/news/zoho-corp-ai-platform-supporting-across-broad-portfolio.html", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 1", "product": "ServiceDesk Plus Cloud", "id": "TX1539241", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2027-06-20" } ] }, { "slug": "securonix-sam-ai-soc-analyst", "name": "Securonix Sam, the AI SOC Analyst (Agentic Mesh)", "vendor": "Securonix", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.securonix.com/products/sam-the-ai-soc-analyst/", "category": "security", "categories": [ "security" ], "summary": "An AI SOC analyst built into the Securonix Unified Defense SIEM that triages, correlates and enriches alerts, writes investigation summaries and prepares cases, coordinated by the Agentic Mesh of specialized agents under human approval.", "description": "Sam is Securonix's AI SOC Analyst, embedded in its Unified Defense SIEM. Securonix's product page says Sam takes on Tier 1 and Tier 2 work: filtering, correlating and ranking alerts by validated risk, enriching detections with identity, behaviour analytics and threat intelligence, generating investigation summaries, compiling evidence and timelines for escalation, and producing executive reports. Sam runs on the Securonix Agentic Mesh, announced Feb 18, 2026 with AWS and built on Amazon Bedrock AgentCore, which coordinates specialized agents across detection, investigation, response and reporting with shared context, policy enforcement and audit logs. Analysts can see the reasoning, review activity logs and approve, modify or override actions. Securonix says Sam is licensed by verified analyst-equivalent work (productivity-based pricing) rather than per seat; prices are not published. Sam and the Agentic Mesh were stated as available to Securonix customers worldwide at launch. Productivity figures on the pages are vendor claims. Securonix's careers page says it is headquartered in Addison, Texas.", "pricing": "Not published (productivity-based licensing by analyst-equivalent work)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "case-investigation", "threat-detection", "incident-response" ], "india_relevance": "Securonix lists an Indian subsidiary office (Securonix India Private Limited, Pune) on its contact page.", "featured": false, "source_url": "https://www.securonix.com/products/sam-the-ai-soc-analyst/", "sources": [ "https://www.securonix.com/products/sam-the-ai-soc-analyst/", "https://www.securonix.com/press_release/securonix-introduces-agentic-mesh-and-the-first-productivity-based-ai-model-for-the-soc/", "https://www.securonix.com/products/agentic-ai/", "https://www.securonix.com/contact-us/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "swimlane-ai-soc-deep-agents", "name": "Swimlane AI SOC (Intelligent Deep Agents on Turbine)", "vendor": "Swimlane", "hq_country": "United States", "hq_region": "north-america", "url": "https://swimlane.com/product/ai-soc/", "category": "security", "categories": [ "security" ], "summary": "Swimlane's AI SOC product, built on its Turbine automation platform, uses autonomous 'deep agents' to plan and run alert investigations, with explainable decisions, auditable actions and AI-generated plans that analysts can review and turn into playbooks.", "description": "Swimlane AI SOC launched as generally available in February 2026 on the Swimlane Turbine security automation platform. Swimlane describes it as a move from AI assistants to autonomous deep agents that handle alert investigation work for SOC teams and MSSPs. The product page describes intelligent routing for agentic investigations: the AI builds investigation plans, and validated AI workflows are codified into playbooks so operations become more autonomous over time. Teams can review, modify and rebuild AI-generated plans and playbooks and apply their own organizational context. Every decision is presented as explainable and every action as auditable. Accuracy, capacity and cost-reduction figures on the page are vendor and customer claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "case-investigation", "incident-response", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://swimlane.com/product/ai-soc/", "sources": [ "https://swimlane.com/product/ai-soc/", "https://swimlane.com/news/ai-soc/", "https://swimlane.com/privacy-policy/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "contrast-ai-smartfix", "name": "Contrast AI SmartFix (agentic vulnerability remediation)", "vendor": "Contrast Security", "hq_country": "United States", "hq_region": "north-america", "url": "https://docs.contrastsecurity.com/en/contrast-ai-smartfix.html", "category": "code-security", "categories": [ "code-security" ], "summary": "An AI agent that runs as a GitHub Action, takes vulnerabilities found by Contrast's IAST (Assess) and SAST, writes code fixes using runtime context, runs your build and tests, and opens pull requests for developers to review.", "description": "Contrast AI SmartFix is described in Contrast Security's documentation as an AI-powered agent for vulnerability remediation. It generates code fixes for vulnerabilities found by Contrast IAST (Assess) and Contrast SAST, using runtime analysis for IAST findings and file and line mapping for SAST findings. It runs through GitHub Actions on a schedule or on demand and opens pull requests with the proposed fixes. Teams supply a build command (ideally running tests) so the agent checks its changes build, plus an optional formatting command, and can cap the number of open SmartFix PRs. Teams bring their own LLM (Contrast docs recommend Anthropic Claude via AWS Bedrock or the Anthropic API; Gemini is documented as experimental). Code sent to the chosen LLM is subject to that provider's terms, and Contrast's docs say generated PRs should be reviewed before merging. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "remediation", "pr-review" ], "india_relevance": "", "featured": false, "source_url": "https://docs.contrastsecurity.com/en/contrast-ai-smartfix.html", "sources": [ "https://docs.contrastsecurity.com/en/contrast-ai-smartfix.html", "https://docs.contrastsecurity.com/en/set-up-contrast-ai-smartfix.html", "https://github.com/Contrast-Security-OSS/contrast-ai-smartfix-action", "https://www.contrastsecurity.com/privacy-matters" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "simbian-ai-pentest-agent", "name": "Simbian AI Pentest Agent", "vendor": "Simbian", "hq_country": "United States", "hq_region": "north-america", "url": "https://simbian.ai/ai-pentest-agent", "category": "security", "categories": [ "security" ], "summary": "An autonomous AI agent for on-demand, ongoing penetration testing that adapts its testing logic in real time and focuses findings on each customer's business context, developed with LRQA's pentesting methodology.", "description": "Simbian launched its AI Pentest Agent on Feb 19, 2026. Simbian's release describes it as an autonomous reasoning engine that adjusts its testing logic in real time based on how an application responds, aiming to find business-logic flaws that fixed-rule scanners miss and to confirm exploitability rather than flag theoretical issues. It uses business context so findings reflect each customer's specific risks and priorities, and it was developed with risk-management firm LRQA, drawing on LRQA's CREST-certified pentesting methodology. The product page positions it as ongoing, on-demand testing of web applications wired into the SOC. The Feb 19, 2026 release says the web-application agent is available immediately, with SaaS, Dedicated SaaS and on-premises deployments. Access is request/Get Started, not a documented self-serve free trial. Simbian also sells AI SOC agents; only the pentest agent is listed here. Deployment figures on the pages are vendor claims.", "pricing": "Published on simbian.ai/ai-pentest-agent: Standard $4,000 per pentest; Premium $8,000 per pentest; Custom by quote. Vendor page says up to five retests are included. Deployment modes in the launch release: SaaS, Dedicated SaaS and on-premises.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pen-test-management", "attack-surface", "vulnerability-management", "exposure-management" ], "india_relevance": "", "featured": false, "source_url": "https://simbian.ai/ai-pentest-agent", "sources": [ "https://simbian.ai/ai-pentest-agent", "https://simbian.ai/press-releases/simbian-launches-autonomous-ai-pentest-agent-to-close-window-of-exposure-for-global-enterprise-security" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "zoho-zia-agents", "name": "Zoho Zia Agents (Agent Studio, Agent Store prebuilt agents and Agent Marketplace)", "vendor": "Zoho Corporation", "hq_country": "India", "hq_region": "india", "url": "https://www.zoho.com/zia/agents/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Zoho's agentic AI platform: 100+ prebuilt Zia Agents in the Agent Store for sales, support, HR and operations across Zoho apps, plus a no-/low-code Agent Studio to build custom agents with tools, knowledge bases, guardrails and multi-agent setups.", "description": "Zia Agents is Zoho's agent platform across its 60+ business apps. The Agent Store is a marketplace of prebuilt agents (Zoho's pages cite 'over 100+' on the Zia Agents page and 'over 40' in the Agent Store FAQ) that come with preconfigured instructions and are deployed with a 'Hire Agent' click into supported Zoho apps such as Zoho CRM and Zoho Desk; examples Zoho names include an SDR agent, email responder, meeting scheduler, a Desk Customer Service Agent that answers or triages incoming requests, a Resolution Expert, and a Lead Generation Agent that converts sales emails in Zoho Mail into CRM leads. Zia Agent Studio lets teams build custom agents by prompt (text-to-agent) or low code, add knowledge-base documents, give agents tool groups to take actions (retrieve emails, update records, add tasks), set do's-and-don'ts guardrails, use observability and multi-agent setups, and provision an agent as a 'digital employee' that respects existing user permissions with behavioural audits. Agents run on Zoho-hosted LLMs (Zia LLM) or external models via bring-your-own-key, and Zoho also offers an MCP server for third-party agents. Listed with HQ India (Chennai) under the owner's rule for Zoho's dual Austin/Chennai headquarters statement. ManageEngine is Zoho Corp's IT-management division; Log360 Cloud, Endpoint Central and ServiceDesk Plus Zia Agents are listed separately as product-level agents in that suite.", "pricing": "Zia Agents platform is free per Zoho's pricing page; you pay only for LLM usage. Zoho-hosted LLMs: Standard tier free up to 30 million tokens/month, Pro tier 20 million tokens/month, over-limit usage billed via prepaid Agent Wallet credits; external LLMs at vendor rates (BYOK or Zoho Key System, currently OpenAI). Underlying Zoho app subscriptions are separate.", "pricing_model": "freemium", "frameworks": [], "frameworks_claimed": [], "tasks": [ "workflow-automation", "process-automation", "agentic-ops" ], "india_relevance": "Zoho Corporation is headquartered in Chennai, India (listed as India per owner rule). Zoho's pricing page notes the Pro LLM tier is available on request in its US and India data centres.", "featured": false, "source_url": "https://www.zoho.com/zia/agents/", "sources": [ "https://www.zoho.com/zia/agents/", "https://www.zoho.com/agents/agent-store.html", "https://www.zoho.com/agents/create-agents.html", "https://www.zoho.com/agents/pricing.html", "https://www.zoho.com/news/zoho-launches-zia-llm-and-deepens-ai-portfolio-with-prebuilt-agents-custom-agent-builder-mcp-and-marketplace.html", "https://www.zoho.com/news/zoho-brings-ease-to-struggling-industry-ai-adoption-with-free-agentic-tools-across-multiple-key-functions.html", "https://www.manageengine.com/news/zoho-corp-ai-platform-supporting-across-broad-portfolio.html" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "workato-agent-studio-genies", "name": "Workato Agent Studio and Genies (enterprise AI agents)", "vendor": "Workato", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.workato.com/agentic", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Workato's agent layer on its integration and automation platform: Agent Studio builds AI agents ('genies') that understand context and execute skills built from Workato workflows and recipes, with prebuilt genies for IT, sales, HR, support and other functions.", "description": "Workato positions its Agentic offering as enterprise AI agents that 'blend reasoning, action, and orchestration' on top of its iPaaS. Per Workato's docs, Agent Studio lets teams build and deploy interactive AI agents called genies without code; genies 'dynamically perform actions and call workflows' and execute pre-defined skills toward a goal. Each genie combines an LLM and job description (persona, instructions, constraints), a chat interface (Slack, Teams or Workato GO), a knowledge base (policies, FAQs, company data) and skills that take action in connected apps, built from Workato workflows and recipes. Workato also offers prebuilt Workato Genies with proven skills for specific business functions (for example an IT genie), agent orchestration, an AI gateway and enterprise MCP servers, and AIRO, described as a multi-agent system. Genies are available in Workato's US, EU, AU, SG and JP data centres. It is a general-purpose agent platform rather than a compliance-specific product.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "workflow-automation", "process-automation", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://docs.workato.com/en/agentic/agent-studio.html", "sources": [ "https://www.workato.com/agentic", "https://docs.workato.com/en/agentic/agent-studio.html", "https://www.workato.com/platform/airo", "https://www.workato.com/about_us" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "box-ai-agents", "name": "Box AI Agents (Box Agent, Extract, Classification and custom agents; Box for Government)", "vendor": "Box", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.box.com/agents", "category": "business-ops", "categories": [ "business-ops", "compliance" ], "summary": "Permissions-aware AI agents on Box's content platform: the Box Agent plans multi-step work across files, Extract agents turn documents into structured metadata, a Classification agent labels sensitive content, and Box AI Studio builds custom agents; Box AI sits inside Box's FedRAMP High boundary per the Marketplace listing.", "description": "Box AI Agents run on content stored in Box and respect existing user permissions, retention rules and compliance controls. Box says the Box Agent reasons, creates multi-step plans and chains native tools to find files, analyse data and create deliverables (for example first-pass review of vendor MSAs against a playbook, RFP responses, or regulatory gap analyses). Specialised agents include the AI Extract Agent (custom fields and extraction logic to turn contracts, forms and images into structured metadata; Box Extract reached general availability with 'advanced agentic capabilities'), the AI Classification Agent (context-aware sensitivity labelling at scale) and the AI Threat Analysis Agent (summarises security alerts for triage). Admins can build and test custom agents in Box AI Studio with scoped knowledge and model choice (OpenAI, Anthropic, Google); rule-based agent guardrails are marked coming soon. Custom agents, agentic workflows and Pro Mode are listed under the Enterprise Advanced plan. For government, Box's FedRAMP Marketplace description states that 'BoxAI operates entirely within the FedRAMP High boundary'; Box is also GovRAMP Authorized (High) and TX-RAMP Level 2.", "pricing": "Not published for agents. Box lists custom AI agents, agentic workflows and Box Agent Pro Mode under the Enterprise Advanced plan (box.com/agents); plan price not captured.", "pricing_model": "quote", "frameworks": [ "fedramp" ], "frameworks_claimed": [ "FedRAMP", "GovRAMP", "TX-RAMP", "DoD IL4", "CJIS", "HIPAA" ], "tasks": [ "workflow-automation", "process-automation", "agentic-ops", "contract-review", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://www.box.com/agents", "sources": [ "https://www.box.com/agents", "https://www.box.com/fedramp", "https://blog.box.com/box-announces-general-availability-box-extract-transform-enterprise-content-actionable-data", "https://blog.box.com/state-and-local-governments-turn-box-modernize-workflows-secure-ai", "https://www.fedramp.gov/marketplace/products/F1212191840A/", "https://govramp.org/program-participants", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Box Enterprise Cloud Content Collaboration Platform (BoxAI in boundary)", "id": "F1212191840A", "impact": "High", "date": "2025-03-25", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/F1212191840A/", "checked": "2026-10-18" }, { "program": "govramp", "status": "Authorized", "product": "Box Enterprise Cloud Content Collaboration Platform", "impact": "High", "scope": "platform-only", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "Box Enterprise Cloud Content Collaboration Platform", "id": "TX985384", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" } ] }, { "slug": "co-brain-legal-agent", "name": "Co-Brain Legal Agent (playbook contract review and redlining)", "vendor": "Co-Brain (Co-Brain GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://co-brain.ai/en/legal-agent", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "German legal agent that detects contract type, jurisdiction and parties, applies the company's playbook to every clause, flags deviations with page-cited reasoning and produces playbook-compliant redlines in Word, Outlook and Teams.", "description": "Co-Brain's Legal Agent handles recurring contract requests for in-house legal teams. Per Co-Brain's product page it automatically detects contract type, jurisdiction, language and parties; applies the team's approved clauses, fallback positions and negotiation standards to every contract; marks each deviating clause with the reasoning and page reference from the playbook; and generates playbook-compliant, negotiation-ready revisions with tracked changes for the lawyer to accept, reject or edit. It also answers routine legal questions from sales, marketing and procurement from the playbook, involving legal only when needed, and works inside Outlook, Teams and Word. A table view extracts defined data points (clauses, deadlines, values) across hundreds of contracts with source references for due diligence and compliance audits. Co-Brain also markets RFP, Questionnaire and Knowledge agents on the same platform (not reviewed in detail here). Co-Brain describes itself as hosted in Europe, GDPR-compliant and 'Made in Germany', with its main office in Oldenburg (Co-Brain GmbH, Escherweg 1, 26121 Oldenburg, Germany).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://co-brain.ai/en/legal-agent", "sources": [ "https://co-brain.ai/en/legal-agent", "https://co-brain.ai/en/about-us", "https://co-brain.ai/en/privacy-policy", "https://co-brain.ai/en/legal-notice" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "docusign-iris-agents", "name": "Docusign Iris agents and Agent Studio (Intelligent Agreement Management)", "vendor": "Docusign", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.docusign.com/blog/new-ai-assistant-and-agents", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Agents in Docusign IAM that review agreements against company standards and playbooks, suggest edits, request approvals, monitor contracts for risks and obligations, and can be built as custom agents in Agent Studio and used as steps in Workflow Builder.", "description": "Docusign announced Iris-powered agents for its Intelligent Agreement Management (IAM) platform at Momentum on May 21, 2026. Per Docusign, agents check agreements against company standards, suggest edits and automatically request the right approvals; monitor contracts in the background to flag risks, track obligations and trigger next steps; and can be custom-built in Agent Studio for deals, renewals and approvals. Docusign's FAQ says ready-to-deploy agents and custom agents can be used as steps in Workflow Builder, where their structured outputs trigger routing, approvals or escalations, alongside an Iris AI assistant, AI-assisted Worksheets and an MCP server. At launch the assistant, ready-to-deploy agents, Agent Studio custom agents and agents in workflows are generally available in English for customers hosted in North America data centres on IAM Professional, IAM Enterprise, IAM for Sales or IAM Platform plans; the MCP server is in global open beta. Docusign eSignature and CLM hold FedRAMP Moderate authorizations, but Docusign does not say the new agents are in those government boundaries, so FedRAMP is noted at platform level only.", "pricing": "Not published for agents. Available on eligible IAM plans (IAM Professional, IAM Enterprise, IAM for Sales, IAM Platform), North America hosting at launch.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "FedRAMP", "GovRAMP", "TX-RAMP" ], "tasks": [ "contract-review", "workflow-automation", "risk-assessment" ], "india_relevance": "", "featured": false, "source_url": "https://investor.docusign.com/news-and-events/press-releases/news-details/2026/Docusign-Unveils-AI-Assistant-and-Agents-to-Power-the-Next-Era-of-Agreement-Work/default.aspx", "sources": [ "https://investor.docusign.com/news-and-events/press-releases/news-details/2026/Docusign-Unveils-AI-Assistant-and-Agents-to-Power-the-Next-Era-of-Agreement-Work/default.aspx", "https://community.docusign.com/what-s-new-at-docusign-156/faq-what-are-the-new-iris-powered-ai-capabilities-in-docusign-iam-27573", "https://www.docusign.com/blog/new-ai-assistant-and-agents", "https://www.docusign.com/company/privacy-policy", "https://www.fedramp.gov/marketplace/products/F1605027893/", "https://govramp.org/program-participants", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "DocuSign CLM", "id": "F1605027893", "impact": "Moderate", "date": "2017-08-24", "scope": "platform-only", "source_url": "https://www.fedramp.gov/marketplace/products/F1605027893/", "checked": "2026-10-18" }, { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Docusign - IAM eSignature", "id": "F1609267945", "impact": "Moderate", "date": "2017-08-10", "scope": "platform-only", "source_url": "https://www.fedramp.gov/marketplace/products/F1609267945/", "checked": "2026-10-18" }, { "program": "govramp", "status": "Authorized", "product": "DocuSign Contract Lifecycle Management (CLM)", "impact": "Moderate", "scope": "platform-only", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "DocuSign Cloud", "id": "TX999107", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2027-01-26" } ] }, { "slug": "auditfile-agentic-ai-orchestrator", "name": "AuditFile Agentic AI Orchestrator Suite (audit agents)", "vendor": "AuditFile", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.auditfile.com/ai-agents", "category": "compliance", "categories": [ "compliance", "business-ops" ], "summary": "Multi-agent orchestration for financial-statement audits: an orchestrator staffs engagements with long-running agents that draft disclosure-checklist answers, categorise trial balances, generate PBC request lists, prepare and perform procedures and draft workpapers, all ending in a human sign-off queue.", "description": "AuditFile, a cloud audit platform for CPA firms, describes its Agentic AI Orchestrator Suite as a multi-agent orchestration platform for audit (citing U.S. Patent No. 10,891,294). The orchestrator staffs engagements with specialised, long-running autonomous agents tracked like human staff, with one approval queue and an immutable, evidence-linked audit trail. Named agents include a Disclosure Checklist Agent (Yes/No/N-A answers with reasoning, confidence and verbatim citations), Disclosure Drafter, AI Trial Balance Categorizer, AI Request List Generator, AI Response Check, Sample Assist (AU-C 530 sampling form), Document Extraction, AI Workpaper Generation and a Financial Statement Workbook agent; every audit procedure offers AI Help, Prepare, Review and Perform modes, plus engagement-wide reviews of strategy and risk assessment. A separate LeasePunch agent team covers lease accounting. AuditFile's design rule is 'AI proposes, deterministic code calculates, humans approve': no agent signs off. Agents can be driven from web, iOS/Apple Watch, CLI, API and MCP, with bring-your-own-token model options and zero training on customer data.", "pricing": "Published on auditfile.com/pricing: Professional US$179/user/month with a one-year agreement (US$199 billed monthly), up to 15 users, AuditFile AI included; Pro Plus US$249/user/month with a one-year agreement (US$299 monthly), unlimited users, includes 'Advantage AI Audit Agents'; Enterprise and Gov custom (incl. on-premise/AWS GovCloud hosting). 14-day free trial.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "audit-management", "evidence-collection", "control-testing", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.auditfile.com/ai-agents", "sources": [ "https://www.auditfile.com/ai-agents", "https://www.auditfile.com/", "https://www.auditfile.com/pricing", "https://www.auditfile.com/contact", "https://www.auditfile.com/about" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "freee-ai-agents", "name": "freee AI agents for accounting firms (freee \u9867\u554f\u5148\u7ba1\u7406 AI\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8 and freee Agent Hub)", "vendor": "freee K.K.", "hq_country": "Japan", "hq_region": "asia-pacific", "url": "https://adv.freee.co.jp/ai/ai-agent", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Japanese accounting-firm agents from freee: prebuilt bookkeeping, rule-maintenance, monthly-check and tax-return-check agents that run client workflows autonomously and return only exceptions to staff, plus freee Agent Hub, a no-code builder for scheduled custom accounting agents.", "description": "freee made two agent products generally available to Japanese accounting and tax firms on Sep 15, 2026. 'freee \u9867\u554f\u5148\u7ba1\u7406 | AI\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8' provides prebuilt agents that progress firm workflows once a client and workflow are selected: a bookkeeping agent (automatic journal entries and document matching from receipts and statements based on past entries and rules, with staff checking only flagged items), a rule-maintenance agent (learns and proposes automation rules), a monthly-check agent (detects BS/PL/consumption-tax balance gaps, double entries and negative balances) and a tax-return-check agent (reconciles corporate tax filings made in freee against accounting data). 'freee Agent Hub' is a no-code platform for building custom agents in natural language that connect to non-public freee APIs, run on a scheduler (for example overnight bookkeeping) and isolate each client's context and credentials. freee describes the design as 'responsible AI': the AI presents hypotheses and evidence the first time, human-confirmed decisions become firm rules, and exceptions or important judgements go back to people. Use requires registration in the freee certified advisor programme. Product pages are in Japanese.", "pricing": "Published (JPY, excl. tax): AI agent entry plan (bookkeeping + monthly-check agents) \u00a51,000 per client/month, minimum 3 clients; tax-return-check agent free for freee advisor-programme members. freee Agent Hub \u00a55,000/month base (1 ID + \u00a55,000 token allowance), additional ID \u00a55,000/month each, usage above allowance metered. Launch campaign: 50% off first month (extended to Nov 30, 2026).", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "agentic-ops", "workflow-automation", "audit-management" ], "india_relevance": "", "featured": false, "source_url": "https://corp.freee.co.jp/news/20260915freee_AIagent&fAH.html", "sources": [ "https://corp.freee.co.jp/news/20260915freee_AIagent&fAH.html", "https://adv.freee.co.jp/ai/ai-agent", "https://corp.freee.co.jp/company/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "xelix-ap-agents", "name": "Xelix AP control centre (agentic AP: statements, transactions and helpdesk agents)", "vendor": "Xelix (GSPV Ltd)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://xelix.com/why-xelix/our-ai", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "UK accounts-payable control software that bolts onto ERPs and uses 20+ autonomous AI agents to catch duplicate payments, overpayments and invoice fraud before the pay-run, reconcile supplier statements and answer vendor queries.", "description": "Xelix sells an accounts-payable 'control centre' that sits on top of ERPs and AP systems (SAP S/4HANA, Microsoft Dynamics, Oracle NetSuite/Fusion, Workday). Xelix says the platform uses '20+ autonomous AI agents' and agentic workflows to enhance controls and automate manual AP work. Its modules cover Capture (extracting, correcting and validating invoices), Transactions (detecting duplicate invoices, overpayments and invoice fraud before payment runs), Statements (automated supplier statement reconciliation) and Helpdesk (automated replies to vendor queries with SLA tracking and workflows). Xelix's July 2025 Series B post said it audited more than 115 million invoices and $750bn of spend a year for 130+ customers and raised $160m to advance agentic AI in AP; the homepage later cites 220 million+ invoices processed annually and $200 million+ saved annually. These are vendor figures and are not independently verified here. Individual agents are not named on the pages checked. Its pages give a London address first (Senna Building, Gorsuch Place; GSPV Ltd) and a Delaware address.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "fraud-detection", "process-automation", "workflow-automation", "audit-management" ], "india_relevance": "", "featured": false, "source_url": "https://xelix.com/why-xelix/our-ai", "sources": [ "https://xelix.com/why-xelix/our-ai", "https://www.xelix.com/", "https://xelix.com/resources/company-news/xelix-raises-series-b-to-grow-agenticai-in-ap", "https://xelix.com/about-us", "https://www.xelix.com/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "pennylane-autopilot", "name": "Pennylane Autopilot (autonomous bookkeeping and pre-review for accounting firms and SMEs)", "vendor": "Pennylane (Pennylane SAS)", "hq_country": "France", "hq_region": "europe", "url": "https://www.pennylane.com/fr/expert-comptable/ia", "category": "business-ops", "categories": [ "business-ops" ], "summary": "French accounting platform's Autopilot runs activated bookkeeping workflows end to end (document requests and reminders, document processing, bank reconciliation, VAT preparation) and pre-reviews year-end diligence with documented conclusions, while accountants supervise exceptions from a control centre.", "description": "Pennylane splits its AI into Copilot (suggestions the user initiates and validates) and Autopilot, which it describes as executing end-to-end the workflows a firm or company has switched on while people supervise results and handle exceptions. For accounting firms, Pennylane says Autopilot collects supporting documents and sends requests and reminders automatically, classifies and processes documents as they arrive, performs lettering and bank reconciliation, and prepares VAT reconciliation; for year-end it pre-reviews eligible diligence work, checking variations, thresholds, unusual balances and ratios, detecting and explaining anomalies, attaching relevant documents from the firm's document store and proposing actions, with the accountant keeping the final decision. A control centre lets the firm activate automations client by client and track actions and exceptions. Pennylane also offers custom AI agents in ComptAssistant (read-only per its help docs), a read-only MCP server, and says an 'AI Studio' for building agents and routines is coming. Pages are in French; Pennylane also sells in Germany.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "ISO 27001" ], "tasks": [ "process-automation", "workflow-automation", "agentic-ops", "audit-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.pennylane.com/fr/expert-comptable/ia", "sources": [ "https://www.pennylane.com/fr/expert-comptable/ia", "https://www.pennylane.com/fr/intelligence-artificielle", "https://www.pennylane.com/fr/legal/mentions-legales" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "archer-evolv-ai-operators", "name": "Archer Evolv AI Operators (Evolv Foundation and Evolv Workplace)", "vendor": "Archer (Archer Technologies LLC)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.archerirm.com/evolv-ai-workplace", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Governed GRC agents ('AI Operators') inside the Archer system of record: identity-bound, scope-limited, human-supervised agents for control generation and assurance, regulatory change, reportable-event review and record hygiene; the Archer Evolv product is TX-RAMP Level 2 certified.", "description": "Archer launched Archer Evolv Foundation and Archer Evolv Workplace on Sep 14, 2026. The press release says both are in production with customers. An AI Operator is a governed agent built for one GRC job inside Archer \u2014 reading regulatory text, scoring a vendor, drafting a finding or watching for disruption \u2014 and each is identity-bound, scope-constrained to defined records and actions, supervised by a named human and audit-emitting, writing every action back to Archer as a timestamped record. Evolv Workplace is the marketplace where customers select and assign operators; Evolv Foundation is the shared layer (Archer cites hundreds of purpose-built models carried over from its Compliance.ai acquisition; the press release said 492 and the product page has said 526 \u2014 treat the count as a vendor figure). The first operators Archer lists include domain onboarding (maps processes to risks to controls), control generation and verification, AI guardrail conformance testing, reportable loss/incident event review, controls assurance (effectiveness, cadence and evidence checks) and record and asset hygiene. The Sep 2026 release says dozens of operators are live across Foundation, Audit, Third-Party Risk, IT Risk and Operational Risk, targeting 200+ by end of 2026 (vendor roadmap). The Evolv Workplace FAQ on the product page currently says Compliance is available today, Foundation is the underlying layer, and every other domain shown is planned, not yet delivered. The 'ARCHER EVOLV' product is TX-RAMP Level 2 certified (TX1958687).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "tx-ramp" ], "frameworks_claimed": [ "TX-RAMP" ], "tasks": [ "control-mapping", "control-testing", "policy-management", "risk-assessment", "audit-management", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://www.archerirm.com/press-releases/archer-launches-archer-evolv-foundation-and-archer-evolv-workplace", "sources": [ "https://www.archerirm.com/press-releases/archer-launches-archer-evolv-foundation-and-archer-evolv-workplace", "https://www.archerirm.com/evolv-ai-workplace", "https://www.archerirm.com/company/privacy-statement", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "ARCHER EVOLV", "id": "TX1958687", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2029-07-14" } ] }, { "slug": "deep-fathom-cmmc-agents", "name": "Deep Fathom Compliance Readiness Platform (agentic CMMC / NIST SP 800-171 readiness)", "vendor": "Deep Fathom, Inc.", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.deepfathom.ai/platform", "category": "compliance", "categories": [ "compliance" ], "summary": "CMMC and NIST SP 800-171 readiness platform for US defence contractors where AI agents interpret obligations, plan and advance routine readiness work, continuously map the CMMC boundary and collect evidence, with human review gates on consequential decisions.", "description": "Deep Fathom launched its Compliance Readiness Platform for US Department of Defense contractors at CUI-CON on Feb 11, 2026, describing it as 'AI-infused intelligent automation and compliance orchestration' powered by agentic AI. Per its platform page, the system interprets requirements against controls and scope, converts readiness gaps into owned actions ('AI agents accelerate analysis and coordination while human review gates keep authority with the accountable team'), keeps evidence attached to each requirement with provenance, and surfaces drift and remediation between assessments. Modules include an Onramp Kit (audit boundary, inheritance, system maps and an initial SSP baseline), Boundary Advisor (continuously maps the CMMC boundary and flags drift), Outpost (collects evidence from cloud platforms and systems) and Scout (structures browser-side artifacts). Deep Fathom states that certification, bid eligibility and compliance decisions stay with the contractor, counsel and assessor. It offers commercial and GovCloud consoles. CMMC certifies organisations, not products, so CMMC appears as a vendor-claimed framework only.", "pricing": "Not published (a 'Start free' option for Platform Commercial is offered; paid pricing via sales).", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "CMMC", "NIST SP 800-171" ], "tasks": [ "evidence-collection", "gap-analysis", "control-mapping", "remediation", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://www.deepfathom.ai/platform", "sources": [ "https://www.deepfathom.ai/platform", "https://www.deepfathom.ai/articles/deep-fathom-launches-agentic-ai-cmmc-platform-at-cui-con-2026", "https://www.deepfathom.ai/contact" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "ironscales-ai-agents", "name": "Ironscales AI agents (Phishing SOC Agent, Red Teaming Agent and Phishing Simulation Agent)", "vendor": "Ironscales", "hq_country": "United States", "hq_region": "north-america", "url": "https://ironscales.com/platform/agents", "category": "security", "categories": [ "security" ], "summary": "API-based email security for Microsoft 365 and Google Workspace that runs three AI agents: a Phishing SOC Agent for L2-style forensic investigation of suspicious emails, a Red Teaming Agent that models attacks aimed at your organisation and hardens detection, and a Phishing Simulation Agent. Plans include agentic autonomous remediation.", "description": "Ironscales sells AI email security that sits on top of Microsoft 365 and Google Workspace through an API, with no MX changes, and can run alongside or replace a secure email gateway. Its agents page describes three AI agents. The Phishing SOC Agent does the forensic investigation a skilled L2 analyst would do on a suspicious or reported email. It runs five parallel tracks: sender and domain authentication, body analysis for social engineering, URL-chain inspection, attachment scanning with 100+ engines and sandbox detonation, and relay tracing. It returns a Safe, Phishing or Spam verdict with evidence and a log of every step it took. The Red Teaming Agent runs recurring reconnaissance (social media, press releases, job posts, vendor news), generates the emails an attacker would write for your organisation, and feeds them into detection so the attack is already detected when it arrives. The Phishing Simulation Agent builds personalised simulations from OSINT, groups employees into 'Phishing Threat Clusters' for one-sample approval, and targets the highest-risk users. The pricing page lists 'Agentic AI Autonomous Remediation' (a virtual SOC that detects and remediates email threats hands-free) in its plans, plus customisable remediation thresholds. Figures such as a 97-second average L2 investigation and 99%+ automatic remediation are vendor claims. Ironscales was founded in Israel in 2014; its About page says it is headquartered in Atlanta, Georgia and Tel Aviv, and its privacy policy says it is a global company headquartered in the US. Pricing is quote-based.", "pricing": "Not published (plan cards on the pricing page say 'Get Pricing')", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "phishing-triage", "email-security", "incident-response", "remediation", "threat-detection" ], "india_relevance": "", "featured": false, "source_url": "https://ironscales.com/platform/agents", "sources": [ "https://ironscales.com/", "https://ironscales.com/platform/agents", "https://ironscales.com/pricing", "https://ironscales.com/about", "https://ironscales.com/contact-us", "https://ironscales.com/privacy-policy/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "sublime-security-asa-ade", "name": "Sublime Security ASA and AD\u00c9 (Autonomous Security Analyst and Autonomous Detection Engineer)", "vendor": "Sublime Security", "hq_country": "United States", "hq_region": "north-america", "url": "https://docs.sublime.security/docs/asa-autonomous-security-analyst", "category": "security", "categories": [ "security" ], "summary": "Email security platform whose AI agents triage user-reported and flagged emails end to end (ASA, with passive or active auto-remediation modes) and write backtested detections for new attacks (AD\u00c9), which default to one-click human approval and can auto-activate when they clear a precision threshold. Runs as SaaS or self-hosted in AWS, including GovCloud.", "description": "Sublime Security is an email security platform built around customisable detections. Sublime's docs describe ASA (Autonomous Security Analyst) as an AI agent that clears the abuse mailbox and triages messages that the Attack Score model flagged as suspicious, unknown or error. ASA chooses which analysis tools to call for each message: attachment detonation, link analysis and computer vision on landing pages, and sender behaviour profiles. It can run parallel sub-investigations and usually reaches a verdict in about a minute. In passive ('Analyst') mode it investigates and writes a report without touching mail. In active ('Autonomous') mode it applies the auto-remediation you set per verdict (quarantine, trash, move to spam or warning banner) and auto-reviews. Verdicts are malicious, spam, graymail, benign or unknown, and unknown always goes to a human. When ASA confirms a miss it can hand the message to AD\u00c9 (Autonomous Detection Engineer), which writes and backtests new detection rules. Docs say you can approve coverage yourself or let AD\u00c9 auto-activate detections that clear the precision bar you set (the docs describe a 99% preset). ASA sends only parsed message data to the model, never the raw email. It runs in Sublime Cloud and in self-hosted AWS deployments, including AWS GovCloud, and needs Sublime Enterprise. Registry: the Sublime Security Platform is TX-RAMP Level 2 (TX1903681). That is a platform-level certification, and the listing doesn't name ASA. Speed and false-positive figures are vendor claims. Enterprise pricing is not published. A free Core tier and a free EML analyzer exist.", "pricing": "Not published for Sublime Enterprise (required for ASA). Free Sublime Core tier and free EML Analyzer available.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "TX-RAMP" ], "tasks": [ "phishing-triage", "email-security", "alert-triage", "remediation", "threat-detection" ], "india_relevance": "", "featured": false, "source_url": "https://docs.sublime.security/docs/asa-autonomous-security-analyst", "sources": [ "https://sublime.security/", "https://docs.sublime.security/docs/asa-autonomous-security-analyst", "https://docs.sublime.security/docs/ade-autonomous-detection-engineer", "https://legal.sublime.security/sublime-legal-terms/sublime-privacy-policy-4ace7a48", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Sublime Security Platform", "id": "TX1903681", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2029-07-05" } ] }, { "slug": "material-security-ai-agents", "name": "Material Security AI agents (user-reported phishing agent and OAuth Remediation Agent)", "vendor": "Material Security", "hq_country": "United States", "hq_region": "north-america", "url": "https://material.security/use-cases/automate-user-report-response", "category": "security", "categories": [ "security" ], "summary": "Cloud workspace security for Google Workspace and Microsoft 365 with an AI agent that triages, clusters and remediates user-reported phishing across the organisation, plus an OAuth Remediation Agent that investigates third-party app and AI-agent grants and can revoke tokens on its own. Per-user pricing is published.", "description": "Material Security connects directly to Google Workspace and Microsoft 365. It covers inbound email threats, account takeover containment, sensitive data in mail and files, and connected-app (OAuth) security. Its 'Automate User Report Response' page says it deploys 'an AI agent' to triage reported emails. Each report is classified as malicious, spam or safe using machine learning, organisational context and semantic analysis, and uncertain verdicts are flagged for manual review. Similar messages are grouped into one case, and policy-based remediation runs across the organisation, from deletion to link speedbumps. Each verdict comes with a plain-language explanation, and teams can start with suggested classifications before moving to full automation. Material's OAuth Remediation Agent watches third-party apps and AI agents connected to Google Workspace. It classifies each grant by scopes, runtime behaviour, vendor reputation and blast radius, and can revoke OAuth tokens on its own. It can also ask users in Slack to confirm an authorisation, or require analyst approval for business-critical apps. Figures such as 'cut phishing triage by up to 91 percent' are vendor claims. Pricing is published per user.", "pricing": "Published: Essentials $4 per user/month and Advanced $6 per user/month (billed annually, plus a fee based on Shared Drive size). Essentials includes the automated agent for user-reported phishing. Advanced adds the agent that investigates, classifies and remediates OAuth grants. ATO Resilience is +$3 per user/month as an add-on or $5 stand-alone. Enterprise is by quote.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "phishing-triage", "email-security", "remediation", "incident-response", "cloud-security" ], "india_relevance": "", "featured": false, "source_url": "https://material.security/use-cases/automate-user-report-response", "sources": [ "https://material.security/", "https://material.security/product/email", "https://material.security/use-cases/automate-user-report-response", "https://material.security/product/oauth-agent", "https://material.security/pricing", "https://material.security/privacy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "proofpoint-satori-agents", "name": "Proofpoint Satori agents (Abuse Mailbox Agent and DLP Triage Agent)", "vendor": "Proofpoint", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.proofpoint.com/us/platform/satori", "category": "security", "categories": [ "security" ], "summary": "Agentic AI layer inside Proofpoint's platform. The Satori Abuse Mailbox Agent classifies every user-reported email that needs manual review (phish, malware, spam or clean) and can trigger configured quarantine or tagging workflows. A DLP Triage Agent does the same for data-loss alerts, with guardrails, chat explanations and audit logs.", "description": "Proofpoint Satori is Proofpoint's set of AI agents for security operations, built on its email, collaboration and data security platform. Satori runs multi-step workflows it calls 'missions' that use Proofpoint telemetry, apply guardrails, act where permitted and log every decision. The Satori Abuse Mailbox Agent works in the Threat Protection Workbench as an autonomous analyst. It processes every abuse-mailbox submission routed through CLEAR that is labelled 'Needs Manual Review', labels each one phish, malware, spam or clean, and can trigger the customer's remediation workflows to quarantine or tag messages. Analysts can ask it about its decisions in a chat interface. 'Memories' (global patterns plus local, natural-language instructions from the team) tune its future behaviour. Per the datasheet, the agents do not carry out enforcement such as blocking, deleting or changing policy, and high-risk alerts are escalated to humans. The Satori DLP Triage Agent triages data loss prevention alerts. Satori MCP Access lets the agents exchange context with other tools such as Microsoft Copilot and CrowdStrike Charlotte. Tessian, which Proofpoint acquired, now redirects to Proofpoint. Pricing is not published. On 15 Oct 2026 Proofpoint and Varonis announced a definitive agreement for Proofpoint to acquire Varonis in an all-cash transaction valued at about $6.3 billion, expected to close in the first half of 2027 subject to shareholder and regulatory approvals; until then the companies operate independently.", "pricing": "Not published as list prices. The Abuse Mailbox Agent datasheet describes an action-based model (pay for automated work performed, not users, tokens or seats) without dollar amounts.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "phishing-triage", "email-security", "alert-triage", "security-operations" ], "india_relevance": "", "featured": false, "source_url": "https://www.proofpoint.com/us/platform/satori", "sources": [ "https://www.proofpoint.com/us/platform/satori", "https://www.proofpoint.com/sites/default/files/data-sheets/pfpt-us-ds-satori-abuse-mailbox-agent.pdf", "https://www.proofpoint.com/sites/default/files/data-sheets/pfpt-us-ds-satori-dlp-agent.pdf", "https://www.proofpoint.com/us/contact", "https://www.proofpoint.com/us/tessian-is-now-proofpoint", "https://www.proofpoint.com/us/newsroom/press-releases/proofpoint-acquire-varonis-creating-global-leader-data-and-ai-security" ], "last_checked": "2026-10-19", "added": "2026-10-18" }, { "slug": "check-point-email-security-ai-agents", "name": "Check Point Email Security AI agents (Harmony Email & Collaboration, formerly Avanan)", "vendor": "Check Point Software Technologies", "hq_country": "Israel", "hq_region": "middle-east", "url": "https://www.checkpoint.com/harmony/email-security/", "category": "security", "categories": [ "security" ], "summary": "Check Point's API-based, prevention-first email and collaboration security (Harmony Email & Collaboration, formerly Avanan) for Microsoft 365, Gmail, Teams, Slack and file-sharing apps. Check Point says autonomous AI agents investigate threats, correlate activity into campaigns, prioritise incidents and orchestrate remediation. Check Point Infinity Platform for Government (which includes Harmony Email) is FedRAMP Moderate and GovRAMP Authorized at platform level; Check Point Harmony is TX-RAMP Level 2 \u2014 none of those registry rows name the AI agents.", "description": "Check Point Email Security (its admin guide calls it 'Check Point's Email Security (Harmony Email & Collaboration)'; the product was formerly Avanan) is an API-based inline service. It scans email for Microsoft 365 and Gmail before delivery and also covers Teams, SharePoint, OneDrive, Slack, Google Drive and other collaboration apps, with DLP, DMARC, account takeover protection, archiving and security awareness training add-ons. The product page says it is 'powered by ThreatCloud AI and autonomous AI agents'. It also says 'AI agents autonomously investigate threats, correlate related activity into campaigns, prioritize incidents, and orchestrate remediation, reducing manual work across email security operations'. It also scans content aimed at AI assistants such as Copilot and Gemini for prompt injection. A Check Point webinar on its CheckMates community (Oct 2026) says an AI agent in the security awareness add-on creates personalised phishing simulations from real threats and automates remediation, retraining, new-hire onboarding and reporting. The administration guide (15 Oct 2026) documents inline protection, quarantine workflows, reported-phishing ingestion and an Infinity AI Copilot for analytics, but does not yet describe the agent features in detail. Treat agent scope as vendor claims and confirm in a demo. Registry: Check Point Infinity Platform for Government, which includes Harmony Email, is FedRAMP Authorized at Moderate and GovRAMP Authorized (Moderate). 'Check Point Harmony' is TX-RAMP Level 2. These are platform-level authorizations that do not mention the AI agents. Pricing is by quote.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "FedRAMP", "GovRAMP", "TX-RAMP" ], "tasks": [ "email-security", "phishing-triage", "threat-detection", "incident-response", "remediation" ], "india_relevance": "", "featured": false, "source_url": "https://www.checkpoint.com/harmony/email-security/", "sources": [ "https://www.checkpoint.com/harmony/email-security/", "https://www.checkpoint.com/harmony/email-security/plans-and-packages/", "https://sc1.checkpoint.com/documents/Harmony_Email_and_Collaboration/CP_Check_Point_Email_Security_Admin_Guide.pdf", "https://community.checkpoint.com/t5/CheckMates-Events/What-If-Email-Security-Ran-Your-Security-Awareness-Program/ev-p/283386", "https://www.checkpoint.com/about-us/", "https://www.fedramp.gov/marketplace/products/FR2511048038/", "https://govramp.org/program-participants", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "Check Point Infinity Platform for Government", "id": "FR2511048038", "impact": "Moderate", "date": "2025-09-24", "scope": "platform-only", "source_url": "https://www.fedramp.gov/marketplace/products/FR2511048038/", "checked": "2026-10-18" }, { "program": "govramp", "status": "Authorized", "product": "Check Point Infinity Platform for Government", "impact": "Moderate", "scope": "platform-only", "source_url": "https://govramp.org/program-participants", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "Check Point Harmony", "id": "TX1598637", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2028-01-27" } ] }, { "slug": "hoxhunt-respond", "name": "Hoxhunt Respond (automated phishing incident response)", "vendor": "Hoxhunt", "hq_country": "Finland", "hq_region": "europe", "url": "https://hoxhunt.com/product/phishing-email-incident-response-automation", "category": "security", "categories": [ "security" ], "summary": "Finnish human-risk platform whose Respond module automatically investigates every employee-reported email, groups related reports into one campaign incident, suppresses safe and duplicate reports, and removes confirmed malicious messages from all affected inboxes without waiting for an analyst.", "description": "Hoxhunt, from Helsinki, is best known for gamified, AI-personalised phishing training and simulations. Its Respond module is email incident response for SOC teams. Per the product page and the Oct 7, 2026 announcement, Respond automatically analyses each reported email with models trained on ten years of employee-reported phishing. It clusters related reports into a single campaign-level incident and suppresses safe, duplicate and low-risk reports. Once a threat is confirmed, it finds matching messages across inboxes, including copies nobody reported, and removes them automatically. Removal is reversible, and employees get instant feedback on their reports. It complements Microsoft Defender and passes clean, campaign-level incidents to SOAR and SIEM tools. Hoxhunt describes this as automation rather than an 'agent', but the documented flow runs end to end without an analyst. Accuracy (96% malicious, 99%+ safe), 'up to 99%' fewer tickets and 'under one minute' remediation are vendor claims. Pricing is per employee by quote.", "pricing": "Not published (per-employee quote after a scoping call)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "phishing-triage", "email-security", "incident-response", "remediation" ], "india_relevance": "", "featured": false, "source_url": "https://hoxhunt.com/product/phishing-email-incident-response-automation", "sources": [ "https://hoxhunt.com/", "https://hoxhunt.com/product/phishing-email-incident-response-automation", "https://www.prnewswire.com/news-releases/hoxhunt-expands-email-incident-response-automation-with-hoxhunt-respond-to-cut-phishing-tickets-by-up-to-99-302900755.html", "https://hoxhunt.com/pricing", "https://www.hoxhunt.com/legal/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "phished-ai-security-agents", "name": "Phished AI security agents (Report Triage, Orchestration, Simulation and Real-Time Protection agents)", "vendor": "Phished", "hq_country": "Belgium", "hq_region": "europe", "url": "https://phished.io/ai-security-agents/", "category": "security", "categories": [ "security" ], "summary": "Belgian human-risk platform with a suite of AI agents that run the phishing training programme (orchestration, simulation, brand, supplier and deepfake simulation agents), triage every reported email with a verdict and a drafted reply, and check clicked links in an isolated environment in real time. New content needs admin approval and every action is logged.", "description": "Phished (Phished BV, Leuven) offers security awareness and phishing-simulation software that it says trains about two million users in 7,100 organisations. Its AI security agents page says the agents 'run your human risk program for you'. IT approves anything new before it reaches people, and every action is logged. Named agents: an Orchestration Agent that runs an always-on programme delivering the right simulation and training to each employee with no campaign calendar. A Simulation Agent that builds a complete phishing simulation and landing page from a prompt in any language, plus Brand Impersonation, Supply Chain (simulations based on your actual suppliers), Deepfake and Threat Radar agents (reported attacks become simulation templates). A Report Triage Agent that analyses every reported email and returns a safe or unsafe verdict in seconds with a drafted reply to the reporter. An Incident Response Agent that drafts a containment checklist for confirmed threats. Real-Time Protection and Link Analysis agents that open clicked links in an isolated silo and return a verdict across the inbox, browser, Teams and SMS. Content Creation, SCORM, Policy Transformer and Policy Evaluator agents round out the suite (the Policy Evaluator checks training against NIS2, DORA or GDPR; that is a vendor feature, not a certification). It integrates with Microsoft 365, Google Workspace, SIEM and SOAR. Plan prices are not shown as text on the pricing page.", "pricing": "Not published (Core, Advanced and higher tiers listed without visible prices; partner pricing available)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "phishing-triage", "email-security", "workflow-automation", "risk-assessment", "incident-response" ], "india_relevance": "", "featured": false, "source_url": "https://phished.io/ai-security-agents/", "sources": [ "https://phished.io/", "https://phished.io/ai-security-agents/", "https://phished.io/pricing/", "https://phished.io/legal-notice/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "strongestlayer-trace-agents", "name": "StrongestLayer TRACE agents (Inbox Advisor, Threat Triage and Threat Hunt)", "vendor": "StrongestLayer", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.strongestlayer.com/platform/threat-triage", "category": "security", "categories": [ "security" ], "summary": "AI-native email security for Microsoft 365 and Google Workspace in which a multi-LLM reasoning engine (TRACE) investigates each email's intent against your business context and blocks attacks. Three classes of agents give employees plain-English verdicts in Outlook and Gmail, send pre-investigated, MITRE-mapped cases to the SOC, and hunt and remediate across mailboxes.", "description": "StrongestLayer (StrongestLayer, Inc., San Francisco; seed-funded, with a Sorenson Capital-led seed and a 2026 round led by Inovia Capital) says its AI agents investigate every email in your business context and stop attacks without disrupting work. Its TRACE engine runs three reasoning models per email: one argues for legitimacy, one against, and one weighs sender history, infrastructure and behavioural baseline. Each verdict ships with a sourced reasoning trace. Three classes of agents sit on TRACE. Inbox Advisor is an Outlook and Gmail add-in that gives every employee a safe, caution or block verdict with reasons. Threat Triage delivers every alert pre-investigated with a MITRE ATT&CK mapping and an explainable verdict; StrongestLayer's triage page says analysts decide and do not have to dig. The vendor claims 80%+ less alert volume reaching analysts. Threat Hunt sweeps mailboxes by time window, group or org unit before remediation. The product deploys via API alongside Proofpoint or Mimecast (vendor says about 15 minutes, no MX changes) or can replace a gateway. It forwards detections and reasoning traces to Microsoft Sentinel, Splunk, Radiant Security or any SIEM via CEF, LEEF or JSON, webhook and REST API. Email content is processed in memory, and only metadata, verdicts and traces are kept. Pricing is custom per mailbox, with a 14-day proof of concept.", "pricing": "Not published (custom, per mailbox; 14-day proof of concept)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "email-security", "phishing-triage", "alert-triage", "threat-detection" ], "india_relevance": "", "featured": false, "source_url": "https://www.strongestlayer.com/platform/threat-triage", "sources": [ "https://www.strongestlayer.com/", "https://www.strongestlayer.com/platform/threat-triage", "https://www.strongestlayer.com/platform/threat-hunt", "https://www.strongestlayer.com/solutions/automate-soc-triage", "https://www.strongestlayer.com/pricing", "https://www.strongestlayer.com/company/about", "https://www.strongestlayer.com/legal/privacy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "adaptive-security-agentic-email-security", "name": "Adaptive Security Agentic Email Security and Phish Triage", "vendor": "Adaptive Security (TeamGuard AI Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.adaptivesecurity.com/email-security", "category": "security", "categories": [ "security" ], "summary": "API-based 'agentic email security' that re-analyses inbound mail after native filtering with ML and LLM reasoning and removes confirmed threats across every inbox automatically (configurable human-in-the-loop thresholds). AI Phish Triage classifies employee-reported emails and acts on them, feeding Adaptive's simulations and awareness training.", "description": "Adaptive Security (TeamGuard AI Inc., New York) sells security awareness training, deepfake and AI social-engineering simulations, and an email security product it calls 'Agentic Email Security'. Per its email security page, the product connects by API with no mail-flow or MX changes. It re-analyses inbound messages after native filtering using dual ML and LLM models that combine behavioural signals, intent analysis and LLM reasoning, and explains each decision. When a threat is confirmed it is removed automatically from every inbox it reached, and similar attacks are taken down at the same time. Customers set confidence thresholds for when a human must approve. Quarantined mail stays inaccessible until an admin reviews, restores or deletes it. The automated phishing response page says AI-powered Phish Triage classifies employee-reported emails (threats, spam, graymail, benign) and takes action automatically. Detected attacks also trigger targeted simulations and training. Detection comparisons against Microsoft and Mimecast and the 'up to 50% of the cost' figure are vendor claims. Pricing is per seat by quote.", "pricing": "Not published (per-seat quote based on employee count and products)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "email-security", "phishing-triage", "remediation", "threat-detection" ], "india_relevance": "", "featured": false, "source_url": "https://www.adaptivesecurity.com/email-security", "sources": [ "https://www.adaptivesecurity.com/", "https://www.adaptivesecurity.com/email-security", "https://www.adaptivesecurity.com/solutions/automated-phishing-response", "https://www.adaptivesecurity.com/pricing", "https://www.adaptivesecurity.com/contact", "https://www.adaptivesecurity.com/legal/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "aiprise-ai-agents", "name": "AiPrise AI agents (AML Agent, Website Agent and Document Agent)", "vendor": "AiPrise (AiPrise, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.aiprise.com/aml-agent", "category": "risk", "categories": [ "risk" ], "summary": "KYC/KYB and compliance platform whose AI agents review AML screening hits (sanctions, PEP, adverse media) and recommend a decision under the customer's AML policy, check business websites for legitimacy and risk with ongoing monitoring, and review documents, with an analyst confirming the outcome.", "description": "AiPrise is a business and user verification platform (KYB, KYC, fraud and risk scoring, watchlist screening, case management) for payments companies, neobanks, cross-border payments, stablecoin/crypto, lending and marketplaces. Its AI Agents menu lists an AML Agent, a Website Agent and a Document Agent. On the AML Agent page, the agent gathers adverse-media, PEP, sanctions and warning-list hits into one case, reads every hit, summarises the findings, then classifies the case against the customer's AML policy and recommends an outcome (for example treating a hit as a false positive and recommending approval) for the analyst to confirm. The Website Agent crawls a company's website and public footprint (domain history, content, contact details, reviews, social profiles, traffic), classifies industry and risk, recommends Approve, Review or Decline with visible reasoning under the customer's onboarding rules, and keeps monitoring the site after onboarding, updating the risk score and alerting the team. False-positive and time-saving figures on the pages are the vendor's claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "kyc", "alert-triage", "case-investigation", "fraud-detection" ], "india_relevance": "", "featured": false, "source_url": "https://www.aiprise.com/aml-agent", "sources": [ "https://www.aiprise.com/aml-agent", "https://www.aiprise.com/website-agent", "https://www.aiprise.com/", "https://www.aiprise.com/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "inetco-bullzai-investigate", "name": "INETCO BullzAI Investigate (agentic AI fraud investigation agents)", "vendor": "INETCO (INETCO Systems Limited)", "hq_country": "Canada", "hq_region": "north-america", "url": "https://www.inetco.com/products/inetco-bullzai/", "category": "risk", "categories": [ "risk" ], "summary": "Payment-fraud prevention platform for banks, processors and payment service providers whose agentic AI fraud agents collate transaction data, triage alerts, prioritise high-risk cases and give explainable risk scores and recommendations, running on a proprietary small language model that can be deployed on-premise.", "description": "INETCO BullzAI is a real-time payment fraud prevention platform (transaction-level KYT data, fraud detection and blocking, including card-testing/BIN-attack firewalling) for banks, payment processors and PSPs. The BullzAI Investigate module, launched on 16 July 2026, adds agentic AI fraud agents to case management: the product page says they collate large transaction data sets, analyse behavioural patterns, automatically triage incoming alerts, prioritise the highest-risk cases and deliver explainable risk scores and recommendations, with cases created automatically from alerts or risk scores. Analysts keep the decision, and analyst feedback refines the system through a human-in-the-loop supervised learning cycle. The agents run on a proprietary small language model deployed on-premise, so transaction data stays in the customer's environment; cloud deployment is also offered. Investigation-time figures (about 20 seconds per case) are the vendor's claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "fraud-detection", "alert-triage", "case-investigation" ], "india_relevance": "", "featured": false, "source_url": "https://www.inetco.com/products/inetco-bullzai/", "sources": [ "https://www.inetco.com/products/inetco-bullzai/", "https://www.inetco.com/inetco-launches-ai-assisted-investigation-to-help-fraud-teams-work-smarter-and-faster/", "https://www.inetco.com/contact-us/", "https://www.inetco.com/privacy-policy/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "cleverchain-vera-ai-agents", "name": "CleverChain AI agents (VERA autonomous due diligence and LUMA screening)", "vendor": "CleverChain (CleverChain Ltd)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.cleverchain.ai/", "category": "risk", "categories": [ "risk" ], "summary": "KYB, KYC, AML and third-party due-diligence platform where the VERA agent runs end-to-end investigations (ownership chain, business activity, sanctions and adverse media) into a cited, policy-mapped report, and LUMA handles AML screening and ongoing monitoring, with analysts approving high-risk decisions.", "description": "CleverChain is a London-registered compliance intelligence platform for KYB, KYC, AML and third-party risk. Its own pages say its AI agents run the full workflow: VERA performs autonomous end-to-end due diligence (reconstructing the full ownership chain, identifying ultimate beneficial owners and control by means other than shareholding, testing declared against evidenced business activity, and tracking how risk changes), LUMA handles AML screening and ongoing monitoring at volume, KIRA turns a finished report into a workspace an analyst can question, and LEXI answers regulatory questions and automates policy review. Assessments are calibrated to the customer's own policy and questionnaire and mapped to the governing framework (for example UK MLR 2017, the US BSA/FinCEN CDD rule, EU AML package). Each finding cites its registry record, list entry or document; automated QA runs before an analyst sees the report; human approval gates apply to high-risk decisions; audit logs record retrieval, assessment and conclusions. The vendor says it is ISO 27001 certified and was selected for the UK FCA Regulatory Sandbox; coverage numbers are vendor claims. No list price: usage-based with an annual minimum for intelligence, tiered annual licence for policy automation.", "pricing": "Not published (usage-based with annual minimum commitment; tiered annual licence for policy automation; no list price)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "ISO 27001" ], "tasks": [ "kyc", "aml", "case-investigation", "vendor-risk", "risk-assessment" ], "india_relevance": "", "featured": false, "source_url": "https://www.cleverchain.ai/", "sources": [ "https://www.cleverchain.ai/", "https://www.cleverchain.ai/about-us", "https://www.cleverchain.ai/terms-of-service", "https://www.cleverchain.ai/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "doppel-agentic-social-engineering-defense", "name": "Doppel agentic social engineering defense (Email Security, Phishing Triage and agentic takedowns)", "vendor": "Doppel (Doppel Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.doppel.com/product/email-security", "category": "security", "categories": [ "security" ], "summary": "Social engineering defense platform where AI agents triage employee-reported phishing, remove malicious mail automatically, tune email detection policies and trace phishing back to its sending infrastructure and links to execute takedowns, alongside brand-impersonation takedowns across web, social, ads and app stores.", "description": "Doppel calls itself an agentic, AI-native social engineering defense platform. It covers digital risk protection (lookalike domains, fake profiles, scam ads, fake apps), human risk management (simulations and training) and email security, linked by its Threat Graph of attacker infrastructure. Doppel Email Security went generally available on July 30, 2026 (AMER and APAC). Doppel's pages say its AI agents trace phishing to the infrastructure behind it and take down the sending infrastructure and malicious links, so the same campaign cannot retarget the organisation, and that agents continuously tune detection policies with human-readable logic. Doppel Phishing Triage takes employee-reported emails: malicious ones are removed from inboxes automatically, suspicious ones go to the security team with recommendations, and reporters get feedback. The platform page says LLM agents fine-tuned on expert decisions validate signals and automate takedowns with human oversight, so treat it as AI plus expert review rather than fully unattended. Accuracy, speed and volume figures are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "email-security", "phishing-triage", "threat-intelligence", "threat-detection", "remediation" ], "india_relevance": "", "featured": false, "source_url": "https://www.doppel.com/product/email-security", "sources": [ "https://www.doppel.com/product/email-security", "https://www.doppel.com/product/phishing-triage", "https://www.doppel.com/platform", "https://www.doppel.com/company/press-releases/doppel-email-security-generally-available", "https://www.doppel.com/privacy-policy" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "keepnet-incident-responder-ai-agent", "name": "Keepnet Incident Responder AI agent (phishing incident response and agentic security awareness)", "vendor": "Keepnet Labs (Keepnet Labs Ltd.)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://keepnetlabs.com/products/incident-responder", "category": "security", "categories": [ "security" ], "summary": "Human risk management platform whose AI agent reviews user-reported emails, opens investigations and proposes next steps in Incident Responder, with every action held in a human approval queue; the same agent builds and runs phishing simulations and awareness training. Per-user pricing is published.", "description": "Keepnet is a human risk management platform (phishing simulation across email, voice, SMS, QR and callback, security awareness training, a phishing reporter add-in and Incident Responder). Keepnet's Incident Responder page says Keepnet runs an AI agent across the platform: in incident response the agent reviews reported emails, opens investigations and recommends what should happen next, but it does not execute those actions itself. Every recommendation goes to a human approval queue, so analysts decide what happens in mailboxes. Analysts can brief the agent in plain language instead of writing rules and schedule recurring tasks for it. Reported messages are analysed automatically and copies in other mailboxes can be removed. On the awareness side, Keepnet markets 'Agentic AI' that plans, builds and delivers training and simulations autonomously, tailored by role, risk, language and regulation. Speed and risk-reduction figures (for example 48.6x faster analysis) are vendor claims. This is a recommend-and-approve agent, weaker on autonomy than active-mode email agents.", "pricing": "Published per-user MSRP tiers on keepnetlabs.com/pricing (USD/EUR/GBP, by user band; e.g. Incident Responder bought alone is shown at about US$0.72\u20131.04 per user in the 25\u20131,000-user bands, and bundle plans from about US$1.40 to US$3.15 per user in the 25\u2013500-user bands). Static capture: check the page for billing period and column mapping; 1,000+ users by quote.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "phishing-triage", "email-security", "incident-response", "alert-triage" ], "india_relevance": "", "featured": false, "source_url": "https://keepnetlabs.com/products/incident-responder", "sources": [ "https://keepnetlabs.com/products/incident-responder", "https://keepnetlabs.com/", "https://keepnetlabs.com/pricing", "https://keepnetlabs.com/about", "https://keepnetlabs.com/contact-us", "https://doc.keepnetlabs.com/legal-hub/for-everyone/website/terms-of-use" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "fortinet-fortisoc-agentic-ai", "name": "Fortinet FortiSOC (agentic AI SOC platform with FortiAI-Assist)", "vendor": "Fortinet", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.fortinet.com/products/fortisoc", "category": "security", "categories": [ "security" ], "summary": "Cloud-delivered SOC platform (SIEM, SOAR, UEBA, ITDR, threat intelligence and case management in one SaaS) whose agentic AI investigates and correlates alerts across assets and identities, then recommends or executes response actions under analyst oversight.", "description": "FortiSOC, announced as available on June 16, 2026, is Fortinet's unified, cloud-delivered SOC platform. It combines SIEM, SOAR, user and entity behaviour analytics, identity threat detection and response, FortiGuard threat intelligence and case management under one console and subscription. Fortinet says FortiSOC embeds agentic AI to autonomously investigate and correlate alerts across assets and identities, then recommend or execute response actions under analyst oversight. FortiAI-Assist adds autonomous investigation, AI-generated playbooks and MCP-powered agent coordination across alerts, investigations, threat hunting, cases and response actions. The product page says FortiSOC uses agentic AI and thousands of SOAR playbooks to investigate alerts automatically and to guide and execute remediation. It also covers NOC/IT and OT visibility for Fortinet Security Fabric customers. Pricing is by quote. Fortinet's FortiGuard and FortiCare services are TX-RAMP certified, but no registry entry names FortiSOC, so no framework is recorded.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "incident-response", "threat-detection", "case-investigation" ], "india_relevance": "", "featured": false, "source_url": "https://www.fortinet.com/products/fortisoc", "sources": [ "https://www.fortinet.com/products/fortisoc", "https://www.fortinet.com/corporate/about-us/newsroom/press-releases/2026/fortinet-launches-fortisoc-unified-soc-platform-powered-by-agentic-ai", "https://www.fortinet.com/blog/security-operations/introducing-fortisoc-one-platform-total-control", "https://www.fortinet.com/corporate/about-us/contact-us" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "arctic-wolf-aurora-agentic-soc", "name": "Arctic Wolf Aurora Agentic SOC (Swarm of Experts agents)", "vendor": "Arctic Wolf (Arctic Wolf Networks)", "hq_country": "United States", "hq_region": "north-america", "url": "https://arcticwolf.com/aurora-platform/", "category": "security", "categories": [ "security" ], "summary": "Agent-led managed SOC on the Aurora Superintelligence Platform: a 'Swarm of Experts' of oversight, authoritative and process agents runs triage, investigation, response, threat hunting, threat intel and detection engineering, with Arctic Wolf's human experts in the loop for novel cases and critical decisions.", "description": "Arctic Wolf announced the Aurora Agentic SOC on March 23, 2026, built on its Aurora Superintelligence Platform. Arctic Wolf says all SOC workflows are run by agents through its Swarm of Experts, a three-tier model: Oversight Agents (a Swarm Orchestrator and a Swarm Judge that coordinate and validate results), Authoritative Agents (triage, investigation, response, threat hunting, threat intel, detection engineering) and hundreds of Process Agents. An 'AI Trust Engine' bounds agent autonomy: agents act only within validated experience, and novel cases are escalated to Arctic Wolf's security experts, whose resolutions feed back into the system. It is delivered as a service (Concierge model) rather than self-run software: the release says it is available as part of Arctic Wolf's Security Operations Bundles and Aurora Managed Endpoint Security, and existing customers and MSPs on those products received it at no added cost. Customer counts and accuracy figures are vendor claims. Registry: Arctic Wolf's 'Managed Detection and Response/Managed Risk' service is TX-RAMP Level 2 (platform-level; the listing does not name the agents).", "pricing": "Not published. Included at no added cost for customers on Arctic Wolf Security Operations Bundles and Aurora Managed Endpoint Security (per Arctic Wolf); bundle pricing by quote.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "TX-RAMP" ], "tasks": [ "security-operations", "alert-triage", "incident-response", "threat-detection", "threat-intelligence" ], "india_relevance": "", "featured": false, "source_url": "https://arcticwolf.com/aurora-platform/", "sources": [ "https://arcticwolf.com/aurora-platform/", "https://arcticwolf.com/resources/press-releases/arctic-wolf-launches-the-worlds-largest-commercial-agentic-soc-to-usher-in-a-new-era-of-agent-led-security-operations/", "https://arcticwolf.com/contact-us/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Managed Detection and Response/Managed Risk", "id": "TX1151665", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2027-05-10" } ] }, { "slug": "ntt-docomo-business-wideangle-ai-soc", "name": "NTT DOCOMO BUSINESS WideAngle AI SOC (AI Agent log analysis with managed SOAR auto-response)", "vendor": "NTT DOCOMO BUSINESS (NTT\u30c9\u30b3\u30e2\u30d3\u30b8\u30cd\u30b9\u682a\u5f0f\u4f1a\u793e, formerly NTT Communications)", "hq_country": "Japan", "hq_region": "asia-pacific", "url": "https://www.ntt.com/business/services/security/security-management/wideangle/aisoc.html", "category": "security", "categories": [ "security" ], "summary": "Japanese managed AI SOC service in which NTT DOCOMO BUSINESS's own AI Agent periodically reviews Microsoft Sentinel incidents, correlates endpoint, network and authentication logs and writes an analysis report back, and Sentinel's managed SOAR playbooks then respond to the alerts automatically, with NTT security experts on call.", "description": "WideAngle AI SOC (launched May 20, 2026) is part of NTT DOCOMO BUSINESS's WideAngle managed security services. Customers send three types of logs (endpoint, network and authentication) and security alerts to Microsoft Sentinel. NTT's in-house AI Agent ('AI Advisor') checks the incidents in Sentinel on a regular cycle, runs cross-log correlation analysis that NTT says previously took analysts one to two hours, and returns an analysis report to Sentinel. Based on the agent's results, Sentinel applies automatic responses using NTT's own SOAR playbooks (managed SOAR), built from its security operations experience. NTT security specialists support customers with questions about results. NTT says it will widen the scope of automatic response over time. The service is aimed at Japanese enterprises without in-house SOC skills; it is a managed service on Microsoft Sentinel rather than standalone software. Timing claims are the vendor's. Pricing is not published (contact NTT DOCOMO BUSINESS sales).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "incident-response", "threat-detection" ], "india_relevance": "", "featured": false, "source_url": "https://www.ntt.com/business/services/security/security-management/wideangle/aisoc.html", "sources": [ "https://www.ntt.com/business/services/security/security-management/wideangle/aisoc.html", "https://www.atpress.ne.jp/news/598721", "https://www.ntt.com/about-us/company-profile.html" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "stackhawk-wingman", "name": "StackHawk Wingman (find-fix-verify security for AI coding agents)", "vendor": "StackHawk (StackHawk, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.stackhawk.com/product/wingman/", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Security plugin for AI coding agents (Claude Code, Cursor, GitHub Copilot, Codex, Antigravity) that runs dynamic tests against the running app during the coding session, has the agent triage and fix what it finds, then rescans to prove the fix before the pull request. Published at US$10 per user per month.", "description": "StackHawk publicly launched Wingman on September 15, 2026. Wingman installs into AI coding agents (Claude Code, Cursor, GitHub Copilot, Codex and Antigravity are named) as a plugin and skills. It scans automatically at session start, after commits and when the agent finishes responding, or on request, sending real HTTP requests at the running app (local, dev, test or prod) to test 150+ vulnerability types, including SQL injection, XSS, sensitive data exposure, remote code execution, broken access control and business-logic flaws. The coding agent then decides whether each finding is real and fixable, writes the fix in the working tree as a normal git diff, and Wingman rescans to confirm the vulnerability is gone, tying each test to a commit. In approve mode the developer approves each edit; in auto mode they review the diff. Scan traffic stays on the developer's machine; findings and app profiles go to StackHawk's platform, not source code. A Scale plan adds attack-surface discovery and org-wide coverage. Result figures on the page are vendor claims.", "pricing": "Wingman: US$10 per user per month, unlimited apps, 14-day free trial (no card). Scale plan: contact sales.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "remediation", "vulnerability-management", "agent-platform-security-integrations" ], "india_relevance": "", "featured": false, "source_url": "https://www.stackhawk.com/product/wingman/", "sources": [ "https://www.stackhawk.com/product/wingman/", "https://www.stackhawk.com/pricing/", "https://www.stackhawk.com/privacy-policy/", "https://www.prnewswire.com/news-releases/stackhawk-launches-wingman-to-autonomously-fix-vulnerabilities-during-ai-coding-sessions-302878443.html" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "c1-autonomous-worker", "name": "C1 Autonomous Worker and C1 Agents (identity governance AI agent, formerly ConductorOne)", "vendor": "C1 (ConductorOne, Inc. d/b/a C1)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.c1.ai/products/agents", "category": "security", "categories": [ "security", "compliance" ], "summary": "Governed AI agent on C1's identity platform that carries out identity work end to end from a plain-language request (revoking stale admin grants, building access reviews, assembling audit evidence on who reached production, finding orphaned entitlement owners), acting only within the operator's own permissions and logging every action.", "description": "C1 (formerly ConductorOne) launched C1 Autonomous Worker (C1AW) on June 15, 2026, available to all C1 customers. C1 says C1AW is a governed AI agent for enterprise identity governance: an operator asks it, for example, to revoke every stale admin grant in Snowflake, build a quarterly access review for Engineering, pull audit evidence for who reached production last quarter, or find deactivated users still listed as entitlement owners, and it reasons over C1's identity data, takes action through C1's policy engine and delivers the finished artifact in the thread. It can only do what its operator is already allowed to do, and every action is attributed in C1's audit trail. The C1 Agents product page says agents plan, gather permitted context and execute work within C1's access controls and inference routing, and escalate for human approval when required. C1 also sells identity governance, an LLM gateway, an MCP gateway and secrets management. Workday announced a definitive agreement to acquire C1.ai on October 13, 2026, expected to close by January 31, 2027. Pricing amounts are not published (SKU-based Platform pricing or usage-based Flex pricing with C1 Tokens).", "pricing": "Not published (two models: SKU-based Platform pricing or usage-based Flex pricing billed in C1 Tokens; amounts by quote).", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "identity-governance", "access-reviews", "evidence-collection", "remediation" ], "india_relevance": "", "featured": false, "source_url": "https://www.c1.ai/news/press-release/c1-launches-c1-autonomous-worker-governed-ai-agent-for-enterprise-identity-work", "sources": [ "https://www.c1.ai/news/press-release/c1-launches-c1-autonomous-worker-governed-ai-agent-for-enterprise-identity-work", "https://www.c1.ai/products/agents", "https://www.c1.ai/pricing", "https://www.c1.ai/about", "https://www.c1.ai/privacy-policy", "https://www.c1.ai/news/press-release/workday-to-acquire-c1-ai/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "icertis-vera-agents", "name": "Icertis Vera agents (Redline, Risk Review, Playbook Creation, Composer, Fulfillment and Insights agents)", "vendor": "Icertis (Icertis, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.icertis.com/products/engage/vera-redline-agent/", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Contract AI agents in the Icertis contract intelligence platform that review third-party paper against a playbook, score risk Red/Amber/Green with plain-language explanations, generate playbook-aligned redlines in Microsoft Word, create playbooks and track obligations.", "description": "Icertis is an enterprise contract lifecycle management (CLM) vendor. Its Vera product line now names a set of agents. Vera Redline Agent detects risks and auto-generates 'surgical', playbook-aligned redlines with instant risk scoring. Vera Risk Review Agent runs an automated contract risk assessment directly in Microsoft Word: it finds gaps and non-standard terms, compares language against playbooks and precedents, and classifies each issue Red, Amber or Green with an overall rating. Without a playbook it uses prior agreements and precedents as context. Icertis's FAQ says the agent prepares positions and surfaces issues for the lawyer, so it does not replace human review. The navigation also lists a Vera Playbook Creation Agent, a Vera Composer Agent (drafting), a Vera Fulfillment Agent (post-signature obligations) and a Vera Insights Agent (analytics). Government angle: Icertis Contract Intelligence (ICI) for Government is FedRAMP Ready (Moderate) on the FedRAMP Marketplace and TX-RAMP Level 2 certified. Both are platform-level, and neither registry row names the Vera agents. Accuracy and time-saving figures on the pages are vendor or customer claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "FedRAMP Ready", "TX-RAMP" ], "tasks": [ "contract-review", "workflow-automation", "risk-assessment" ], "india_relevance": "Icertis has an office in Pune, India (ICC Trade Tower, Senapati Bapat Road, per its global locations page).", "featured": false, "source_url": "https://www.icertis.com/products/engage/vera-redline-agent/", "sources": [ "https://www.icertis.com/products/engage/vera-redline-agent/", "https://www.icertis.com/products/engage/vera-risk-review-agent/", "https://www.icertis.com/products/engage/vera-playbook-creation-agent/", "https://www.icertis.com/contact-us/", "https://www.icertis.com/information/icertis-privacy-statement/", "https://raw.githubusercontent.com/FedRAMP/marketplace-fedramp-gov-data/main/data.json", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Ready", "product": "Icertis Contract Intelligence (ICI) for Government", "id": "FR2022963780", "impact": "Moderate", "date": "2026-04-20", "scope": "platform-only", "source_url": "https://www.fedramp.gov/marketplace/products/FR2022963780/", "checked": "2026-10-18" }, { "program": "tx-ramp", "status": "Level 2", "product": "Icertis Contract Intelligence (ICI) for Government", "id": "TX1045023", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" } ] }, { "slug": "mntsq-ai-agent", "name": "MNTSQ AI Agent (contract review, drafting and matter-management agent in MNTSQ CLM)", "vendor": "MNTSQ (MNTSQ, Ltd. / MNTSQ\u682a\u5f0f\u4f1a\u793e)", "hq_country": "Japan", "hq_region": "asia-pacific", "url": "https://mntsq.co.jp/product/mntsq-ai-agent", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Legal AI agent built into the Japanese MNTSQ CLM. It agrees a review policy with the lawyer from the deal background, then reviews the contract against a playbook co-developed with Nagashima Ohno & Tsunematsu, redlines and comments directly in Microsoft Word, and drafts matter-management comments.", "description": "MNTSQ is a Tokyo legal-tech company whose MNTSQ CLM covers matter intake (\u6848\u4ef6\u7ba1\u7406), contract management and AI contract review for large Japanese companies. MNTSQ AI Agent launched in October 2025 and has been rolled out across its services in stages. The third stage, released in phases from September 7, 2026, brings the agent into Microsoft Word. Before the review starts, the agent proposes a review policy (\u30ec\u30d3\u30e5\u30fc\u65b9\u91dd) and lists missing information based on the deal background and the company's standards. Once the lawyer agrees, it reviews the draft against the company playbook and a standard playbook co-developed with the law firm Nagashima Ohno & Tsunematsu, writes redlines (\u8d64\u5165\u308c) and comments with stated grounds directly into the Word document, and drafts comments for the matter-management record. The product page says it also finds relevant past matters, does initial legal analysis and suggests questions to put to the requesting business unit, using prompts written by lawyers. Approval workflows can be tracked step by step and linked to external ringi (approval) systems. Pricing is quote-based (initial setup fee plus monthly fee). Pages are in Japanese.", "pricing": "Not published (quote-based: initial setup/onboarding fee plus monthly service fee, per MNTSQ's page)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://mntsq.co.jp/news/release/mntsq-ai-agent-contract-review", "sources": [ "https://mntsq.co.jp/product/mntsq-ai-agent", "https://mntsq.co.jp/news/release/mntsq-ai-agent-contract-review", "https://mntsq.co.jp/news/release/mntsq-ai-agent-2025", "https://mntsq.co.jp/about" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "lecheck-ai-agent", "name": "LeCHECK AI agent (Word add-in that runs the contract-review workflow)", "vendor": "Lisse (\u682a\u5f0f\u4f1a\u793e\u30ea\u30bb)", "hq_country": "Japan", "hq_region": "asia-pacific", "url": "https://corp.lisse-law.com/release/notice/20260821/", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "AI agent in Lisse's LeCHECK contract-review service (Microsoft Word add-in, from Aug 21, 2026). It runs the steps of a legal professional's contract review in order (risk check, proposed clause edits, comments, format check), and the reviewer applies its suggestions with a click.", "description": "Lisse is a Tokyo legal-AI company founded by a lawyer. Its LeCHECK service offers AI contract review for Japanese corporate legal teams. On August 21, 2026 Lisse added an AI agent that 'reproduces a legal professional's contract-review flow' as a Microsoft Word add-in. When a contract is opened in Word, the agent works through the review steps in sequence: it checks risks, proposes amended clause text, drafts comments and runs a format check. The legal reviewer checks and decides on each suggestion and applies it to the document with a click, instead of typing edits and comments by hand. Lisse says it has also started a pilot that covers the flow from intake to review (not covered by this listing). Note: Bengo4.com's CloudSign Review announced a Word AI agent on Sep 24, 2026 with near-identical wording. The two may share technology; that relationship is not verified, so it is not listed separately. Pricing is not published on the pages checked. Pages are in Japanese.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://corp.lisse-law.com/release/notice/20260821/", "sources": [ "https://corp.lisse-law.com/release/notice/20260821/", "https://corp.lisse-law.com/about/company/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "auditoria-ai-agents", "name": "Auditoria AI agents (AP Helpdesk, AP Invoices, AP Accruals, AP Vendor Watch, AP Statement Reconciliation, AR Collections, AR Remittances)", "vendor": "Auditoria (Auditoria.AI)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.auditoria.ai/products/accounts-payable/", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "AI agents that run accounts payable and receivable work inside finance's own ERP and inboxes: they answer vendor emails, capture and code invoices, chase accruals, monitor supplier bank, tax ID and sanctions data, reconcile vendor statements, and run collections and remittance matching within policy guardrails.", "description": "Auditoria.AI sells 'Governed Autonomy' agents for the cash cycle. On the AP side, AP Helpdesk reads the shared AP inbox, classifies senders and intent, and drafts or sends ERP-grounded replies, with human review on exceptions. AP Invoices captures, matches and codes vendor invoices and creates records in the ERP. AP Accruals chases non-billed expenses from stakeholders and generates journal entries with segregation of duties. AP Vendor Watch continuously checks supplier bank accounts, tax IDs, sanctions lists, credit and addresses to reduce payment fraud and 1099 errors. AP Statement Reconciliation extracts balances from vendor statements, matches them to the ERP and closes discrepancies with a supplier confirmation and audit trail. On the AR side, agents handle collections follow-up, AR helpdesk replies and remittance capture and matching. Teams set policies by role, entity, supplier, amount and rules; agents apply policy changes immediately; and every action is logged, with exceptions sent to humans. It integrates with ERPs including Workday. Customer metrics on the pages are vendor-reported. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "fraud-detection", "vendor-risk" ], "india_relevance": "", "featured": false, "source_url": "https://www.auditoria.ai/products/accounts-payable/", "sources": [ "https://www.auditoria.ai/products/accounts-payable/", "https://www.auditoria.ai/products/accounts-receivable/", "https://www.auditoria.ai/contact-us/", "https://www.auditoria.ai/privacy-policy/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "expenzing-fincat", "name": "Expenzing FinCat (autonomous AP scrutiny, expense processing and fraud-control agents)", "vendor": "Expenzing (Nexstep Infotech Pvt. Ltd.)", "hq_country": "India", "hq_region": "india", "url": "https://www.expenzing.com/expenzing-unveils-fincat-a-team-of-autonomous-ai-agents-that-multiplies-a-p-productivity-and-delivers-forensic-grade-fraud-control/", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Indian spend-management vendor's AI suite (launched Sep 2, 2026). An autonomous AP Scrutinizer runs 20+ vendor-compliance, arithmetic and anomaly checks on every invoice and confidence-scores it for straight-through processing or human review. Fraud Control Agents scan expense receipts for doctored or fake documents.", "description": "Expenzing is a Mumbai-based source-to-pay, accounts-payable and travel-and-expense SaaS vendor built for Indian enterprises. Its FinCat suite has three parts. AI Smart Scan (vision AI) turns invoices, e-invoices and scans into posting-ready data. The Autonomous APA AI Scrutinizer then acts as a 'digital controller': it runs over 20 vendor-compliance, invoice, arithmetic and anomaly checks, gives each invoice a confidence score, passes clean invoices straight through and routes risky exceptions to a human with evidence attached. Expense claims can likewise clear automatically, while specialised Fraud Control Agents scan every receipt for fake vendor logos, doctored receipts and arithmetic inconsistencies. CFO's Buddy is a conversational layer for questions over live voucher data (assistant, not agent). The platform sits in front of existing ERPs and approval matrices. Expenzing says it handles Indian tax compliance (GST/TDS), prepaid provisioning and IND AS 116 reporting, and that the company is ISO/IEC 27001:2022, SOC 2 Type II and 'CERT-In certified' with India-only data localisation. Those are vendor claims about the company, not product framework mappings. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "fraud-detection", "workflow-automation" ], "india_relevance": "Indian vendor (Mumbai HQ) building 'in India for India': GST/TDS compliance checks on invoices, IND AS 116 reporting and India-only data localisation (vendor claims).", "featured": false, "source_url": "https://www.expenzing.com/expenzing-unveils-fincat-a-team-of-autonomous-ai-agents-that-multiplies-a-p-productivity-and-delivers-forensic-grade-fraud-control/", "sources": [ "https://www.expenzing.com/expenzing-unveils-fincat-a-team-of-autonomous-ai-agents-that-multiplies-a-p-productivity-and-delivers-forensic-grade-fraud-control/", "https://www.expenzing.com/contact/", "https://www.expenzing.com/privacy-policy/" ], "last_checked": "2026-10-18", "added": "2026-10-18" }, { "slug": "freshservice-freddy-ai-agent", "name": "Freshservice Freddy AI Agent and Freddy AI Agent Studio (IT and HR service agents)", "vendor": "Freshworks (Freshworks Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.freshworks.com/freshservice/ai-agent-studio/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "AI agents in Freshworks' Freshservice ITSM that resolve employee IT and HR requests end-to-end (access provisioning, password resets, device setup, onboarding, leave queries) across Teams, Slack, Microsoft 365 Copilot and the portal, with an Agent Studio to build and govern pre-built and custom agents.", "description": "Freshservice is Freshworks' IT and enterprise service-management product. Freddy AI Agent provides autonomous front-line support on Microsoft Teams, Slack, Microsoft 365 Copilot and the service portal. It answers in 40+ languages from connected knowledge (Freshservice, Confluence, SharePoint, Google Drive), runs multi-turn conversations, reads images, and escalates with context. Freddy AI Agent Studio ('AI Agents that act, not just respond') is a platform to build, deploy, govern and improve agents grounded in Freshservice data and workflows. Its pre-built IT agents handle access provisioning, password resets and device setup end-to-end across systems, and its HR agents handle onboarding, leave requests and payroll queries. Some Studio governance and analytics features (workflow versioning, full auditability, performance analytics) are marked 'Coming soon' on the page. The pricing page lists Freddy AI Agent (Classic) in the Enterprise plan with 1,200 sessions per license per year. Government angle: FreshService is TX-RAMP Level 2 certified. That is platform-level, and the row does not mention Freddy AI.", "pricing": "Freshservice plans are published: Starter US$19, Growth US$49 and Pro US$99 per agent/month billed annually; Enterprise is custom and includes Freddy AI Agent (Classic) with 1,200 sessions per Enterprise license per year (session = a unique user's interactions in 24 hours). Freddy AI Copilot add-on US$29/agent/month. Agent Studio pricing not stated.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [ "TX-RAMP" ], "tasks": [ "it-service", "employee-support", "workflow-automation", "identity-governance" ], "india_relevance": "Freshworks was founded in Chennai, India (per Freshworks' own CEO-transition release).", "featured": false, "source_url": "https://www.freshworks.com/freshservice/ai-agent-studio/", "sources": [ "https://www.freshworks.com/freshservice/ai-agent-studio/", "https://www.freshworks.com/it-service/solutions/ai-agent/", "https://www.freshworks.com/freshservice/pricing/", "https://www.freshworks.com/press-releases/freshworks-announces-ceo-transition/", "https://www.freshworks.com/privacy/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "FreshService", "id": "TX1114772", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2027-07-12" } ] }, { "slug": "vulcan-justinian", "name": "Vulcan Justinian (AI agent for government legal, regulatory and permitting work; VulcanGov)", "vendor": "Vulcan Technologies (Vulcan Technologies, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://vulcan.ai/justinian", "category": "compliance", "categories": [ "compliance", "business-ops" ], "summary": "AI agent for US government knowledge workers, grounded in a large corpus of federal and state statutes, regulations, court cases and fiscal data. It runs 50-state research in parallel with citations, monitors legal changes, reviews permit applications against the code, drafts memos and comment responses, and builds internal tools inside the agency boundary.", "description": "Vulcan Technologies builds Justinian for government agencies, executive offices and legislative counsel, plus a commercial version for law firms and compliance teams. Justinian works through its own platform, email, Slack and Teams. On Vulcan's pages it: runs multi-jurisdiction research by spinning up one agent copy per state in parallel, with every statute cited to source, then keeps watch for changes; works permit applications from intake to issuance (completeness checks, applicable code and calculations, comment responses, staff memos, milestone tracking); works across spreadsheets, documents and presentations; and builds and deploys dashboards and internal tools in secure single-use sandboxes inside the agency boundary. Vulcan's site lists state deployments (for example the NC General Assembly, Virginia ORM, the Oklahoma DEQ and several Texas agencies) as vendor claims. Government compliance: VulcanGov (the GovCloud deployment) is FedRAMP Ready (Moderate) on the FedRAMP Marketplace, not Authorized. On TX-RAMP, 'Justinian' (Agentic AI Regulatory Review) is certified Level 1 and 'VulcanGov (Justinian for Government)' is Provisional. A sister product, TRAJAN, is a public-facing permit and licensing concierge (not covered here). Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "tx-ramp" ], "frameworks_claimed": [ "FedRAMP Ready" ], "tasks": [ "government-compliance", "policy-management", "workflow-automation", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://vulcan.ai/justinian", "sources": [ "https://vulcan.ai/justinian", "https://vulcan.ai/fedramp", "https://vulcan.ai/", "https://vulcan.ai/terms", "https://vulcan.ai/privacy", "https://raw.githubusercontent.com/FedRAMP/marketplace-fedramp-gov-data/main/data.json", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 1", "product": "Justinian (Agentic AI Regulatory Review)", "id": "TX1797606", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2029-01-26" }, { "program": "tx-ramp", "status": "Provisional (provisional expiry 2027-10-01)", "product": "VulcanGov (Justinian for Government)", "id": "TX1988256", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" }, { "program": "fedramp", "status": "FedRAMP Ready", "product": "VulcanGov", "id": "FR2619254906", "impact": "Moderate", "date": "2026-06-09", "scope": "listing", "source_url": "https://www.fedramp.gov/marketplace/products/FR2619254906/", "checked": "2026-10-18" } ] }, { "slug": "thomson-reuters-clear-investigate", "name": "CLEAR Investigate (agentic AI investigations for government, risk and fraud teams)", "vendor": "Thomson Reuters", "hq_country": "Canada", "hq_region": "north-america", "url": "https://legal.thomsonreuters.com/en/products/clear-investigate", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Agentic investigation tool built on Thomson Reuters CLEAR public-records data. From a plain-language question it plans and runs searches across CLEAR data and the open web, resolves conflicting records and returns concise cited findings with a record of the searches it ran, for AML, fraud, program-integrity and law-enforcement investigators.", "description": "CLEAR is Thomson Reuters' public-records investigation platform for corporate risk and fraud teams, government agencies and law enforcement. CLEAR Investigate (2026) adds what TR calls 'the first agentic AI solution designed to transform investigations'. Per TR's FAQ, it 'plans and runs searches across CLEAR data and the open web based on your question, retrieves relevant documents, and returns concise answers with citations', and users can see which searches were performed. TR's materials target government and law-enforcement investigations (resolving conflicting or incomplete records across sources), as well as corporate AML, fraud and adverse-media work. Government compliance: the TX-RAMP DIR row for 'Clear' (Level 2) explicitly describes CLEAR Investigate as 'a purpose-built agentic AI investigative platform', with AML, program-integrity fraud and public-safety use cases. On the FedRAMP Marketplace, 'Thomson Reuters Risk & Fraud (TR R&F)' is only Agency In Process (Moderate), not Authorized. Thomson Reuters' CoCounsel Legal is listed separately. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "tx-ramp" ], "frameworks_claimed": [ "FedRAMP (In Process)" ], "tasks": [ "case-investigation", "aml", "fraud-detection", "government-compliance" ], "india_relevance": "", "featured": false, "source_url": "https://legal.thomsonreuters.com/en/products/clear-investigate", "sources": [ "https://legal.thomsonreuters.com/en/products/clear-investigate", "https://legal.thomsonreuters.com/blog/clear-investigate-ushering-in-the-era-of-agentic-ai-for-corporate-risk-fraud-professionals/", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "https://raw.githubusercontent.com/FedRAMP/marketplace-fedramp-gov-data/main/data.json" ], "last_checked": "2026-10-18", "added": "2026-10-18", "authorizations": [ { "program": "tx-ramp", "status": "Level 2", "product": "Clear (incl. CLEAR Investigate)", "id": "TX1480568", "scope": "listing", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18", "expires": "2027-04-01" }, { "program": "fedramp", "status": "Agency In Process", "product": "Thomson Reuters Risk & Fraud (TR R&F)", "id": "FR2333543855", "impact": "Moderate", "scope": "platform-only", "source_url": "https://www.fedramp.gov/marketplace/products/FR2333543855/", "checked": "2026-10-18" } ] }, { "slug": "genpact-transaction-monitoring-analyst", "name": "Genpact Transaction Monitoring Analyst (Banking Analyst Suite)", "vendor": "Genpact", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.genpact.com/agentic/products/banking-analyst-suite", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Generally available agentic AML module for banks: a central orchestrator coordinates specialised agents that gather data, analyse transactions and customer behaviour, review prior alerts and deliver a decision-ready Level 1 alert recommendation with documented rationale, with analysts making every final decision.", "description": "Genpact Transaction Monitoring Analyst is the first module of the Genpact Banking Analyst Suite, announced on July 23, 2026 as generally available for AML alert investigations. Per Genpact, it coordinates AI agents to assess customer behaviour, analyse transactions, validate profiles, review prior alerts and recommend next steps, completing the first-level investigation workflow and delivering a decision-ready recommendation with a documented rationale and a detailed audit trail for analyst review. The product page describes a fleet of specialised agents for data gathering, analysis and risk assessment run by a central orchestrator, in line with the institution's own Bank Secrecy Act (BSA) processes, and says the system learns from analyst feedback, overrides and QA signals. Analysts make the final decisions; Genpact says the system does not take regulated action without human approval. It runs natively alongside Genpact's riskCanvas financial-crime platform but is described as platform-agnostic, and Genpact plans to extend the suite to customer due diligence, screening and fraud. Handle-time and cost reductions on the pages are projected estimates (vendor claims). Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "alert-triage", "case-investigation" ], "india_relevance": "", "featured": false, "source_url": "https://www.genpact.com/agentic/products/banking-analyst-suite", "sources": [ "https://www.genpact.com/agentic/products/banking-analyst-suite", "https://media.genpact.com/2026-07-23-Genpact-Launches-Banking-Analyst-Suite,-Agentic-AI-for-Regulated-Banking-Operations", "https://www.genpact.com/about-us/locations" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "oscilar-agent-hub", "name": "Oscilar Agent Hub (AML, sanctions, fraud and onboarding agents)", "vendor": "Oscilar (Oscilar, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://oscilar.com/ai/agents", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Risk-decisioning platform with 30+ orchestrated agents on a shared risk memory, including AML L1 review, sanctions screening dispositions, adverse media, EDD dossier, SAR narrative, fraud L1 review, fraud-network and KYB review agents, where every recommendation is confirmed by a human analyst.", "description": "Oscilar launched Agent Hub on June 3, 2026: more than 30 specialised agents across fraud, AML compliance, credit, onboarding, sanctions, disputes, analytics, workflow creation and explainability, all reading from and writing to one shared risk memory (a live unified customer risk profile of identity signals, transaction history, device and network intelligence, behaviour and prior cases). The agents catalogue lists, among others, AML L1 Review (evidence-backed L1 dispositions so analysts confirm instead of investigate), Sanctions Screening (pre-filled disposition guidance for every hit), Adverse Media Screening, EDD Creation (an enhanced due diligence dossier assembled before the analyst opens the case), Case Narrative and SAR Narrative Creation (in the institution's format), Fraud L1 Review, Fraud Network Detection, KYB Review, Rule Recommendation, Test Case Creation and QA review of closed investigations. Oscilar's FAQ says agents never autonomously close or escalate alerts: every recommendation is reviewed and confirmed by a human analyst, and the reasoning is captured for regulators. Speed figures are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "alert-triage", "case-investigation", "sar-narratives", "kyc", "fraud-detection" ], "india_relevance": "", "featured": false, "source_url": "https://oscilar.com/ai/agents", "sources": [ "https://oscilar.com/ai/agents", "https://oscilar.com/blog/oscilar-agent-hub", "https://oscilar.com/contact-us", "https://oscilar.com/legal/privacy-policy" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "vaas-ai-risk-agents", "name": "VAAS AI risk agents (KYC/KYB, AML and onboarding risk decisions)", "vendor": "VAAS (VAAS Tecnologia LTDA)", "hq_country": "Brazil", "hq_region": "latin-america", "url": "https://vaas.com.br/produto/ia", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Brazilian risk and compliance decisioning platform whose AI agents read the full KYC/KYB dossier, compare it with current regulation, flag risks such as adverse-media homonyms, and suggest a justified decision with a confidence level for the analyst to validate, with continuous re-analysis when a monitored person or company changes.", "description": "VAAS is a Brazilian risk, compliance, fraud-prevention and credit platform with five modules: auditable workflows, a decision desk (queue, approval levels, dossier and committee), an AI layer, a risk centre for continuous monitoring of people and companies, and a DataHub of 40+ integrated bureaus. Compliance use cases include KYC, KYS (suppliers), KYP (partners) and KYE (employees). On the AI page, VAAS's agents read the complete dossier, highlight what matters, compare it against current regulation and suggest a decision with a confidence level, ready for the analyst to validate; in the decision desk they 'vote alongside the analyst and justify the decision'. The page's examples include a KYC opinion on a company (risks found, rules triggered, a suggested decision with conformity checks against Brazilian rules such as CMN Resolution 4,943, the AML (PLD) framework and LGPD) and an adverse-media analysis that tests homonyms, age and location mismatches. The risk centre re-analyses a target automatically when something changes, and each AI decision is logged with input, output, hash and agent version. VAAS states SOC 1 and SOC 2 certifications and LGPD compliance on its trust materials (vendor claims). Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "LGPD" ], "tasks": [ "kyc", "aml", "risk-assessment", "case-investigation" ], "india_relevance": "", "featured": false, "source_url": "https://vaas.com.br/produto/ia", "sources": [ "https://vaas.com.br/produto/ia", "https://vaas.com.br/", "https://vaas.com.br/legal", "https://blog.vaas.com.br/ia-para-risco-em-onboarding-e-compliance" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "kaitosec-ai-agents", "name": "KaitoSec AI agents (agentic ISMS and GRC platform)", "vendor": "KaitoSec (KaitoSec GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://kaitosec.app/en/platform/ai-assistant", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "German agentic GRC/ISMS platform whose agents import and map existing registers and documents, check them against the method (e.g. BSI IT-Grundschutz), turn gaps into owned tasks, propose risk ratings and controls, assign evidence, prepare audit answers and reassess risks when a record changes, with no change taking effect without human approval.", "description": "KaitoSec is a Berlin-based GRC platform covering information security (ISMS), AI management (AIMS), business continuity (BCMS), data protection, supplier risk and audit on one data model, with framework coverage including ISO 27001, BSI IT-Grundschutz, NIS2, DORA, SOC 2, TISAX, ISO 22301, ISO 42001 and the EU AI Act. Per its AI page, KaitoSec's agents import existing registers and documents, check them against the methodology (for example the six phases of BSI IT-Grundschutz), find gaps and turn them into tasks with an owner and due date; they prepare the risk analysis, statement of applicability and actions from audit reports, propose risk assessments, derive controls from requirements, collect and assign evidence and prepare audit responses. The AI works on the record itself: when something changes (a backup that has now been tested, for example) it reassesses the risk and shows the change for confirmation. KaitoSec says agents prepare and people decide: every suggestion is reasoned and only takes effect after approval. Hosting is in Germany, customer data is not used for model training, the agent keeps the user's permissions, and customers' own AI assistants can read and write registers through an MCP server and API. KaitoSec GmbH also sells ISMS consulting and certification support. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "iso27001", "dora" ], "frameworks_claimed": [ "ISO 27001", "BSI IT-Grundschutz", "NIS2", "DORA", "SOC 2", "TISAX", "ISO 22301", "ISO 42001", "EU AI Act", "GDPR" ], "tasks": [ "gap-analysis", "control-mapping", "risk-assessment", "evidence-collection", "policy-management" ], "india_relevance": "", "featured": false, "source_url": "https://kaitosec.app/en/platform/ai-assistant", "sources": [ "https://kaitosec.app/en/platform/ai-assistant", "https://kaitosec.app/de/platform/ai-assistant", "https://kaitosec.app/en", "https://kaitosec.app/en/imprint", "https://kaitosec.app/de/terms", "https://kaitosec.app/en/integrations" ], "last_checked": "2026-10-20", "added": "2026-10-19", "integrations": [ "aws", "azure", "gcp", "microsoft-365-entra", "jira" ] }, { "slug": "mindlapse-ernest", "name": "Mindlapse Ernest (agentic Cyber-GRC: compliance, third-party and risk agents)", "vendor": "Mindlapse (Mindlapse SAS)", "hq_country": "France", "hq_region": "europe", "url": "https://www.mindlapse.ai/platform/ernest/", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "French agentic Cyber-GRC operating system whose Ernest engine runs separate planner, collector, adjudicator and writer agents to verify every governance claim (from policies, control owners or vendors) against evidence, connector signals and a cyber knowledge graph, returning sourced verdicts with confidence that are re-checked continuously and accepted or rejected by a human.", "description": "Mindlapse OS is a Paris-built 'agentic Cyber-GRC operating system' with modules for Risk Intelligence (continuous risk analysis from initiative to enterprise), Third-Party Risk Management (context-aware assessments with contradiction detection), Compliance (dozens of frameworks, controls tied to live evidence), board-ready reporting (Cyber Cockpit) and GRCOps (security actions tracked through a lifecycle to verified closure). Ernest is the agentic AI embedded in every module: it suggests what a team would otherwise write (likelihoods, scenarios, treatments, control mappings), scores what needs a number, and verifies governance claims such as 'MFA is enforced on all admin accounts' against uploaded or connected evidence, connector signals and the company's cyber knowledge graph. Planning, collection, adjudication and writing are separate agents with separate responsibilities; each verdict carries a confidence level and matched sources, is written to the audit trail and is re-checked continuously. Mindlapse says Ernest never decides alone: a human accepts or rejects every suggestion. It runs on sovereign open-source LLMs (Mistral) on EU-hosted infrastructure with no training on customer data. Regulations highlighted include NIS2, DORA, the Cyber Resilience Act and the EU AI Act. Pricing is by subscription and not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "dora" ], "frameworks_claimed": [ "NIS2", "DORA", "EU Cyber Resilience Act", "EU AI Act" ], "tasks": [ "control-monitoring", "evidence-collection", "control-mapping", "vendor-risk", "risk-assessment" ], "india_relevance": "", "featured": false, "source_url": "https://www.mindlapse.ai/platform/ernest/", "sources": [ "https://www.mindlapse.ai/platform/ernest/", "https://www.mindlapse.ai/fr/plateforme/", "https://www.mindlapse.ai/", "https://www.mindlapse.ai/legal/legal-notice/", "https://www.mindlapse.ai/pricing/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "noze-datagovern", "name": "noze DataGovern (on-premise compliance agents for NIS2, GDPR and the AI Act)", "vendor": "noze (noze S.r.l.)", "hq_country": "Italy", "hq_region": "europe", "url": "https://www.noze.it/prodotti/datagovern/", "category": "compliance", "categories": [ "compliance", "risk", "privacy" ], "summary": "Italian on-premise platform whose AI agents read company documents and procedures, map them to NIS2, GDPR, AI Act, CRA and DORA obligations, flag gaps and risks with the source linked, and pre-fill registers, evidence and one remediation plan; a person approves every proposal and each confirmed gap becomes an owned task.", "description": "DataGovern is a compliance product from noze, an Italian software and IT services company near Pisa. Its agents connect read-only to shared folders, file servers, mail, repositories and REST/JSON systems, read documents and procedures, compare them with European regulations, sector rules and internal policies, and prepare the compliance work: they flag gaps and risks with the linked source and deliver pre-filled registers, documentation and a single remediation plan across the requirements GDPR, NIS2, the AI Act, the Cyber Resilience Act and DORA have in common. Every proposed change is approved by a person, and each confirmed gap becomes a task with an owner and a deadline. Use cases on the page include EU AI Act readiness (AI system inventory, risk class and technical documentation ready to validate), a NIS2 measures register with incident notification inside the 24/72-hour windows, GDPR records of processing, guided DPIAs and data subject requests with deadlines tracked, plus a 'company brain' that answers questions on documents with the passage cited. It runs on-premise with open-weight LLMs executed locally, and is built on noze's open-source Admina framework (Apache 2.0). Pricing starts with an audit, then an annual licence; no prices are published.", "pricing": "Not published (starts with an audit, then an annual licence)", "pricing_model": "quote", "frameworks": [ "dora" ], "frameworks_claimed": [ "NIS2", "GDPR", "EU AI Act", "EU Cyber Resilience Act", "DORA" ], "tasks": [ "gap-analysis", "control-mapping", "evidence-collection", "ai-governance", "privacy-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.noze.it/prodotti/datagovern/", "sources": [ "https://www.noze.it/prodotti/datagovern/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "data-adhikaar-dpdpa-agents", "name": "Data Adhikaar DPDPA agents (ten-agent compliance fabric)", "vendor": "Data Adhikaar (Qodequay Technologies Pvt. Ltd.)", "hq_country": "India", "hq_region": "india", "url": "https://dapro.in/agents", "category": "risk", "categories": [ "risk", "compliance", "privacy" ], "summary": "India DPDP Act compliance platform run by ten scoped agents for data discovery and RoPA, consent, data principal rights requests, breach response, DPIAs, regulatory intelligence, policy drafting, processor risk and audit evidence, with human approval gates for Board notifications, policy publication and severity downgrades.", "description": "Data Adhikaar is an agentic DPDPA compliance product built by Qodequay Technologies in Pune. Its agents page lists ten agents: Sutradhaar (orchestrator and DPO copilot that coordinates the others and routes escalations), Drishti (continuously scans connected systems, classifies personal data and maintains a live Record of Processing Activities and data-flow map, flagging unregistered children's, financial, health and biometric data), Sammati (consent capture, refresh, expiry, withdrawal and proof, with a decision on every consent check), Adhikari (receives rights requests from portal, email, phone and app, verifies identity, locates the data, fulfils straightforward requests automatically and escalates ambiguous ones within the statutory SLA), Suraksha (opens and classifies breach incidents and drafts Data Protection Board and data principal notifications), Vivek (screens new processing and prepares DPIAs), Vidhi (reads MeitY, Data Protection Board and sector regulator publications and proposes posture updates), Lekhak (drafts notices and policies in English and configured Indian languages), Sambandh (processor inventory, vendor risk scoring and attestation chasing) and Saakshi (assembles audit evidence). Each agent has a least-privilege identity, actions are logged to a tamper-evident Evidence Vault, and Board notifications, policy publication and severity downgrades need explicit human approval. Data residency is the Mumbai region. The site states ISO 27001 certification and SOC 2 Type II (vendor claims). Published plans: Starter from Rs 15,000/month, Growth from Rs 75,000/month (all ten agents), Enterprise custom (Rs 5 lakh+/month), excluding GST, with a 14-day trial.", "pricing": "Starter from Rs 15,000/month (up to 100K data principals); Growth from Rs 75,000/month (up to 5M data principals, all ten agents); Enterprise custom (Rs 5 lakh+/month). Prices exclude GST; 14-day trial.", "pricing_model": "published-tiers", "frameworks": [ "dpdp" ], "frameworks_claimed": [ "DPDP Act 2023" ], "tasks": [ "privacy-management", "consent", "dsr-automation", "data-discovery", "vendor-risk", "evidence-collection" ], "india_relevance": "Indian company (Qodequay Technologies Pvt. Ltd., Hinjawadi Phase 1, Pune) built specifically for India's DPDP Act, with Mumbai-region data residency, notices in Indian languages and INR pricing.", "featured": false, "source_url": "https://dapro.in/agents", "sources": [ "https://dapro.in/agents", "https://dapro.in/", "https://dapro.in/about", "https://dapro.in/pricing", "https://dapro.in/terms" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "riskxchange-the-agency", "name": "RiskXchange The Agency (32 AI agents for third-party risk)", "vendor": "RiskXchange", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.riskxchange.co/agency", "category": "risk", "categories": [ "risk", "security" ], "summary": "AI workforce of five lead agents and 27 specialists that runs third-party risk end to end: vendor outreach, onboarding and questionnaire chasing, document assessment, outside-in breach and score monitoring, regulatory gap analysis and remediation, and regulator-ready reporting, with Manual, Assisted or Autonomous mode set per vendor.", "description": "RiskXchange is a London-headquartered TPRM and security-ratings platform. The Agency is its AI agent workforce: five lead agents, each commanding sub-agents. NOVA (AI Vendor Relationship Manager) runs outreach, onboarding, questionnaire collection, follow-up, renewal and offboarding and is the only agent that communicates with vendors; REX (Risk & Breach Intelligence) scans vendors from the outside and owns continuous monitoring, breach detection and material-change alerts; ARIA (Assessment & Risk Intelligence) reads the documents vendors supply, and its findings are reconciled with REX's into one combined view; TARA (Tiering, Assessment & Remediation) analyses regulatory compliance gaps and assigns remediation; VANCE (Vendor Analysis & Compliance Engine) composes the reports. Autonomy is set per supplier: in Manual mode people do the work; in Assisted mode agents prepare every email, score and remediation task and queue it for approval; in Autonomous mode agents run approved workflows without per-action approval and humans are notified. Framework pages cover DORA, NIS2, ISO 27001, APRA CPS 230, NIST CSF, Cyber Essentials Plus and SOC 2. RiskXchange publishes annual platform tiers (see pricing); its pages don't say which tiers include The Agency.", "pricing": "Platform tiers published: Essentials GBP 14,900/year (50 vendors), Professional GBP 31,500/year (150 vendors), Enterprise from GBP 75,000/year; unlimited seats, no setup fee. The pages don't say which tiers include The Agency.", "pricing_model": "published-tiers", "frameworks": [ "dora" ], "frameworks_claimed": [ "DORA", "NIS2", "ISO 27001", "APRA CPS 230", "NIST CSF", "Cyber Essentials Plus", "SOC 2" ], "tasks": [ "vendor-risk", "questionnaire-automation", "risk-assessment", "remediation", "security-ratings" ], "india_relevance": "", "featured": false, "source_url": "https://www.riskxchange.co/agency", "sources": [ "https://www.riskxchange.co/agency", "https://www.riskxchange.co/faq", "https://www.riskxchange.co/", "https://www.riskxchange.co/pricing" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "co-brain-questionnaire-agent", "name": "Co-Brain Questionnaire Agent (security questionnaire automation)", "vendor": "Co-Brain (Co-Brain GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://co-brain.ai/en/questionnaire-agent", "category": "security", "categories": [ "security", "compliance", "risk" ], "summary": "German agent that completes incoming security questionnaires (vendor assessments, TISAX, ISO 27001, DORA) in Excel, PDF, Word or vendor portals from the customer's policies, certificates and past answers, with a source citation on every answer, consistent answers to re-worded questions, expert routing and team approval.", "description": "Co-Brain's Questionnaire Agent automatically answers security questionnaires using the customer's policies, standards, certificates and past responses, and the team reviews and approves. It detects the format of Excel, PDF and Word files and vendor portal uploads, connects to SharePoint, Google Drive or Confluence (or takes uploaded policies, certificates and TISAX, ISO 27001 or DORA evidence), recognises similarly worded questions to keep answers consistent across questionnaires, and cites the source document and page for every answer. It assigns specific questions to experts and tracks progress and deadlines, routes privacy questions to the data protection officer, and saves approved answers back to the knowledge base. Co-Brain says it is hosted only in EU data centres (private cloud or on-premises on request) and that customer data is not used to train models. Co-Brain also sells RFP, Legal (live separately on Agent Index) and Knowledge agents. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "dora" ], "frameworks_claimed": [ "TISAX", "ISO 27001", "DORA", "GDPR" ], "tasks": [ "questionnaire-automation", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://co-brain.ai/en/questionnaire-agent", "sources": [ "https://co-brain.ai/en/questionnaire-agent", "https://co-brain.ai/en/legal-notice" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "optivalue-questionnaire-agents", "name": "Optivalue.ai questionnaire agents (security questionnaires, TISAX and third-party collection)", "vendor": "Optivalue.ai (Optivalue.ai SAS)", "hq_country": "France", "hq_region": "europe", "url": "https://www.optivalue.ai/en/security-questionnaire-automation/", "category": "security", "categories": [ "security", "risk", "business-ops" ], "summary": "French platform whose agents answer incoming security questionnaires, TISAX catalogues, DDQs and tenders from the customer's own evidence with document, page and version on every answer, score and gap-check the result and draft missing documents with the team before named sign-off, while its Reach product sends questionnaires to suppliers and chases non-responders automatically.", "description": "Optivalue.ai answers the questionnaires companies receive (public tenders and RFPs, security questionnaires, TISAX catalogues, due-diligence questionnaires, customer and ESG questionnaires). Its security-questionnaire flow has seven stages: connect sources, indexing with version history (a 'librarian agent' knows which version of each policy is in force so withdrawn controls aren't quoted), upload the workbook or open the assessment portal through a browser extension, 'the security agents answer' (each answer drafted from the customer's evidence with document, page and version), checks, scores and gap analysis, missing documents drafted with the customer instead of invented, and named sign-off and export. Optivalue Reach handles the other direction: it sends compliance questionnaires to suppliers and partners, automatically chases those who don't reply and shows each third party's status in one place. The site says it has 'GRC expertise ingested into 85 agents' and offers a no-code Agent Builder; deployment can be a private instance, hosted in Germany, or on-premises with air-gap. Pricing is a licence with an included quota of deliverables set by quote; no prices are published.", "pricing": "Not published (licence with an included quota of deliverables, by quote)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "TISAX", "ISO 27001" ], "tasks": [ "questionnaire-automation", "vendor-risk", "gap-analysis" ], "india_relevance": "", "featured": false, "source_url": "https://www.optivalue.ai/en/security-questionnaire-automation/", "sources": [ "https://www.optivalue.ai/en/security-questionnaire-automation/", "https://www.optivalue.ai/en/reach/", "https://www.optivalue.ai/de/sicherheitsfragebogen/", "https://www.optivalue.ai/de/kostenmodell/", "https://www.optivalue.ai/de/impressum/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "zscaler-agentic-soc", "name": "Zscaler Agentic SOC (specialized AI agents for triage, investigation and inline containment)", "vendor": "Zscaler (Zscaler, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.zscaler.com/products-and-solutions/agentic-soc", "category": "security", "categories": [ "security" ], "summary": "AI-first security operations product launched September 2026. Specialized autonomous AI agents triage alerts, investigate root cause, assign evidence-backed verdicts and trigger response workflows, and Zscaler's inline Zero Trust controls can automatically isolate users, block command-and-control traffic and cut off lateral movement.", "description": "Zscaler Agentic SOC (announced and generally available September 9, 2026) unifies alerts from Zscaler and third-party endpoint, identity, email and cloud tools into correlated 'threat stories' using Zscaler's Data Fabric for Security and context graph. Per Zscaler's press release, 'autonomous agents perform dedicated roles across triage, root-cause investigation, assigning verdicts, and triggering response workflows', and closed-loop inline remediation 'automatically contains threats at machine speed' through native Zero Trust Exchange controls (isolating compromised users, blocking C2 and cutting off lateral movement), with outbound actions to third-party tools. The product page says the AI agents show supporting and contradictory evidence for each determination, generate incident summaries and MITRE ATT&CK-mapped attack paths, and recommend impact-based containment. Zscaler says it uses frontier models from Anthropic and OpenAI alongside its own threat intelligence, and offers threat hunting and expert support with Zscaler and Red Canary analysts. Zscaler's ZIA/ZPA Government offerings are FedRAMP authorized, but Agentic SOC is not named in those boundaries. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "case-investigation", "incident-response", "threat-detection" ], "india_relevance": "", "featured": false, "source_url": "https://www.zscaler.com/products-and-solutions/agentic-soc", "sources": [ "https://www.zscaler.com/products-and-solutions/agentic-soc", "https://www.zscaler.com/press/zscaler-launches-agentic-soc-contain-ai-driven-threats" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "aipentix-agentic-security-testing", "name": "AIpentix (agentic continuous security testing and agentic red teaming, by Swipergy)", "vendor": "Swipergy (Swipergy GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://www.aipentix.com/en/", "category": "security", "categories": [ "security" ], "summary": "German continuous security-testing platform with an AI agent that signs in to the customer's application on its own, chooses follow-up checks and documents attack paths, with every tool run evidenced. Findings are grouped into remediation actions with owners, deadlines and Jira sync, and retests confirm fixes. Agentic red-team campaigns (recon, access, lateral and report agents led by human red teamers) are also offered for TIBER-EU and DORA TLPT style testing.", "description": "AIpentix is built by Swipergy GmbH (H\u00f6chstadt an der Aisch, Bavaria). The AIpentix Security Center continuously tests ports, TLS/SSH, web vulnerabilities, email protection and attack surface with tools such as nmap, testssl.sh, nuclei, checkdmarc and subfinder, on a schedule or on demand. Per the site, its 'AI agent with evidence' 'signs in to your application on its own, chooses follow-up checks and documents attack paths', with each tool run backed by timestamp, exit code and checksum. Findings become remediation actions with owners and deadlines and sync to Jira Cloud. A closed ticket triggers an automatic retest, and a regression reopens the action. Monthly evidence and management reports come in German and English, as PDF and HTML. Asset ownership is verified by DNS TXT record or file before testing, and the LLM budget can be capped. As a service, Swipergy runs agentic red teaming (full-scope, LLM/agent red teaming and critical-infrastructure/TLPT) in which recon, access, lateral and report agents work in parallel under human red teamers. The site names TIBER-EU, DORA TLPT, CBEST, CORIE and NERC CIP. Pricing is not published: the platform is priced by monitored assets and testing scope, and red-team campaigns at a fixed price.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "dora" ], "frameworks_claimed": [ "DORA TLPT", "TIBER-EU" ], "tasks": [ "pen-test-management", "attack-surface", "vulnerability-management", "remediation" ], "india_relevance": "", "featured": false, "source_url": "https://www.aipentix.com/en/", "sources": [ "https://www.aipentix.com/en/", "https://www.aipentix.com/impressum.html" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "zefort-agent", "name": "Zefort Agent (agentic CLM assistant for contract review, redlining and follow-up; beta)", "vendor": "Zefort (Zefort Oy)", "hq_country": "Finland", "hq_region": "europe", "url": "https://zefort.com/zefort-agent/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Agent built into the Zefort contract-management platform that takes assigned contract work (reviewing and redlining agreements, comparing contract sets, finding risks or missing information) and turns findings into suggested updates to metadata, parties, binders, tasks and reminders that a person approves before they are applied.", "description": "Zefort is a Finnish contract lifecycle management platform (repository, contract intelligence, e-signatures, templates, playbooks). Zefort Agent, labelled BETA on its product page and billed as 'Agentic CLM', lets users ask questions or assign a task; the agent searches contracts, binders and metadata in the workspace, reviews agreements, evaluates findings and prepares recommendations and next steps, showing the reasoning behind each conclusion. With the user's approval it can apply suggested changes to contract metadata, parties, contract details, binders, tasks and reminders. It respects existing Zefort access rights and can run on a model chosen by the customer (OpenAI, Anthropic, Mistral or Azure OpenAI). The pricing page describes it as moving 'from questions and answers to tasks and outcomes' and able to review and redline agreements. Zefort Agent is included in the Enterprise and Enterprise+ plans and is an add-on to Team; it is not sold standalone.", "pricing": "Published plans (excl. VAT): Enterprise, which includes Zefort Agent, is EUR 2,395/month or EUR 1,995/month billed annually; Enterprise+ is EUR 4,795/month or EUR 3,995/month billed annually; Team (EUR 1,195 or 995/month) can add Zefort Agent as an add-on. One-off onboarding fee EUR 1,995.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://zefort.com/zefort-agent/", "sources": [ "https://zefort.com/zefort-agent/", "https://zefort.com/pricing/", "https://zefort.com/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "orcha-finance-agents", "name": "Orcha AI agents for finance (Accounts Payable, Receivables, Approvals, Close & Reconciliation and more)", "vendor": "Orcha (Orcha GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://getorcha.com/en/agenten/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Berlin 'agentic ERP' whose finance agents capture, validate, GL-code, 3-way-match and post vendor invoices (with VAT checks, fraud/anomaly and sanctions screening), handle receivables, approvals and daily bank/intercompany/VAT reconciliation inside DATEV, SAP, Dynamics or Xero, escalating low-confidence decisions to a person.", "description": "Orcha runs a set of coordinated AI agents for European finance teams: Accounts Payable, Accounts Receivable (billing, dunning, revenue recognition), Document Management, Contract Management (obligations, renewals), Approvals, Close & Reconciliation (bank, intercompany and VAT, daily), Variance Analysis and FP&A, with Procurement in beta. The AP agent performs formal and tax validation, GL account and cost-centre coding, 2/3-way matching against POs and goods receipts, fraud and anomaly detection (split invoices, changed bank details, duplicates) and vendor master-data matching, then exports postings to the ERP or DATEV after approval with an audit trail. Every decision carries a confidence score and plain-text reasoning; below a configurable threshold the item goes to a human in an Orchestrator queue. Orcha can run as the system of record ('agentic ERP') or as an agent layer on top of DATEV, SAP, Microsoft Dynamics 365 or Xero, and exposes data to Copilot, Claude or ChatGPT via MCP. Hosted in Germany. Straight-through and close-time figures on the site are vendor claims.", "pricing": "Not published (volume-based offer after a setup review; self-serve sign-up offered)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "fraud-detection" ], "india_relevance": "", "featured": false, "source_url": "https://getorcha.com/en/agenten/", "sources": [ "https://getorcha.com/en/agenten/", "https://getorcha.com/en/produkt/kreditoren", "https://getorcha.com/en/", "https://getorcha.com/en/imprint/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "serrala-ai-agents", "name": "Serrala AI agents (governed AP, AR and payments agents in the Serrala Finance Platform)", "vendor": "Serrala (Serrala Group GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://www.serrala.com/serrala-ai-finance-solutions", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Purpose-built finance agents inside the Serrala Finance Platform that interpret context, decide the next best action within defined policies and execute AP, AR and payments tasks across systems (for example resolving AP price variances and matching and allocating unmatched incoming payments), with human-in-the-loop oversight and an auditable record of every action.", "description": "Serrala is a German finance-automation vendor (AP, AR/cash application, credit and collections, payments, treasury), widely used with SAP. On April 23, 2026 it launched AI-powered agents in the Serrala Finance Platform, described as purpose-built agents that interpret context, determine the next best action within defined policies and execute tasks across systems while finance teams keep control through human-in-the-loop oversight. Examples given are agents that resolve price variances in accounts payable by gathering context, applying policy rules, routing approvals when required and progressing work to completion, and agents that identify, match and allocate previously unmatched payments in accounts receivable, using multi-agent orchestration with handoffs for exceptions. Serrala's AI solutions page says its agentic AI validates and posts invoices or routes them for approval or exception handling, extracts and enriches invoice data, matches payments for cash application, and supports credit/risk decisions and collections prioritisation. Automation rates on the pages are vendor claims.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.serrala.com/news/serrala-launches-governed-ai-agents-to-accelerate-the-shift-to-autonomous-finance", "sources": [ "https://www.serrala.com/news/serrala-launches-governed-ai-agents-to-accelerate-the-shift-to-autonomous-finance", "https://www.serrala.com/serrala-ai-finance-solutions", "https://www.serrala.com/legal-information", "https://www.serrala.com/about-us" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "floqast-transform-ai-agents", "name": "FloQast Transform AI agents (accounting close agents built from finished work, plus prebuilt agents)", "vendor": "FloQast (FloQast, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.floqast.com/close-ai/products/ai-agents", "category": "business-ops", "categories": [ "business-ops", "compliance" ], "summary": "Close-management platform whose Transform AI agents run accounting workflows end to end (reconciliations, journal entries, close tasks); Transform can rebuild a finished close into a governed, documented agent tested against approved numbers, and each agent needs accountant sign-off before it runs.", "description": "FloQast is an accounting workflow automation platform (close checklist, account reconciliations, journal entries, accounting operations, compliance). FloQast Transform lets teams hand over files from a close they have already finished, or describe inputs and outputs, and builds an AI agent that runs that process: documented, verified against numbers the team already approved, and signed off by an accountant before it runs. Agents are assembled from reusable accounting Skills (fetch a trial balance, create a journal entry, validate data, post the reconciliation), and prebuilt agents cover common close work and can be tailored to accounts, entities and policies. Transform captures audit evidence as it works. At TakeControl 2026 (Sep 16, 2026) FloQast also announced an AI Assistant on every page (first used for journal-entry review), FloQast Detect anomaly monitoring, and plans to wrap agents in COSO GenAI governance. Pricing is by quote.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "audit-management", "workflow-automation" ], "india_relevance": "FloQast lists an office in Pune, Maharashtra, India on its contact page.", "featured": false, "source_url": "https://www.floqast.com/close-ai/products/ai-agents", "sources": [ "https://www.floqast.com/close-ai/products/ai-agents", "https://www.floqast.com/uk/press-releases/floqast-takecontrol-2026-ai-accounting-innovations", "https://www.floqast.com/contact" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "blackline-verity-ai-agents", "name": "BlackLine Verity AI agents (Verity Prepare multi-agent reconciliation, Verity Accruals and other close agents)", "vendor": "BlackLine (BlackLine, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.blackline.com/products/verity-ai/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Suite of specialised AI agents in BlackLine's financial close platform; Verity Prepare (GA July 2026) is a multi-agent system that ingests supporting documents, matches transactions, isolates anomalies, explains variances and assembles audit-ready reconciliation packages for human approval, and Verity Accruals automates the accruals process.", "description": "BlackLine (Nasdaq: BL) sells financial close and accounting automation (Record-to-Report and Invoice-to-Cash), now positioned as an 'Agentic Financial Operations Platform' powered by Studio360 and Verity AI. Its Verity AI page describes Verity as a suite of specialised AI agents that handle transaction matching, reconciliations and accruals, plus Verity Forecast and Verity Insights for cash-flow prediction and plain-English queries. Verity Prepare, announced generally available on July 27, 2026 after an early-adopter programme, is a multi-agent system that analyses supporting documentation, matches transactions, identifies reconciling items, writes variance explanations and compiles audit-ready reconciliations. Each recommendation carries reasoning, confidence scoring and an audit trail, and humans approve outcomes. The June 25, 2026 release added governance tooling for AI agents across the platform. BlackLine says it holds ISO 42001 certification (vendor claim). On the FedRAMP Marketplace, 'BlackLine Government Solution' is listed as Agency In Process (Moderate), not Authorized, so FedRAMP is recorded as claimed only. Time-saving figures are vendor claims.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "FedRAMP (BlackLine Government Solution: Agency In Process, Moderate)", "ISO 42001" ], "tasks": [ "process-automation", "audit-management", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.blackline.com/products/verity-ai/", "sources": [ "https://www.blackline.com/products/verity-ai/", "https://www.blackline.com/about/press-releases/2026/blackline-advances-governed-ai-for-finance-with-general-availability-of-verity-prepare/", "https://www.blackline.com/about/press-releases/2026/blackline-expands-agentic-financial-operations-platform-establishing-the-trust-infrastructure-for-ai-powered-finance/", "https://www.blackline.com/contact/", "https://www.fedramp.gov/marketplace/products/FR2507664687/" ], "last_checked": "2026-10-19", "added": "2026-10-19", "authorizations": [ { "program": "fedramp", "status": "Agency In Process", "product": "BlackLine Government Solution", "id": "FR2507664687", "impact": "Moderate", "date": "2025-11-05", "scope": "platform-only", "source_url": "https://www.fedramp.gov/marketplace/products/FR2507664687/", "checked": "2026-10-19" } ] }, { "slug": "actico-compliance-ai-agents", "name": "ACTICO Compliance Solutions AI agents (KI-Agenten for AML, customer and payment screening)", "vendor": "ACTICO (ACTICO GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://www.actico.com/de/loesungen/compliance-fraud-management/", "category": "risk", "categories": [ "risk" ], "summary": "Rules-based AML, customer screening, payment screening and market-abuse software for banks and insurers in which AI agents do the research, analysis and documentation work (for example adverse-media checks on screening hits) inside the platform's governance, with the compliance analyst making the final decision.", "description": "ACTICO Compliance Solutions are a standard software family for anti-money laundering, customer screening (sanctions, PEP and adverse-media lists), payment screening and market-abuse detection, with integrated case management and goAML FIU reporting. Since September 2026 ACTICO places AI agents (KI-Agenten) inside these compliance processes: per ACTICO, the agents take over time-consuming preparatory work (research, analysis and documentation), while governance, roles, permissions and audit trails stay in the ACTICO platform and the final decision stays with the compliance expert. The worked example ACTICO publishes is adverse-media research in customer screening, from the screening hit through checking regulatory relevance to the analyst's documented decision; ACTICO names AML clarification support, FIU reporting, payment screening, regulatory analysis and completeness checks as further application areas. Institutions can choose which language model the agents use and where they run (including their own data centre or European infrastructure). Efficiency figures in ACTICO's whitepaper are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "EU AML package (AMLR)" ], "tasks": [ "aml", "kyc", "alert-triage", "case-investigation", "sar-narratives" ], "india_relevance": "", "featured": false, "source_url": "https://www.actico.com/de/news/actico-bringt-ki-agenten-kontrolliert-in-die-compliance/", "sources": [ "https://www.actico.com/de/loesungen/compliance-fraud-management/", "https://www.actico.com/de/news/actico-bringt-ki-agenten-kontrolliert-in-die-compliance/", "https://www.actico.com/de/impressum/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "dataleon-leon-kyb-kyc-agent", "name": "Dataleon L\u00e9on (AI agent for KYB/KYC file review with multi-agent verification, screening and follow-ups)", "vendor": "Dataleon (Dataleon SAS)", "hq_country": "France", "hq_region": "europe", "url": "https://www.dataleon.ai/plateforme/agent-ia", "category": "risk", "categories": [ "risk" ], "summary": "French KYB/KYC compliance platform whose agent L\u00e9on pre-audits pending customer files, has KYC and KYB 'workers' review them and recommend the next step from the firm's past decisions, and launches specialised agents in parallel for identity verification, sanctions/PEP screening and customer follow-ups, with analysts making the final decision.", "description": "Dataleon is a Paris-based KYB/KYC platform (document reading, identity verification with liveness, company registers and beneficial owners, sanctions/PEP/adverse-media screening, scoring rules, ongoing monitoring and periodic re-checks, white-label onboarding portal, EU hosting). Its AI agent L\u00e9on pre-audits each file awaiting verification (summary, points of attention, missing documents); KYC and KYB workers review files and recommend the action to take based on the institution's own decision history, with an explanation (rules applied, documents analysed, similar files); and L\u00e9on routes and launches multi-agent operations (identity verification, screening, customer reminders) in parallel according to each file's needs. Analysts keep the decision: each action is validated and logged in the audit trail. Time-saved and acceptance-rate figures on the page are vendor claims. A 15-day free trial is mentioned on the pricing page; prices are not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "GDPR", "EU AMLR" ], "tasks": [ "kyc", "aml", "case-investigation", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.dataleon.ai/plateforme/agent-ia", "sources": [ "https://www.dataleon.ai/plateforme/agent-ia", "https://www.dataleon.ai/", "https://www.dataleon.ai/mentions-legales", "https://www.dataleon.ai/tarifs" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "censinet-risk-assessor-agent", "name": "Censinet Risk Assessor Agent (Assessor Agent for Supply Chain and Vendor Risk, Censinet GRC AI)", "vendor": "Censinet", "hq_country": "United States", "hq_region": "north-america", "url": "https://censinet.com/capabilities/third-party-risk", "category": "risk", "categories": [ "risk" ], "summary": "Healthcare third-party risk agent in Censinet RiskOps that reviews vendor questionnaire responses and supporting documents (such as SOC 2 and penetration-test reports), captures integration details from requests, identifies findings and drafts assessment reports and corrective action plans for the risk assessor to validate.", "description": "Censinet sells Censinet RiskOps, a cloud risk exchange and third-party risk platform built for healthcare organisations. The Assessor Agent for Supply Chain and Vendor Risk, announced at ViVE 2026 (Feb 23, 2026) as the first generally available agent of the seven-agent Censinet GRC AI roadmap, orchestrates and completes the documentation-heavy steps of a vendor assessment: it captures technical integration details from business-owner request forms and vendor questionnaire responses, summarises uploaded documents such as SOC 2 reports and penetration-test results, generates findings for corrective action plans and drafts the summary report. Censinet says the agent runs inside its own private AI infrastructure, customer data is not used to train third-party models, and the human analyst reviews, validates and approves all agent output. The other six GRC AI agents (enterprise risk, cybersecurity, finance, clinical, ESG) are a roadmap and are not part of this listing. Time-saving figures (3.5 hours per assessment; up to 66% on key workflows) are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "vendor-risk", "risk-assessment", "questionnaire-automation", "evidence-collection" ], "india_relevance": "", "featured": false, "source_url": "https://www.censinet.com/blog/censinet-unveils-censinet-grc-ai-tm-vision-and-delivers-major-platform-innovations-for-healthcare-risk-management-at-vive-2026", "sources": [ "https://censinet.com/capabilities/third-party-risk", "https://www.censinet.com/blog/censinet-unveils-censinet-grc-ai-tm-vision-and-delivers-major-platform-innovations-for-healthcare-risk-management-at-vive-2026" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "hybridity-compliance-agents", "name": "Hybridity compliance execution platform agents (policy-to-control registry, scheduled evidence and batch contract checks)", "vendor": "Hybridity (Hybridity AB)", "hq_country": "Sweden", "hq_region": "europe", "url": "https://www.hybridity.ai/platform", "category": "compliance", "categories": [ "compliance" ], "summary": "Swedish compliance execution platform for regulated firms that turns a company's own policies into a requirement registry, checks it against DORA, NIS 2, GDPR or customer demands, and hands routine work to agents (contracts checked in batches, evidence collected on schedule, updates computed when a rule changes), with a person approving every result.", "description": "Hybridity reads a firm's policies and documents in any format or language and structures them into one requirement registry, with every rule traced to its clause, for people to approve. Regulations, standards or contracts (DORA, NIS 2, GDPR, a customer's security demands) are then run as row-by-row checks against that registry, marking each item verified, covered, partial or gap. Controls issue tasks to named owners on a cadence, and AI checks each evidence submission against the requirement on arrival and explains what looks right, missing or risky. Per the platform page, Hybridity then 'runs the routine, with a person approving every result': agents check contracts in batches, collect evidence on schedule and compute the updates the week a rule changes. Customer results quoted on the site (for example a mid-size bank's legal-review cost reduction) are vendor claims. Hybridity states it is ISO 27001 certified (vendor claim). Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "dora" ], "frameworks_claimed": [ "DORA", "NIS2", "GDPR", "ISO 27001 (vendor's own certification)" ], "tasks": [ "gap-analysis", "control-mapping", "evidence-collection", "policy-management", "contract-review" ], "india_relevance": "", "featured": false, "source_url": "https://www.hybridity.ai/platform", "sources": [ "https://www.hybridity.ai/platform", "https://www.hybridity.ai/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "command-zero-agent-zero", "name": "Command Zero Agent Zero (autonomous security analyst)", "vendor": "Command Zero (Command Zero, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.commandzero.ai/agent-zero", "category": "security", "categories": [ "security" ], "summary": "Autonomous and AI-assisted SOC investigation platform from Austin, Texas. Its LLM agent, Agent Zero, investigates alerts end to end across identity, endpoint, cloud, email and SaaS, auto-closes routine cases with documented reasoning, and escalates the rest with a replayable chain of evidence for analysts to confirm or override.", "description": "Command Zero describes itself as an autonomous and AI-assisted SOC platform that runs the investigation lifecycle from alert to verdict. Agent Zero, its 'Lead Autonomous Security Analyst', is described as a large language model orchestrating structured tool use under customer-controlled policy (not a chatbot or playbook engine). It investigates alerts end to end across identity, endpoint, cloud, email and SaaS data, pivots across systems (for example from a phishing alert to credential, identity, cloud-permission and endpoint questions), switches hypotheses when new evidence appears, documents why false positives were closed, and routes the subset that needs a human with the evidence attached. The homepage says Triage & Prioritization Agents investigate alert volume autonomously and auto-close routine cases with documented reasoning. Data is queried where it lives (federated, no ingestion pipeline) across SIEMs and data lakes such as Splunk SPL, KQL, ES|QL and Snowflake SQL. Command Zero ships thousands of pre-built investigative questions written by its research team. Customers set which verdict types need human sign-off. Agent Zero's stated function is limited to running queries, drawing conclusions and documenting the work, so containment actions are not claimed. Case counts (500,000+ a year) and the SOC 2 Type II audit of its audit trail are the vendor's statements. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "case-investigation", "threat-detection" ], "india_relevance": "", "featured": false, "source_url": "https://www.commandzero.ai/agent-zero", "sources": [ "https://www.commandzero.ai/agent-zero", "https://www.commandzero.ai/", "https://www.commandzero.ai/company", "https://www.commandzero.ai/contact", "https://www.commandzero.ai/privacy" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "bricklayer-ai-security-agents", "name": "Bricklayer AI security agents (agentic platform for the AI security workforce)", "vendor": "Bricklayer AI (Bricklayer AI Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.bricklayer.ai/platform/", "category": "security", "categories": [ "security" ], "summary": "Agentic cybersecurity platform that deploys, coordinates and governs teams of role-based and tool-specialist AI agents to triage alerts, investigate incidents, run threat-intelligence and threat-hunting work and track vulnerability remediation inside analyst-approved procedures, with every agent action auditable.", "description": "Bricklayer AI (headquartered in Arlington, Virginia, with an R&D centre in Atlanta) calls its product 'the operating platform for the AI security workforce'. Analysts define a goal, and Bricklayer assembles the right AI agents, data and context and coordinates their actions within defined operating procedures. Teams can choose prebuilt agents or build custom ones: Role-Based Agents 'know the job' and SME Agents 'know the tools', and they share context and reusable procedures. Bricklayer can generate an auditable, task-based workflow from a stated goal, and 'agents execute, humans oversee'. Use cases on the site cover alert triage and response across endpoint, identity and cloud, incident investigation with coordinated AI case management, vulnerability prioritisation and remediation tracking, threat-intel collection, analysis and dissemination, and proactive hunt missions. Integrations run over MCP and APIs, and roles, permissions and runtime policies control what agents may do. A 2026 'Agentic Approvals' feature lets teams delegate authority to act. MSSP use is supported. Figures such as 60\u201390% less investigation time and 665,000+ analyst hours saved are the vendor's claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "case-investigation", "incident-response", "threat-intelligence", "vulnerability-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.bricklayer.ai/platform/", "sources": [ "https://www.bricklayer.ai/platform/", "https://www.bricklayer.ai/", "https://www.bricklayer.ai/company/", "https://www.bricklayer.ai/contact/", "https://www.bricklayer.ai/privacy-policy/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "ontinue-ion-agentic-mxdr", "name": "Ontinue ION MXDR autonomous investigations (agentic AI SOC for Microsoft Defender and Sentinel)", "vendor": "Ontinue (Ontinue AG)", "hq_country": "Switzerland", "hq_region": "europe", "url": "https://www.ontinue.com/first-to-launch-agentic-ai-mdr/", "category": "security", "categories": [ "security" ], "summary": "Zurich-headquartered managed detection and response provider for Microsoft Defender and Sentinel whose ION MXDR service uses a team of AI agents to run autonomous Tier 2-level incident investigations (aggregate telemetry, form and test hypotheses) before handing a step-by-step summary to an Ontinue Cyber Defender.", "description": "Ontinue's ION is a Microsoft-focused managed extended detection and response (MXDR) service. Its press release says autonomous investigations powered by agentic AI have been live in production for every customer since December 2024. When an incident is escalated to the Ontinue Cyber Defense Center, 'a team of AI agents automatically aggregates telemetry, forms and tests hypotheses, and conducts a full investigation', work Ontinue says would typically need a Tier 2/3 analyst. The result is a detailed summary with step-by-step logic that is passed to a human Cyber Defender. Ontinue says this cut mean time to investigate by up to 50% and that it resolves 99.5% of incidents without customer involvement (vendor claims). The ION IQ layer learns each customer's environment, people and operations using Ontinue's own models plus Azure OpenAI, and Ontinue says customer data never flows into third-party models. This is a managed service: the AI agents investigate and Ontinue's analysts decide and respond. Add-ons cover enhanced phishing protection and vulnerability mitigation. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "case-investigation", "incident-response", "threat-detection" ], "india_relevance": "", "featured": false, "source_url": "https://www.ontinue.com/first-to-launch-agentic-ai-mdr/", "sources": [ "https://www.ontinue.com/first-to-launch-agentic-ai-mdr/", "https://www.ontinue.com/ion-mxdr-service/ion-iq/", "https://www.ontinue.com/corporate-information/", "https://www.ontinue.com/ontinue-opens-new-zurich-headquarters/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "depthfirst-autonomous-security-agents", "name": "depthfirst autonomous security agents (code, supply chain, secrets and agentic pentesting)", "vendor": "depthfirst (DepthFirst AI, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://depthfirst.com/", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "San Francisco application-security platform whose autonomous AI agents trace business logic and data flows to find exploitable code vulnerabilities, check dependency reachability and secrets, review pull requests with proposed fixes, and run agentic pentests against running applications, re-running each attack after a fix merges to confirm it is closed.", "description": "depthfirst says it combines deep context from code to production with 'autonomous AI agents that continuously discover, fix, and prevent security risks'. Its code product reasons about business logic, data flows and cross-service interactions to replace traditional SAST. Supply-chain analysis traces each dependency to the code that calls it, so only reachable vulnerabilities are surfaced. It also validates secrets across code, CI/CD and runtime, and a Dependency Firewall detects malicious packages. A PR reviewer proposes concrete code changes in the pull request (per customer quotes on the homepage). In Agentic Pentesting, AI agents authenticate, navigate UIs and APIs and chain requests to run real attack paths against running applications (white-, grey- or black-box), testing for issues such as prompt injection, IDOR and vulnerability chains. Static findings are linked to runtime exploitation evidence in one timeline, and each attack is replayed after the fix merges, so a vulnerability counts as resolved only when the same attack fails. Customer names on the site (e.g. Moveworks, Supabase, AngelList, Chainguard) are the vendor's. Pricing is not published (no pricing page).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "sca", "secrets-detection", "pr-review", "remediation", "pen-test-management" ], "india_relevance": "", "featured": false, "source_url": "https://depthfirst.com/", "sources": [ "https://depthfirst.com/", "https://depthfirst.com/agentic-pentesting", "https://depthfirst.com/legal/privacy-policy" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "nullify-autonomous-product-security", "name": "Nullify autonomous product-security agents (find-to-fix with merge-ready PRs and AI Pentest Agent)", "vendor": "Nullify (Nullify Holdings Pty Ltd)", "hq_country": "Australia", "hq_region": "australia-new-zealand", "url": "https://www.nullify.ai/", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Australian 'autonomous system of agents' for product security that covers code, secrets, API pentesting and exploit validation. It proves findings with reproducible evidence, scores them against the customer's assets, writes merge-ready fix PRs routed to code owners, and runs remediation campaigns through Jira and Slack until merge, with the customer keeping final merge approval.", "description": "Nullify describes itself as an autonomous system of agents that takes product-security tasks through to closure, standing in for SAST, SCA, DAST, secret, container and IaC scanning, bug bounty triage and ASPM work. In its find-to-fix loop, agents validate that a finding is real (reachability, exposure and reproducible evidence) and triage it against the customer's assets, data sensitivity and threat model ('Vault'). They then write a merge-ready pull request, route it to the right owner, refine it until CI is green, and confirm the merge before closing the item. Campaigns handle bulk work across repositories and teams: they read code ownership from Compass and sprint capacity from Jira, escalate in Slack when an SLA is at risk, and follow up until merge. The product menu also lists an AI Pentest Agent for continuous API pentesting and Exploit Validation. Humans keep final merge approval, and changes to shared code are flagged for owner sign-off. Outcome figures (e.g. 89% merge-ready rate, 10,781 vulnerabilities fixed) are the vendor's claims. Nullify says it prices on the work it performs, scoped per program, not on seats. No price list is published.", "pricing": "Not published. Nullify says it prices on work performed (scoped program and estimated volume), not seats or license tiers.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "sca", "secrets-detection", "remediation", "vulnerability-management", "pen-test-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.nullify.ai/", "sources": [ "https://www.nullify.ai/", "https://www.nullify.ai/pentest-agent", "https://www.nullify.ai/pricing", "https://www.nullify.ai/legal" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "check-point-agentic-exposure-validation", "name": "Check Point Agentic Exposure Validation (AEV, AI agents that prove external exploitability)", "vendor": "Check Point Software Technologies", "hq_country": "Israel", "hq_region": "middle-east", "url": "https://www.checkpoint.com/solutions/agentic-exposure-validation/", "category": "security", "categories": [ "security" ], "summary": "Part of Check Point Exposure Management, launched May 28, 2026. AI agents reason like attackers across an organisation's external attack surface, correlating exposures, leaked credentials, CVE and live exploit research with existing protection coverage, then safely prove, pivot on, or discard each finding, so teams get evidence of what is actually exploitable.", "description": "Agentic Exposure Validation (AEV) runs AI agents that analyse an asset, technology, CVE, credential or exposed code. The agents enrich it with live Check Point threat intelligence and exploit research, check whether existing controls already block the path, and build a targeted, non-disruptive validation that mirrors attacker reasoning. AEV then reports the exposure as proven with direct evidence, pivots to a new path when blocked, or deletes unproven findings instead of passing on noise. A separate AI reviewer evaluates each probe for safety, novelty, accuracy and exploit depth before it runs. Check Point positions AEV as the validation step of a continuous threat exposure management (CTEM) programme alongside its threat intelligence, vulnerability prioritisation and safe remediation modules. The launch release says AEV produced novel exploits for dozens of vulnerabilities that had no known public exploit in early engagements (vendor claim). AEV is available now as part of Check Point Exposure Management, and Check Point offers a complimentary AEV scan of the external attack surface. Check Point's government cloud authorisations (Infinity Platform for Government) do not name AEV, so no registry status is recorded. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "attack-surface", "exposure-management", "pen-test-management", "vulnerability-management", "threat-intelligence" ], "india_relevance": "", "featured": false, "source_url": "https://www.checkpoint.com/solutions/agentic-exposure-validation/", "sources": [ "https://www.checkpoint.com/solutions/agentic-exposure-validation/", "https://www.checkpoint.com/press-releases/check-point-software-launches-agentic-exposure-validation-to-counter-frontier-ai-models-now-capable-of-autonomous-exploitation/", "https://www.checkpoint.com/about-us/", "https://www.checkpoint.com/about-us/contact-check-point/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "ridge-security-ridgegen", "name": "Ridge Security RidgeGen (agentic AI red teaming) and RidgeBot", "vendor": "Ridge Security (Ridge Security, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://ridgesecurity.ai/ridgegen/", "category": "security", "categories": [ "security" ], "summary": "Offensive-security vendor from Milpitas, California. Its on-premises, model-agnostic RidgeGen agent does agentic AI red teaming: it reasons through multi-step attack chains to find business-logic and non-CVE risks, verifies every finding with reproducible exploit evidence, gives fix guidance and re-runs to confirm fixes. It sits alongside RidgeBot automated pentesting.", "description": "Ridge Security says its agentic platform 'continuously finds, proves, and fixes risks through bounded, evidence-backed validation'. It has two products. RidgeBot is continuous, production-safe, machine-learning-based penetration testing with CVE-centric coverage aligned to OWASP and MITRE. RidgeGen is 'agentic AI red teaming that augments your human team'. It reasons through multi-step attack chains to surface business-logic and non-CVE vulnerabilities and runs an autonomous verification step, so a finding is only reported when artifacts and evidence support the target, severity and exploitability. It provides evidence-backed guidance to fix the code behind each finding, and a re-run button verifies the fix. RidgeGen deploys as a virtual machine inside the customer's network and is model-agnostic: it can use the customer's frontier-model enterprise API key or a self-hosted open-source model, so data, credentials and IP stay inside the boundary. Ridge says safety-critical policies are enforced outside model discretion, and that the customer's team directs testing and owns the decision to fix. Customer outcomes quoted on the site are the vendor's claims. RidgeBot is sold through the Azure and AWS marketplaces; prices were not checked and are not published on Ridge's own pages.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pen-test-management", "attack-surface", "vulnerability-management", "exposure-management" ], "india_relevance": "", "featured": false, "source_url": "https://ridgesecurity.ai/ridgegen/", "sources": [ "https://ridgesecurity.ai/ridgegen/", "https://ridgesecurity.ai/", "https://ridgesecurity.ai/company/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "keelvar-kai-sourcing-agents", "name": "Keelvar Kai and autonomous sourcing agents (Sourcing, RFI and Optimal Close agents)", "vendor": "Keelvar (Keelvar Systems Ltd)", "hq_country": "Ireland", "hq_region": "europe", "url": "https://www.keelvar.com/kai", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Procurement sourcing platform whose AI orchestrator, Kai, takes plain-language requests and hands them to specialised agents that run sourcing events end to end (intake, supplier selection, event creation, multi-round bidding and award) under rules the procurement team sets.", "description": "Keelvar is an AI-native sourcing optimisation and autonomous sourcing vendor founded in Cork in 2012. Kai, its AI orchestrator, sits across the platform: a user describes what they need, Kai picks the right sourcing agent and hands off to it to run the full event end to end (intake, event creation, supplier selection, award). Named agents include a Sourcing agent, an RFI Agent that generates the RFI question set and response settings from a prompt, and an Optimal Close agent that uses machine learning to set bid duration and auto-close rules. Kai can also build optimisation scenarios from plain language and route users to events, rates or agents. On the Autonomous Sourcing page, prebuilt category agents handle intake, supplier recommendation, event creation, multi-round bidding and award/reporting for tactical and tail spend; 'your team sets the rules, the agent applies them every time', and intake can be triggered without human input. Savings and cycle-time figures are vendor claims. Pricing is not published (demo/pricing by request).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://www.keelvar.com/kai", "sources": [ "https://www.keelvar.com/kai", "https://www.keelvar.com/autonomous-sourcing", "https://www.keelvar.com/about-us", "https://www.keelvar.com/privacy-policy" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "trintech-ai-agents", "name": "Trintech AI agents (Variance Analysis, Flux, Exception Management, Accruals Intelligence and Data Access agents)", "vendor": "Trintech (Trintech, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.trintech.com/agentic-ai/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Financial-close platform (Cadency, Adra) with five AI agents that investigate variances and account fluctuations, triage and root-cause reconciliation exceptions, generate and roll forward accruals, and build governed data pipelines, keeping evidence, approvals and audit trails for reviewers.", "description": "Trintech's agentic AI covers the record-to-report close. The Variance Analysis Agent analyses balances across periods, identifies material changes, explains likely drivers and writes reviewer-ready narratives with evidence. The Flux Agent does period-over-period fluctuation analysis across entities, currencies and hierarchies. Three agents launched at Trintech Connect on September 28, 2026: the Exception Management Agent identifies, classifies and prioritises exceptions in transaction matching and reconciliation, investigates each one, names a likely root cause with a confidence score and gathers supporting evidence, grouping related exceptions; the Accruals Intelligence Agent recommends accrual amounts from historical patterns, flags estimates outside trends, tracks true-ups and reversals and its own accuracy; and the Data Access Agent retrieves, cleans and reshapes data from hard-to-reach sources (including login-only and MFA-gated systems) into governed pipelines for Cadency, Adra and ReconNET. Every action and every step held for a person is logged. Existing customers get the agents through their account manager. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "audit-management", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.trintech.com/agentic-ai/", "sources": [ "https://www.trintech.com/agentic-ai/", "https://www.trintech.com/news/trintech-launches-three-new-ai-agents-to-advance-governed-autonomous-finance/", "https://www.trintech.com/office-and-locations/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "kyriba-tai-agentic-treasury", "name": "Kyriba TAI (Trusted AI agentic treasury assistant with Skills)", "vendor": "Kyriba", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.kyriba.com/products/agentic-ai-tai/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Agentic AI embedded in Kyriba's treasury and payments platform that queries live treasury data, analyses variances, tracks and reconciles payments, runs reusable Skills (operations checks, data validations, ISO 20022 address audits, compliance reviews) and prepares and executes actions such as money-market investments and stablecoin payments only with explicit approval.", "description": "TAI is Kyriba's agentic AI for treasury and finance, built on an embedded LLM so customer data stays in the platform and is not used for training. Users query treasury data in plain language, analyse variances, generate CFO-ready reports and treasury health checks, and cross-check payment status against bank confirmations and actuals. Skills turn recurring tasks into repeatable workflows that teams share (for example daily operations checks, data validations, cash optimisation routines, compliance reviews and AI-guided ISO 20022 address auditing). For orchestration, TAI retrieves data, analyses options, prepares recommendations and executes actions with the user's approval across partner platforms (money-market investments with Morgan Money, stablecoin payments via Circle). Controls: agents see and do only what the user is authorised to; each tool is scoped (read payments vs create payments); sensitive actions always need explicit approval; reasoning steps and calls are fully audited. Kyriba states SOC 1 Type 2, SOC 2 Type 2, ISO/IEC 27001 and ISAE 3000 for the platform. Pricing is modular subscription by quote.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "SOC 2", "ISO 27001" ], "tasks": [ "process-automation", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.kyriba.com/products/agentic-ai-tai/", "sources": [ "https://www.kyriba.com/products/agentic-ai-tai/", "https://www.kyriba.com/info/kyriba-company-information-ai-models/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "clio-work-agentic", "name": "Clio Work agentic mode (goal-based multi-step legal work with Vincent)", "vendor": "Clio (Themis Solutions Inc.)", "hq_country": "Canada", "hq_region": "north-america", "url": "https://www.clio.com/about/press/clio-work-agentic-mode-small-law-firms/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Legal AI workspace for law firms whose agentic mode takes a single goal-based prompt (for example 'find everything that could kill this deal before signing'), picks the legal skills it needs and runs the multi-step work itself, showing live reasoning traces that the lawyer can interrupt or redirect.", "description": "Clio is a legal practice-management and legal AI company (Themis Solutions Inc.). On April 2, 2026 it added agentic capabilities to Clio Work: lawyers delegate complex, multi-step tasks from one prompt such as 'build a defense strategy' or 'find everything that could kill this deal before signing'. Clio Work works out the goal, chooses which skills from its skills infrastructure (legal-aware capabilities that were previously invoked by hand as workflows) are needed, and executes across them in one continuous run, using the firm's matter context. It shows real-time thinking traces, and users can interrupt, redirect or refine mid-task. Agentic capabilities are applied automatically for all Clio Work users with no setup. Clio says its AI cites sources and that lawyers review and approve everything before it reaches a client or court. Clio Manage plans are published from USD 49 per user per month, but Clio Work pricing is not listed on the pricing page.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.clio.com/about/press/clio-work-agentic-mode-small-law-firms/", "sources": [ "https://www.clio.com/about/press/clio-work-agentic-mode-small-law-firms/", "https://www.clio.com/about/", "https://www.clio.com/pricing/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "nasdaq-verafin-agentic-ai-workforce", "name": "Nasdaq Verafin Agentic AI Workforce (Agentic Sanctions, AML, EDD and Fraud Analysts)", "vendor": "Nasdaq Verafin (Verafin, a Nasdaq company)", "hq_country": "Canada", "hq_region": "north-america", "url": "https://verafin.com/product/agentic-ai-workforce/", "category": "risk", "categories": [ "risk" ], "summary": "A suite of role-based agentic AI analysts for bank and credit-union financial-crime teams. They triage and disposition sanctions, money-laundering and fraud alerts and prepare EDD recommendations. Institutions can switch on auto-dispositioning, run them inside the Verafin platform or overlay them on third-party systems.", "description": "Nasdaq Verafin's Agentic AI Workforce is a set of role-based Agentic AI Analysts for anti-financial-crime teams. Per Verafin's product page there are four analysts. The Agentic Sanctions Analyst triages and dispositions sanctions alerts. The Agentic AML Analyst triages money-laundering alerts (currently cash structuring, with more skills planned): it acknowledges low-risk alerts and elevates the ones that need an investigator. The Agentic EDD Analyst automates manual enhanced-due-diligence tasks and produces recommendations for human review. The Agentic Fraud Analyst triages fraud alerts across channels (currently ACH fraud alerts). Institutions can enable auto-dispositioning for fully autonomous, end-to-end workflows in which the analysts triage alerts, gather context and decide whether to clear or escalate. Reporting and performance tools are there for human oversight. The analysts draw on Verafin's consortium data, can be embedded in the Nasdaq Verafin platform, and can also be overlaid on third-party anti-financial-crime systems. The workload-reduction figures (for example 'up to 90%' for sanctions alert review) are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "fraud-detection", "alert-triage", "case-investigation", "kyc" ], "india_relevance": "", "featured": false, "source_url": "https://verafin.com/product/agentic-ai-workforce/", "sources": [ "https://verafin.com/product/agentic-ai-workforce/", "https://verafin.com/contact/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "fluxforce-agentic-os", "name": "FluxForce Agentic OS (28 financial-crime and compliance agents, incl. Rhea Ledger KYC/AML Analyst)", "vendor": "FluxForce (FluxForce AI Pvt. Ltd.)", "hq_country": "India", "hq_region": "india", "url": "https://www.fluxforce.ai/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "An 'Agentic OS' of 28 named AI agents in three squads covering fraud, KYC/AML, sanctions screening, STR/SAR drafting, audit trails and model risk for banks, fintechs and insurers. Each agent works in shadow mode first, then within autonomy bands and a per-agent kill switch that the institution sets.", "description": "FluxForce sells AI agents for financial crime and compliance, organised into three squads: Threat (fraud, OSINT, payments, BNPL), Trust & Identity (KYC/AML, identity, zero trust) and Risk & Governance (STR/SAR, audit trail, model risk). Its KYC/AML agent, Rhea Ledger, screens customers and counterparties against sanctions and PEP lists, resolves look-alike names across scripts, refreshes KYC when customer facts change, rates customer risk on the institution's own factors, and drafts STR, SAR and CTR content for the MLRO to review and approve. In the low-risk bands the institution allows, it can close clear namesake matches on its own with a recorded reason. Medium-risk cases go to an analyst by default, and high-risk ones, including likely true sanctions matches, always do. Every decision is stored with its inputs, reasoning and approver in tamper-evident storage. Deployment starts with a shadow-mode trial and runs as SaaS, on-premises or hybrid (built on Microsoft Azure), beside existing core banking, screening and case systems. FluxForce lists markets including India, the UAE, the Philippines, Kenya, the US and the UK. It was founded in 2025. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "FATF Recommendations", "PMLA (India)", "RBI KYC Master Direction", "UK MLRs 2017", "BSA/AML Act 2020", "EU AI Act", "DPDP Act 2023" ], "tasks": [ "aml", "kyc", "fraud-detection", "alert-triage", "case-investigation", "sar-narratives" ], "india_relevance": "Indian company (FluxForce AI Pvt. Ltd., Kharar/Punjab; terms governed by Indian law, Chandigarh courts). Rhea Ledger's page maps its work to the RBI Master Direction on KYC and STR drafting for the Principal Officer, and the privacy policy is written for India's DPDP Act. Confirm the current RBI/FIU-IND scope with the vendor.", "featured": false, "source_url": "https://www.fluxforce.ai/ai-agents/ai-kyc-aml-analyst", "sources": [ "https://www.fluxforce.ai/ai-agents/ai-kyc-aml-analyst", "https://www.fluxforce.ai/about-us", "https://www.fluxforce.ai/terms-and-conditions", "https://www.fluxforce.ai/privacy-policy" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "elucidate-eli-compliance-agent", "name": "Elucidate Eli (autonomous compliance agent for screening, monitoring and investigation)", "vendor": "Elucidate (Elucidate GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://elucidate.co/eli", "category": "risk", "categories": [ "risk" ], "summary": "An autonomous financial-crime compliance agent on Elucidate's risk-intelligence platform for banks and payment institutions. It screens and monitors transactions across SWIFT and ISO 20022, triages adverse media, traces hidden ownership and layering, investigates alerts to disposition and drafts CDD reports.", "description": "Eli is the compliance agent on Elucidate's 'agentic risk platform', which also includes a Risk Module Builder and a Portfolio Assessment tool built on the Elucidate FinCrime Index data. Per Elucidate's pages, Eli does real-time transaction screening and monitoring across SWIFT and ISO 20022 and your case management. It also handles autonomous adverse-media monitoring and triage, and automated detection of hidden structures, nesting, layering and opaque ownership. Its risk decisioning is governed by Elucidate's ISO 42001-certified AI management system. Elucidate's published demos show Eli onboarding a client (collecting documents, resolving entities, producing a CDD report) and triaging a transaction-monitoring alert from match to disposition. They also show it flagging an unusual payment, requesting trade documents from the client, verifying them and approving the release, and running due diligence on a corporate group with a proposed, evidenced risk grade. The page's call to action is 'Request access'. ISO 27001 and ISO 42001 are vendor claims. Live-volume figures on the site are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "ISO 42001 (vendor's own AI management system)", "ISO 27001 (vendor's own certification)" ], "tasks": [ "aml", "kyc", "alert-triage", "case-investigation" ], "india_relevance": "", "featured": false, "source_url": "https://elucidate.co/eli", "sources": [ "https://elucidate.co/eli", "https://elucidate.co/", "https://elucidate.co/imprint" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "point-predictive-predictor-agents", "name": "Point Predictive Predictor Agents (agentic forensic fraud reviews for lenders)", "vendor": "Point Predictive", "hq_country": "United States", "hq_region": "north-america", "url": "https://pointpredictive.com/press-releases/point-predictive-releases-predictor-agents/", "category": "risk", "categories": [ "risk" ], "summary": "Specialist fraud agents for auto lenders, banks, credit unions and finance companies, launched Oct 16, 2026. They review consortium loan applications in real time for fraud rings and produce agentic forensic fraud reviews of loan files in seconds. Plain-language portfolio and dealer-risk questions run over Point Predictive's lending-fraud consortium.", "description": "Predictor Agents are a set of specialist agents trained by Point Predictive's fraud team. Each covers one review area: identity, income and employment, dealer risk, straw borrowing, credit washing and bust-out activity. Per Point Predictive's Oct 16, 2026 release, the agents review every consortium application in real time and flag applications from one or several lenders that are tied together by a common thread (phone number, employer, address or dealer), so lenders can act on fraud rings before funding. Agentic Forensic Fraud Reviews produce, in seconds, a report on any or all loan files that sets out the agents' findings by review area, the supporting evidence and next steps (what to verify before funding, or why the loan can proceed). The product also answers plain-language questions on loan performance, negative files, fraud trends, dealer activity and cohort benchmarks across consortium data from 650+ lenders and 340M+ applications (vendor figures). The Q&A part is conversational analytics; the forensic reviews and ring detection are the agentic parts. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "fraud-detection", "case-investigation", "risk-assessment" ], "india_relevance": "", "featured": false, "source_url": "https://pointpredictive.com/press-releases/point-predictive-releases-predictor-agents/", "sources": [ "https://pointpredictive.com/press-releases/point-predictive-releases-predictor-agents/", "https://pointpredictive.com/contact/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "episki-autonomous-grc-agents", "name": "episki Autonomous GRC (AI Orchestration agents for policies, questionnaires, vendors and evidence)", "vendor": "episki (episki, llc)", "hq_country": "United States", "hq_region": "north-america", "url": "https://episki.com/product/ai", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "A GRC platform built around agents that draft policies, answer inbound security questionnaires, review vendors' SOC 2 and CAIQ responses, map controls, assess risks and write deterministic evidence-collection recipes. Every plan, step-run and sensitive action goes through human approvals and safety floors. Pricing is published.", "description": "episki calls itself an 'Autonomous GRC' platform for SOC 2, ISO 27001, PCI DSS, CMMC and other frameworks. Its AI Orchestration layer runs agents with a skills catalogue: draft policy, answer questionnaire, map controls, collect evidence, review vendor (read incoming SOC 2 reports and CAIQ responses and score posture) and assess risk. Per episki's AI page, an agent takes a request from chat, a workflow trigger or a webhook and proposes a plan. It then runs discrete, logged step-runs that call native integrations or allow-listed MCP servers, and routes sensitive actions to human approval under hard 'safety floors'. Evidence collection is deterministic: the agent drafts an evidence 'recipe', a human approves it, and it then runs on a schedule without a model in the loop. Agents propose fixes when a recipe breaks. In the product preview, agents request decisions such as raising a vendor's tier, closing a finding or accepting a risk. The Trust module ingests buyers' questionnaires and has agents draft answers from the evidence store for review. The AI Governance module adds an agent and use-case registry mapped to ISO 42001, NIST AI RMF and the EU AI Act. A free trial is offered.", "pricing": "Published on episki.com/pricing: Compliance Platform $7,500/year (required base); modules Risk Management +$4,800/year, Third-Party Risk Management +$6,000/year, Trust +$7,200/year, AI Governance +$6,000/year; EU/Canada data residency +$6,000/year; shared AI token pool with overage at $0.50 per 1K tokens. Users, frameworks and vendors unlimited.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [ "SOC 2", "ISO 27001", "PCI DSS", "CMMC", "HIPAA", "ISO 42001", "NIST AI RMF", "EU AI Act" ], "tasks": [ "policy-management", "questionnaire-automation", "vendor-risk", "evidence-collection", "control-mapping", "risk-assessment", "trust-center" ], "india_relevance": "", "featured": false, "source_url": "https://episki.com/product/ai", "sources": [ "https://episki.com/product/ai", "https://episki.com/", "https://episki.com/product/trust", "https://episki.com/pricing", "https://episki.com/terms" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "rescana-autonomous-tprm-agents", "name": "Rescana autonomous TPRM agents (Discovery & Classification, Risk Assessment, Communication & Remediation and Manager agents)", "vendor": "Rescana (Rescana Ltd.)", "hq_country": "Israel", "hq_region": "middle-east", "url": "https://www.rescana.com/", "category": "risk", "categories": [ "risk", "security" ], "summary": "A third-party risk platform run by a coordinated team of AI agents. They discover and classify vendors from identity, procurement and IT systems, collect and analyse vendor documentation and questionnaires against external attack-surface intelligence, chase vendors for missing evidence and remediation, and orchestrate approvals with humans in control.", "description": "Rescana is a TPRM platform that uses agentic AI to automate the vendor-risk lifecycle for organisations in banking, healthcare, telecoms and government. Per Rescana's site, four agents split the work. The Discovery & Classification Agent continuously identifies vendors from identity platforms, procurement records, IT assets and OSINT and classifies them by criticality. The Risk Assessment Agent collects documentation, analyses questionnaires, validates claims against external intelligence and produces consistent, auditable risk scores. The Communication & Remediation Agent handles vendor outreach, requests missing evidence, follows up and escalates unresolved risks until closure. The Manager Agent orchestrates policies, reporting, approvals and human-in-the-loop controls. The platform also covers contract cybersecurity-clause analysis, trust-center data collection, product-level risk assessment, continuous exposure monitoring (CVEs, breaches, attack surface), post-engagement monitoring of former vendors and board reporting. Scoring maps to NIST CSF, ISO 27001, SOC 2, MITRE ATT&CK and DORA, or the customer's own framework. Impact figures are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "dora" ], "frameworks_claimed": [ "NIST CSF", "ISO 27001", "SOC 2", "MITRE ATT&CK", "DORA" ], "tasks": [ "vendor-risk", "risk-assessment", "questionnaire-automation", "attack-surface", "remediation", "contract-review" ], "india_relevance": "", "featured": false, "source_url": "https://www.rescana.com/", "sources": [ "https://www.rescana.com/", "https://www.rescana.com/terms", "https://www.rescana.com/privacy-policy" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "procol-supplier-ops-agent", "name": "Procol Supplier Ops Agent (supplier onboarding, due-diligence and compliance, scoring and risk agents)", "vendor": "Procol (Procol Tech Private Limited)", "hq_country": "India", "hq_region": "india", "url": "https://www.procol.ai/ai-supplier-management/", "category": "risk", "categories": [ "risk", "business-ops" ], "summary": "A coordinated set of procurement-side AI agents that run supplier onboarding from invite to approval. They validate tax IDs, licences and certificates, run continuous AML, sanctions and debarment screening, track contract expiry and compliance deviations with audit trails, and score suppliers on cost, quality, delivery and compliance.", "description": "Procol is a source-to-pay procurement platform with AI agents for intake, autonomous sourcing, supplier operations and spend analytics. Its Supplier Ops Agent is described as 'four specialized agents in a single coordinated system' for supplier onboarding, governance, performance and risk. The supplier onboarding agent manages onboarding from invite to approval: it extracts and validates supplier data from submitted documents and flags missing certifications or tax details before onboarding. The due-diligence and compliance agent verifies GST, TAN, EIN, business licences, insurance certificates and registrations. It runs AML screening, sanctions checks and debarment-list monitoring continuously, and tracks contract expiry and compliance deviations to keep audit-ready approval trails. The supplier scoring agent continuously evaluates suppliers across cost, quality, delivery, responsiveness and compliance. Procol lists 250+ enterprise customers (vendor claim). This listing covers the supplier due-diligence side relevant to third-party risk; Procol's sourcing and intake agents are procurement tools. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "vendor-risk", "risk-assessment", "process-automation", "workflow-automation" ], "india_relevance": "Indian company (Procol Tech Private Limited, corporate office Unitech Cyber Park, Sector 39, Gurugram, Haryana). The due-diligence agent validates Indian GST and TAN registrations, and the privacy policy is written for India's DPDP Act 2023 with a DPO/Grievance Officer.", "featured": false, "source_url": "https://www.procol.ai/ai-supplier-management/", "sources": [ "https://www.procol.ai/ai-supplier-management/", "https://www.procol.ai/privacy-policy/", "https://www.procol.ai/about/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "blackpoint-ai-soc-agent-itdr", "name": "Blackpoint AI SOC Agent for ITDR (autonomous identity threat containment for Microsoft 365 and Google Workspace)", "vendor": "Blackpoint Cyber (Blackpoint Holdings, LLC)", "hq_country": "United States", "hq_region": "north-america", "url": "https://blackpointcyber.com/press/blackpoint-cyber-unveils-new-identity-threat-ai-soc-agent/", "category": "security", "categories": [ "security" ], "summary": "AI SOC agent inside Blackpoint's managed ITDR service that autonomously contains high-confidence credential attacks on Microsoft 365 and Google Workspace accounts: it suspends the account, forces a password reset, ends active sessions and logs its reasoning, and escalates anything below its confidence threshold to a human SOC analyst. Generally available since July 8, 2026.", "description": "Blackpoint Cyber, an MDR and ITDR provider focused on managed service providers, made its AI SOC Agent for Identity Threat Detection and Response generally available on July 8, 2026 as its first autonomous response capability. A machine-learning pre-filter separates real threats from noise, and the agent acts only when confidence thresholds are met for attack patterns such as suspicious logins, suspicious inbox rules and other high-fidelity business email compromise indicators. When it acts, it suspends the account, forces a password reset, disrupts active sessions and logs its full reasoning; Blackpoint says this contains credential-based attacks in under two minutes on average and in as little as 21 seconds (vendor claims). Cases outside the validated confidence threshold go to a human analyst in Blackpoint's 24/7 SOC with the agent's reasoning attached. Blackpoint says the agent was trained on years of its SOC analyst decisions, breach forensics and telemetry from nearly a million protected accounts, ran alongside analysts before acting autonomously, and keeps retraining on analyst decisions. It is part of a managed service rather than self-operated software, and it is included in all Blackpoint ITDR service tiers.", "pricing": "Not published. The AI SOC Agent is included with all Blackpoint ITDR service tiers at no additional cost (vendor release); ITDR pricing is by quote, mainly sold through MSP partners.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "incident-response", "threat-detection", "alert-triage", "security-operations" ], "india_relevance": "", "featured": false, "source_url": "https://blackpointcyber.com/press/blackpoint-cyber-unveils-new-identity-threat-ai-soc-agent/", "sources": [ "https://blackpointcyber.com/press/blackpoint-cyber-unveils-new-identity-threat-ai-soc-agent/", "https://blackpointcyber.com/blog/autonomous-identity-threat-detection-and-response-for-msps/", "https://blackpointcyber.com/privacy-policy/", "https://blackpointcyber.com/company/contact-us/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "edgescan-atomic-autonomous-pentesting", "name": "Edgescan Atomic (agentic autonomous penetration testing in the Edgescan platform)", "vendor": "Edgescan (BCC Risk Advisory Limited)", "hq_country": "Ireland", "hq_region": "europe", "url": "https://www.edgescan.com/the-platform/atomic-autonomous-penetration-testing-edgescan/", "category": "security", "categories": [ "security" ], "summary": "Autonomous penetration testing built into the Dublin-based Edgescan platform, launched October 7, 2026. A team of narrow AI agents plans, adapts, chains vulnerabilities and validates real impact on web applications, using Edgescan's existing asset context and findings, while a deterministic 'Harness' enforces scope, permissions, approvals and allowed actions. Findings land alongside Edgescan's DAST, PTaaS and ASM results.", "description": "Edgescan introduced Atomic on October 7, 2026 as AI-native, on-demand autonomous penetration testing inside the Edgescan platform. A user assigns an Atomic Attack Credit to an asset, chooses the approach (from reconnaissance and scanning to targeted exploration) and launches the test with no separate engagement to schedule. Atomic's agentic AI plans, adapts and pursues attack hypotheses as evidence emerges, chains vulnerabilities to explore deeper attack paths and verifies whether a weakness leads to real-world impact, with a focus on access-control, authorisation and business-logic flaws that scanners miss. It draws on existing Edgescan context (previous findings, site maps, authenticated workflows, scan history and Edgescan's 20M+ triaged vulnerabilities). Edgescan's engineering post says Atomic uses many small, narrow agents rather than one long session. The Edgescan Harness sits between the AI's reasoning and the actions it requests and enforces scope, permissions, approvals, policies and execution in deterministic, fail-closed code. Results appear immediately in the Edgescan platform next to continuous DAST, API, network and ASM findings, with a path to escalate to Edgescan's human-led PTaaS.", "pricing": "Not published. Atomic runs on Atomic Attack Credits assigned per asset in the Edgescan platform; pricing by quote/demo.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pen-test-management", "attack-surface", "vulnerability-management", "appsec", "exposure-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.edgescan.com/introducing-edgescan-atomic/", "sources": [ "https://www.edgescan.com/introducing-edgescan-atomic/", "https://www.edgescan.com/the-platform/atomic-autonomous-penetration-testing-edgescan/", "https://www.edgescan.com/many-small-agents-one-strict-harness-how-atomic-is-built/", "https://www.edgescan.com/privacy-policy/", "https://www.edgescan.com/contact-us/", "https://www.edgescan.com/about-us/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "aisle-autonomous-vulnerability-remediation", "name": "AISLE (autonomous vulnerability discovery, triage and verified-fix agents)", "vendor": "AISLE (Aisle s.r.o. / Aisle Inc.)", "hq_country": "Czech Republic", "hq_region": "europe", "url": "https://aisle.com/", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Prague-headquartered AI code-security platform in which thousands of agents analyse a codebase in parallel for exploitable vulnerabilities, fix agents write patches, and agentic verification builds the repo and runs tests before opening a pull request for human merge. October 2026 added agent-driven proof of exploitability against running web apps and APIs. Cohere signed a letter of intent to acquire AISLE on Oct 15, 2026.", "description": "AISLE describes its Enterprise Platform as taking findings 'from discovery to verified fix, autonomously'. Analysis agents reason in parallel across code, dependencies and architecture to pinpoint exploitable vulnerabilities in any language (vendor claims a 91% true-positive rate and 500+ CVEs found in open-source projects such as OpenSSL and curl). AISLE's fix agents generate patches for code and dependency findings, including backlog items and findings imported from third-party scanners. Each fix is verified by building the repository in an isolated container and running the customer's tests plus agent-generated sandboxed tests, then delivered as a pull request. A human must review and merge; teams set automation per severity and per repository, and every action is traceable. After merge, a confirmation analysis checks that the issue is gone. The October 14, 2026 rollout added proof of exploitability, where, with authorisation, an AI agent sends targeted requests to the customer's running web app or API in a test environment and attaches the request/response evidence; reproducers for memory-safety bugs; an MCP server for developers' coding agents; and an AI package firewall. Deployment options include AISLE's cloud, the customer's cloud (Bedrock, Foundry, Vertex), on-premises and air-gapped. On Oct 15, 2026 AISLE announced a letter of intent for Cohere to acquire it, with the Prague headquarters to become Cohere's Prague office when the deal completes.", "pricing": "Not published. Enterprise platform by demo/quote; a no-commitment 'AISLE Snapshot' assessment is offered.", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "SOC 2", "ISO 27001", "ISO 42001 (vendor's own certification)" ], "tasks": [ "sast", "sca", "remediation", "pr-review", "vulnerability-management", "appsec" ], "india_relevance": "", "featured": false, "source_url": "https://aisle.com/platform/autonomous-remediation", "sources": [ "https://aisle.com/", "https://aisle.com/platform/autonomous-remediation", "https://aisle.com/blog/aisle-october-rollout", "https://aisle.com/blog/aisle-and-cohere-to-join-forces", "https://aisle.com/privacy-policy" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "cloudgeni-cloud-agents", "name": "Cloudgeni cloud agents (Compliance Remediation, Drift & Import, PR Review and other infrastructure agents)", "vendor": "Cloudgeni (Cloudgeni AS)", "hq_country": "Norway", "hq_region": "europe", "url": "https://cloudgeni.ai/", "category": "security", "categories": [ "security", "compliance" ], "summary": "Oslo-built agentic cloud operations platform whose agents find cloud security and compliance issues, investigate across cloud state and IaC, write the Terraform/Bicep fix, validate it with a plan and policy checks and open a pull request, then verify the fix after it lands. The Compliance Remediation Agent works from Prowler, Security Hub, Defender and Checkov findings against CIS, SOC 2, ISO 27001 and NIS2. Autonomy is set by policy.", "description": "Cloudgeni says it runs 'your cloud, run by agents': every run follows understand, investigate, change, validate and verify steps. The Compliance Remediation Agent fixes compliance findings automatically by writing IaC, validating it via plan execution and policy checks and opening clean pull requests; it ingests findings from Prowler, AWS Security Hub, Microsoft Defender and Checkov and maps to CIS, SOC 2, ISO 27001 and NIS2. Other agents include a Drift & Import Agent (detects drift and console-created resources and reconciles them as PRs), a PR Review Agent (reviews every infrastructure PR for correctness, security and compliance and enforces policy gates pre-merge), an IaC Pipeline Agent, a chat-based DevOps Agent and a Cost Optimization Agent, plus early-access AI Infrastructure and SRE agents and custom scheduled agents. Guardrails include sandboxed, ephemeral execution, read-only integrations by default, pre-PR validation, human approval gates with plain-English policies ('routine changes merge on their own, critical paths wait for review'), RBAC and SSO/SAML, and an exportable audit trail. It runs as SaaS or self-hosted via Helm, covers AWS, Azure, Google Cloud, Oracle Cloud, Kubernetes, OpenShift and on-prem, and is built on Opengeni, Cloudgeni's Apache-2.0 open-source agent runtime. Customer metrics on the site (e.g. Posten ISO 27001 compliance up from 54% to 96%, 79% of agent PRs merged) are vendor claims.", "pricing": "Published tiers on cloudgeni.ai/pricing: Free ($0, 1 cloud account, 2 repos, 50 agent actions/month, DevOps Agent only); Pro $79 per user/month (Remediation, Drift, Import, DevOps and PR Review agents; CIS, SOC 2, ISO 27001); Enterprise custom (all agents, DORA/HIPAA/PCI-DSS frameworks, SSO, self-hosting options). Confirm current amounts on the vendor pricing page.", "pricing_model": "freemium", "frameworks": [ "dora" ], "frameworks_claimed": [ "CIS Benchmarks", "SOC 2", "ISO 27001", "NIS2", "DORA" ], "tasks": [ "cloud-security", "remediation", "iac", "compliance-posture", "pr-review", "policy-as-code" ], "india_relevance": "", "featured": false, "source_url": "https://cloudgeni.ai/", "sources": [ "https://cloudgeni.ai/", "https://cloudgeni.ai/pricing", "https://cloudgeni.ai/privacy", "https://cloudgeni.ai/about" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "bryter-hybrid-agents", "name": "BRYTER Hybrid Agents (AI plus rule-based workflow agents for DORA, DPA and NDA contract review)", "vendor": "BRYTER (BRYTER GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://bryter.com/hybrid-agents/", "category": "business-ops", "categories": [ "business-ops", "compliance" ], "summary": "Legal and compliance agents that combine AI document review with BRYTER's rule-based workflow engine to run specific tasks end to end, such as reviewing contracts against DORA, reviewing DPAs and NDAs against a playbook, and generating the amendment agreements or reports.", "description": "BRYTER Hybrid Agents pair AI review with BRYTER Workflows, the company's no-code, rule-based automation engine for legal and compliance teams, so that a specific task runs end to end rather than stopping at an AI answer. BRYTER's featured agent is a DORA readiness assessment: contracts are uploaded, the AI reviews each one against EU DORA requirements, results are shown in a table, and amendment agreements are generated. Other agents in the suite review data processing agreements (DPAs) for gaps and generate amendments, review NDAs and other contracts against a playbook to assess risk, run real-estate due diligence and produce a DD report, analyse claims, and check law-firm timesheets against billing guidelines. The agents sit alongside BEAMON AI, BRYTER's AI suite for drafting, research and review in which users can also create their own agents. Lawyers stay in the loop and review the outputs. Pricing for the agents is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "dora" ], "frameworks_claimed": [ "DORA (EU) contract readiness", "GDPR (DPA review)" ], "tasks": [ "contract-review", "workflow-automation", "gap-analysis", "compliance-workflows" ], "india_relevance": "", "featured": false, "source_url": "https://bryter.com/hybrid-agents/", "sources": [ "https://bryter.com/hybrid-agents/", "https://bryter.com/", "https://bryter.com/imprint/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "finto-ai-accounting-agents", "name": "Finto AI accounting agents (invoice-to-journal-entry agents for enterprise finance teams)", "vendor": "Finto (Finto GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://www.gofinto.com/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "AI agents that take incoming supplier invoices from the inbox to verified journal entries: capturing any format (PDF, scan, XML, ZUGFeRD), validating, coding accounts, handling accruals and three-way matches, and communicating with vendors, with a vendor-claimed 90% no-touch rate.", "description": "Finto is a Munich-based AI accounting product for enterprise and mid-market finance teams. Per Finto, its AI agents 'handle everything in between' incoming invoices and posted journal entries: inbox management that records all incoming documents in any format (PDF, scan, XML or ZUGFeRD) and automates communication with vendors, invoice validation, account coding, accruals and three-way matching, with analytics on top. Finto positions this as delivering results rather than interfaces, with accountants reviewing exceptions instead of clicking through each invoice. Figures such as a 90% no-touch rate, 5x throughput per accountant and under two days from receipt to journal entry are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://www.gofinto.com/", "sources": [ "https://www.gofinto.com/", "https://www.gofinto.com/de/impressum" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "bill-ai-agents", "name": "BILL AI agents (W-9 Agent, Reconciliation Agent and other touchless AP agents)", "vendor": "BILL (BILL Holdings, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.bill.com/product/ai", "category": "business-ops", "categories": [ "business-ops", "compliance" ], "summary": "AI agents inside the BILL finance platform for small and midsize businesses: the W-9 Agent requests, follows up on, collects and pre-validates vendor W-9s (names and TINs), and the Reconciliation Agent codes and reconciles receipts, with the customer's team approving the final data.", "description": "BILL launched BILL AI agents on October 28, 2025 as part of its push toward 'touchless' B2B transactions for small and midsize businesses. The W-9 Agent contacts vendors to request W-9 forms, follows up, collects and organizes the forms, validates names and taxpayer identification numbers, flags mismatches and updates vendor information; the customer's team still reviews and approves the final information. BILL says it removes more than 80% of the steps in W-9 collection, which feeds 1099 tax reporting. The Reconciliation Agent handles receipts so that they reconcile and code themselves, and BILL describes further agentic onboarding and assistant features. BILL's product page defines its agents as digital coworkers that plan actions, use tools or APIs, operate independently and escalate when appropriate. Efficiency figures are vendor claims. BILL plan pricing is published on its site, but no separate price for the agents is published. On 19 Oct 2026 BILL announced more agentic capabilities, rolling out to customers that day. Risk intelligence checks invoices before a payment is scheduled and flags any that deviate from a vendor's billing history. An AI control hub shows the actions BILL AI has taken and lets teams switch AI tools on or off. BILL also added an external MCP server for connecting AI assistants to BILL data, AI-assisted onboarding (users review changes before they apply) and inbox labelling of incoming invoices and W-9s. A broader 'Chat with BILL' is in beta with a waitlist. Savings figures in the release are vendor claims.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "compliance-workflows", "vendor-risk" ], "india_relevance": "", "featured": false, "source_url": "https://www.bill.com/press-release/bill-launches-new-ai-agents", "sources": [ "https://www.bill.com/press-release/bill-launches-new-ai-agents", "https://www.bill.com/blog/bill-launches-new-ai-agents", "https://www.bill.com/product/ai", "https://www.bill.com/press-release/bill-launches-new-suite-of-ai-capabilities" ], "last_checked": "2026-10-20", "added": "2026-10-19" }, { "slug": "ivalua-iva-agentic-ai", "name": "Ivalua IVA and IVA Studio (single source-to-pay AI agent with skills and sub-agents)", "vendor": "Ivalua (Ivalua SAS)", "hq_country": "France", "hq_region": "europe", "url": "https://www.ivalua.com/technology/agentic-ai/", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "IVA is a single procurement agent with full access to the Ivalua source-to-pay platform: it can set up and launch sourcing events, redline contracts with approved language, validate invoices against contract terms, and react to supplier-risk events by finding affected contracts and proposing a mitigation plan, inheriting the invoking user's permissions with every action logged.", "description": "Ivalua launched IVA Studio on June 11, 2026, describing IVA as 'the first complete Source-to-Pay agent'. Instead of a catalogue of separate agents, IVA uses the whole Ivalua S2P application as its knowledge source and toolset, assembles skills and tools for each task, and creates temporary sub-agents for complex work. Examples Ivalua gives: a category manager asks IVA to pull an expiring contract, benchmark it, identify stronger suppliers, set up an RFx and launch the event; AP teams have IVA validate invoices against contract terms, not just price and PO; and a supplier risk event can trigger IVA to surface affected contracts, open a PO, create a mitigation plan and propose alternative suppliers. IVA runs on demand, inside workflows or in the background. Governance is enforced at platform level: IVA inherits the permissions of the user who invokes it and cannot exceed them, an accountable user is kept for autonomous runs, human-in-the-loop controls are maintained, and every action is logged. IVA Studio manages IVA's skills (built through chat in Skill Builder), permissions, tools and MCP integrations. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "contract-review", "vendor-risk", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://www.ivalua.com/technology/agentic-ai/", "sources": [ "https://www.ivalua.com/technology/agentic-ai/", "https://www.ivalua.com/press-releases/ivalua-launches-iva-studio-redefining-how-procurement-works-with-ai/", "https://fr.ivalua.com/legal/", "https://www.ivalua.com/company/offices/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "gep-quantum-intelligence-agents", "name": "GEP Quantum Intelligence AI agents (sourcing, CLM, supplier-risk and P2P agents)", "vendor": "GEP", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.gep.com/software/gep-quantum", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "An agentic orchestration platform for procurement and supply chain that coordinates domain-trained agents across sourcing, category management, contract lifecycle, supplier risk and compliance, and procure-to-pay, including obligation-management, clause-risk, supplier risk assessment, fraud/anomaly detection and invoice n-way matching agents.", "description": "GEP Quantum Intelligence is GEP's AI-native platform, which GEP calls procurement's first true agentic orchestration platform: it 'coordinates a fleet of domain-trained agents to plan, decide and act across every workflow'. Named agents include sourcing agents (Quick Quote Agent that launches RFQs and recommends awards, Strategic Sourcing, Bid Optimization, Negotiation, Supplier Recommendation and Requisition Analyzing agents); category-management agents (market intelligence, strategy tracking, spend analysis, insights); contract lifecycle agents (Obligation Management, Contract Amendment for policy and regulatory updates, Contract Clause Risk, Contract Extraction, Contract Creation from approved playbooks, Expiry Monitoring); risk management and compliance agents (Diversity Verification, Supplier Risk Assessment across financial, ESG and performance factors, Policy Response, and a Risk Anomaly Agent that scans transactions for compliance risks); and procure-to-pay agents (Intelligent Buying, Order Tracking, Receiving, Fraud/Anomaly Detection for duplicate invoices and pricing deviations, Invoice N-Way Matching with exception handling, Approval Recommendation and an Integration Agent). GEP also offers GEP Quantum Intelligence Studio. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "contract-review", "vendor-risk", "fraud-detection" ], "india_relevance": "", "featured": false, "source_url": "https://www.gep.com/software/gep-quantum", "sources": [ "https://www.gep.com/software/gep-quantum", "https://www.gep.com/company/contact-us", "https://www.gep.com/newsroom/akshaya-patra-foundation-to-leverage-gep-ai-native-platform-to-modernize-procurement-support-growth-across-india" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "levelpath-ranger-ai-agents", "name": "Levelpath Ranger (autonomous source-to-pay platform with AI agents)", "vendor": "Levelpath", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.levelpath.com/", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Ranger is Levelpath's autonomous source-to-pay platform in which AI agents run sourcing events, generate RFPs and qualify suppliers, scan contract repositories and flag risks, continuously monitor operational and compliance signals across suppliers, and match invoices to orders and receipts, with configurable autonomy and logged actions.", "description": "Levelpath describes Ranger as its autonomous source-to-pay platform that 'directs the work instead of processing it', with AI agents running each step inside the customer's policies across sourcing, contracts, suppliers and risk management. Per Levelpath, Ranger runs sourcing events, generates RFPs, qualifies suppliers and surfaces a ranked shortlist; scans the whole contract repository, answers questions with clause-level precision, flags risks and monitors renewals; continuously monitors operational and compliance signals across the supplier base, updates risk profiles and notifies stakeholders with recommended actions; and turns requests into purchases and matches invoices to what was ordered and received. Customers define where Ranger can act independently and where it escalates; every Ranger action is logged for audit. It integrates with systems such as Oracle Fusion, NetSuite, OneTrust, Ironclad, Docusign and Coupa. Performance figures on the site are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "vendor-risk", "contract-review", "risk-assessment" ], "india_relevance": "", "featured": false, "source_url": "https://www.levelpath.com/", "sources": [ "https://www.levelpath.com/", "https://www.levelpath.com/contact-us" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "omnea-agentic-procurement-agents", "name": "Omnea agentic operating system for procurement (Intake, Review, Approval, Doc Review, Performance and Mitigation agents)", "vendor": "Omnea (Omnea Limited)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.omnea.co/", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "A procurement orchestration platform in which agents run intake, review, approvals, document review, supplier performance and risk mitigation from request to renewal, with autonomous sourcing, PO automation, AP and TPRM/continuous supplier monitoring modules, each agent with configurable human oversight and a full audit trail.", "description": "Omnea describes its product as 'the agentic operating system for procurement' (aOS): one place where humans and agents manage suppliers, with 'agents [that] run tedious work from request to renewal'. The agents shown on its site are an Intake Agent, Review Agent, Approval Agent, Doc Review Agent, Performance Agent and Mitigation Agent, working alongside procurement and finance staff. Platform modules cover intake and orchestration (unified intake, approvals, renewals), source-to-contract (autonomous sourcing, supplier CLM, guided buying, price intelligence), procure-to-pay (PO automation, accounts payable, e-invoicing) and supplier management (third-party risk management, continuous monitoring, SRM). Per Omnea, every agent runs with a configurable level of human oversight, a full audit trail and a rationale traceable to source data; requests can be made via Teams, Slack and MCP. Customer figures on the site are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "vendor-risk", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://www.omnea.co/", "sources": [ "https://www.omnea.co/", "https://www.omnea.co/privacy-policy" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "intrepid-fox-kyb-ai-agents", "name": "Intrepid Fox AI KYB agents (business onboarding, periodic review and transaction-monitoring follow-up)", "vendor": "Intrepid Fox (Intrepid Fox Project Limited)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://intrepidfox.ai/", "category": "risk", "categories": [ "risk" ], "summary": "AI-native KYB platform for banks, EMIs, PSPs and fintechs in which embedded AI agents check business-onboarding documents in real time, ask the applicant follow-up questions, pull data from official company registers and compile an audit-ready report for the compliance officer's decision.", "description": "Intrepid Fox replaces the document-upload step of digital business onboarding with AI-driven dynamic forms embedded via iframe. Per its own pages, its AI agent checks each uploaded document for accuracy and completeness, asks the client follow-up questions when something is unclear, holds a dialogue with the client about the nature of its business, enriches the case from official registers (about 250 registers; a September 2026 integration with Kausate adds real-time European registry access so agents look up shareholders, UBOs and directors before asking the client), website analytics and screening tools, and then assembles an all-in-one report so the compliance officer can decide. The same flow is offered for periodic review and for transaction-monitoring follow-ups that need client context or documents. Features cover UBO and corporate-structure discovery, business-nature discovery, legal and operational address verification and directors' powers. The company was founded in London in 2024. The '80% fewer back-and-forth iterations' and '10x faster' figures are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "SOC 2 Type 2", "GDPR", "DORA" ], "tasks": [ "kyc", "aml", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://intrepidfox.ai/", "sources": [ "https://intrepidfox.ai/", "https://intrepidfox.ai/solutions/periodic-review", "https://intrepidfox.ai/solutions/transaction-monitoring", "https://intrepidfox.ai/blog/company-updates/kyc-register-access-kausate", "https://intrepidfox.ai/privacy-policy", "https://find-and-update.company-information.service.gov.uk/company/15741576" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "muinmos-ai-compliance-agents", "name": "Muinmos AI agents (orchestrated KYC, KYB, screening, client classification and perpetual-KYC agents)", "vendor": "Muinmos (Muinmos ApS)", "hq_country": "Denmark", "hq_region": "europe", "url": "https://muinmos.com/", "category": "risk", "categories": [ "risk" ], "summary": "Client onboarding and lifecycle-management platform for investment firms, banks, crypto and payment firms that runs KYC, KYB, screening, client classification, suitability and risk assessment through specialised AI agents coordinated by an orchestration agent, with event-driven perpetual-KYC monitoring.", "description": "Muinmos organises its onboarding and client-lifecycle platform as a set of specialised AI agents: an Orchestration Agent that routes data between agents, triggers the right checks at the right time and keeps a full audit trail, plus Screening, Identity Verification, Proof of Residence, KYB, Regulatory Client Classification (status across frameworks such as MiFID, MiCA, Dodd-Frank, DFSA and ADGM), Suitability & Appropriateness, Document Collection, Client Risk Assessment and Perpetual KYC Monitoring agents. Per Muinmos, the KYB agent verifies legal entities, traces shareholders, beneficial owners and control structures from corporate data across 200+ jurisdictions, and the perpetual-KYC agent monitors customer changes continuously and launches refreshes, escalations or remediation when risk events occur instead of relying on fixed review cycles. The platform targets AMLR readiness. Workload and time-reduction figures are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "EU AML package (AMLR)", "MiFID II", "MiCA" ], "tasks": [ "kyc", "aml", "risk-assessment", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://muinmos.com/", "sources": [ "https://muinmos.com/", "https://muinmos.com/kyb-agent/", "https://muinmos.com/perpetual-kyc-monitoring-agent/", "https://muinmos.com/legal-notice/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "middesk-agents", "name": "Middesk Agents (KYB investigation agents for OFAC false positives, ownership, address and merchant risk)", "vendor": "Middesk (Middesk, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.middesk.com/solutions/use-cases/agents", "category": "risk", "categories": [ "risk" ], "summary": "Business-identity platform whose specialised AI agents investigate and resolve KYB review work (OFAC false positives, address discrepancies, beneficial-ownership verification, litigation matches, operating-status checks and merchant-risk monitoring) across 400+ data sources, returning evidence-backed, audit-ready decisions through one API.", "description": "Middesk adds an investigation layer of specialised agents on top of its US business-identity data. Per Middesk, the agents research, verify and resolve the CIP, CDD, EDD and merchant-risk work that compliance teams run today: they investigate each OFAC screening match and deliver a decision with full reasoning, cross-reference sources to resolve address discrepancies, trace and verify beneficial ownership across complex structures, assess flagged litigation for materiality, confirm operating status from Secretary of State, web-presence and activity signals, and monitor merchant portfolios continuously, flagging and escalating what needs attention. An orchestration layer coordinates the agents. Findings arrive with evidence, sourcing and reasoning for audit, and the customer's team makes the final call. Delivery is through the Middesk platform and API. False-positive and hours statistics on the page are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "kyc", "aml", "case-investigation", "fraud-detection", "alert-triage" ], "india_relevance": "", "featured": false, "source_url": "https://www.middesk.com/solutions/use-cases/agents", "sources": [ "https://www.middesk.com/solutions/use-cases/agents", "https://www.middesk.com/", "https://www.middesk.com/contact", "https://www.middesk.com/policies/terms-and-conditions" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "spharaka-sphere-agentic-soc", "name": "Spharaka Sphere (agentic AI SOC platform with autonomous investigation and policy-bounded response)", "vendor": "Spharaka Networks (Spharaka Networks Private Limited)", "hq_country": "India", "hq_region": "india", "url": "https://spharaka.com/capabilities/ai-soc", "category": "security", "categories": [ "security" ], "summary": "Indian-built agentic SOC platform (SIEM, SOAR, UEBA, XDR and threat hunting in one) where AI agents triage and investigate every alert to a conclusion and execute containment inside a customer-defined policy envelope, staging higher-impact actions for a named approver.", "description": "Spharaka Sphere is a unified security operations platform from Spharaka Networks that combines SIEM, SOAR, UEBA, XDR, EDR and threat hunting and, per the vendor, is powered by 40+ AI agents (multi-agent layer branded AuraXP, on Spharaka's own SAGE cybersecurity model). On its AI SOC page Spharaka says its agents 'investigate and act, inside limits the customer sets': triage, enrichment and correlation for every alert, investigation to a conclusion with an evidence chain, and containment actions the policy allows (isolating a host, disabling a session, revoking a token, blocking a route) executed immediately through its AI SOAR, while actions outside the envelope are staged with evidence for a named approver. Case records, handover briefs and audit evidence are written as decisions are made. It can run on India-resident cloud, on-premises or air-gapped, and Spharaka says the platform is mapped to CERT-In, DPDP, RBI and SEBI requirements. A sister product, Spharaka Signal, covers OT/ICS. Agent counts and speed figures are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "CERT-In Directions", "DPDP Act", "SOC 2 Type I", "RBI cyber security directions", "SEBI CSCRF" ], "tasks": [ "security-operations", "alert-triage", "case-investigation", "incident-response", "threat-detection" ], "india_relevance": "India-headquartered vendor (registered office Hyderabad, office in Bengaluru); incubated by the DSCI/MeitY National Centre of Excellence for Cybersecurity. Deploys on India-resident cloud, on-premises or air-gapped and says its reporting is mapped to CERT-In, DPDP, RBI and SEBI CSCRF requirements (vendor claim; confirm fit).", "featured": false, "source_url": "https://spharaka.com/capabilities/ai-soc", "sources": [ "https://spharaka.com/capabilities/ai-soc", "https://spharaka.com/", "https://spharaka.com/made-in-india-cybersecurity-platform", "https://spharaka.com/contact", "https://spharaka.com/privacy-policy" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "gambit-cyber-vizier-ai-agents", "name": "Gambit Cyber Vizier AI and KnightGuard AI agents (agentic CTEM and security workflow automation)", "vendor": "Gambit Cyber (Gambit Cyber B.V.)", "hq_country": "Netherlands", "hq_region": "europe", "url": "https://gambitcyber.org/", "category": "security", "categories": [ "security" ], "summary": "Netherlands-headquartered continuous threat exposure management (CTEM) platform, KnightGuard, whose Vizier AI layer uses coordinated AI agents (CTI analyst, SOC analyst, red and blue team, ITOps) to monitor the attack surface, turn threat intel into deployable detections, validate them and orchestrate response.", "description": "Gambit Cyber's KnightGuard is a threat exposure management platform aimed at CTI and SOC teams and MSSPs. Its homepage describes 'a mesh of AI agents': a CTI Analyst AI Agent that turns unstructured advisories, blogs and intel reports into structured intelligence; a SOC Analyst AI Agent that generates detection analytics in Sigma, FQL, KQL, Splunk and other formats for one-click deployment to SIEMs; Red and Blue Team AI Agents that emulate threat campaigns to validate detections and adapt them for purple teaming; and an ITOps AI Agent that turns remediation guidance into control-specific playbooks. Vizier AI, launched June 3, 2026 and stated to be available now as part of KnightGuard, is described as an 'agentic security workflow automation' workspace in which coordinated autonomous agents continuously monitor external, cloud and dark-web attack surface, automate security workflows and respond to incidents on the customer's behalf. Autonomy and outcome claims are the vendor's. A free trial is offered; pricing is not published.", "pricing": "Not published (free trial offered)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "threat-intelligence", "exposure-management", "attack-surface", "threat-detection", "security-operations" ], "india_relevance": "Has an Indian subsidiary (Gambit Cyber India Pvt. Ltd., listed on its contact page) and a February 2026 distribution partnership with iValue for Indian enterprises.", "featured": false, "source_url": "https://gambitcyber.org/press-releases/gambit-cyber-launches-vizier-ai-an-autonomous-security-intelligence-workspace-for-continuous-exposure-management/", "sources": [ "https://gambitcyber.org/", "https://gambitcyber.org/press-releases/gambit-cyber-launches-vizier-ai-an-autonomous-security-intelligence-workspace-for-continuous-exposure-management/", "https://gambitcyber.org/about/", "https://gambitcyber.org/contact-us/", "https://gambitcyber.org/terms-conditions/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "cybedefend-cybe-autofix", "name": "CybeDefend Cybe AutoFix (AI code security agent that opens tested fix pull requests)", "vendor": "CybeDefend (CybeDefend SAS)", "hq_country": "France", "hq_region": "europe", "url": "https://www.cybedefend.com/en/cybe-autofix", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "French AI code security platform (SAST, SCA, IaC, container and secret scanning) whose Cybe AutoFix agent reads the code graph, rewrites vulnerable lines or picks the safest dependency upgrade, tests the change in isolation and opens a bot-signed, CI-gated pull request for a human to merge.", "description": "CybeDefend is an AI code security platform from Lille that combines SAST with reachability, SCA, IaC and container scanning, secret detection, AI triage and remediation, and is designed to run inside AI coding-agent workflows (an MCP server and 'VibeDefend' guards for Claude Code, Cursor, Codex, Copilot and Windsurf). Its Cybe AutoFix component, per its product page, reasons over a knowledge graph of the codebase, writes multi-file fixes in the team's own idioms, grades each patch against the graph so no new finding is introduced, generates a regression test, and opens a documented, bot-signed pull request on GitHub or GitLab whose merge is gated by the customer's CI; for vulnerable direct and transitive dependencies across 12 package managers it chooses the safest upgrade path and builds and tests it in isolation before the PR opens. A human merges each PR. Cloud hosting is offered in an EU (SecNumCloud) or US region. Published plans: a free open-source Community edition, a free trial, Cloud billed per developer and project (amounts not shown), and Enterprise on quote.", "pricing": "Free open-source Community edition and free trial; Cloud plans billed per developer and project (amounts not published); Enterprise on quote.", "pricing_model": "freemium", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "sca", "secrets-detection", "iac", "remediation", "pr-review" ], "india_relevance": "", "featured": false, "source_url": "https://www.cybedefend.com/en/cybe-autofix", "sources": [ "https://www.cybedefend.com/en/cybe-autofix", "https://www.cybedefend.com/en/pricing", "https://www.cybedefend.com/en/legal/terms-of-use", "https://www.cybedefend.com/en/contact", "https://www.cybedefend.com/en/about", "https://recherche-entreprises.api.gouv.fr/search?q=cybedefend" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "qualys-etm-cyber-risk-agents", "name": "Qualys Cyber Risk Agents in Enterprise TruRisk Management (Agent Val, Sara, Insta, Nyra, Sid)", "vendor": "Qualys (Qualys, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.qualys.com/apps/agentic-ai/", "category": "security", "categories": [ "security" ], "summary": "Agent marketplace inside Qualys Enterprise TruRisk Management where teams 'hire' AI agents that detect new exposures without scanning, safely validate exploitability, re-rank risk by active threat campaigns and run confidence-gated patch and patchless remediation with rollback and re-validation.", "description": "Qualys added a Cyber Risk Agents tab (My Agents, All Agents, Marketplace) to its Enterprise TruRisk Management (ETM) risk operations center in ETM 1.6.1 (February 20, 2026); customers hire agents from the marketplace, assign tasks and monitor outcomes. Per Qualys's agentic AI page and documentation: Agent Insta turns existing telemetry into scanless, confidence-scored detections soon after new advisories; Agent Val chooses which exposures to validate, safely tests exploitability with TruConfirm, deploys the selected remediation and re-validates afterwards; Agent Sara runs confidence-gated remediation waves (hands-free deployment of high-confidence patches, ring-staged or change-board routes for riskier ones), executes patchless mitigations such as uninstall, custom script or isolation, rolls back on failure and verifies closure; Agent Nyra re-ranks the risk backlog by active threat-actor campaigns; Agent Sid adds asset and blast-radius context and generates remediation plans. Qualys's February 2026 release notes said all agents then required human approval before any change; the current product page describes zero-touch deployment for high-confidence patches, so the level of autonomy depends on configuration. Agent Grant (identity) is marked 'coming soon' and the ROCky conversational assistant is not part of this listing. Agents require an ETM subscription (Patch Management for remediation); a 30-day trial is offered and pricing is not published.", "pricing": "Not published (30-day trial offered)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "vulnerability-management", "exposure-management", "remediation", "risk-prioritization", "attack-surface" ], "india_relevance": "", "featured": false, "source_url": "https://www.qualys.com/apps/agentic-ai/", "sources": [ "https://www.qualys.com/apps/agentic-ai/", "https://docs.qualys.com/en/etm/latest/agentic_ai/cyber_risk_agents.htm", "https://docs.qualys.com/en/etm/latest/agentic_ai/getting_started_with_val.htm", "https://docs.qualys.com/en/etm/latest/agentic_ai/getting_started_with_sara.htm", "https://docs.qualys.com/en/etm/release-notes/etm/release_1_6_1.htm", "https://www.qualys.com/company/contacts/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "lisse-legal-ai-cowork", "name": "Lisse Legal AI Cowork (Lisse\u6cd5\u52d9AI Cowork: AI agents for legal intake, issue analysis and draft responses)", "vendor": "Lisse (\u682a\u5f0f\u4f1a\u793e\u30ea\u30bb)", "hq_country": "Japan", "hq_region": "asia-pacific", "url": "https://lisse-law.com/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Japanese legal AX platform, available since Oct 2, 2026, where AI agents take incoming legal requests, collect missing facts from the requester, organise the issues and prepare a draft response that follows the company's own past decisions. Low-risk matters that meet company-set conditions can go ahead in the business unit without a legal check.", "description": "Lisse\u6cd5\u52d9AI Cowork is Lisse's new platform for in-house legal work. Lisse is moving from contract review alone (its LeCHECK product) to the whole legal function. Per Lisse's Oct 2, 2026 release, the platform needs no up-front rulebook. Each time a legal staff member checks, approves or corrects an agent's proposal, the decision, its reasoning and the matter history are stored, and these become the company's own judgement criteria. On the next matter the AI agent works ahead of the lawyer. It takes in the request, reads the request text and the contract, asks the requester for any missing background, checks relevant law, sorts out the issues and proposes a response in the company's style. The company can also set conditions under which routine, low-risk contracts are finished by the business unit without going through legal. Humans keep the final judgement. Lisse says it will keep widening the scope to cover all legal work. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://corp.lisse-law.com/release/notice/20261002-2/", "sources": [ "https://corp.lisse-law.com/release/notice/20261002-2/", "https://corp.lisse-law.com/about/company/", "https://lisse-law.com/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "bakuraku-ai-agents", "name": "Bakuraku AI agents (\u30d0\u30af\u30e9\u30af AI\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8: document collection, payment request, journal entry and analysis agents)", "vendor": "LayerX (\u682a\u5f0f\u4f1a\u793eLayerX)", "hq_country": "Japan", "hq_region": "asia-pacific", "url": "https://bakuraku.jp/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Japanese back-office suite (AP, expenses, invoicing, corporate cards, receivables) built around AI agents. The agents collect and digitise supplier invoices, draft and pre-check payment requests, create journal entries and run the accounting double-check, approve expense claims against company rules, and analyse cost increases.", "description": "Bakuraku (\u30d0\u30af\u30e9\u30af) is LayerX's back-office product line for Japanese companies. It covers invoice receipt, expense claims, invoice issuing, approval workflows, corporate cards, e-bookkeeping, receivables and spend analysis. LayerX now presents the suite as 'AI\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u3067\u696d\u52d9\u3092\u5b8c\u5168\u81ea\u52d5\u5316\u3059\u308b' (fully automating the work with AI agents) and names four core Bakuraku AI Agents. (1) \u8a3c\u6191\u53d6\u5f97\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8 automatically collects invoices without gaps and turns them into data. (2) \u7533\u8acb\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8 drafts monthly payment requests, reviews what was submitted and runs the checks at approval time. (3) \u4ed5\u8a33\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8 creates journal entries from past data and performs the accounting double-check. (4) \u5206\u6790\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8 analyses why costs rose and proposes specific savings. Product pages also describe an approval-proxy function (\u627f\u8a8d\u4ee3\u884c) that approves expense claims against each company's internal rules, plus helpdesk and contract-management agents. Per LayerX, more than 20,000 companies use Bakuraku (vendor claim). The suite supports Japan's invoice system (\u30a4\u30f3\u30dc\u30a4\u30b9\u5236\u5ea6) and the revised Electronic Bookkeeping Act. Pricing is not published (quote via sales).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://bakuraku.jp/", "sources": [ "https://bakuraku.jp/", "https://bakuraku.jp/invoice/function/receiving-agent/", "https://bakuraku.jp/helpdesk-agent/", "https://layerx.co.jp/about/company/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "sidetrade-aimie-agents", "name": "Sidetrade Aimie Agents and Customer Agents (order-to-cash AI agents and Agent Builder Studio)", "vendor": "Sidetrade (Sidetrade SA)", "hq_country": "France", "hq_region": "europe", "url": "https://www.sidetrade.com/core-platform/aimie-agent/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Order-to-cash (accounts receivable) platform with prebuilt Aimie Agents that run collections, cash application, dispute and credit-risk work, including autonomous outbound calling. Customer Agents built in Agent Builder Studio automate company-specific O2C processes under policy controls and human oversight.", "description": "Sidetrade's O2C Intelligence Platform covers credit risk, e-invoicing, collections, cash application, deductions and disputes. Its AI agents come in two forms. Aimie Agents are prebuilt for autonomous O2C execution across collections, cash application, disputes and credit-risk management. Per Sidetrade they are production-ready, not pilots, and listed features include autonomous outbound calling, interaction-outcome qualification, auto-generated responses, instant financial reporting, escalation and governance, and multilingual execution. Customer Agents are built by business teams without code in Agent Builder Studio and follow the company's own rules and workflows, with capability tiers matched to the autonomy wanted. Sidetrade says every agent decision is traceable and auditable, with human oversight and policy controls built in. The '68% efficiency rate' figure is a vendor claim. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.sidetrade.com/core-platform/aimie-agent/", "sources": [ "https://www.sidetrade.com/core-platform/aimie-agent/", "https://www.sidetrade.com/contact-us/", "https://www.sidetrade.com/" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "peakflo-ai-agents", "name": "Peakflo AI agents (agentic AP/AR workflows with AI browser, voice and WhatsApp agents)", "vendor": "Peakflo (Peakflo Pte. Ltd.)", "hq_country": "Singapore", "hq_region": "asia-pacific", "url": "https://peakflo.co/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Singapore-based finance back-office platform (procure-to-pay, invoice-to-cash, expenses) built on agentic workflows. AI browser agents log in to web apps and portals to act, voice agents make collection and follow-up calls, and WhatsApp agents work alongside them, all under configurable workflow templates.", "description": "Peakflo automates accounts payable (invoice capture, 2- and 3-way PO matching, non-PO invoices, approvals, payments, vendor reconciliation) and accounts receivable (invoicing, agentic invoice delivery to customers' AP portals, payment reminders, cash application, reconciliations). Its agentic workflows plug into finance and operations systems and learn from past runs. Per Peakflo, AI Browser Agents 'browse internal web apps and browser-based systems, make decisions and take action, just like a human would'. AI Voice Agents automate calls, including invoice-collection calls. WhatsApp agents handle messaging workflows. Peakflo says its agentic system uses LLM-as-judge self-evaluation to test workflow variants and keep the best-performing one. Peakflo also sells 20x, a separate general agent-orchestration product that is not covered by this listing. Efficiency figures on the site (for example '40% reduction in operational cost') are vendor claims. Finance-automation pricing is not published. The public pricing page covers the 20x product.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://peakflo.co/", "sources": [ "https://peakflo.co/", "https://peakflo.co/ai-voice-agents", "https://peakflo.co/contact-us", "https://help.peakflo.co/terms-and-conditions" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "workday-financial-audit-agent", "name": "Workday Financial Audit Agent (part of Workday Accounting Agent)", "vendor": "Workday (Workday, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://community-content.workday.com/en-us/public/learn/resources/get-to-know-workday-ai/workday-s-ai-agents/agents-for-finance/financial-audit.html", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Generally available Workday Financials agent for audit readiness. It finds the supporting evidence for transactions (invoices, supplier contracts, receipts, POs, journals, bank reconciliations) across the Workday tenant, compiles auditor-ready evidence packages and flags high-priority risks such as duplicate invoices.", "description": "The Financial Audit Agent is part of Workday's broader Accounting Agent for Workday Financials. When an auditor sends a 'prepared by client' request, accountants and controllers ask for the evidence in natural language. The agent retrieves the supporting artifacts from across HR, procurement and finance data in the Workday tenant and assembles them into a package ready to share with auditors. Workday's adoption hub says the agent also monitors continuously and flags high-priority risks, giving a duplicate invoice as the example. Workday says early customers cut evidence-package preparation time by 75% (vendor claim). Availability per Workday: General Access in all regions except FedRAMP, and it needs the Core Financials SKU. The wider 'autopilot' Accounting Agent capabilities announced Oct 13, 2026 (continuous financial testing, contract-to-entry preparation) are planned only for early adopters in early 2027 and are not covered here. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "audit-management", "evidence-collection" ], "india_relevance": "", "featured": false, "source_url": "https://blog.workday.com/en-us/workdays-financial-audit-agent.html", "sources": [ "https://blog.workday.com/en-us/workdays-financial-audit-agent.html", "https://community-content.workday.com/en-us/public/learn/resources/get-to-know-workday-ai/workday-s-ai-agents/agents-for-finance/financial-audit.html", "https://investor.workday.com/news-and-events/press-releases/news-details/2026/Workday-Launches-Autopilot-Agents-That-Get-Real-Work-Done-Across-HR-Finance-and-IT/default.aspx", "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001327811" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "partspace-partsagent", "name": "PartSpace PartsAgent (autonomous technical-procurement agent for drawing parts)", "vendor": "PartSpace (PartSpace GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://partspace.io/procurement-agent", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Procurement agent for manufacturers. It works on CAD, PLM, ERP, supplier and pricing data to plan and run technical purchasing from need analysis to order: bundling demand, finding suppliers, preparing RFQs, comparing quotes and placing orders. Teams can give it natural-language commands.", "description": "PartsAgent, from Bavarian vendor PartSpace, is an AI agent for technical procurement and cost engineering of drawing parts in machinery, automotive, aerospace and similar industries. It has two tiers. A data-intelligence layer consolidates CAD, PLM, ERP, supplier and pricing data into a structured base. On top of it, the agent plans, executes and keeps optimising procurement workflows, including demand analysis, bundling similar parts, supplier identification, RFQ preparation, bid comparison, price-anomaly detection and order placement. PartSpace's product page describes 'Fully Automated Request to Order' ('RFQs, supplier selection, offer comparison and ordering executed end-to-end without manual work'). The agent connects to ERP, PLM, SRM and CAD systems and works with the customer's preferred LLMs through the Model Context Protocol. PartSpace says that for its customers 40% of operational purchasing volume for drawing parts is already fully automated (vendor claim). Pricing is not published (demo on request).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://partspace.io/procurement-agent", "sources": [ "https://partspace.io/procurement-agent", "https://partspace.io/press/partspace-launches-ai-agent-for-technical-procurement", "https://partspace.io/legal/imprint" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "mercanis-procurement-agents", "name": "Mercanis AI procurement agents (Offer Comparison, Contract AI, Onboarding and 3-Way Matching agents)", "vendor": "Mercanis (CdC3 GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://www.mercanis.com/agentic-procurement-orchestration", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Berlin-based procurement platform (intake, sourcing, supplier management, contracts) with embedded AI agents. The agents compare and normalise supplier offers, score contract terms against past agreements, run supplier onboarding with document and risk checks, and reconcile 3-way matches, flagging only true exceptions.", "description": "Mercanis is a procurement suite covering intake and request routing, strategic sourcing from RFx to award, supplier relationship management and contracts, all on one data foundation. Its 'agentic procurement orchestration' page says agents 'validate requirements, assign tasks, compare offers, follow up with stakeholders, and unblock steps' and 'trigger actions across systems' while users stay in the loop. Named agents: the Offer Comparison Agent normalises price structures, delivery terms, specifications and compliance factors. The Contract AI Agent reads, compares and scores contract terms, highlights deviations, suggests clauses from prior agreements and links contract risk to supplier performance. The Onboarding Agent collects supplier data, required documents and risk checks, guides suppliers and keeps records up to date. The 3-Way Matching Agent matches orders, receipts and invoices and reconciles discrepancies. AskMercu is a Q&A and drafting assistant, so this listing rests on the action-taking agents. Mercanis claims 55+ AI agents deployed and \u20ac70B+ annual spend managed (vendor claims). Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "contract-review" ], "india_relevance": "", "featured": false, "source_url": "https://www.mercanis.com/agentic-procurement-orchestration", "sources": [ "https://www.mercanis.com/agentic-procurement-orchestration", "https://www.mercanis.com/", "https://www.mercanis.com/imprint" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "wealthai-kyc-onboarding-agents", "name": "WealthAi KYC & onboarding agents (client data collection, ID verification, PEP/sanctions and KYC checks for wealth managers)", "vendor": "WealthAi (WealthAi Technology Limited)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://wealthai.tech/product", "category": "risk", "categories": [ "risk" ], "summary": "AI agents inside the WealthAi operating system for wealth managers that run client onboarding and KYC end-to-end: they collect client information and documents, spot what is missing, generate forms, and start identity verification, PEP and sanctions screening, KYC and account checks, bringing in a person only where review or approval is needed.", "description": "WealthAi is an AI operating system for wealth managers, advisers, family offices and private banks. On 2 October 2026 it launched a suite of AI agents for client onboarding and KYC. According to its own release, the agents collect client information and documents, identify missing information, generate forms, and initiate identity verification, PEP and sanctions checks, KYC and account verification. They connect to specialist identity-verification and compliance services and coordinate the whole process across clients, advisers, compliance and operations, bringing in human review and approval only where required. Results feed the WealthAi Client File and the firm's existing systems, and the release says the agents work across multiple jurisdictions. WealthAi's product page lists an agent library that includes Account Opening, KYC & Onboarding, Risk Management, Market Abuse Reporting, Transaction Reporting and Suitability agents. The site says it runs on Azure with a full audit trail and claims GDPR compliance. KYC & digital onboarding and custom specialist agents are part of the Enterprise plan (custom pricing). The published Basic plan (\u00a3250 per user per month, 14-day trial) covers the Assistant and Client File, not these agents.", "pricing": "Not published (KYC & onboarding agents are in the Enterprise plan, custom pricing; the published \u00a3250/user/month Basic plan does not include them)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "GDPR" ], "tasks": [ "kyc", "aml", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://wealthai.tech/newsroom/wealthai-launches-ai-agents-for-kyc-onboarding", "sources": [ "https://wealthai.tech/newsroom/wealthai-launches-ai-agents-for-kyc-onboarding", "https://wealthai.tech/product", "https://wealthai.tech/pricing", "https://wealthai.tech/terms", "https://wealthai.tech/privacy", "https://find-and-update.company-information.service.gov.uk/company/15164982" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "crogl-sovereign-ai-soc", "name": "Crogl sovereign AI SOC (autonomous alert investigation, threat hunting and evidence-gated auto-remediation)", "vendor": "Crogl (Crogl, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.crogl.com/", "category": "security", "categories": [ "security" ], "summary": "Self-hosted AI SOC whose agents pick up alerts from SIEM, SOAR and ticketing queues, investigate each one end to end across the customer's own tools, hunt threats and investigate advisories, and only trigger SOAR playbooks once an evidence gate is passed, with a full audit trail for the analyst's decision.", "description": "Crogl describes itself as a sovereign AI SOC that runs on-premises, in a private cloud or fully air-gapped, with a semantic knowledge graph, orchestration and the customer's own LLM. Per its own pages, it monitors SIEM, SOAR and ticketing queues continuously, and 'the agent works the full investigation plan, phase by phase' on every alert, querying SIEM, EDR, identity and email tools in their native formats through federated search, and returns a benign / escalate / inconclusive verdict mapped to MITRE ATT&CK with a confidence score and audit trail. Further use cases cover continuous threat hunting, security-advisory investigation, vulnerability blast radius, ransomware kill-chain correlation and insider-threat identity checks. Its Governed Auto-Remediation use case sits in front of the customer's SOAR: an alert clears only with at least one independent confirming source and zero contradicting sources, the gate is re-run at dispatch, and only then does Crogl trigger the SOAR playbook through its webhook; containment and ambiguous cases stay with analysts. Skills (reusable investigation playbooks) can be built and shared. Pricing page: a free single-user install ($0, includes a 30-day full-feature trial) and a custom-priced Enterprise plan that adds fully autonomous investigations and threat hunting, autonomous execution attached to case management, multi-user SSO and RBAC. Volume figures (e.g. 1,000+ alerts a day) are vendor claims.", "pricing": "Free single-user install ($0; 30-day full-feature trial); Enterprise (autonomous investigations, SSO/RBAC, 24/7 support) custom annual pricing", "pricing_model": "freemium", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "case-investigation", "threat-detection", "incident-response" ], "india_relevance": "", "featured": false, "source_url": "https://www.crogl.com/", "sources": [ "https://www.crogl.com/", "https://www.crogl.com/use-cases/alert-triage", "https://www.crogl.com/use-cases/governed-auto-remediation", "https://www.crogl.com/pricing", "https://www.crogl.com/contact", "https://www.crogl.com/company" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "anomali-agentic-ai-threatstream-next-gen", "name": "Anomali Agentic AI in ThreatStream Next-Gen and the Anomali Data Lake (autonomous triage, scoring and investigation agents)", "vendor": "Anomali (Anomali, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.anomali.com/products/agentic-ai", "category": "security", "categories": [ "security" ], "summary": "Intelligence-native agentic SOC layer: ThreatStream Next-Gen and the Anomali Data Lake ship with autonomous triage, scoring and investigation steps, Tier 1/2 triage agents, a stack-ranked decision queue and automated Priority Intelligence Requirement monitoring, with analysts setting how much autonomy the agents get.", "description": "Anomali's May 5, 2026 launch of ThreatStream Next-Gen states that the product 'ships today with autonomous triage, scoring, and investigation steps (agentic levels 1 and 2), available across ThreatStream Next-Gen and the Anomali Data Lake', with autonomous response (levels 3-5) in development and released 'deliberately, with configurable analyst oversight at every stage'. The listing covers only the shipped autonomous triage/investigation levels. Its Agentic AI product page describes AI that reasons over enriched telemetry 'to recommend and execute the right action at the right time, with analysts staying in control of how much autonomy it's given', 'Tier 1/2 triage agents that reflect your SOC's judgment', a stack-ranked decision queue and MCP-enabled agentic operations. ThreatStream Next-Gen also adds Priority Intelligence Requirements that automate recurring intelligence questions without analyst intervention on every cycle, a Command Center, AI-context intelligence search, case management and reporting. Available standalone or embedded in the Anomali Unified Security Data Lake (SIEM/XDR). The '300 times faster' and customer quotes are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "case-investigation", "threat-intelligence", "threat-detection" ], "india_relevance": "", "featured": false, "source_url": "https://www.anomali.com/products/agentic-ai", "sources": [ "https://www.anomali.com/products/agentic-ai", "https://www.anomali.com/press/anomali-launches-threatstream-next-gen-to-turn-intelligence-into-action-at-the-speed-threats-demand", "https://www.anomali.com/company/contact-us" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "nagomi-ai-exposure-eliminators", "name": "Nagomi AI Exposure Eliminators (Agentic Exposure Operations: autonomous exposure investigation, one-click neutralization and validated closure)", "vendor": "Nagomi Security", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.nagomisecurity.com/platform", "category": "security", "categories": [ "security" ], "summary": "Agentic exposure-operations platform whose AI Exposure Eliminators continuously discover exposures across identity, attack surface, control gaps and vulnerabilities, investigate which attack paths are actually exploitable given existing controls, pick the neutralization path (config hardening, control deployment or patch) for one-click approval, route the work and verify from the sensor that the fix holds.", "description": "Nagomi Security connects the EDR, identity, firewall and vulnerability tools a customer already owns into one correlated exposure picture and runs 'Agentic Exposure Operations' on top of it. Per its own platform page, the AI Exposure Eliminators work in four stages: always-on discovery of asset-level changes in attack surface, control gaps and vulnerabilities; contextual investigation, where a team of specialist agents handles triage, enrichment, correlation and validation, checks reachability, evaluates existing controls and chains what attackers would chain; targeted neutralization, where the customer authorizes one-click fixes while the agents select the path (hardening configs, deploying compensating controls or patching); and validated closure, where the agent continuously verifies from the sensor, not the ticket status, that the fix holds. The FAQ states agents 'run the full investigation, pick the neutralization path, route the work, and validate the close - all without prompting', while the human reviews the case and approves the action. Exploit verification continuously tests controls against new attacker behaviour. Use cases cover attack surface management, exposure management and exposure governance; standalone RBVM and CAASM consoles are positioned as collapsing into the platform. Founded around automated security-controls assessment; customer quotes are vendor-published. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "exposure-management", "vulnerability-management", "attack-surface", "remediation", "risk-prioritization" ], "india_relevance": "", "featured": false, "source_url": "https://www.nagomisecurity.com/platform", "sources": [ "https://www.nagomisecurity.com/", "https://www.nagomisecurity.com/platform", "https://www.nagomisecurity.com/about", "https://www.nagomisecurity.com/contact" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "workday-clm-contract-agents", "name": "Workday Contract Negotiation Agent (Workday CLM / Evisort)", "vendor": "Workday (Workday, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://community-content.workday.com/en-us/public/learn/resources/get-to-know-workday-ai/workday-s-ai-agents/agents-for-finance/contract-negotiation.html", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Generally available Workday Contract Lifecycle Management (ex-Evisort) agent. It reviews whole pre-signature agreements against the company playbook, flags risk and missing terms and drafts pinpoint redlines with a rationale for each; users apply the redlines. The Contract Workflow Agent is Early Access and is not covered by this listing.", "description": "Workday sells the Contract Negotiation Agent inside Workday CLM, the contract platform it gained by buying Evisort. Per Workday's adoption hub (General Access in all regions except FedRAMP; requires the Contract Lifecycle Management SKU), the agent 'automatically analyzes pre-signature agreements for risks and opportunities, drafts new language, revises proposed language, and speeds contract approval'. Its May 2026 'Full Document Review' skill reviews an entire agreement at once against published playbooks, flags risks and missing terms, rates severity and suggests targeted redlines that users can apply directly in the document editor, each with an explanation. Humans still approve what goes to the counterparty. The Contract Workflow Agent (intake, alerts, escalations) is listed as Early Access on Workday's own adoption hub and is excluded. Workday's Financial Audit Agent is a separate listing. Workday prices AI use with usage-based Flex Credits; no list prices are published.", "pricing": "Not published (Workday prices AI use through usage-based Flex Credits)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "ISO/IEC 42001" ], "tasks": [ "contract-review", "workflow-automation", "risk-assessment" ], "india_relevance": "", "featured": false, "source_url": "https://community-content.workday.com/en-us/public/learn/resources/get-to-know-workday-ai/workday-s-ai-agents/agents-for-finance/contract-negotiation.html", "sources": [ "https://community-content.workday.com/en-us/public/learn/resources/get-to-know-workday-ai/workday-s-ai-agents/agents-for-finance/contract-negotiation.html", "https://blog.workday.com/en-us/agentic-contract-review-redlining-here.html", "https://doc.workday.com/evisort/en-us/contract-management-and-document-intelligence/release-notes/2026/may/friday--01st-may.html", "https://marketplace.workday.com/en-US/apps/532301/contract-negotiation-agent", "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001327811" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "cortea-audit-quality-agents", "name": "Cortea Audit Quality Agents (AI agents for external audit file review, sample testing and disclosure checks)", "vendor": "Cortea (AI Audit Systems GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://www.cortea.ai/", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Berlin-based AI quality layer for audit firms. Its agents review audit files end to end, cross-checking figures, disclosures and assertions across financial statements, audit reports and working papers, run substantive sample testing against the auditor's criteria and work through IFRS/UK GAAP/Companies Act disclosure checklists, documenting findings for auditor and partner sign-off.", "description": "Cortea sells to external and internal audit teams (UK and German firms such as Forvis Mazars, dhpg, ETL and GVB are quoted on its site). Per its own product pages, its 'AI quality agents' review financial statements, disclosures, audit reports and supporting documentation end to end. They cross-check figures, disclosures and assertions across the audit file to surface inconsistencies, disclosure gaps and compliance issues, supporting completion procedures, engagement quality review and final partner review. Further capabilities: substantive sample testing (Cortea reviews transactions and documents against the auditor's criteria, surfaces exceptions and documents results in an inspection-ready trail), correctness and consistency checks across documents and datasets, disclosure checklists against IFRS, UK GAAP and Companies Act requirements, financial-data validation against source documents and risk-based audit planning aligned with ISA (UK) 315. It covers financial and IT audits. Cortea 'flags, drafts, and analyses, but the auditor reviews, approves, and signs.' Its June 16, 2026 seed-round release (EUR 12M, Dawn Capital) says the Audit Quality Agents reviewed more than 4,000 audit reports in the latest season (vendor claim). Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "ISO 27001", "SOC 2 Type 1", "GDPR" ], "tasks": [ "audit-management", "control-testing", "evidence-collection" ], "india_relevance": "", "featured": false, "source_url": "https://www.cortea.ai/product", "sources": [ "https://www.cortea.ai/", "https://www.cortea.ai/product", "https://www.cortea.ai/solutions/financial", "https://www.cortea.ai/imprint", "https://www.bizwireexpress.com/showstoryGNW.php?storyid=1203438" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "steuerboard-kompass-agentic-os", "name": "Steuerboard Kompass (agentic OS for German tax firms: AI agents working directly on DATEV data)", "vendor": "Steuerboard (Steuerboard Labs GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://steuerboard.com/", "category": "business-ops", "categories": [ "business-ops", "compliance" ], "summary": "Generally available since Oct 14, 2026: an agentic operating system for German tax-advisory firms (Steuerkanzleien). AI agents work on the firm's DATEV data in the background. They check client bookkeeping for missing receipts, unusual costs and missing tax codes, flag missing year-end closing entries, calculate BWA metrics and email clients to request missing documents, and changes go back to DATEV only after the firm approves them.", "description": "Kompass is D\u00fcsseldorf startup Steuerboard's product for tax firms. Per its Oct 14, 2026 launch release, agents, chat, skills and a per-client memory run in one place directly on the firm's DATEV data. Agents 'check bookkeeping, calculate, write and collect missing receipts from the client'. In Steuerboard's example, every Monday at 8 a.m. an agent checks a client's postings, finds three without receipts, emails the client asking for them, matches the documents when they arrive and hands everything to DATEV after the firm approves. Skills cover bookkeeping, annual accounts, BWA (monthly management reports) and client meetings. Steuerboard builds and tests them with tax advisers, and firms can add their own. Kompass connects to all DATEV interfaces and the German commercial register, with Outlook and publishers to follow and MCP for in-house systems. It reads everything but writes only after the firm approves. Steuerboard says it complies with \u00a7 203 StGB and \u00a7 62a StBerG (professional secrecy), is ISO 27001 certified and hosts data in Germany, and that over 100 firms use Steuerboard. Pricing is public: EUR 449 per month billed monthly or EUR 359 per month billed annually, each including 3 seats, with extra seats at EUR 149 or EUR 119, all excluding VAT.", "pricing": "Kompass from EUR 449/month (monthly billing) or EUR 359/month (annual billing), 3 seats included; extra seats EUR 149 or EUR 119/month; plus VAT", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [ "ISO 27001", "GDPR", "\u00a7 203 StGB", "\u00a7 62a StBerG" ], "tasks": [ "process-automation", "workflow-automation", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://steuerboard.com/newsroom/steuerboard-stellt-kompass-vor-das-agentic-os-fur-steuerkanzleien", "sources": [ "https://steuerboard.com/newsroom/steuerboard-stellt-kompass-vor-das-agentic-os-fur-steuerkanzleien", "https://steuerboard.com/pricing", "https://steuerboard.com/legal/imprint" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "kolleno-ai-agents", "name": "Kolleno AI agents (Maestro AI and order-to-cash agents for collections, cash application and credit risk)", "vendor": "Kolleno (Kolleno Limited)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.kolleno.com/ai-agents", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Order-to-cash platform whose AI agents chase invoices, reconcile and match payments and monitor credit risk within the customer's credit policy. Maestro AI routes work to task-specific agents, and each agent's autonomy can be set to insights, copilot drafting or independent execution, with every action logged and restricted actions sent to existing sign-off flows.", "description": "Kolleno is an accounts-receivable and order-to-cash platform for CFOs and credit controllers, with modules for collections, a payment portal, cash application, credit risk, disputes, reconciliation and e-invoicing on top of ERPs such as NetSuite, QuickBooks, Xero, Sage, Microsoft Dynamics, SAP and Oracle. Per its own pages, 'AI Agents handle collections and reconciliation autonomously' and handle execution: 'chasing invoices, reconciling payments, monitoring risk'. Customers upload their credit policy and Kolleno 'builds your AI workforce based on your policy, deploying task-specific AI Agents for all of the modules'. Each agent's autonomy is configurable: provide insights, act as a copilot that drafts work, or execute independently. Maestro AI is the O2C command centre. It analyses risk, matches payments and flags exceptions, takes plain-language instructions and executes them, and routes work to the right agents. Agents inherit role-based permissions, every AI action is logged with timestamp, user and triggering policy, and restricted actions go through established sign-off. Kolleno claims ISO 27001, SOC 2 Type II and SOC 1 Type II. Its public pricing page lists Business Pay at $545/month billed annually ($650 monthly) and Business Plus at $995/month billed annually ($1,245 monthly), with Enterprise and Enterprise Plus by quote. 'AI agent support' appears from Business Plus up, and auto reconciliation from Enterprise up.", "pricing": "Business Pay $545/month billed annually ($650 monthly); Business Plus $995/month billed annually ($1,245 monthly); Enterprise and Enterprise Plus by quote", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [ "ISO 27001", "SOC 2 Type 2", "SOC 1 Type 2" ], "tasks": [ "process-automation", "workflow-automation", "agentic-ops", "risk-assessment" ], "india_relevance": "", "featured": false, "source_url": "https://www.kolleno.com/ai-agents", "sources": [ "https://www.kolleno.com/", "https://www.kolleno.com/ai-agents", "https://www.kolleno.com/pricing/", "https://www.kolleno.com/terms-of-service/", "https://www.kolleno.com/contact-us/", "https://find-and-update.company-information.service.gov.uk/company/12755717" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "embat-tellme-ai-agent", "name": "Embat TellMe (AI agent for corporate treasury, reconciliation and accounting)", "vendor": "Embat (Embat Technologies, S.L.)", "hq_country": "Spain", "hq_region": "europe", "url": "https://www.embat.io/artificial-intelligence-finance", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Treasury platform agent that runs routine finance work in the background, including transaction categorisation and enrichment, forecast-to-actual reconciliation, bank-to-invoice matching, GL postings and PSP-to-sales-order matching. Every action is logged and reversible, and it presents judgement calls with context for one-click approve, modify or reject.", "description": "Embat is a Madrid-based treasury and finance-operations platform covering cash visibility, forecasting, accounting reconciliation and multi-bank payments. Per Embat's own AI page, TellMe is 'Embat's AI agent built for corporate treasury', working across treasury, accounting, payments and cash optimisation. Its stated model is 'Autonomous when it can be. Guided when it should be.' Routine tasks such as categorisation, enrichment and reconciliation run in the background ('Executed, logged, reversible'), and items needing judgement are presented with context and reasoning for one-click approve, modify or reject. Documented capabilities: automatic transaction categorisation, structuring raw forecast imports, matching forecasts to transactions, adjusting forecast dates to real counterparty payment behaviour, filling forecast gaps, narrative commentary on treasury reports, settling invoices through bank-transaction matching (1-to-1, multi-invoice, partial), proposing GL accounts, cost centres and tags, real-time bank-to-GL reconciliation, matching payment-gateway (PSP) transactions to sales orders and proposing postings for PSP discrepancies. Users can also ask for ad-hoc analyses or bulk recategorisations. Embat claims ISO 27001 and SOC 2 Type II. Pricing is modular and quote-based.", "pricing": "Not published (modular, tailored plans)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "ISO 27001", "SOC 2 Type 2", "GDPR" ], "tasks": [ "process-automation", "workflow-automation", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://www.embat.io/artificial-intelligence-finance", "sources": [ "https://www.embat.io/", "https://www.embat.io/artificial-intelligence-finance", "https://www.embat.io/es/aviso-legal", "https://www.embat.io/pricing" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "vertice-ana-negotiation-agent", "name": "Vertice Ana (Autonomous Negotiation Agent for software purchases)", "vendor": "Vertice (Vertice Group Ltd)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.vertice.one/platform/ana", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "AI negotiation agent, launched Sep 8, 2026, that runs software purchase and renewal negotiations with vendors on the customer's behalf. It builds scenario-specific strategies, drafts every exchange in the customer's voice and tracks vendor responses, either autonomously end to end or as a copilot that waits for review of each round, and it enforces customer policies such as data-protection evidence.", "description": "Vertice is a London-headquartered AI procurement platform for SaaS and indirect spend (intake-to-procure, procure-to-pay, vendor and contract management, pricing benchmarks). Per Vertice's Sep 8, 2026 launch release, Ana 'runs unlimited numbers of custom negotiations simultaneously on customers' behalf'. It builds scenario-specific strategies, selects levers and sequences, models likely outcomes at each step (Monte Carlo simulations), drafts every interaction and tracks every vendor exchange. It 'operates either autonomously end to end, or as a copilot should teams prefer to review each round'. Customers set priorities (price, payment terms, contract length), share vendor history and set the tone, and exchanges are drafted in the customer's own voice learned from previous email. Vertice says Ana has run more than 4,000 live negotiations with 18% average savings and 15 days cut from cycles, and gives an example of it enforcing a customer's data-protection policy by obtaining subprocessor transparency and SOC 2 Type II evidence from a new vendor (vendor claims). Every negotiation keeps a full audit trail of strategy, rationale and dialogue. Vertice acquired Vendr. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "vendor-risk", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://www.prnewswire.com/news-releases/vertice-launches-ana-the-ai-negotiation-agent-for-software-purchases-302872482.html", "sources": [ "https://www.vertice.one/platform/ana", "https://www.prnewswire.com/news-releases/vertice-launches-ana-the-ai-negotiation-agent-for-software-purchases-302872482.html", "https://www.vertice.one/about", "https://www.vertice.one/legal", "https://find-and-update.company-information.service.gov.uk/company/13771845" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "archlet-spark-ai-agents", "name": "Archlet Spark AI agents (Setup, Auction, Scenario, Summary and Proposal Analysis agents for sourcing)", "vendor": "Archlet (Archlet AG)", "hq_country": "Switzerland", "hq_region": "europe", "url": "https://archlet.com/product/spark-ai", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Zurich sourcing and eAuction platform whose Spark agents build RFx questionnaires, bid sheets and cost formulas, analyse an RFQ and auto-generate the right auction setup, turn plain-language rules into award scenarios, summarise supplier bids and score proposals. Supplier invitations, reminders and data validation are automated around them.", "description": "Archlet is a sourcing-optimisation and eAuction platform used by enterprises such as PepsiCo, TotalEnergies and Stada for strategic, tactical and tail-spend sourcing. Its own pages describe Spark as 'the AI Agent for smarter sourcing' and name several agents. The Setup Agent creates questionnaires, bid sheets and cost formulas in minutes. The Auction Agent analyses the RFQ, recommends the auction format (English, Dutch or Japanese) and builds the setup automatically. A scenario agent generates sourcing and award scenarios from rules typed in plain words. The Summary Agent scans supplier bids and documents to produce RFP summaries, and the Proposal Analysis Agent supports collaborative scoring. Archlet's agentic-sourcing page adds automated supplier invitations and guidance, automated analytics, and 'intelligent agents' for event setup, supplier communication and analysis. Its FAQ lists automated RFI and questionnaire creation, bid-sheet setup, supplier invites, reminders, data validation and award-scenario generation. Negotiation support is guidance only (Spark 'highlights your strongest levers and recommends the best moves'), and award decisions stay with buyers. Integrations include SAP Ariba, Coupa, Sievo and SpendHQ. The 30% cycle-time and 5-25% savings figures are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://archlet.com/product/spark-ai", "sources": [ "https://archlet.com/", "https://archlet.com/product/spark-ai", "https://archlet.com/solutions/agentic-sourcing", "https://www.zefix.ch/en/search/entity/list/firm/1369741", "https://zh.chregister.ch/cr-portal/auszug/auszug.xhtml?uid=CHE-371.975.365" ], "last_checked": "2026-10-19", "added": "2026-10-19" }, { "slug": "getteddy-compliance-agents", "name": "GetTeddy compliance agents (Certification, Gap Audit, Policy, Evidence, Questionnaire and Contract agents)", "vendor": "GetTeddy (Teddy Technologies GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://getteddy.ai/", "category": "compliance", "categories": [ "compliance" ], "summary": "Berlin agentic compliance platform in which six AI agents run recurring ISO 27001, SOC 2, NIS2, TISAX and DORA work on a schedule: planning a first certification, weekly gap audits against connected systems, drafting policies, collecting evidence, drafting security-questionnaire answers and checking vendor contracts and DPAs, with every result logged and approved by a person.", "description": "GetTeddy (Teddy Technologies GmbH, Berlin) maps a company's obligations once into a single control set and hands the recurring compliance work to agents that run daily or weekly. Per its own agents page: the Certification Agent proposes a scope, turns each requirement into an owned task with a due date and runs readiness checks before stage 1 and stage 2 audits; the Gap Audit Agent rates every requirement across frameworks and entities as met, partly met or missing, checks controls in connected systems rather than only documents, scores each gap and creates remediation tasks; the Policy Agent drafts the policy set from the customer's real systems, roles and terminology and proposes updates when a system changes; the Evidence Agent collects evidence on a schedule from identity, cloud, HR and code tools through read-only service accounts, checks each item against its control and maps it to every framework; the Questionnaire Agent drafts answers to Excel, Word and PDF questionnaires from controls, policies and evidence with source links and flags what it cannot answer; and the Contract Agent rates vendor contracts and DPAs clause by clause against GDPR Art. 28, DORA Art. 30, NIS2 supply-chain clauses and the customer's own positions and suggests wording. Every action goes to an activity log, and policies, questionnaire answers, contract edits, risk acceptance and scope stay with a human approver. A 'Teddy' co-pilot chat sits on top; the agents, not the chat, are the listed capability. Supported frameworks named by the vendor include ISO 27001, SOC 2, NIS2, TISAX, DORA, CRA, EU AI Act and ISO 42001. It imports from Vanta, Drata or spreadsheets. The company emerged from the Antler ecosystem in Berlin and is young (VAT ID still 'applied for' on the imprint). Pricing is quote-based, scaled by how much work the agents take on.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "ISO 27001", "SOC 2", "NIS2", "TISAX", "DORA", "CRA", "EU AI Act", "ISO 42001" ], "tasks": [ "gap-analysis", "evidence-collection", "policy-management", "questionnaire-automation", "contract-review", "control-mapping", "audit-management" ], "india_relevance": "", "featured": false, "source_url": "https://getteddy.ai/agents", "sources": [ "https://getteddy.ai/", "https://getteddy.ai/agents", "https://getteddy.ai/about", "https://getteddy.ai/legal/imprint", "https://getteddy.ai/integrations" ], "last_checked": "2026-10-20", "added": "2026-10-20", "integrations": [ "aws", "azure", "gcp", "github", "gitlab", "okta", "google-workspace", "microsoft-365-entra", "jira", "slack" ] }, { "slug": "harkx-agentic-ai-soc", "name": "HarkX Agentic AI SOC platform (multi-agent triage, threat hunting, investigation and automated response)", "vendor": "HarkX (HarkX Technologies Global Private Limited)", "hq_country": "India", "hq_region": "india", "url": "https://harkx.ai/", "category": "security", "categories": [ "security" ], "summary": "Bengaluru-built AI-native SOC platform in which specialised AI agents correlate and score alerts, run scheduled threat hunts, investigate cases and execute containment and automated response actions across SIEM, EDR/XDR, cloud and SOAR tools, with multi-tenant support for MSSPs.", "description": "HarkX describes itself as an agentic AI SOC that 'embeds specialized AI agents into an AI-native SOC platform'. Its product page sets out a seven-step agent pipeline: onboard data sources, normalise and enrich logs and IOCs, multi-agent analysis (correlation engine, reasoning agents, anomaly detection and dynamic risk scoring), prioritised triage with automated classification, incident response (create incidents, contain threats, remediate and 'execute automated response actions'), closure and learning, and KPI dashboards. Agents also schedule recurring threat hunts. Use cases shown include suspicious logins, ransomware containment, phishing analysis and remediation, and blocked data exfiltration. The vendor's wording is 'Autonomous where AI excels. Human-led where expertise matters', so analysts stay in the loop for complex decisions. It integrates with EDR/XDR, SIEM, cloud (AWS, Azure, GCP) and SOAR tools and is multi-tenant for MSSPs. The '80% reduction in investigation time' and '83% AI-handled alerts' figures are vendor claims. Pricing is not published; access is by demo.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "case-investigation", "incident-response", "threat-detection" ], "india_relevance": "India-headquartered vendor (registered office in Bengaluru per its Master Subscription Agreement); contracts are governed by Indian law with arbitration seated in Bengaluru.", "featured": false, "source_url": "https://harkx.ai/platform", "sources": [ "https://harkx.ai/", "https://harkx.ai/platform", "https://harkx.ai/about", "https://harkx.ai/contact", "https://harkx.ai/terms", "https://harkx.ai/HarkX_MSA_v1.0_05082026.pdf" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "barracuda-email-protection-agentic-remediation", "name": "Barracuda Integrated Email Protection agentic threat investigation and clawback (BarracudaONE)", "vendor": "Barracuda Networks (Barracuda Networks, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.barracuda.com/products/email-protection", "category": "security", "categories": [ "security" ], "summary": "API-based email security for Microsoft 365 and Google Workspace in which AI agents triage threat activity, correlate cross-domain BarracudaONE signals and run real-time, tenant-wide clawback of malicious messages after delivery without SOC intervention, with Bailey AI explaining every verdict and action.", "description": "Barracuda launched Integrated Email Protection, an integrated cloud email security (ICES) product on the BarracudaONE platform, on June 17, 2026. Per the launch release, it 'pairs autonomous remediation agents with rich, cross-domain telemetry': AI agents triage threat activity, correlate signals across environments and 'execute real-time clawback with tenant-wide remediation as threats evolve'. The product page says 'Agentic clawback removes threats across all mailboxes in near real-time - no security operations center (SOC) intervention required', and that Barracuda IQ re-evaluates risk after delivery. The Bailey AI assistant explains each decision in plain language and lets teams review or reverse automated actions. Other features include unified quarantine (Microsoft-quarantined mail consolidated and rescanned), behavioural account-takeover detection, bulk actions across tenants for MSPs, and integration with Barracuda Managed XDR. It deploys by API with no MX change. Efficacy figures are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "email-security", "phishing-triage", "incident-response", "remediation", "threat-detection" ], "india_relevance": "", "featured": false, "source_url": "https://www.barracuda.com/products/email-protection", "sources": [ "https://www.barracuda.com/products/email-protection", "https://www.barracuda.com/company/news/2026/barracuda-integrated-emai-protection-cyber-resilience-agentic-ai-era", "https://www.barracuda.com/company/contact", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "last_checked": "2026-10-20", "added": "2026-10-20", "authorizations": [ { "program": "tx-ramp", "status": "Provisional", "product": "Impersonation Protection / Incident Response", "id": "TX1332609", "scope": "platform-only", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products", "checked": "2026-10-18" } ] }, { "slug": "takumi-by-gmo-security-ai-agent", "name": "Takumi byGMO security AI agent (AI-SAST/AI-DAST diagnosis, automatic fix pull requests and AI penetration testing)", "vendor": "GMO Flatt Security (GMO Flatt Security\u682a\u5f0f\u4f1a\u793e)", "hq_country": "Japan", "hq_region": "asia-pacific", "url": "https://flatt.tech/takumi", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Japanese security AI agent that continuously finds vulnerabilities with AI-SAST and AI-DAST (including logic, authentication and authorisation flaws), generates fix patches and opens pull requests with unit tests, and runs AI penetration tests that actually attempt intrusion to prove exploitability.", "description": "Takumi byGMO is GMO Flatt Security's 'security AI agent' (\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3AI\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8). Its product page says Takumi uses AI agents for vulnerability detection and fixing: continuously running AI diagnosis (AI-SAST/AI-DAST) that the vendor says detects logic flaws and authentication/authorisation gaps at senior-security-engineer level in hours to about a day per run; automatic fixes, where Takumi submits the fix as a pull request with unit tests and a report; and AI penetration testing, where 'AI actually attempts intrusion' to show realistic damage and which vulnerabilities to fix. The same subscription includes developer-malware protections (Takumi Guard blocks malicious packages before install; Takumi Runner records CI/CD traces). Takumi Images is in beta and not part of this listing. The vendor says it is used by 300+ organisations, with testimonials from Nikkei, freee and Findy. Data is processed in Japan by default and not used for LLM training (LLM inference excepted unless a paid domestic-inference option is bought). The company holds ISMS certification covering Takumi operations (vendor claim). Pricing is published.", "pricing": "Published on flatt.tech/takumi: base fee JPY 70,000/month (excl. tax) including 250 credits shared across diagnosis, auto-fix and AI pentest, 15 Takumi Guard users and Runner minutes; overage JPY 280 per credit; a 30-day AI penetration test offer at JPY 980,000 (excl. tax, through end of 2026).", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [ "ISO 27001 (ISMS certification, vendor claim)" ], "tasks": [ "appsec", "sast", "remediation", "pr-review", "pen-test-management", "vulnerability-management" ], "india_relevance": "", "featured": false, "source_url": "https://flatt.tech/takumi", "sources": [ "https://flatt.tech/takumi", "https://flatt.tech/" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "fleuret-agentic-ai-pentesting", "name": "Fleuret agentic AI pentesting (\u00c9mile multi-agent orchestrator for web apps and APIs)", "vendor": "Fleuret (FLEURET AI SAS)", "hq_country": "France", "hq_region": "europe", "url": "https://fleuret.ai/", "category": "security", "categories": [ "security" ], "summary": "Paris-based agentic pentesting platform in which the \u00c9mile orchestrator coordinates 12-60 specialist attack agents (auth bypass, IDOR, injection chains, business logic, privilege escalation) against web apps and APIs, reports only findings proven with a replayable proof of concept, and re-tests fixes, with EU-sovereign hosting.", "description": "Fleuret runs penetration tests on web applications and APIs with agentic AI. Its platform page describes \u00c9mile V2: automated reconnaissance builds a coverage graph of exposed endpoints and subdomains; \u00c9mile then 'coordinates dozens of specialist agents, each focused on a specific attack vector' (authentication, IDOR, injection and others), which run real attacks in parallel and are retired after their mission. A deterministic validator confirms each finding through a controlled, non-destructive proof of concept, and anything that cannot be proven is not reported. Output is an audit-ready report with DORA and NIS2 mapping plus a live workspace where findings become tickets (Jira, Linear, Slack) that can be assigned, fixed and re-tested in one click. Findings are hosted on Scaleway in Paris. A free plan offers SAST, SCA, secret scanning and DAST/attack-surface discovery without a pentest. The company was founded in 2026 and announced a EUR 4M pre-seed round in October 2026. Price comparisons with manual pentests are vendor claims.", "pricing": "Published on fleuret.ai: free organisation plan (scanners only, 2 users, 10 repositories); one-off pentest EUR 4,000 per web app; contract covering every app on quote.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pen-test-management", "attack-surface", "vulnerability-management", "exposure-management" ], "india_relevance": "", "featured": false, "source_url": "https://fleuret.ai/platform", "sources": [ "https://fleuret.ai/", "https://fleuret.ai/platform", "https://fleuret.ai/about", "https://fleuret.ai/mentions-legales", "https://recherche-entreprises.api.gouv.fr/search?q=999515604", "https://www.eu-startups.com/2026/10/french-cybersecurity-startup-fleuret-ai-raises-e4-million-to-automate-penetration-testing-with-ai-agents/" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "penetrify-ai-pentest-agent", "name": "Penetrify AI penetration testing agent (automated web app and API pentests)", "vendor": "Penetrify (Algofy, s.r.o.)", "hq_country": "Czech Republic", "hq_region": "europe", "url": "https://www.penetrify.cloud/en/", "category": "security", "categories": [ "security" ], "summary": "Self-serve automated pentesting from Brno in which an AI agent maps a web app's attack surface, forms hypotheses, chains findings into multi-step attack scenarios (auth bypass, broken access control, exposed secrets) and writes up only what it can demonstrate, with published monthly plans and EU/GDPR data processing.", "description": "Penetrify sells automated penetration testing for teams without a security function. Per its own pages, the AI agent first maps the full attack surface (endpoints, data flows, authentication boundaries), then tests authentication and session handling (email-verification bypass, token replay, password-reset flaws, session fixation, missing rate limits), access control, injection, configuration and secrets exposure, and chains findings so that 'a leaked endpoint becomes a reconnaissance target'. It reports what it proves, with remediation guidance, typically in under 30 minutes. Scans run in automatic or semi-automatic mode, from the web or a CLI, and can run on every deploy via API. Targets must be verified as owned by the customer, and the agent avoids destructive payloads. The service is operated from Brno under EU jurisdiction. False-positive rates, customer stories and 'press mention' counts on the site are vendor claims.", "pricing": "Published on penetrify.cloud: Starter USD 100/month (1 pentest), Growth USD 900/month (10), Professional USD 1,700/month (20), Business USD 4,000/month (50), Enterprise USD 7,500/month (100); annual billing saves 20%; first scan USD 29 credited to a plan.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pen-test-management", "attack-surface", "vulnerability-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.penetrify.cloud/en/", "sources": [ "https://www.penetrify.cloud/en/", "https://www.penetrify.cloud/en/about/", "https://www.penetrify.cloud/en/terms/", "https://ares.gov.cz/ekonomicke-subjekty-v-be/rest/ekonomicke-subjekty/14442752" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "upflow-ar-ai-agents", "name": "Upflow AI agents (Collections, Cash App and AP Portal agents for B2B accounts receivable)", "vendor": "Upflow (Upflow SAS)", "hq_country": "France", "hq_region": "europe", "url": "https://upflow.io/ai-agents", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Paris-founded B2B accounts-receivable platform whose AI agents run collections outreach and follow-ups (with autonomy controls up to fully autonomous), match payments to open invoices and write reconciled payments back to the ERP, and submit invoices to buyer AP portals.", "description": "Upflow is an accounts-receivable and cash-collection platform for B2B finance teams. Per its own pages, the Collections Agent runs the day-to-day collections engine: outreach is sent and followed up automatically across email, SMS, calls, letters and tasks, dispute and promise-to-pay intent is extracted from customer replies, complex accounts are routed to a person, and autonomy controls range 'from suggestion-only to fully autonomous'. The Cash App Agent matches partial and complex payments to open items, captures remittance details from emails and portals, surfaces exceptions and writes reconciled payments back to the ERP in real time. The AP Portal Agent handles buyer-portal invoice submissions. An Insights Agent (Q&A over AR data, included on all plans) is assistant-level and is not the basis of this listing. Upflow also offers an MCP server for Claude/ChatGPT. Per the pricing page, the Collections, AP Portal and Cash App agents are available on higher tiers; all tiers are 'Ask for a quote'. Metrics such as '85% of follow-up emails processed automatically' are customer/vendor claims.", "pricing": "Not published (tiers by annual invoiced revenue, all \"Ask for a quote\"; action agents on higher tiers)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "workflow-automation", "process-automation" ], "india_relevance": "", "featured": false, "source_url": "https://upflow.io/ai-agents", "sources": [ "https://upflow.io/ai-agents", "https://upflow.io/", "https://upflow.io/pricing", "https://upflow.io/about-us", "https://docs.upflow.io/en-us/legal-and-security/contractual-documents/upflow-privacy-policy", "https://recherche-entreprises.api.gouv.fr/search?q=upflow" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "eagl-month-end-close-agents", "name": "Eagl AI agents for the month-end close (controlling, capex, VAT, reconciliation and accrual agents)", "vendor": "Eagl", "hq_country": "Belgium", "hq_region": "europe", "url": "https://geteagl.com/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Ghent-based close-automation platform whose accounting agents check every ERP posting against policy (capex, VAT and controlling agents), match bank lines to the ledger, propose, book and reverse accruals, prepare recurring close tasks and post correcting journal entries to NetSuite after one-click review.", "description": "Eagl sells 'AI agents for the month-end close' for multi-entity finance teams. Per its homepage, Eagl checks every posting the moment it lands and its Capex, VAT and Controlling agents flag issues such as repairs wrongly capitalised, a German VAT code used instead of reverse charge, or duplicate bills, each with a proposed correction that posts in one click. Bank lines are matched to the ledger so accountants clear only exceptions; missing accruals are 'proposed, booked and reversed on time'; and an agentic close checklist shows tasks completed by the Eagl agent (bank reconciliation, prepaid amortisation, intercompany sync) next to human tasks. A controller's question in an Eagl session (for example whether the suspense account is empty) is answered from the GL, bank lines and files, a reclass entry is drafted and posted to NetSuite, and the session can be turned into a recurring task that Eagl prepares itself every period with a human reviewer. Integrations include NetSuite, bank feeds and Google Drive. The company was registered in April 2025. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "workflow-automation", "process-automation" ], "india_relevance": "", "featured": false, "source_url": "https://geteagl.com/", "sources": [ "https://geteagl.com/", "https://geteagl.com/compliance/privacy-policy", "https://kbopub.economie.fgov.be/kbopub/toonondernemingps.html?ondernemingsnummer=1022611909&lang=en" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "tacto-procurement-ai-agents", "name": "Tacto AI agents for industrial procurement (supplier-document, order-confirmation, RFQ/quote, should-cost and savings agents)", "vendor": "Tacto (Tacto Technology GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://tacto.ai/en/product", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Munich-based procurement platform for manufacturers whose AI agents request and update supplier documents autonomously, read order confirmations and match them to purchase orders (escalating only deviations), convert and compare supplier quotes, verify compliance documents (REACH, ESG, CBAM, LkSG) and surface savings opportunities.", "description": "Tacto builds procurement software for mid-sized and large manufacturers ('You set the strategy. AI agents execute.'). Per its product page, AI agents run supplier document requests autonomously, extract relevant information and update expired documents; read incoming order confirmations, match them against the purchase order and escalate to the buyer only when there is a deviation; convert supplier-uploaded quote PDFs into the requested format and analyse bids from PDFs, emails and Excel for comparison; handle compliance document verification and updates (a customer quote cites 2,000+ suppliers vetted for REACH, ESG, CBAM and the German Supply Chain Act); and send proactive 'Procurement Radar' alerts with recommendations such as master agreements or volume shifts. The German homepage names Defender, Should Cost, RFQ and negotiation agents. Savings figures (for example KERN LIEBERS 3.1% savings) are customer/vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "vendor-risk" ], "india_relevance": "", "featured": false, "source_url": "https://tacto.ai/en/product", "sources": [ "https://tacto.ai/en/product", "https://tacto.ai/de", "https://tacto.ai/de/impressum" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "hivebuy-procurement-ai-agents", "name": "Hivebuy KI-Agenten (Intake, Recommendation, Savings, Invoice, Compliance and Accounting agents for indirect procurement)", "vendor": "Hivebuy (Hivebuy GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://www.hivebuy.com/ki-agenten-finance", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Berlin-based purchase-to-pay platform for mid-sized companies whose AI agents turn free-text, PDF or email requests into complete purchase requisitions, pick preferred suppliers and cheapest compliant offers, process invoices with automatic 3-way matching, check deviations and escalate, and assign cost centres and GL accounts before ERP/DATEV export.", "description": "Hivebuy is a German indirect-procurement and invoice platform. Its own 'KI-Agenten' pages describe a set of named agents. On the requisition side, the Intake Agent converts free-text messages, emailed PDFs and Excel files into complete purchase requisitions; the Recommendation Agent checks preferred suppliers and framework agreements and recommends the cheapest compliant source; the Category Agent classifies requests; and the Savings Agent compares prices across connected shops at every order. Teams/Slack, Status, Parsing and Contract agents are also listed. On the finance side, three agents cover the invoice process: the Invoice Agent imports invoices from email, uploads and e-invoice formats, extracts fields and starts automatic 3-way matching; the Compliance Agent checks price, item and quantity deviations, escalates to the responsible buyer when thresholds are exceeded and documents every check for the audit trail; and the Accounting Agent assigns cost centre and GL account per line and prepares the ERP handover (SAP, DATEV and others). The '20% savings per order' figure is a vendor claim.", "pricing": "Published: AI plans from \u20ac999/month (Basic, up to 50 users) and from \u20ac1,899/month (Business, up to 150 users, all AI agents); Enterprise on request (Hivebuy pricing page)", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.hivebuy.com/ki-agenten-finance", "sources": [ "https://www.hivebuy.com/ki-agenten-finance", "https://www.hivebuy.com/ki-agenten-bedarfsanforderung", "https://www.hivebuy.com/savings-agent", "https://www.hivebuy.com/preise-hivebuy", "https://www.hivebuy.com/impressum" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "gu1-compliance-ai-agents", "name": "Gu1 compliance and fraud AI agents (Onboarding, Screening, KYT, Case and Reporting agents)", "vendor": "Gu1 (operated by Gueno USA LLC)", "hq_country": "Argentina", "hq_region": "latin-america", "url": "https://gu1.ai/en-us/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Buenos Aires-headquartered compliance and fraud platform for Latin American fintechs and banks in which 25+ specialised AI agents run KYC/KYB onboarding, sanctions/PEP screening, real-time transaction monitoring, alert triage with an auditable case file, and regulator-format SAR/STR drafting, while a human decides and signs.", "description": "Gu1 describes itself as AI agent infrastructure for compliance and fraud prevention. Per its own English homepage, a chain of named agents covers the customer lifecycle: a Device Agent (SDK flags emulators, root, VPN and multi-accounting), an Onboarding Agent (validates documents, biometrics and official databases for people and companies), a Screening Agent (sanctions, PEP, adverse media and restrictive lists), a KYT Agent (analyses every transaction in real time), a Case Agent (triages alerts and leaves an auditable defence file ready for the analyst's decision) and a Reporting Agent (generates the SAR/STR in each regulator's format, ready to sign). An orchestrator connects the agents to a marketplace of 1,000+ Latin American data providers and the customer's own provider credentials, and a decision engine scores each case against configurable risk matrices; the vendor states that 'at each stage the agents do the work; the human decides and signs' and that every action keeps auditable evidence. The agents are also exposed over REST API, SDKs, a CLI and an MCP server so customers' own agents can work alongside them. Regulatory coverage listed as live: Brazil (BACEN/COAF), Argentina (BCRA/UIF), Chile (CMF/UAF), Colombia (SFC/UIAF), Peru (SBS/UIF), Costa Rica (SUGEF/UIF) and Mexico (CNBV/UIF); the United States (FinCEN/OFAC) is marked beta/enterprise and further LatAm markets are on the roadmap. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "kyc", "aml", "fraud-detection", "alert-triage", "case-investigation", "sar-narratives" ], "india_relevance": "", "featured": false, "source_url": "https://gu1.ai/en-us/", "sources": [ "https://gu1.ai/en-us/", "https://gu1.ai/en-us/about/", "https://gu1.ai/en-us/privacy/", "https://gu1.ai/en-us/terms/" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "legiscope-gdpr-ai-agents", "name": "Legiscope GDPR AI agents (RoPA, processor/DPA review, DPIA, incident and rights-request workflows)", "vendor": "Legiscope (Legiscope UAB)", "hq_country": "Lithuania", "hq_region": "europe", "url": "https://www.legiscope.com/", "category": "risk", "categories": [ "risk", "compliance", "privacy" ], "summary": "Vilnius-registered 'agentic compliance' GDPR platform whose AI agents write and keep the Article 30 register current as the business changes, find and assess every processor's DPA against Article 28, prepare DPIAs, draft breach-notification decisions and turn data-subject requests into deadline-tracked case records, routing judgement calls to the privacy team.", "description": "Legiscope (Legiscope UAB, founded by French privacy lawyer Dr. Thi\u00e9baut Devergranne) is an evidence-first GDPR operating system for DPOs, legal and IT teams. Per its own pages, its AI agents read source material, connect records, identify gaps, draft outputs and bring decisions requiring judgement to the right person: when a new vendor, application, cookie or processing activity appears, Legiscope detects the change and prepares every affected record, assessment and decision; for processors it finds each vendor's data processing addendum on the vendor's own legal pages, keeps a dated copy, checks it against all eight requirements of Article 28(3) section by section with quoted wording and a verdict, and re-reads it when the vendor changes its paper; it writes Article 30 register entries (purpose, lawful basis, retention, recipients) from a short business description and the customer's own material; it prepares review-ready DPIAs (Art. 35); for incidents it drafts facts, deadlines and notification letters (Art. 33/34); and a pasted data-subject request becomes a structured case record with the one-month deadline calculated and the relevant processing activities linked. Every output is a sourced draft or recommendation, and each decision is filed with its author, date, reasoning and evidence (Art. 5(2)). It covers GDPR and CCPA and is hosted in the EU. Published annual pricing (excl. VAT, 12-month commitment): Essentiel \u20ac1,500, Pro \u20ac2,500 (adds the 'Expert AI agents', ingestion service and DPIA), Business \u20ac4,000, Premium \u20ac6,000, Enterprise from \u20ac12,000; each plan includes a token allowance for AI work.", "pricing": "Essentiel \u20ac1,500/year; Pro \u20ac2,500/year (expert AI agents, DPIA); Business \u20ac4,000/year; Premium \u20ac6,000/year; Enterprise from \u20ac12,000/year (all excl. VAT, 12-month commitment, token allowance per plan)", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [ "GDPR", "CCPA" ], "tasks": [ "privacy-management", "dsr-automation", "vendor-risk", "contract-review", "risk-assessment", "incident-response" ], "india_relevance": "", "featured": false, "source_url": "https://www.legiscope.com/", "sources": [ "https://www.legiscope.com/", "https://www.legiscope.com/features/rights.html", "https://www.legiscope.com/pricing.html", "https://www.legiscope.com/privacy.html", "https://www.legiscope.com/terms.html", "https://www.legiscope.com/about.html", "https://www.legiscope.com/contact.html" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "decanos-ai-agents-autonomous-security-operations", "name": "Decanos AI Agents (Triage, Investigate, Hunt, Response and Compliance agents for autonomous security operations)", "vendor": "Decanos (Decanos GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://decanos.com/platform/ai-agents", "category": "security", "categories": [ "security" ], "summary": "Berlin security platform whose specialist AI agents triage alerts, assemble investigations, run continuous threat hunts, execute containment and update compliance reporting across connected tools such as CrowdStrike, Splunk, Elastic, SentinelOne, Microsoft Sentinel and Wiz, with autonomy levels, escalation thresholds and approval gates set per agent and per action type.", "description": "Decanos AI Agents are the agent layer of the Decanos Enterprise Platform, which Decanos announced on December 5, 2025 as a unified platform for autonomous detection, investigation and response across endpoints, cloud and network. Per the vendor's AI Agents page, each agent specialises in one job: a Triage Agent for alert classification (labelled 'Autonomous'; the page says it handles Tier-1 alert triage '100% autonomous'), an Investigate Agent for case assembly ('Supervised'), a Hunt Agent that tests threat hypotheses continuously ('Autonomous'), a Response Agent for containment actions ('Supervised', 'with configurable guardrails') and a Compliance Agent for reporting and audit ('Autonomous'). An orchestration layer hands work between them: hunt findings open investigations and triage verdicts are routed to the Response Agent, with a human hand-off queue for cases such as destructive-action thresholds or host isolation that requires approval. Customers set autonomy levels per agent and per action type, escalation thresholds and approval gates; agents are read-only by default, write actions need explicit human authorisation, and every reasoning step, tool call and action is logged in an audit trail. Agents connect to existing tools through API credentials (CrowdStrike, Wiz, Splunk, Elastic, Microsoft Sentinel and 100+ other integrations) and learn from analyst corrections. The dashboard figures shown on the page are illustrative product UI. Decanos also sells advisory (ISO 27001, TISAX, NIS2, BSI IT-Grundschutz) and a managed SOC service; this listing covers the software agents only. Pricing is quote-based, by protected assets and enabled modules (Alert Triage, Threat Hunting, EDR, Cloud, Compliance, MSSP).", "pricing": "Not published (custom quote by protected assets and enabled modules; multi-year and MSSP pricing on request)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "alert-triage", "case-investigation", "threat-detection", "incident-response", "security-operations" ], "india_relevance": "", "featured": false, "source_url": "https://decanos.com/platform/ai-agents", "sources": [ "https://decanos.com/platform/ai-agents", "https://decanos.com/de/platform/ai-agents", "https://decanos.com/about", "https://decanos.com/legal-notice", "https://decanos.com/pricing", "https://decanos.com/newsroom" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "raonsecure-onesoar-onehacker-agentic-ai", "name": "RaonSecure OneSOAR (AI autonomous security control tower) and OneHacker (AI pentester) from the ONE AI agentic platform", "vendor": "RaonSecure (\ub77c\uc628\uc2dc\ud050\uc5b4)", "hq_country": "South Korea", "hq_region": "asia-pacific", "url": "https://www.raon.com/en/solution/onesoar", "category": "security", "categories": [ "security" ], "summary": "Seoul security and authentication vendor's agentic AI products: OneSOAR runs security operations from natural-language commands, automates account changes for joiners, movers and leavers, and on detecting anomalous behaviour immediately executes autonomous defence such as account lock, session termination, MFA step-up and admin alerts; OneHacker runs continuous, autonomous AI penetration tests from Pentest-Graph scenarios with white-hacker verification.", "description": "RaonSecure, a Seoul-based authentication and mobile-security vendor, markets an 'Agentic AI Platform' (ONE AI) on its own site. This listing covers the two products that act as security agents. OneSOAR, the 'AI Autonomous Security Control Tower' ('AI-powered Security Operations with Natural Language & Autonomous Response'), creates security policies from natural-language commands and applies them to infrastructure, automates account lifecycle changes for onboarding, role changes and offboarding, and, per the vendor's Agentic AI brochure, analyses logs to detect anomalous behaviour and immediately executes an autonomous defence response (account lock, stronger MFA, administrator notification). The brochure's integration scenario has OneSOAR force-terminate the user's session and lock the account on detecting a threat, send an emergency block command to OneShield and have OneAccess revoke the AI agent's credentials. It links with RaonSecure's OmniOne Access, TouchEn Wiseaccess and OnePass. OneHacker, the 'AI Pentester', is described as 'fully autonomous AI penetration testing' in which AI agents find and verify vulnerabilities from an attacker's perspective, using Pentest Graph (PTG) scenarios designed by the company's DEF CON-winning white-hacker team, running 24/7 continuous and repeated tests, supporting local (on-premises, public and financial sector) and cloud AI models, and combining automated testing with expert white-hacker verification. The other ONE AI products (OneAccess, OneShield, OneTag) govern and protect customers' own AI agents and are not part of this listing. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "incident-response", "threat-detection", "identity-governance", "pen-test-management", "attack-surface" ], "india_relevance": "", "featured": false, "source_url": "https://www.raon.com/en/solution/onesoar", "sources": [ "https://www.raon.com/en/solution/onesoar", "https://www.raon.com/ko/solution/onesoar", "https://www.raon.com/en/solution/onehacker", "https://www.raon.com/common/ko/downfile/RAON_Agentic%20AI_Brochure_260702.pdf?v=1", "https://www.raon.com/en/", "https://www.raon.com/ko/" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "sourcery-ai-code-review-security-scanning", "name": "Sourcery AI code review and security scanning (PR review bot with merge-blocking security checks, auto-approval of low-risk PRs and nightly codebase scans)", "vendor": "Sourcery (Sourcery.AI Limited)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://sourcery.ai/security", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "London AI code reviewer for GitHub and GitLab that reviews every pull request within minutes, flags security issues and suggests commit-ready fixes, fails the check on high-severity security findings so merging can be blocked, auto-approves low-risk PRs with no blocking findings, and scans whole repositories every night for vulnerable code, exposed secrets, misconfigured infrastructure and vulnerable dependencies.", "description": "Sourcery (Sourcery.AI Limited, London) reviews every pull request or merge request within minutes on GitHub, GitLab.com and self-managed GitLab (GitHub Enterprise Server on Enterprise), posting a PR summary, review comments and suggested changes that can be committed in one click. Per its security page, it reviews changed code for vulnerabilities and explains each finding; when it finds a blocking high-severity security issue its GitHub check fails, so teams can require it before merging. On the Team plan it also scans up to 50 repositories every night (Open Source and Pro scan twice a week), flagging exposed secrets, vulnerable code, misconfigured infrastructure and dependencies with known CVEs, tracks issues until a later scan no longer finds them, and gives each issue a ready-made prompt to hand to a coding agent such as Cursor. It can auto-approve low-risk PRs that have no blocking findings. Teams can write custom review rules. Sourcery says it keeps no copy of code after a review and does not train models on it, and that it is SOC 2 Type II compliant (vendor claim about its own controls). Enterprise runs self-hosted with SSO and the customer's own LLM keys. Note: Sourcery describes itself as an AI code reviewer and does not use the word 'agent'; it is listed for its autonomous PR review, approval and merge-blocking security checks.", "pricing": "Open Source plan free for public repositories; Pro $12 per developer/month billed annually ($15 monthly); Team (code review and security, nightly scans of 50 repos) $24 per developer/month billed annually ($30 monthly); Enterprise (self-hosted, SSO, own LLM keys) via demo. 14-day free trial.", "pricing_model": "freemium", "frameworks": [], "frameworks_claimed": [ "SOC 2 (vendor's own certification)" ], "tasks": [ "pr-review", "appsec", "sast", "secrets-detection", "sca", "iac", "code-quality" ], "india_relevance": "", "featured": false, "source_url": "https://sourcery.ai/security", "sources": [ "https://sourcery.ai/", "https://sourcery.ai/security", "https://sourcery.ai/pricing", "https://sourcery.ai/terms", "https://sourcery.ai/privacy", "https://find-and-update.company-information.service.gov.uk/company/11158247" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "ares-cyber-agentic-ai-security-testing", "name": "Ares Cyber agentic AI security testing platform (autonomous exploit chaining and runtime verification across SAST, SCA, DAST, VA and pentest)", "vendor": "Ares Cyber (Ares Cyber S.r.l.)", "hq_country": "Italy", "hq_region": "europe", "url": "https://ares-cyber.ai/", "category": "security", "categories": [ "security", "code-security" ], "summary": "Rome security-testing platform that runs SAST, SCA, IaC/secrets, DAST, vulnerability assessment and penetration testing as one pipeline, in which AI agents autonomously chain vulnerabilities and safely run exploits to prove which findings are exploitable, available as SaaS, self-hosted or an air-gapped appliance.", "description": "Ares Cyber S.r.l. (Rome) describes Ares as 'the agentic-AI platform that proves which vulnerabilities are exploitable - from code to exploit, in one validated pipeline'. Static code analysis, dependency and supply-chain analysis, IaC and secrets checks, dynamic testing, network vulnerability assessment and penetration testing feed one pipeline. Per the vendor's FAQ, Ares 'uses AI agents trained on real attacker methodologies to autonomously chain vulnerabilities together - at machine speed, 24/7', and its Runtime Verification has 'Ares' AI agent' safely construct and run the exploit, typically via out-of-band channels such as canary DNS or LDAP listeners, to produce concrete proof. AI code triage marks findings as true or false positives, and every automated step, finding and decision is logged with a chain of custody. It integrates with GitHub, GitLab, Bitbucket, Jenkins, CircleCI and Azure DevOps, pushes findings to Jira or ServiceNow, and produces audit-ready reports the vendor positions as evidence for GDPR, PCI DSS, SOC 2 and ISO 27001 audits. The vendor claims 1-4 hours from commit to validated exploit chain and zero-day discovery capability (vendor claims). Plans (Basic, Pro, Enterprise, Air-Gapped) set annual quotas of DAST runs, AI code triage, AI runtime verification and network and web-app pentests; Air-Gapped runs offline AI on a dedicated appliance. Ares Cyber states it holds ISO/IEC 27001:2022 and ISO 9001:2015 certification (AQ Cert). It has regional partners in Switzerland, the United States, Argentina and Saudi Arabia. Pricing is on request; a free trial is offered.", "pricing": "Not published (Basic, Pro, Enterprise and Air-Gapped plans priced on request, billed annually; free trial offered)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "ISO 27001", "SOC 2", "PCI DSS", "GDPR" ], "tasks": [ "pen-test-management", "attack-surface", "vulnerability-management", "appsec", "sast", "sca" ], "india_relevance": "", "featured": false, "source_url": "https://ares-cyber.ai/", "sources": [ "https://ares-cyber.ai/", "https://ares-cyber.ai/faq", "https://ares-cyber.ai/where-we-are", "https://ares-cyber.ai/legal/privacy-policy", "https://ares-cyber.ai/legal/terms-and-conditions" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "cortena-ap-agents", "name": "Cortena AI agents for accounts payable (invoice capture, line-level coding, entity routing, booking and payment-run preparation)", "vendor": "Cortena (Cortena B.V.)", "hq_country": "Netherlands", "hq_region": "europe", "url": "https://cortena.ai/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Amsterdam accounts-payable platform whose agents pick up new invoices from mailboxes, drives and Peppol, route each to the right entity, code every line to account, VAT code and cost centre using the customer's rules and booking history, check it against the supplier contract and post booking-ready entries to DATEV, Exact Online or Twinfield, with payment runs prepared after VAT-ID and IBAN checks.", "description": "Cortena (Cortena B.V., Amsterdam) describes itself as an 'AI operator for accounts payable' for European SME finance teams, finance professionals and accounting firms. Its homepage says 'Agents that follow your rules, on a flow you shape' and shows an agent activity log in which a new invoice is found in the mailbox, routed to an entity, supplier and payment details and line items are extracted, booking accounts, VAT codes and cost centres are assigned, and the booking is prepared; booking-ready batches go straight into DATEV Rechnungswesen, DATEV Unternehmen Online, Exact Online or Twinfield (and coded invoices can be transmitted to Greece's AADE myDATA). The AI coding page says its agents automate complex cost-centre and cost-carrier allocations consistently across entities, following the patterns already set in the books (chart of accounts such as SKR04, mapped VAT codes, booking history). A Workflow Builder 'directs the agents' and defines the path each invoice takes. The payments page says Cortena does not transfer funds: it prepares payment runs, validating the supplier VAT ID against VIES and the IBAN's existence and reconciling line totals, queues ready invoices and skips incomplete ones, and hands off a SEPA file or a treasury/accounting tool. Bank reconciliation (Yapily feeds or CAMT/MT940 upload) uses configurable matching logic 'with Cortena's agents and workflows'. A GoBD-aligned audit trail records each step, and approvals follow the customer's approval matrix. An MCP server ('Ask Cortena') lets ChatGPT or Claude query payables; that Q&A layer is not the listed capability. Pricing is a tailored quote by invoice volume, entities and stack.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "workflow-automation", "process-automation" ], "india_relevance": "", "featured": false, "source_url": "https://cortena.ai/", "sources": [ "https://cortena.ai/", "https://cortena.ai/product/ai-coding", "https://cortena.ai/product/payments", "https://cortena.ai/product/bank-reconciliation", "https://cortena.ai/pricing", "https://cortena.ai/imprint", "https://cortena.ai/about" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "sequenta-ki-kontierungsagent", "name": "SEQUENTA KI-Kontierungsagent (AI invoice-coding agent with DATEV export)", "vendor": "SEQUENTA (Sequenta UG (haftungsbeschr\u00e4nkt))", "hq_country": "Germany", "hq_region": "europe", "url": "https://sequenta.de/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Berlin bookkeeping agent for German SMEs and the self-employed that collects incoming invoices by upload, email or e-invoice, extracts the data, applies hard-coded German VAT rules (\u00a713b reverse charge, low-value-asset limits, intra-EU acquisitions), researches unclear receipts on its own and produces complete booking entries (account, contra account, BU key, text) for DATEV-EXTF export, flagging uncertain items.", "description": "SEQUENTA (Sequenta UG (haftungsbeschr\u00e4nkt), Berlin) sells a 'KI-Kontierungsagent' ('Kontierung? Erledigt der Agent.'). Per its homepage the agent gathers receipts automatically by upload, email or e-invoice; reads PDFs, photos and e-invoices; extracts supplier, amounts, tax rates and service periods; checks tax logic, the client profile, the chart of accounts and missing context before coding; and outputs a finished booking entry with general-ledger account, contra account, BU tax key and booking text ('Kein Vorschlag \u2013 das fertige Ergebnis'). Tax treatment uses hard rules (\u00a713b UStG, GWG limits, intra-community acquisitions) rather than LLM judgement, and where receipt text is unclear the agent 'recherchiert selbstst\u00e4ndig', asking questions only when really needed. Results are exported as DATEV-EXTF with uncertain items colour-flagged, and corrections feed back so errors are not repeated. Several adjacent features are marked as coming soon or planned on the same pages (bank matching, ELSTER VAT pre-return submission, portal auto-download agents, API access, direct accounting/bank/authority integrations); the listing covers only the live coding agent. Data processing is stated as GDPR-compliant in Germany. Self-serve monthly plans are published.", "pricing": "Published: Starter \u20ac29/month (up to 50 documents/month, first month free), Growth \u20ac49/month (up to 200 documents/month), Enterprise \u20ac99/month (individual volume); monthly cancellable.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "workflow-automation", "process-automation" ], "india_relevance": "", "featured": false, "source_url": "https://sequenta.de/", "sources": [ "https://sequenta.de/", "https://sequenta.de/impressum", "https://sequenta.de/ueber-uns" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "zalion-procurement-ai-agents", "name": "Zalion KI-Agenten f\u00fcr den Einkauf (Intake, Sourcing, Negotiation and Order-confirmation check agents)", "vendor": "Zalion (Zalion GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://zalion.ai/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Munich-headquartered modular AI-agent platform for direct and indirect procurement in manufacturing: a sourcing agent drafts and sends RFQs, chases suppliers and lines up quotes; a negotiation agent benchmarks each offer and drafts the negotiation email for approval; an order-check agent matches order confirmations against POs, writes correct ones back to the ERP and clears deviations with suppliers.", "description": "Zalion (Zalion GmbH; imprint 'HQ M\u00fcnchen', registered seat Heilbronn) builds 'die modulare KI-Agenten-Plattform f\u00fcr den Einkauf' for industrial companies (machinery, automotive suppliers, electronics, chemicals and pharma, energy, medtech, construction and agriculture, defence), and says it is in use at 40+ industrial companies. Per its homepage: the Sourcing agent understands specifications, drafts and sends the request for quotation, sends supplier reminders, compares the quotes and prepares a recommendation; the Negotiation (Verhandlungs-) agent checks each offer against benchmarks from history and market, prepares arguments, drafts the negotiation email and puts the finished strategy up for approval, then reports savings; the Order-check (Bestellpr\u00fcfungs-) agent reconciles order confirmations in any format against the purchase order, sends reminders for overdue confirmations, writes correct confirmations straight back into the ERP and resolves deviations with the supplier, with goods-receipt and invoice checks to follow. An Intake agent (clarifying needs in Teams chat, searching catalogues and creating the purchase requisition in SAP) is shown as being built in design partnership. The product dashboard shows connections to SAP, Outlook, Teams and Coupa. Routine tasks run automatically and anything else is laid out ready for a decision; every lever the agents propose is traceable to its source. Pricing is not published (demo booking).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://zalion.ai/", "sources": [ "https://zalion.ai/", "https://zalion.ai/about", "https://zalion.ai/imprint" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "procure-ai-autonomous-sourcing-negotiation-agents", "name": "Procure Ai autonomous sourcing and negotiation agents (tail-spend tenders, autonomous negotiations, intake and SOW agents)", "vendor": "Procure Ai (ProcureAi Ltd)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.procure.ai/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "London-registered agentic procurement automation platform whose agents run tactical and tail-spend sourcing events on autopilot, finding suppliers, collecting bids and analysing proposals, and negotiate commercial terms with suppliers autonomously within a negotiation playbook the buyer configures, alongside chat-based intake and SOW-generation agents.", "description": "Procure Ai (ProcureAi Ltd, London, with sister companies ProcureAi GmbH in Hainburg, Germany, and ProcureAi SASU in Paris) sells an 'AI-native', agentic procurement automation platform for enterprise procurement teams and the public sector. Its Autonomous Sourcing & Negotiations module automatically runs sourcing events on tactical and tail-spend requests: a conversational AI agent creates the briefing, finds relevant suppliers (predictive supplier scouting in the customer's system or new ones), autonomously collects bids and analyses proposals. In the AI Negotiation Cockpit buyers configure the negotiation parameters, behaviours and tactics of its 'autonomous negotiation agents', which then negotiate commercial terms with suppliers across previously untouched tactical and tail spend (the vendor cites an average 4.7% savings and says it is a Sample Vendor in the 2026 Gartner Market Guide for Sourcing Applications for advanced and autonomous sourcing). The Generative Intake Management module adds a chat-based AI Intake Agent for guided buying (catalogue and marketplace checks, preferred suppliers, existing contracts), a free-text request agent that structures requisitions, and a GenAI Scope Generator agent that drafts SOWs, RFP requirements, questionnaires and cost templates; procurement, IT-security and TPRM policies can be built into the buying process. Other modules (spend analytics, strategic sourcing scenarios, supplier management, purchasing operations) round out the platform. Pricing is not published (demo request).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.procure.ai/platform/autonomous-sourcing", "sources": [ "https://www.procure.ai/", "https://www.procure.ai/platform/autonomous-sourcing", "https://www.procure.ai/platform/generative-intake-management", "https://www.procure.ai/impressum", "https://find-and-update.company-information.service.gov.uk/company/12564716" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "bind-contract-agent", "name": "Bind agentic contract workspace (drafting and negotiation agent with automated renewals and workflows)", "vendor": "Bind (Aatos Legal Technology Oy)", "hq_country": "Finland", "hq_region": "europe", "url": "https://bindlegal.com/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Helsinki agentic contract workspace for in-house legal, sales and procurement teams: an agent drafts contracts from emails, call notes or deal terms using the team's templates, reads each counterparty redline against the playbook and past deals and writes the counter, remembers what was conceded in earlier rounds, and runs renewal reminders, assignments and post-signature filing on its own.", "description": "Bind (Aatos Legal Technology Oy, Helsinki; founded in 2024 by the team behind the Finnish consumer legal service Aatos) positions itself as an 'agentic workspace for in-house legal' and 'not another CLM': 'Contracts drafted and negotiated by an agent that knows your playbooks, positions and past deals' and 'Bind does the work itself: it reads the redlines, writes the counters, and watches the renewals.' Per its homepage, users can ask in plain language (e.g. 'draft me an MSA') and Bind turns emails, call notes or deal terms in Word, PDF or PowerPoint into a contract that follows the team's templates and formatting; for incoming redlines it checks the counterparty's changes against the playbook and past deals, writes the counter-position and keeps a negotiation timeline that knows what was already conceded or agreed in earlier rounds. Stored contracts have parties, values, dates and obligations extracted automatically, and Bind flags contracts that are stuck, overdue or off standard terms. Rule-based workflows run without manual steps (for example, when a renewal date is 30 days away and contract value exceeds a threshold, assign to Legal and email a reminder; signed contracts are filed, tagged and followed up). It includes e-signature, Salesforce, Notion, Linear and email-intake integrations and a REST API through which customers' own AI agents can connect. The contact page says Bind is SOC 2 Type I and ISO 27001 compliant (vendor claim, not checked). Pricing is published.", "pricing": "Published: Starter $90 per user per month (1\u20134 users, up to 200 stored documents, 50 e-signatures/month), Business $500 per month (5 users included, up to 2,000 documents, 500 e-signatures/month), Enterprise custom; the pricing page offers an annual-billing toggle marked -17% (the page does not state whether the displayed dollar amounts are monthly or annual).", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [ "SOC 2", "ISO 27001" ], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://bindlegal.com/", "sources": [ "https://bindlegal.com/", "https://bindlegal.com/about/", "https://bindlegal.com/contact/", "https://bindlegal.com/pricing/", "https://bindlegal.com/terms-of-service/", "https://avoindata.prh.fi/opendata-ytj-api/v3/companies?businessId=2901500-3" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "sopra-steria-ian-investigation-agent-network", "name": "Sopra Steria IAN \u2013 Investigation Agent Network (agentic AML alert investigation)", "vendor": "Sopra Steria (Sopra Steria SE, Hamburg)", "hq_country": "Germany", "hq_region": "europe", "url": "https://www.soprasteria.de/products/ian", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Agentic AI product from Sopra Steria's German company for anti-financial-crime teams: it takes transaction-monitoring alerts and runs the first-level investigation itself (gathering case information from approved sources, analysing facts and patterns in the alert's context, documenting results, sources and reasoning) and prepares a recommended action, while the final case decision stays with the analyst.", "description": "IAN (Investigation Agent Network) is sold by Sopra Steria SE in Germany to banks' anti-financial-crime (AFC) teams. Per its own product page, IAN uses agentic AI to process the information around a transaction-monitoring alert into a structured, traceable first-level investigation with a recommended action. It carries out defined research, analysis and documentation steps along a controlled workflow: research (pulling case-related information from defined, approved sources), analysis (placing facts, patterns and anomalies in the context of the specific alert), documentation (recording results, sources and reasoning for audits) and decision preparation. It is built to sit alongside existing monitoring, case-management and data systems rather than replace them. The vendor states plainly that IAN 'automates the investigation and prepares the decision without making it itself': final case decisions, approvals and decision points stay with the analysts and responsible roles (human oversight). Live demos are offered on a concrete transaction-monitoring case. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "alert-triage", "case-investigation" ], "india_relevance": "", "featured": false, "source_url": "https://www.soprasteria.de/products/ian", "sources": [ "https://www.soprasteria.de/products/ian", "https://www.soprasteria.de/footer/impressum" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "xpert-ia-agent-onboarding-lcb-ft", "name": "Xpert-iA Agent Onboarding clients / LCB-FT (AML onboarding agent for French accounting firms)", "vendor": "Xpert-iA (Xpert-IA SAS)", "hq_country": "France", "hq_region": "europe", "url": "https://xpert-ia.fr/robots/agent-onboarding-lcbft.html", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "French AI agent for accounting firms' anti-money-laundering (LCB-FT) client onboarding: from a SIREN it pulls the company and directors from the national business register, sends the client a secure portal link and chases missing documents, checks beneficial owners against the RBE register, asset-freeze lists, FATF/EU country risk and document consistency, screens for PEPs, and assembles a traced due-diligence file for the firm to decide.", "description": "Xpert-iA sells automation 'robots' and AI agents to French chartered-accountant firms (experts-comptables). Its Agent Onboarding clients / LCB-FT (marked 'Op\u00e9rationnel') runs the AML/CFT new-client file. Per its own page: starting from the client's SIREN or name it finds the company and its directors in the Registre National des Entreprises, prepares the file and the list of documents required; it sends the client a personal link to a secure portal to fill in a form and upload documents (articles, director ID, ownership chart), and follows up for missing items; it checks declared beneficial owners against the beneficial-ownership register (RBE, through the firm's INPI connection), checks the DG Tr\u00e9sor asset-freeze list, assesses geographic risk against official FATF and EU lists and checks that uploaded documents match the declared information (automatic document reading); a public PEP screen (Wikidata) is a supplementary signal and every hit goes to mandatory human review. It then proposes the vigilance level and measures, and the firm reviews and validates or declines the relationship, with documents archived. The vendor states the agent prepares, checks and documents, and the risk assessment and onboarding decision remain the firm's. The agent is included in the published Pack M\u00e9ga and Pack Int\u00e9gral CRM bundles. Small, young vendor (SAS created 2024) focused on French accounting firms.", "pricing": "Included in Pack M\u00e9ga, \u20ac1,990/yr excl. VAT (or \u20ac207.30/month excl. VAT); also in Pack Int\u00e9gral CRM, \u20ac3,990/yr excl. VAT", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "kyc", "aml", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://xpert-ia.fr/robots/agent-onboarding-lcbft.html", "sources": [ "https://xpert-ia.fr/robots/agent-onboarding-lcbft.html", "https://xpert-ia.fr/", "https://xpert-ia.fr/mentions-legales.html", "https://recherche-entreprises.api.gouv.fr/search?q=xpert-ia" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "blinqx-kyc-agent", "name": "Blinqx KYC Agent (Wwft client due diligence and UBO checks for accounting firms)", "vendor": "Blinqx", "hq_country": "Netherlands", "hq_region": "europe", "url": "https://blinqx.ai/ai/kyc-agent", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Dutch AI agent that runs Wwft client due diligence for accounting and tax firms: it analyses client files, UBO structures and legal constructions, checks identities against PEP and sanctions lists, pulls audit information from the Dutch UBO register and Trade Register, flags profile changes and schedules re-reviews, and delivers audit-ready KYC files with a source reference for every conclusion, while a person makes the decision.", "description": "Blinqx, a Dutch group of software companies for professional-services firms, sells the KYC Agent as part of its AI offering for Accountancy & Tax. Per its own page, the agent 'carries out client due diligence automatically for new and existing clients' under the Dutch anti-money-laundering act (Wwft): it analyses client files, UBO structures and legal constructions; checks identities, PEP lists and sanctions lists; extracts audit information from the UBO register and the Handelsregister (KvK); detects changes in client profiles and schedules re-assessments; backs every conclusion with a direct source reference (KvK and other external registers); and produces structured, audit-ready KYC files. The vendor positions it as human-in-the-loop: the AI prepares the work (collecting, analysing, structuring) and a person reviews each conclusion and takes the decision, with a full audit trail and no training on customer data. Vendor-claimed result: 3\u20135 hours saved per new client review. Blinqx lists other agents for the same sector (fiscal authorisation/deferral agent, pension calculation agent, client-structure agent), which are outside this listing. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "kyc", "aml", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://blinqx.ai/ai/kyc-agent", "sources": [ "https://blinqx.ai/ai/kyc-agent", "https://blinqx.ai/contact/alle-locaties", "https://blinqx.ai/contact" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "metis-legenda-aml-agent", "name": "Metis Legenda AML (AI agent for KYC due diligence and transaction monitoring)", "vendor": "Metis (Metis S.r.l.)", "hq_country": "Italy", "hq_region": "europe", "url": "https://www.metisai.it/legenda-aml-kyc.html", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Milan AML product in which an AI agent runs Italian 'adeguata verifica' (customer due diligence) end to end: it analyses each onboarding document for relevance and extracts the data, traces beneficial owners through chains of shell companies using private documents and public databases, screens PEP, EU/UN sanctions and internal watchlists, proposes a reasoned risk classification and logs every step in a traceable report; a companion agent analyses transactions to surface real behavioural anomalies and cut false positives.", "description": "Metis S.r.l. (Milan) offers Legenda AML, built around an AI agent 'designed to govern complex compliance processes end to end'. Per its own KYC page: documents are uploaded by the operator or pulled through integrations, and the agent analyses them one by one, checks their relevance to due diligence and extracts the relevant information using uniform, repeatable criteria; it cross-references private documentation with public databases to identify beneficial owners, reconstructing ownership chains even through several interposed shell companies; where required it screens PEP lists, sanctions and anti-terrorism lists (EU/UN) and internal watchlists; and it outputs the subject's profile with a reasoned proposed risk classification to support the human decision. Every step is logged, the operator can watch the agent's steps in real time, and the system produces a documentary-completeness report so each file can be reconstructed later. The transaction-monitoring page describes the agent combining transactions, KYC profile and external information into one customer view, surfacing recurring behavioural patterns and anomalies and reducing false positives, with compliance-team decisions feeding back into the scoring model. Responsibility stays with the compliance function. The vendor states SOC 2 Type II, GDPR compliance, EU data residency and no training on customer data. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "SOC 2 Type II", "GDPR" ], "tasks": [ "kyc", "aml", "alert-triage" ], "india_relevance": "", "featured": false, "source_url": "https://www.metisai.it/legenda-aml-kyc.html", "sources": [ "https://www.metisai.it/legenda-aml-kyc.html", "https://www.metisai.it/legenda-aml-transaction-monitoring.html" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "freeday-kyc-digital-employee", "name": "Freeday KYC digital employee (AI agents for KYC document collection, verification and screening)", "vendor": "Freeday (Freeday B.V.)", "hq_country": "Netherlands", "hq_region": "europe", "url": "https://www.freeday.ai/nl/oplossingen/kyc", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Rotterdam 'digital employee' platform whose KYC agents request, validate and classify customer documents in real time, guide customers through verification by voice or chat, run sanctions, adverse-media and PEP checks before onboarding completes, and close routine KYC checks without manual review, routing exceptions to analysts with pre-extracted data and logging every decision for supervisors.", "description": "Freeday B.V. builds AI 'digital employees' for customer service, invoice processing and KYC, used mainly by Benelux financial-services firms. Per its own KYC solution page: AI agents request documents, validate and classify them in real time; complex cases are passed to staff with data already extracted; automated checks against sanctions lists, adverse-media databases and PEP registers flag risk before onboarding is finished; an AI voice agent (or chat) guides customers step by step through KYC verification and requests and validates documents directly; and routine KYC verifications are handled directly by the digital employee without manual review, with every decision recorded and traceable for regulators. It connects to existing KYC, CRM and source systems and sets up document collection, verification, screening and exception routes; the vendor says most customers go live within four weeks and cites Novum Bank processing more than 1 million documents (vendor claim; also cites 80% less time per KYC check and 150+ ID types). The vendor claims Wwft, MiCA, AML and GDPR alignment and ISO 27001-certified security infrastructure. Pricing is outcome-based (per resolved conversation, verified document or processed invoice) and set per customer; no prices are published.", "pricing": "Not published (outcome-based: per verified document / resolved case, custom quote)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "ISO 27001", "GDPR", "Wwft", "MiCA" ], "tasks": [ "kyc", "aml", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.freeday.ai/nl/oplossingen/kyc", "sources": [ "https://www.freeday.ai/nl/oplossingen/kyc", "https://www.freeday.ai/nl/service-terms", "https://www.freeday.ai/nl/over-ons", "https://www.freeday.ai/nl/prijzen" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "cytix-agentic-pentesting-change-approvals", "name": "Cytix agentic pentesting and automatic change approvals (change-driven software security)", "vendor": "Cytix (Cytix Ltd)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://cytix.io/", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "Manchester software-change security platform that risk-scores every code change, automatically approves changes that fall within the customer's own policy and escalates the rest, then sends sandboxed AI pentest agents against high-risk changes and logs every decision and tool call as an audit-ready change record.", "description": "Cytix (Cytix Ltd, Manchester, UK) treats each software change, rather than a yearly test window, as the unit of security work. Per its own solution pages: the platform discovers changes, gathers context (affected asset, environment, company policy and prior findings) and assesses each change against the customer's approval policy and risk thresholds; changes that clearly fall within policy are approved automatically without manual sign-off, and changes that do not are escalated to a human reviewer, with the decision and its rationale attached to the change either way. For changes that warrant attack-grade proof, Cytix deploys pentest agents scoped to that specific change (using the change summary and task description as context); agents run in parallel, each isolated in its own sandbox, and work like a human tester by issuing requests, managing sessions, comparing responses and using browser-based tools, choosing tools for the task rather than running a fixed script. Verified vulnerabilities are raised in the platform with change-specific remediation advice, and every engagement is logged in full (tool calls, execution steps, cost and time). Customers choose per change between agentic validation and human testing; a Hybrid plan routes validation to CREST-accredited partner testers. The Self-Service plan lists change discovery, change risk assessment, auto change approval, prioritised test plans, agentic testing and audit-ready reporting. Pricing is not published (plans are 'Get Started' / demo).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pen-test-management", "appsec", "risk-assessment", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://cytix.io/solutions/agentic-pentesting", "sources": [ "https://cytix.io/", "https://cytix.io/solutions/agentic-pentesting", "https://cytix.io/solutions/automatic-change-approvals", "https://cytix.io/plans", "https://cytix.io/company", "https://cytix.io/contact", "https://find-and-update.company-information.service.gov.uk/company/14043556" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "feld-ai-document-agents", "name": "feld.ai KI-Agenten (invoice-intake-to-booking and freight-invoice audit agents)", "vendor": "feld.ai (feld.ai GmbH)", "hq_country": "Austria", "hq_region": "europe", "url": "https://feld.ai/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Austrian document-agent platform whose AI agents take incoming invoices (PDF, e-invoice, Swiss QR bill) through capture, master-data matching, mandatory-field and PO/delivery-note checks to a booking proposal in the ERP, passing clear cases straight through and sending only exceptions, with the reason and source location, to a person.", "description": "feld.ai GmbH (Feldkirch, Vorarlberg) sells 'KI-Agenten f\u00fcr dokumentenreiche Prozesse'. Per its invoice-processing page, an agent reads header and line data, looks the supplier up in the customer's master data, assigns account and cost centre by the customer's rules and hands a booking proposal to the ERP; it then checks invoice number, date, amounts, IBAN and VAT ID for presence and consistency, verifies that the supplier exists and that purchase order or delivery note match. If everything fits, the booking proposal goes on without a detour; if a mandatory field is missing or values contradict each other (net, tax, gross), the clerk gets exactly that case with the location in the document and the reason. The work list shows clear cases already booked and open cases awaiting a decision. The vendor cites a German logistics group (Logwin on its homepage) in production since May 2025 with 96% of invoices fully traced and over 90% of line items booked correctly. Related solutions include freight-invoice audit, mailroom classification, file extraction, redaction and document verification. Models run on the vendor's own GPU servers in Feldkirch, as a dedicated instance or in the customer's environment; DATEV connects via export formats or middleware. Published pricing (net, per active user per month, model usage billed separately by consumption, setup and custom work extra): Basic EUR 75 (self-service core agents), Team EUR 199 (configured standard workflows), Professional EUR 400 (custom business workflows); Enterprise/partner on quote.", "pricing": "Basic EUR 75, Team EUR 199, Professional EUR 400 per active user/month (net); model usage billed by consumption; setup extra; Enterprise on quote", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://feld.ai/solutions/invoice-processing/", "sources": [ "https://feld.ai/", "https://feld.ai/solutions/invoice-processing/", "https://feld.ai/pricing/", "https://feld.ai/about/", "https://feld.ai/impressum/" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "cygnet-one-ai-accounts-payable-agents", "name": "Cygnet.One AI Accounts Payable agents (invoice validation, GST/ITC checks, approve/hold/escalate recommendations and ERP posting)", "vendor": "Cygnet.One (Cygnet Infotech Pvt. Ltd.)", "hq_country": "India", "hq_region": "india", "url": "https://www.cygnet.one/products/accounts-payable/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Ahmedabad tax-technology and IT firm whose agentic accounts-payable platform has AI agents ingest invoices, extract line and tax fields, cross-check vendor master, PO/GRN, GST/ITC and bank-detail changes against policy rules, recommend approve/hold/escalate/reject with reasons, and post approved invoices to the ERP while finance teams keep exception handling and final authority.", "description": "Cygnet.One (Cygnet Infotech Pvt. Ltd., Ahmedabad) sells an Agentic AI platform for Accounts Payable. Per its product page, invoices arrive by upload, email inbox or folder watch; vision-language extraction pulls line items, tax fields and PO references with confidence scoring; agents cross-check vendor master data, PO/GRN matching, GST/ITC fields and bank-detail changes against the customer's policy rules; every invoice gets an approve, hold, escalate or reject recommendation with the reasoning in plain language; approved invoices post straight to the ERP with an audit trail, and agents keep watching for ageing and policy drift. The vendor says agents 'execute defined AP tasks autonomously while finance teams retain oversight, exception handling and final decision authority'. It connects to SAP, Oracle, NetSuite, Microsoft Dynamics, Tally and Cygnet's own IRP/GST stack. Pricing is scoped to invoice volume and the agents deployed and set in a discovery workshop. The product page's security section states that its capability claims are 'illustrative pending your security & compliance team's review', so no security or compliance certifications are listed.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "agentic-ops" ], "india_relevance": "Indian vendor (Ahmedabad) whose AP agents are built for Indian GST, e-invoicing/IRN, ITC and TDS rules and Tally/SAP stacks.", "featured": false, "source_url": "https://www.cygnet.one/products/accounts-payable/", "sources": [ "https://www.cygnet.one/products/accounts-payable/", "https://www.cygnet.one/contact-us/" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "citsmart-grc-s-ai-agents", "name": "CITSmart GRC.S (GRC + SecOps platform with AI agents that check deadlines and execute response actions)", "vendor": "Central IT (CITSmart)", "hq_country": "Brazil", "hq_region": "latin-america", "url": "https://www.centralit.com.br/produtos/gestao-de-riscos-e-compliance", "category": "compliance", "categories": [ "compliance", "security" ], "summary": "Brazilian GRC-plus-security-operations platform from Central IT: alerts from proxy, DNS, XDR, e-mail and identity tools are correlated and prioritised by AI, AI agents check deadlines, priorities and owners for each compliance or security demand, and AI agents execute checks and response actions in the environment (Cognitive Workflow), with LGPD, ISO 27001, NIST, CIS Controls 8 and ISO 42001 mapped out of the box.", "description": "CITSmart GRC.S is Central IT's platform that joins governance, risk, compliance and security operations in one AI-orchestrated engine. Per its own product page, alerts from proxy, DNS, XDR, e-mail and identity tools flow into the CITSmart Alert Center, where AI removes noise and false positives, correlates events and opens security tickets; each event is qualified with a compromise score; 'Governan\u00e7a por IA' has AI agents check deadlines, priorities and responsibilities for each demand; and 'A\u00e7\u00e3o por IA' has AI agents execute checks and actions in the environment, orchestrating the response ('da detec\u00e7\u00e3o \u00e0 a\u00e7\u00e3o, sem operador no loop', with runbooks applied by the AI agents). Governance controls are applied to the responsible people with real-time dashboards, risk is assessed periodically, and non-conformities and continuity issues are tracked to closure with a full audit trail. Frameworks listed as native: LGPD, HIPAA, CCPA, ISO/IEC 27001, ISO/IEC 27002, NIST, CIS Controls 8, ISO/IEC 42001, PPSI and PSEC PJ (Brazilian public-sector programmes). Central IT is a 22-year-old Brazilian technology company with offices in Bras\u00edlia (head office), S\u00e3o Paulo, Rio de Janeiro, Recife and Dallas. Pricing is not published (demo on request).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "iso27001", "hipaa" ], "frameworks_claimed": [ "LGPD", "HIPAA", "CCPA", "ISO 27001", "ISO 27002", "NIST", "CIS Controls 8", "ISO 42001", "PPSI", "PSEC PJ" ], "tasks": [ "compliance-workflows", "control-monitoring", "alert-triage", "incident-response", "risk-assessment", "remediation" ], "india_relevance": "", "featured": false, "source_url": "https://www.centralit.com.br/produtos/gestao-de-riscos-e-compliance", "sources": [ "https://www.centralit.com.br/produtos/gestao-de-riscos-e-compliance", "https://www.centralit.com.br/sobre" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "vibrantix-compliance-agents", "name": "VibrantiX agentic compliance platform (Evidence Review, Vendor Risk Scoring, Risk Detection, Customer Trust, Policy Drafting and Control Remediation agents)", "vendor": "VibrantiX (Vibrantix, Inc.)", "hq_country": "Singapore", "hq_region": "asia-pacific", "url": "https://vibrantix.ai/", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Singapore-headquartered agentic compliance platform whose named agents review uploaded evidence against framework controls and flag gaps, score vendors from 12+ external sources without questionnaires, scan cloud posture and auto-escalate critical findings to the risk register, draft answers to customer security questionnaires (SIG, CAIQ, custom) from live policies, draft policies, and generate fixes for failed controls and mark them ready for re-audit.", "description": "VibrantiX describes itself as an agentic AI platform for continuous trust and compliance across ISO, SOC 2, EU AI Act, ISO 42001, NIST AI RMF, DORA, HIPAA, GDPR, CCPA, DPDP and APAC frameworks (PDPA, MAS TRM, HKMA, APRA CPS 234). Per its own homepage, customers connect cloud, identity and work tools (AWS, GCP, Azure, Okta, Slack, GitHub and others) and a set of autonomous agents runs continuously: the Evidence Review Agent scans uploaded documents, validates them against ISO 27001/SOC 2/HIPAA controls and flags expired, missing or mismatched evidence; the Vendor Risk Scoring Agent pulls 12+ external data sources, runs security assessments and returns a vendor risk score with continuous monitoring and alerts, no questionnaire needed; the Risk Detection Agent runs 10,000+ cloud checks across AWS, Azure and GCP, maps findings to framework controls and auto-escalates critical risks to the risk register; the Customer Trust Agent drafts every answer to forwarded customer security questionnaires (SIG, CAIQ, custom) from the live policy library with control citations; the Policy Drafting Agent generates policies with a RAG pipeline; and the Control Remediation Agent generates a fix when a control fails, updates policies, creates evidence and marks the control ready for re-audit. A vCISO agent and a Trust Portal are also included. The contact page names Singapore as global headquarters with offices in Sharjah (UAE), Pune and Bengaluru (India). Pricing is not published on a readable page.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "iso27001", "soc2", "hipaa", "dora", "dpdp" ], "frameworks_claimed": [ "ISO 27001", "SOC 2", "EU AI Act", "ISO 42001", "NIST AI RMF", "DORA", "HIPAA", "GDPR", "CCPA", "DPDP", "PDPA", "MAS TRM", "APRA CPS 234", "PCI DSS" ], "tasks": [ "evidence-collection", "vendor-risk", "questionnaire-automation", "policy-management", "remediation", "control-mapping" ], "india_relevance": "Offices in Pune and Bengaluru; the vendor lists DPDP among supported frameworks (DPDP module depth not verified).", "featured": false, "source_url": "https://vibrantix.ai/", "sources": [ "https://vibrantix.ai/", "https://vibrantix.ai/contact" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "crest-tprm-ai-agents", "name": "Crest TPRM AI agents (Vendor Outreach, Questionnaire Intelligence, Continuous Monitoring, Risk-Based Scoring, Finance, Screening and Efficiency agents)", "vendor": "Crest (Crest Veda TechWorks Private Limited)", "hq_country": "India", "hq_region": "india", "url": "https://crest.digital/tprm/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "New Delhi-headquartered third-party risk platform with seven agents marked Live: an outreach agent that autonomously sends and follows up vendor emails and voice reminders and escalates non-response, a questionnaire agent that distributes, chases and analyses vendor questionnaires, plus continuous adverse-media/watchlist monitoring, risk-based scoring, financial analysis, screening and efficiency agents that auto-approve low-risk vendors and trigger re-assessments.", "description": "Crest, built by Crest Veda TechWorks (CVT), is an AI-native TPRM platform for procurement, risk, audit, finance and compliance teams. Per its own TPRM and Agentic AI pages, seven purpose-built agents, all marked Live, work across the vendor lifecycle: the Vendor Outreach Agent drafts and sends personalised vendor emails without human intervention, tracks replies, sends timed follow-ups, uses AI voice reminders and escalates non-responsive suppliers; the Questionnaire Intelligence Agent distributes questionnaires to vendor cohorts, chases overdue vendors, reads free-text answers, extracts risk signals and flags incomplete or contradictory answers; the Continuous Monitoring Agent watches adverse media, watchlists, courts and regulatory channels all year; the Risk-Based Scoring Agent classifies vendors with a configurable rules engine and recommends re-assessment timelines; the Finance Agent reads API financials and scanned documents and recommends a financial rating; the Screening Agent filters adverse-media noise with relevancy scoring; and the Efficiency Agents auto-approve low-risk vendors and trigger re-assessments by vendor type. Compliance questionnaires are mapped to DORA, NIS2, MAS, RBI, DPDP and CSDDD. Crest is offered as platform-only, as platform with managed services, or as one-time due-diligence reports; prices are not published.", "pricing": "Not published (platform-only, managed-service and one-time report models)", "pricing_model": "quote", "frameworks": [ "dora", "dpdp" ], "frameworks_claimed": [ "DORA", "NIS2", "MAS", "RBI", "DPDP", "CSDDD" ], "tasks": [ "vendor-risk", "questionnaire-automation", "risk-assessment", "workflow-automation" ], "india_relevance": "India-headquartered (New Delhi) vendor; questionnaires mapped to RBI and DPDP, and BFSI pages cite RBI, SEBI and IRDAI.", "featured": false, "source_url": "https://crest.digital/tprm/intelligence/agentic-ai/", "sources": [ "https://crest.digital/tprm/", "https://crest.digital/tprm/intelligence/agentic-ai/", "https://crest.digital/about/", "https://crest.digital/tprm/pricing/" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "gradient-labs-kyb-agent", "name": "Gradient Labs KYB Agent (business-verification agent for financial services)", "vendor": "Gradient Labs (Gradient Labs Limited)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://gradient-labs.ai/", "category": "risk", "categories": [ "risk" ], "summary": "London AI-agent company for financial services whose KYB Agent, in production, checks each business-verification document against the customer's internal policy, requests anything missing from the customer, and verifies the business before routing it to onboarding; it runs alongside Gradient Labs' disputes, lending/collections and customer-service agents.", "description": "Gradient Labs builds specialist AI agents for regulated financial-services operations, used by UK, European and US fintechs and banks. Per its own homepage, its KYB automation has the AI agent check each document against the customer's internal policy, request anything missing from the customer, and verify the business before routing it to onboarding. The company's funding post on its own blog says that, in production today, 'a KYB Agent runs identity and document checks' as part of a suite of specialist agents (Lending Agent for collections, Disputes Agent from intake to investigation to chargeback, KYB Agent) that share context and memory and hand work to each other, each with domain guardrails, compliance checks and test scenarios (e.g. FCA Consumer Duty, EU AI Act). The disputes agent gathers and verifies evidence, decides the outcome, escalates to a human for sign-off and files the chargeback. Only the KYB agent is listed here; pricing is not published (demo on request).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "kyc", "process-automation" ], "india_relevance": "", "featured": false, "source_url": "https://gradient-labs.ai/", "sources": [ "https://gradient-labs.ai/", "https://gradient-labs.ai/blog/weve-raised-26m-to-bring-autonomous-customer-operations-to-financial-services", "https://find-and-update.company-information.service.gov.uk/company/14864752" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "filigran-xtm-one-agents", "name": "Filigran XTM One (CTEM AI agents and autonomous attack chaining for OpenCTI and OpenAEV)", "vendor": "Filigran (Filigran SAS)", "hq_country": "France", "hq_region": "europe", "url": "https://filigran.io/products/xtm-one", "category": "security", "categories": [ "security" ], "summary": "Agentic AI layer for Filigran's open-source threat-intelligence (OpenCTI) and exposure-validation (OpenAEV) platforms: pre-built agents turn threat intelligence into hunting packages, detection rules and attack scenarios, and an autonomous attack-chaining orchestrator plans, runs and adapts an AI penetration test against an authorized environment, with optional human approval for sensitive actions.", "description": "XTM One is the AI orchestration layer of Filigran's eXtended Threat Management (XTM) platform, launched June 9, 2026 and described by the vendor as available now. Its pre-packaged agents work across OpenCTI and OpenAEV: a CTEM Assistant routes work between agents; a Threat Hunt Creator searches for high-value indicators, converts them to platform-native detection rules and assembles them into an OpenCTI grouping; Scenario and Payload Creators turn intelligence into adversary-emulation scenarios in OpenAEV; and exposure-validation agents run scenarios against live environments, identify control gaps and generate detection rules for tools such as Splunk and CrowdStrike. In OpenAEV, Autonomous Attack Chaining (an Enterprise Edition feature documented in the OpenAEV docs) lets an XTM One orchestrator agent take a plain-language objective and scope, build the attack graph, execute injects, read the results, pivot and keep going until the objective is reached or it needs input; operators can steer a live run, answer its questions or stop it. Q3 2026 updates added human approval gates before agents take sensitive actions, a desktop app, a visual flow builder for multi-agent workflows, custom agents and bring-your-own-LLM, with SaaS or on-prem deployment. Enterprise Edition customers of OpenCTI/OpenAEV get a built-in set of agents; advanced capabilities are licensed separately. A free open-source MCP server and a 30-day platform trial are offered. Pricing is not published.", "pricing": "Not published (pre-packaged agents included for OpenCTI/OpenAEV Enterprise Edition customers with a usage quota; advanced XTM One capabilities licensed separately; 30-day trial and free open-source MCP server)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "SOC 2", "ISO 27001" ], "tasks": [ "threat-intelligence", "pen-test-management", "exposure-management", "threat-detection" ], "india_relevance": "", "featured": false, "source_url": "https://filigran.io/products/xtm-one", "sources": [ "https://filigran.io/products/xtm-one", "https://filigran.io/press-releases/filigran-launches-xtm-one/", "https://filigran.io/fr/blog/xtm-platform-q3-2026-updates-opencti-openaev-xtm-one-and-xtm-hub", "https://docs.openaev.io/latest/usage/attack-chaining/autonomous/overview/", "https://docs.openaev.io/latest/usage/attack-chaining/autonomous/configuration/", "https://filigran.io/api/media/file/filigran_on-prem-community-ed._terms-and-conditions_europe_aug-2025.pdf", "https://annuaire-entreprises.data.gouv.fr/entreprise/901384479" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "cloudpeek-agentic-security-operations", "name": "CloudPeek agentic security operations platform (automatic triage, agent-run investigations and approval-gated response)", "vendor": "CloudPeek (CloudPeek Limited)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://cloudpeek.ai/platform/", "category": "security", "categories": [ "security" ], "summary": "UK agentic SOC platform that sits on top of existing SIEM, cloud, endpoint and threat-intelligence tools: it automatically triages every new alert, runs AI-agent follow-up investigations across connected tools, writes the incident summary and can act within per-workflow authority levels (advise, approve, act), including in on-premises or fully air-gapped deployments.", "description": "CloudPeek, from Bristol-based CloudPeek Limited, is an agentic AI platform for security operations. Per its documentation, an Incident Sync worker pulls alerts from connected sources (for example Microsoft Azure/O365, AWS, Splunk, Elasticsearch/OpenSearch, Trend Micro Vision One, Netskope and GitHub), deduplicates and suppresses noise, and an automatic AI triage pipeline normalises, enriches, scores and summarises each incident, matches it to a runbook and drafts an investigation plan with no human action required. A Follow-up worker then runs each plan step through an AI agent loop that queries the connected tools until it has an answer, stores the findings on the incident and regenerates the summary; these autonomous follow-ups are restricted to read-only tools. Analysts and automations can also give agents write-capable tools under human-in-the-loop approval modes that range from 'Approve All' to 'No Approvals', plus a plan mode, and the platform describes three operating levels: Advise, Approve and Act. It also offers threat-hunting workers, playbook-based automations, an agent SDK, MCP and custom-API tool connectors, and a choice of frontier, sovereign or open-weight models. Deployment is dedicated hosting, on-premises or fully air-gapped (the vendor cites a UK Government air-gapped proof of concept and production use at Mastek with ServiceNow case creation). A free Vulnerability Intelligence agent plugin service is offered separately. Platform pricing is not published.", "pricing": "Not published (platform via demo/quote; separate Vulnerability Intelligence agent plugin service is free)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "case-investigation", "incident-response" ], "india_relevance": "", "featured": false, "source_url": "https://docs.cloudpeek.ai/docs/what-is-cloudpeek/", "sources": [ "https://cloudpeek.ai/", "https://cloudpeek.ai/platform/", "https://cloudpeek.ai/faq/", "https://docs.cloudpeek.ai/docs/what-is-cloudpeek/", "https://docs.cloudpeek.ai/docs/incident-triage-pipeline/", "https://docs.cloudpeek.ai/docs/followup-actions/", "https://docs.cloudpeek.ai/docs/human-in-the-loop/", "https://cloudpeek.ai/terms/", "https://find-and-update.company-information.service.gov.uk/company/16018331" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "priam-ava-autonomous-soc-triage", "name": "Priam AVA (autonomous L1 alert triage and investigation agent with evidence-backed verdicts)", "vendor": "Priam Cyber AI (Priam Cyber AI Ltd)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://priam.ai/", "category": "security", "categories": [ "security" ], "summary": "London-based agentic SOC product: AVA investigates every alert from SIEM/EDR/XDR sources by testing malicious and benign hypotheses against the customer's environment and closes it with a defensible verdict (true positive, false positive or inconclusive with the missing evidence named), producing an audit-ready investigation report for enterprise SOCs and MSSP/MDR teams.", "description": "AVA from Priam Cyber AI is positioned by the vendor as 'autonomous L1 triage that closes alerts with a defensible verdict'. For each alert, AVA's agents gather evidence across endpoint, identity and other layers from the customer's existing tools, test competing hypotheses, and a separate reasoning engine (PEBRE) weighs the evidence so the verdict rests on measured evidence rather than a model's free-form opinion. Every alert produces an Investigation Report containing the verdict, the evidence chain, the reasoning and the evidence gaps, and AVA returns a third verdict, INCONCLUSIVE, naming exactly what evidence is missing when it cannot conclude. The vendor lists connectors for SIEM, EDR/XDR, threat-intelligence and ITSM/comms tools (its integrations page notes the list mixes built-in, partner and roadmap connectors). It runs in cloud, on-premises or private deployments for enterprise SOCs and MSSP/MDR teams. The vendor reports, as observed in deployment, closure of 97% of false positives with a report rather than auto-suppression; this is a vendor claim. A free single-alert pilot (send one sanitised alert, receive a full report within 48 hours) is offered. Pricing is not published.", "pricing": "Not published (free single-alert pilot; otherwise via briefing/quote)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "alert-triage", "case-investigation", "security-operations", "threat-detection" ], "india_relevance": "", "featured": false, "source_url": "https://priam.ai/", "sources": [ "https://priam.ai/", "https://priam.ai/methodology", "https://priam.ai/integrations", "https://find-and-update.company-information.service.gov.uk/company/12932723" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "squr-autonomous-pentest", "name": "SQUR Autonomous Pentest (24-hour AI web and API pentesting with exploit verification)", "vendor": "SQUR (SQUR UG (haftungsbeschr\u00e4nkt))", "hq_country": "Germany", "hq_region": "europe", "url": "https://squr.ai/", "category": "security", "categories": [ "security", "code-security" ], "summary": "German autonomous pentesting product for web apps and APIs: given a target URL, scope and optional source code, its AI agents carry out real exploitation, a separate agent re-tests every finding against the live app to weed out false positives, and a compliance-ready report with proof-of-exploit and remediation steps arrives within 24 hours; continuous monthly runs mark findings fixed, regressed or new.", "description": "SQUR, built by SQUR UG (haftungsbeschr\u00e4nkt) in Weingarten, Germany, sells autonomous penetration testing for web applications and APIs, black-box or white-box. The customer points SQUR at a target URL and gives an objective and scope (optionally uploading source code for a white-box test at no extra cost); SQUR then actually exploits vulnerabilities rather than matching patterns, and a separate verifier agent independently re-tests each finding against the live application, labels anything it could not confirm and deduplicates results, so every confirmed finding comes with proof of exploitation. Reports are delivered within 24 hours with step-by-step remediation guidance and are formatted for ISO 27001, SOC 2 and EU Cyber Resilience Act evidence (vendor statement); free one-click retests confirm fixes. The Professional plan runs a full pentest per app every month and marks findings Fixed, Regressed or New, with alerts on regressions. A free attack-surface scan maps external exposure without sending attacks. A separate Autonomous Remediation feature (fixes delivered as pull requests) is in private beta and is not part of this listing. The vendor reports benchmark results comparable to top human pentesters; that is a vendor claim.", "pricing": "Published on squr.ai/pricing: Compliance Pentest EUR 1,995 one-time per web app/API (24h, free retest); Professional continuous EUR 995 per app per month; bulk credits EUR 1,495 per pentest for 10+ apps; free attack-surface scan.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [ "ISO 27001", "SOC 2" ], "tasks": [ "pen-test-management", "appsec", "vulnerability-management", "attack-surface" ], "india_relevance": "", "featured": false, "source_url": "https://squr.ai/", "sources": [ "https://squr.ai/", "https://squr.ai/pricing", "https://squr.ai/about.html", "https://squr.ai/imprint.html" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "nec-procurement-negotiation-ai-agent", "name": "NEC Procurement Negotiation AI Agent Service (NEC \u8abf\u9054\u4ea4\u6e09AI\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u30b5\u30fc\u30d3\u30b9: autonomous delivery-date and quantity negotiation with suppliers)", "vendor": "NEC (NEC Corporation / \u65e5\u672c\u96fb\u6c17\u682a\u5f0f\u4f1a\u793e)", "hq_country": "Japan", "hq_region": "asia-pacific", "url": "https://jpn.nec.com/ai/negotiation-ai/index.html", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Service from NEC for manufacturers' procurement teams. An AI agent built on NEC's own automated-negotiation AI finds the purchase orders whose delivery dates or quantities need adjusting and works out proposed terms. It then negotiates those terms with suppliers itself, interactively, and connects to ERP and other existing systems. Offered since December 2025.", "description": "NEC announced the NEC Procurement Negotiation AI Agent Service (NEC \u8abf\u9054\u4ea4\u6e09AI\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u30b5\u30fc\u30d3\u30b9) on Dec 2, 2025, available from that month. It uses NEC's in-house automated negotiation AI (\u81ea\u52d5\u4ea4\u6e09AI) to automate the complex delivery-date and quantity adjustments that manufacturers' procurement teams make with suppliers. According to NEC, the service checks all orders, picks out the ones that need date or quantity changes to optimise inventory, and generates negotiation proposals. It then presents those proposals to suppliers through an AI agent and negotiates with them interactively, aiming for terms both sides can accept without a buyer stepping in. It integrates with ERP and other existing systems. NEC's own solution page says the technology generates optimal trading terms in place of people and negotiates autonomously. It is designed for AI-to-human and AI-to-AI negotiation. Vendor-reported results: a November 2024 trial at an NEC group company covered about 1,300 purchased parts, with a 95% rate of agreements reached by AI alone and negotiation time cut from hours or days to about 80 seconds. Later NEC releases list a trial with Mitsubishi Electric Trading (Apr 15, 2026) and NEC's own group procurement adopting the service (May 26, 2026). NEC also says its e-negotiation approach was adopted as an international standard at UN/CEFACT. These figures and statements are vendor claims. Published price: from \u00a536 million a year, plus a separate initial fee. NEC's stated target is 100 companies over five years.", "pricing": "Published (JPY): from \u00a536,000,000 per year, plus a separate initial fee (NEC press release, Dec 2, 2025).", "pricing_model": "annual-contract", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://jpn.nec.com/press/202512/20251202_01.html", "sources": [ "https://jpn.nec.com/press/202512/20251202_01.html", "https://jpn.nec.com/ai/negotiation-ai/index.html", "https://jpn.nec.com/profile/corp/profile.html" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "tokium-keiri-ai-agents", "name": "TOKIUM finance AI agents (\u7d4c\u7406AI\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8 TOKIUM: AI expense approval, AI travel arrangement and AI invoice matching)", "vendor": "TOKIUM (\u682a\u5f0f\u4f1a\u793eTOKIUM / TOKIUM Inc.)", "hq_country": "Japan", "hq_region": "asia-pacific", "url": "https://www.keihi.com/keiri-ai-agent/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Japanese expense and invoice-management vendor that sells finance work as AI agents backed by its own staff. Its AI expense-approval agent checks every claim against company rules, performs the first-level approval itself and sends faulty claims back to the applicant with the reason. A travel agent turns a chat message into a submitted pre-approval request plus transport and hotel bookings.", "description": "TOKIUM markets its finance products as \u7d4c\u7406AI\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8 (finance AI agents). In its words, AI and professional staff work together to take over repetitive finance tasks, so work finishes on the customer's instruction. The core named agent, TOKIUM AI\u7d4c\u8cbb\u627f\u8a8d (AI expense approval, launched Jul 3, 2025), checks every submitted expense claim. It looks for breaches of company rules and expense manuals, missing receipts, wrong expense accounts, attendee and date details, and errors in qualified-invoice registration numbers. It then executes the first-level approval. When a claim is faulty, it reports the issue to the finance team and sends the claim back to the applicant, showing which field is wrong and why. It also works with expense systems other than TOKIUM's own. The TOKIUM AI\u51fa\u5f35\u624b\u914d (travel arrangement) agent takes a destination and dates sent by chat and decides whether pre-approval is needed. It fills in the details, submits the pre-application and books transport and accommodation. TOKIUM AI\u8acb\u6c42\u7167\u5408 (invoice matching, Aug 7, 2025) matches uploaded order and invoice data on configurable keys, and AI suggests reasons for mismatches. That one is closer to rule-based matching than to an agent. TOKIUM positions the overall offer as 'AI BPO': agents plus its own operators (for example, line-item data entry by TOKIUM staff). Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.keihi.com/keiri-ai-agent/expense-approval/", "sources": [ "https://www.keihi.com/keiri-ai-agent/expense-approval/", "https://www.keihi.com/keiri-ai-agent/", "https://corp.tokium.jp/news/ry6bi9og_1/", "https://corp.tokium.jp/news/i4mol06iw/" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "cleavr-ai-cash-collection", "name": "Cleavr (autonomous AI accounts-receivable collection: multichannel follow-up, reply qualification, disputes and payment reconciliation)", "vendor": "Cleavr (Cleavr SAS)", "hq_country": "France", "hq_region": "europe", "url": "https://www.cleavr.fr/en", "category": "business-ops", "categories": [ "business-ops" ], "summary": "French accounts-receivable platform that connects to a company's ERP or billing tool and runs cash collection itself. It finds the right contacts and follows up from day one after the due date by email, SMS, voice and WhatsApp. It reads and classifies every customer reply (promise to pay, dispute, payment difficulty), pauses or escalates disputes, proposes payment plans and reconciles payments.", "description": "Cleavr (Cleavr SAS, founded 2025) sells AI-powered accounts-receivable automation that it says replaces the whole collection process, not just reminders. Once connected to the ERP or billing system (integrations listed include Pennylane, Stripe, Chargebee, NetSuite, SAP, Odoo, Xero and Qonto), it works through open invoices. It identifies billing contacts and follows up from D+1 by email, SMS, voicemail/AI phone calls and WhatsApp, in the debtor's language. It tracks payment promises, handles disputes and credit notes, and reconciles incoming payments. Its 'Cleavr Intelligence' reads every customer reply, classifies it (for example 'OK to pay', 'dispute', 'cash-flow difficulty') and acts on it: scheduling the next follow-up, pausing and alerting the team on a dispute, or proposing a payment plan. It also adjusts tone, channel and timing to each customer's payment history. The vendor says routine collection runs with 'no human oversight required' and teams step in only when needed. It also lists recovery workflows 'from friendly to legal', a debtor payment portal and Chorus Pro deposits. Vendor-reported results (average 37% lower DSO and 40% more cash collected) are claims. Cleavr announced an \u20ac8M round (led by Varsity) and says it has launched in Spain, Germany, Belgium, Italy and the UK. It says there are no setup fees and no annual commitment. Pricing is not published.", "pricing": "Not published (vendor states no setup fees and no annual commitment)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.cleavr.fr/en", "sources": [ "https://www.cleavr.fr/en", "https://www.cleavr.fr/en/cgv", "https://www.cleavr.fr/en/blog/cleavr-raises-eur8m-to-become-europes-leader-in-ai-powered-invoice-collection", "https://recherche-entreprises.api.gouv.fr/search?q=989360615" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "lio-procurement-agents", "name": "Lio multi-agent procurement workforce (Lio OS agents for direct and indirect procurement)", "vendor": "Lio (Lio Technologies; Lio Technologies GmbH)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.lio.ai/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Multi-agent system for enterprise direct and indirect procurement. Lio's agents take over the operational procurement work that companies usually give to shared-service centres or BPOs (matching, chasing suppliers and handling exceptions end to end, including edge cases). They also support strategic work such as should-cost models, negotiation preparation and contract and supplier lifecycle management.", "description": "Lio sells Lio OS, which it calls the world's first multi-agent system for direct and indirect procurement. It brings procurement agents and the enterprise into one operating layer connected to existing procurement and ERP systems. According to its homepage, the agents 'run the entire operative layer, from matching to chasing to exception handling' and execute operational work end to end, including edge cases. That covers work 'you used to hand to internal shared service centers or BPOs'. Strategically, the agents work alongside buyers to build should-cost models, prepare negotiations and manage the full contract and supplier lifecycle. Lio covers direct procurement (including raw materials), indirect procurement, finance and logistics. It cites 150+ enterprise deployments and customer stories with tesa, BASF Coatings and Novonesis, plus quotes from executives at Schaeffler and Bilfinger. Lio pairs the software with on-site AI engineers and transformation experts who redesign the procurement operating model with the customer. Customer counts and quotes are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://www.lio.ai/", "sources": [ "https://www.lio.ai/", "https://www.lio.ai/legal/imprint" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "onfinance-maxwell", "name": "OnFinance AI Maxwell (open-source cybersecurity and compliance agent for Indian BFSI)", "vendor": "OnFinance AI (Mindweave Transformers Private Limited, Bengaluru)", "hq_country": "India", "hq_region": "india", "url": "https://github.com/OnFinance/Maxwell", "category": "compliance", "categories": [ "compliance", "security" ], "summary": "Free, self-hosted, open-source (AGPL-3.0) agent from India's OnFinance AI for banks, brokers, NBFCs, AMCs, insurers and fintechs. It runs 26 workflows of specialist agents that keep a company's regulatory profile current, probe repositories, infrastructure and vendors for gaps against SEBI, RBI, IRDAI, CERT-In and DPDP controls, and write findings (each citing a specific clause), remediation plans and audit reports into a validated, append-only ledger for human review.", "description": "Maxwell was released by OnFinance AI in September 2026 as its first open-source product. It runs headlessly on Claude Code or OpenCode on the customer's own infrastructure. Per the vendor's GitHub README and its announcement in OnFinance's own newsletter, deterministic workflow scripts send work to specialist agents. Every candidate finding is challenged by a separate 'refuter' agent, and only findings that survive are written, through validated helpers, into a schema-checked workspace and an append-only state-of-controls ledger. The 26 workflows cover: context maintenance (rechecking the company profile against regulator registers, rebuilding the control inventory, refreshing vendor assurance and discovering vendors from IaC and environments); static probes of repositories (IaC, Kubernetes manifests, schemas with unprotected PII, CI/CD, secure code review, LLM-agent code against the OWASP Agentic Top 10); read-only runtime probes of live environments under rules of engagement (workloads, sandboxes, data pipelines, network perimeter, IAM); and remediation and reporting. In that last group, it groups findings into change-management initiatives with owners and SLA deadlines, drafts fix diffs without modifying the target repo, and writes audit-findings reports. Every finding must cite a clause from a fixed library of 37 instruments. Indian instruments include SEBI CSCRF, RBI cybersecurity/IT and outsourcing directions, IRDAI guidelines, CERT-In Directions and the DPDP Rules 2025; global ones include DORA, ISO 27001, SOC 2 and NIST. Candidate security incidents are never confirmed automatically, and production probing is read-only. Regulation look-ups use OnFinance's ComplianceOS (a read-only account is available on request). Pricing: the software is free under AGPL-3.0; users pay only for their own AI model usage.", "pricing": "Free and open source (AGPL-3.0, github.com/OnFinance/Maxwell); you pay only for your own AI model usage. OnFinance's separate ComplianceOS platform pricing is not part of this listing.", "pricing_model": "freemium", "frameworks": [ "cert-in", "dpdp" ], "frameworks_claimed": [], "tasks": [ "compliance-posture", "control-monitoring", "evidence-collection", "vendor-risk", "remediation", "audit-management" ], "india_relevance": "India-headquartered (CIN U62099KA2023PTC173821, Karnataka). Built for Indian regulated entities first: its control library maps SEBI CSCRF, RBI cybersecurity and outsourcing directions, IRDAI guidelines, CERT-In Directions and the DPDP Rules 2025, and it derives CERT-In, SEBI, RBI and DPDP incident-reporting clocks. Confirm coverage for your entity type with the vendor.", "featured": false, "source_url": "https://github.com/OnFinance/Maxwell", "sources": [ "https://github.com/OnFinance/Maxwell", "https://onfinanceainewsletter.beehiiv.com/p/700-sebi-rbi-and-dpdp-requirements-1-ai-agent-maxwell-by-onfinance-ai", "https://www.onfinance.ai/", "https://www.onfinance.ai/company", "https://www.onfinance.ai/privacy-policy" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "countershadow-ami-autonomous-soc", "name": "CounterShadow AMI (Autonomous Machine Intelligence) \u2013 autonomous SOC triage, investigation and response", "vendor": "CounterShadow (CounterShadow Ltd)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://countershadow.com/", "category": "security", "categories": [ "security" ], "summary": "UK autonomous SOC product: AMI plans and runs investigation of every SIEM/EDR alert across connected tools without playbooks, returns a true/false-positive verdict with severity and logged evidence in about eight minutes, and can isolate hosts, block IPs or disable accounts under approvals the customer configures.", "description": "CounterShadow Ltd's AMI (Autonomous Machine Intelligence) is sold as an autonomous AI responder for security operations centres. Per the vendor's own site, AMI ingests alerts from SIEM and EDR sources, selects investigation scenarios, interrogates connected integrations autonomously to gather evidence, and delivers a verdict and severity with every query logged on an investigation timeline. The vendor states AMI investigates and responds end-to-end in about eight minutes on average, with no playbooks to build or maintain, and that it can isolate hosts, block malicious IPs, disable accounts and generate remediation paths, with approvals-based runbooks when humans want the final say. Deployment is described as SaaS, private cloud or fully self-hosted, with 100+ native integrations and 1,200+ out-of-the-box actions, including CrowdStrike, Google SecOps, Microsoft Sentinel, Splunk, SentinelOne and AWS. Custom agents, scenarios and instructions are supported. Pricing is not published (demo / ROI calculator).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "case-investigation", "incident-response" ], "india_relevance": "", "featured": false, "source_url": "https://countershadow.com/", "sources": [ "https://countershadow.com/", "https://countershadow.com/about", "https://countershadow.com/contact", "https://countershadow.com/terms", "https://find-and-update.company-information.service.gov.uk/company/15941419" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "codewall-autonomous-attack-agents", "name": "CodeWall autonomous attack agents (continuous external adversarial testing)", "vendor": "CodeWall (CodeWall Ltd)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://codewall.ai/", "category": "security", "categories": [ "security" ], "summary": "UK offensive-security product that deploys autonomous attack agents starting from the outside with no credentials or source code: specialist agents investigate in parallel, share discoveries on a persistent investigation graph, prove exploitable paths across applications, identities and data, and retest within authorised scope as the environment changes.", "description": "CodeWall Ltd emerged from stealth on 14 Oct 2026 with a platform of autonomous attack agents for continuous, controlled adversarial testing. Per its own announcement and product pages, agents start where an external attacker starts (no credentials, source code or inside access), investigate in parallel, share discoveries through a persistent investigation graph, and produce verified evidence of exploitable attack paths; as systems change or fixes land, agents return to investigate and retest within the authorised scope. The vendor describes itself as building the offensive layer for enterprise security for sustained adversarial testing under defender control, and states it is already used by banks and financial institutions (customer quote from Axos Financial CISO on the announcement). Pricing is not published (demo).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pen-test-management", "attack-surface", "exposure-management", "appsec" ], "india_relevance": "", "featured": false, "source_url": "https://codewall.ai/", "sources": [ "https://codewall.ai/", "https://codewall.ai/news/codewall-emerges-from-stealth-with-4m", "https://codewall.ai/terms", "https://codewall.ai/privacy", "https://find-and-update.company-information.service.gov.uk/company/17124935" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "beelzebub-arcangelo-agentic-pentesting", "name": "Beelzebub Arcangelo (IASM/EASM with agentic penetration testing)", "vendor": "Beelzebub (Beelzebub S.r.l.)", "hq_country": "Italy", "hq_region": "europe", "url": "https://beelzebub.ai/products/arcangelo/", "category": "security", "categories": [ "security" ], "summary": "Italian AI-native offensive platform product: Arcangelo continuously maps internal and external attack surfaces, then runs adaptive multi-stage agentic penetration tests that plan and pivot like an attacker, with potentially intrusive exploitation kept human-approved and auditable.", "description": "Arcangelo is Beelzebub S.r.l.'s product combining Internal Attack Surface Management (IASM), External Attack Surface Management (EASM) and agentic penetration testing. Per its own product page, AI agents continuously discover associated organisations, domains, subdomains, IP ranges and live services from a brand or domain, organise internal and external assets as an attack-surface graph, plan multi-stage penetration tests, adapt when a route closes, and validate exploitable paths within a governed scope. Passive discovery is separated from active validation; potentially intrusive actions require explicit authorisation, and campaigns can be scoped to approved assets and techniques. Findings can be mapped to MITRE ATT&CK, NIST CSF, ISO 27001, DORA, NIS2 and the EU AI Act (vendor statement; compliance interpretation remains with the customer). Pricing is not published (demo).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "ISO 27001" ], "tasks": [ "pen-test-management", "attack-surface", "exposure-management", "threat-intelligence" ], "india_relevance": "", "featured": false, "source_url": "https://beelzebub.ai/products/arcangelo/", "sources": [ "https://beelzebub.ai/", "https://beelzebub.ai/products/arcangelo/", "https://beelzebub.ai/terms-conditions/", "https://ec.europa.eu/taxation_customs/vies/" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "corma-ai-identity-agents", "name": "Corma AI agents (browser-based identity lifecycle, provisioning and access automation)", "vendor": "Corma (Corma SAS)", "hq_country": "France", "hq_region": "europe", "url": "https://www.corma.io/platform/ai-agent-automation", "category": "security", "categories": [ "security" ], "summary": "French identity and SaaS-management product whose custom AI agents automate joiner-mover-leaver provisioning, offboarding and other identity actions in web apps even when no API, SCIM or SAML is available, using a browser-based agent that interprets the admin UI and executes the workflow steps.", "description": "Corma SAS sells an IAM/SAM platform with Limitless AI Automation: a documented Agent Builder and clicker agent that creates AI-driven actions for applications with or without APIs and plugs them into IT workflows. Per the vendor's AI Agent Automation page, the browser-based agent runs in a dedicated Chrome environment, reads the HTML structure and UI state, decides the next step, and performs actions such as offboarding users and zero-touch provisioning across joiner-mover-leaver workflows when SSO/SAML/API paths are unavailable. The platform also covers discovery of software and AI usage, shadow AI/NHI detection, RBAC/IGA policy enforcement, access reviews and SaaS spend. Pricing is published via the site's pricing page (tiers; confirm live amounts at quote time).", "pricing": "Published on corma.io/pricing: Freemium (free tier); Essential from \u20ac3/user/month; Pro (demo); Enterprise custom from 1,000 users.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [ "ISO 27001", "SOC 2" ], "tasks": [ "identity-governance", "access-reviews", "workflow-automation", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://www.corma.io/platform/ai-agent-automation", "sources": [ "https://www.corma.io/platform/ai-agent-automation", "https://www.corma.io/", "https://www.corma.io/company/legal", "https://www.corma.io/pricing", "https://recherche-entreprises.api.gouv.fr/search?q=CORMA%2090%20MOZART" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "appomni-marlin-ai", "name": "AppOmni Marlin AI (autonomous SaaS and agentic-AI risk investigation)", "vendor": "AppOmni", "hq_country": "United States", "hq_region": "north-america", "url": "https://appomni.com/platform/marlin-ai-autonomous-security/", "category": "security", "categories": [ "security" ], "summary": "US SaaS-security product whose Marlin AI engine autonomously correlates posture, identity and threat signals across SaaS and AI apps, opens investigations without a prompt, and delivers expert-guided remediation steps so teams can cut investigation and resolution time.", "description": "Marlin AI, launched by AppOmni on 26 May 2026, is described by the vendor as an autonomous security engine purpose-built for SaaS environments (not a copilot or assistant). Per the Marlin product page, it autonomously correlates security indicators, investigates risks, surfaces incidents and provides guided remediation; investigations can open with no prompt required, and walkthroughs show it hunting ServiceNow AI-agent risk by correlating posture, identity and threat signals that normally sit in separate silos. Every closed finding is documented with a reason and sign-off. AskOmni (GenAI assistant) and AgentGuard are separate products and are not this listing. AppOmni states the company is headquartered in San Mateo, California. Platform-level FedRAMP: AppOmni SaaS Security for Government (FR2431264500) is FedRAMP Authorized Moderate (Agency, CMS) on the FedRAMP marketplace data feed (last_change 2026-10-20); Marlin itself is not separately listed, so FedRAMP is recorded as platform-only.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "FedRAMP", "SOC 2", "HIPAA", "GDPR" ], "tasks": [ "alert-triage", "case-investigation", "security-operations", "identity-governance" ], "india_relevance": "", "featured": false, "source_url": "https://appomni.com/platform/marlin-ai-autonomous-security/", "sources": [ "https://appomni.com/platform/marlin-ai-autonomous-security/", "https://appomni.com/press-releases/announcing-marlin-ai/", "https://appomni.com/about-us/", "https://www.fedramp.gov/marketplace/products/FR2431264500/" ], "last_checked": "2026-10-20", "added": "2026-10-20", "authorizations": [ { "program": "fedramp", "status": "FedRAMP Authorized", "product": "AppOmni SaaS Security for Government", "id": "FR2431264500", "impact": "Moderate", "scope": "platform-only", "source_url": "https://www.fedramp.gov/marketplace/products/FR2431264500/", "checked": "2026-10-20" } ] }, { "slug": "replit-security-agent", "name": "Replit Security Agent (agent platform with security scans, AI pentest and Agent autofix)", "vendor": "Replit", "hq_country": "United States", "hq_region": "north-america", "url": "https://docs.replit.com/features/security/agent-security-scans", "category": "code-security", "categories": [ "code-security" ], "summary": "US agentic development platform whose Security Agent reviews a project's full codebase (threat model plus Semgrep/HoundDog static analysis), Level 3 AI pentest black-box tests the running Preview, and accepted findings can be sent to Agent for parallel remediation with a follow-up rescan \u2014 listed as an agent platform with security integrations, not a dedicated AppSec scanner.", "description": "Replit documents a Security Agent and Project Security Center for Replit Apps. Per Replit's own docs, Agent security scans (available to paid builders) map routes/APIs/data flows, build a threat model, run static analysis (including Semgrep and HoundDog.ai) and produce findings in Security Center; accepted issues can be sent to Agent, which organises them into parallel fix tasks, after which the customer reruns the scan. Level 3 (AI pentest) runs the source-code review and an external black-box pen test of the live Preview in parallel (anonymous and, for Clerk Auth apps, authenticated synthetic-user passes). Auto-Protect can have Agent prepare dependency CVE patches for admin review. Replit careers page states most of the team works from 'our Foster City HQ' (plus New York, London, Salt Lake City). Pricing: Core and Teams plans are published on replit.com/pricing; Agent/security work is billed as Agent usage on those plans.", "pricing": "Published: Core from $20/month ($18 annual); Teams from $100/month ($90 annual); Enterprise quote; Agent/security-scan usage billed as Agent work (replit.com/pricing at last check).", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "agent-platform-security-integrations", "appsec", "pen-test-management", "remediation" ], "india_relevance": "", "featured": false, "source_url": "https://docs.replit.com/features/security/agent-security-scans", "sources": [ "https://docs.replit.com/features/security/agent-security-scans", "https://docs.replit.com/features/security/black-box-pen-tests", "https://docs.replit.com/features/security/project-security-center", "https://replit.com/careers", "https://replit.com/pricing" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "compri-procurement-ai-agents", "name": "Compri AI workforce for procurement and supply chain (sourcing, RFQ, supplier compliance and PO-follow-up agents)", "vendor": "Compri (COMPRI S.R.L., Milan)", "hq_country": "Italy", "hq_region": "europe", "url": "https://www.compri.ai/en", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Italian procurement platform for manufacturers that runs as a workforce of 30+ specialised AI agents in five teams. The agents capture and route purchase requests, run RFQs and chase supplier replies, onboard and risk-score suppliers and keep certificates current, and send POs, check order confirmations and update the ERP, acting within approval thresholds the customer sets.", "description": "Compri (COMPRI S.R.L., founded 2024, Milan) sells what it calls 'the AI workforce for supply chains': AI agents that 'source, negotiate and manage suppliers in the background, 24/7'. Per its homepage, the platform runs 30+ agents organised into five teams, each owning one stage of the procurement loop. Intelligence Backbone reads spend, contract and supplier data and surfaces savings, anomalies and risks. Intake Orchestration captures requests from any channel, classifies them and routes them to the right buyer. Smart Sourcing suggests suppliers, runs RFQs, chases replies and consolidates and compares offers. Compliance Co-Pilot onboards suppliers, scores their risk and keeps certifications and contracts audit-ready (for example renewing ISO 9001 certificates). Supply Chain Automation sends POs, chases suppliers, checks order confirmations, notifies buyers and updates the ERP. The agents integrate with SAP, Oracle, Dynamics 365, NetSuite, Outlook, Gmail, Google Sheets and SharePoint, plus external sources such as Dun & Bradstreet and EcoVadis. Listed actions include updating POs in the ERP, emailing suppliers, requesting approval, generating documents and logging decisions. The vendor's FAQ says every agent operates within approval thresholds the customer defines; anything outside them is escalated to a human buyer before action is taken, and every decision is logged and replayable with rollback. Buyers keep strategy, negotiation and supplier-relationship decisions. Data is hosted on AWS in the EU. Figures such as '80% of tasks fully automated' and 'up to 10% annual savings' are vendor claims. Pricing is not published (demo and pilot on request).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "ISO 27001", "NIS2", "GDPR", "EU AI Act" ], "tasks": [ "process-automation", "workflow-automation", "vendor-risk", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://www.compri.ai/en", "sources": [ "https://www.compri.ai/en", "https://www.compri.ai/en/about", "https://ec.europa.eu/taxation_customs/vies/rest-api/ms/IT/vat/13568830965" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "soource-agentic-procurement", "name": "Soource agentic procurement (supplier scouting, qualification, RFQ and follow-up agents)", "vendor": "Soource (Soource Srl, Bolzano)", "hq_country": "Italy", "hq_region": "europe", "url": "https://soource.com/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Italian procurement platform that runs a network of AI agents on a company's own supplier data plus verified external sources. The agents scout and contact suppliers, send qualification questionnaires and check certificates, dispatch RFIs/RFQs, chase replies, compare responses and keep supplier records updated, while buyers keep approvals and decisions.", "description": "Soource Srl (NOI Techpark, Bolzano) sells 'agentic procurement built on your data and your processes'. Per its homepage, a network of AI agents automates purchasing work using the customer's internal data (suppliers, spend, contracts, history, documents, master data) and verified external data (certifications, financial reports, ownership structures, country risk, external events). Agents automatically run tasks such as supplier scouting and outreach, qualification (sending questionnaires, reading responses, checking certifications and documents), automatic RFI/RFQ dispatch to selected suppliers, follow-up management, quote collection and structured comparison, continuous supplier monitoring (Soource Intelligence flags risks and opportunities) and supplier data updates (DataLab). Workflows are configured in Soource Studio by combining triggers, agents, actions and human controls; approvals, thresholds and decisions stay where the customer defines them. Rollout is vendor-led: a design workshop, a supplier-data clean-up, then configuration of agents on priority workflows over roughly eight weeks, followed by ongoing tuning. A customer case (supplier scouting and RFQ for a multinational food group) and the 'over 95% of operational time given back' figure are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "vendor-risk" ], "india_relevance": "", "featured": false, "source_url": "https://soource.com/", "sources": [ "https://soource.com/", "https://soource.com/about-us", "https://ec.europa.eu/taxation_customs/vies/rest-api/ms/IT/vat/03237710219" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "phacet-finance-ai-agents", "name": "Phacet AI agents for finance (40+ agents for AP 3-way matching, supplier-billing control, bank reconciliation and close)", "vendor": "Phacet (SPX Software, France)", "hq_country": "France", "hq_region": "europe", "url": "https://www.phacetlabs.com/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "French finance-operations platform with 40+ ready-to-use AI agents (plus a builder) for accounts payable, receivables, treasury, accounting, internal controls and close. Agents pull invoices from email, extract and normalise data, run 3-way matching and price-list controls against the ERP, reconcile bank flows and can trigger actions in the accounting system on schedules, routing exceptions and edge cases to people.", "description": "Phacet is published by SPX Software (registered in Cr\u00e9teil, France; office in Paris). It markets 'AI agents for finance work': a catalogue of 40+ ready-to-use finance agents across Accounts Payable, Accounts Receivable, Treasury & Cash, General Accounting, Data & Documents, Internal Controls, Reporting & Analysis and Close & Audit, plus an agent that co-builds new workflows from a plain-language description. Examples on its own pages include 3-way matching (reconciling invoices, delivery notes and POs to detect billing errors and overpayments), supplier-billing control (enforcing negotiated price lists) and bank reconciliation (matching bank flows with accounting data and surfacing unmatched items). Per the product page, 'a Phacet agent can read an invoice from your email, verify it against your ERP system, and trigger an action in your accounting software, all in a single automated process'; plans include scheduling and automatic triggers. Rules (negotiated prices, spending caps, approval thresholds) are applied to every row, discrepancies are flagged with the reason, and the vendor says Phacet 'doesn't decide edge cases alone': ambiguous results go to the right person with source documents and a confidence score, and results are validated before export to the ERP. Connectors include Pennylane, NetSuite and Sage; hosting is in Europe on AWS Bedrock. Paid plans include hands-on support from an 'AI finance expert'. Published pricing (USD, monthly billing): Pro $69/month (1 user, 200 credits), Studio $299/month (45,000 credits), Studio Max from $999/month (5 users, 120,000 credits), Factory from $2,500/month (annual billing, expert-built agents); 14-day trial on Pro and Studio. Customer results are vendor claims.", "pricing": "Pro $69/month; Studio $299/month; Studio Max from $999/month; Factory from $2,500/month (annual billing). Credit-based; 14-day trial on Pro and Studio (vendor pricing page, Oct 2026).", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [ "ISO 27001", "GDPR" ], "tasks": [ "process-automation", "workflow-automation", "fraud-detection" ], "india_relevance": "", "featured": false, "source_url": "https://www.phacetlabs.com/product", "sources": [ "https://www.phacetlabs.com/product", "https://www.phacetlabs.com/ai-agents/3-way-matching-stop-losing-money-on-supplier-mismatches", "https://www.phacetlabs.com/pricing", "https://www.phacetlabs.com/legal-notice", "https://recherche-entreprises.api.gouv.fr/search?q=985300250" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "kapittx-ar-ai-agents", "name": "Kapittx AI agents for accounts receivable (AI Collection Agent and AI Cash Application agent)", "vendor": "Kapittx (Pune, India)", "hq_country": "India", "hq_region": "india", "url": "https://www.kapittx.com/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Indian accounts-receivable platform whose AI agents run collections and cash application. The AI Collection Agent sends reminders, reads and classifies every customer reply by payment intent, records promise-to-pay dates, sends automated responses and creates and assigns dispute tasks; the cash-application agent matches remittances to invoices and bank deposits and posts cash to the ERP in real time.", "description": "Kapittx sells AR automation built around specialised AI agents for B2B finance teams. Per its AI Collection Agent page, the agent sends reminders on time, classifies every customer reply by payment intent (collectable, disputed or rejected), captures promise-to-pay dates automatically, sends automated responses based on that intent, updates invoice status and works with a Task Agent that creates and assigns tasks with full receivables context, so disputes, missing POs and approval holds are routed to the right teams. Payments are flagged for verification before posting. Its AI Cash Application page says the agent ingests remittance advice from emails, PDFs, spreadsheets and bank files, performs 2-way (invoice to remittance) and 3-way (invoice, remittance and bank deposit) reconciliation, detects short payments, deductions and chargebacks, routes unapplied-cash exceptions and does real-time cash posting with automated ledger updates to the ERP. Listed integrations include Oracle NetSuite, Dynamics 365 Business Central, Microsoft Navision, SAP S/4HANA, SAP ECC, SAP Business One, Tally, QuickBooks, Xero and Zoho Books. Performance statements ('zero errors', DSO reductions) are vendor claims. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation" ], "india_relevance": "Indian vendor (registered office in Pune) whose AR agents integrate with Tally and Zoho Books as well as SAP, Oracle and Microsoft ERPs used by Indian mid-market finance teams.", "featured": false, "source_url": "https://kapittx.com/ai-email-agent-collections/", "sources": [ "https://kapittx.com/ai-email-agent-collections/", "https://kapittx.com/ai-agents-for-cash-application/", "https://www.kapittx.com/contact-us/" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "dexiq-ai-bookkeeping-agents", "name": "dexIQ AI bookkeeping agents (inbox, accounts payable, receivables, bank reconciliation and month-end agents for Xero)", "vendor": "dexIQ (Dexterous AI Pty Ltd, Australia)", "hq_country": "Australia", "hq_region": "australia-new-zealand", "url": "https://dexiq.com.au/", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Australian agentic bookkeeping platform: a team of specialist AI agents reads the finance inbox, extracts, validates (ABN against the ABR, GST arithmetic, duplicates, bank-detail changes) and codes supplier invoices, matches bank lines, prepares receivables follow-ups and posts approved bills to Xero. Humans approve by default; an autopilot mode lets high-confidence bills post and high-confidence matches clear on their own within set limits, and it never releases payments itself.", "description": "dexIQ is built by Dexterous AI Pty Ltd, part of Dexterous Group, an Australian outsourced-finance firm. Its platform pages describe a team of specialist agents. Inbox Management reads and classifies every finance email and routes supplier invoices to the accounts-payable agents. The AP agents extract every line, header and total, check the supplier ABN against the Australian Business Register and the GST arithmetic, run fraud/scam (bank-detail change), anomaly and duplicate checks, compare vendor history and apply GL coding from the customer's rules and history; low-confidence or flagged invoices are held for review with the reason. Approved bills post straight to Xero and payment runs can be prepared as ABA files, but dexIQ 'never releases a payment on its own'. Approval is the default; once confident, customers can turn on autopilot so predictable, high-confidence bills post to Xero on their own within their limits. The reconciliation agent matches bank lines to ledger entries (including one-to-many and fuzzy matches), clears high-confidence matches on its own above a customer-set threshold and proposes the rest with reasoning. The AR agent drafts invoices from billing schedules, applies credit terms, matches receipts and prepares overdue follow-ups, but external communications with financial weight are sent by a human. Further modules cover BAS/IAS, month-end close and management reporting. Data is stored in an Australian (Sydney) data centre and every action is logged. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "fraud-detection" ], "india_relevance": "", "featured": false, "source_url": "https://dexiq.com.au/platform/accounts-payable", "sources": [ "https://dexiq.com.au/platform/accounts-payable", "https://dexiq.com.au/platform/bank-reconciliation", "https://dexiq.com.au/platform/accounts-receivable", "https://dexiq.com.au/about", "https://abr.business.gov.au/ABN/View?id=80680070455" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "nxt4ap-nxt-ap-sap-ap-agent", "name": "NXT AP (SAP-native vertical AI agent for autonomous accounts-payable invoice processing)", "vendor": "NXT4AP (nxt4ap Pte Ltd, Singapore)", "hq_country": "Singapore", "hq_region": "asia-pacific", "url": "https://www.nxt4ap.com/nxtap-accountspayable", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Singapore-registered vendor of NXT AP, which it calls a vertical AI agent for SAP accounts payable. Running inside SAP, it receives PDF, hybrid and structured e-invoices, identifies suppliers, POs and goods receipts, matches and validates lines, bank details, tax and duplicates, proposes coding for non-PO invoices, routes approvals and exceptions, and creates and posts the SAP documents, resuming automatically once an exception is resolved.", "description": "NXT4AP (nxt4ap Pte Ltd) sells NXT AP, described on its product page as 'a vertical AI agent for SAP' that 'combines SAP-native logic with embedded Azure AI to enable true straight-through processing in Accounts Payable'. Per the page, NXT AP receives image-based, hybrid and structured electronic invoices; identifies suppliers, purchase orders and related goods receipts; matches invoice lines with PO and receipt data; validates references, dates, currencies and bank information; performs tax, compliance and duplicate checks; proposes accounting assignments for non-PO invoices; validates and updates payment terms; determines who is responsible for approvals and exceptions; creates and updates standard SAP documents; continues processing automatically after an exception is resolved; and completes and posts invoices through standard SAP processes. The vendor says NXT AP coordinates retrieval, capture, validation, matching, exception handling, approval and posting as one continuous process on live SAP data, with SAP remaining the system of record. An 'NXT AI Harness' governs access, data use, validation and audit before AI results influence the SAP process. Companion products are NXT Document Analyzer (XRechnung, Factur-X, hybrid and signed formats), NXT AP Intelligence (process mining and natural-language analytics) and native connections to 30+ national e-invoice networks. The 'under 10 seconds' processing figure is a vendor claim. Two subscription models are offered (NXT AP On Demand, consumption-based, and NXT AP Corporate); prices are not published. NXT4AP states it is not affiliated with or endorsed by SAP SE.", "pricing": "Not published (two subscription models: consumption-based On Demand and Corporate)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.nxt4ap.com/nxtap-accountspayable", "sources": [ "https://www.nxt4ap.com/nxtap-accountspayable", "https://www.nxt4ap.com/imprint" ], "last_checked": "2026-10-20", "added": "2026-10-20" }, { "slug": "covasant-tprm-agents", "name": "Covasant TPRM (agentic third-party risk management)", "vendor": "Covasant (Covasant Technologies Private Limited, Hyderabad)", "hq_country": "India", "hq_region": "india", "url": "https://www.covasant.com/products/tprm", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Third-party risk product from Hyderabad-headquartered Covasant. Purpose-built AI agents onboard vendors through due-diligence workflows, chase vendors who are slow to respond, keep watching news, sanctions and financial data, and, when risk thresholds break, open remediation workflows, track vendor responses, escalate unresolved issues and produce DORA, SOX and NIST reporting packages.", "description": "Covasant TPRM is one of Covasant's enterprise AI products, built on its SERAA platform. Per the vendor's product page, purpose-built agents each cover one risk dimension and work together across the vendor portfolio. The Automated Vendor Onboarding Agent runs configurable due-diligence workflows that collect, validate and score documentation, with SAP Ariba, Coupa and Oracle integrations. It automatically re-sends requests, escalates to vendor-management contacts and flags unresponsive vendors for manual intervention. Continuous Monitoring Agents watch news, sanctions and financial data. A Dynamic Risk Scoring Engine keeps financial, cyber, regulatory, ESG and operational sub-scores. The Governance and Reporting Agent opens remediation workflows when thresholds are breached, tracks vendor responses, escalates unresolved issues through the customer's governance process, and generates SOX, DORA and NIST reporting packages, including DORA monitoring evidence, concentration-risk analysis and exit-strategy documentation. The vendor calls the product production-ready and configures it for each customer's vendor categories, risk models and frameworks; it also offers custom builds. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [ "dora" ], "frameworks_claimed": [ "DORA", "SOX", "NIST", "SOC 2", "GDPR" ], "tasks": [ "vendor-risk", "risk-assessment", "evidence-collection", "remediation", "workflow-automation" ], "india_relevance": "India-headquartered (Global HQ in Hyderabad, Telangana; Covasant Technologies Private Limited). The TPRM page does not name Indian regulations such as RBI outsourcing directions, so confirm India coverage with the vendor.", "featured": false, "source_url": "https://www.covasant.com/products/tprm", "sources": [ "https://www.covasant.com/products/tprm", "https://www.covasant.com/contact-us", "https://www.covasant.com/about-us" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "amnify-security-agents", "name": "Amnify security agents (agent-driven code audit, AI pentesting, PR review and autofix pull requests)", "vendor": "Amnify (Amnify GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://amnify.ai/", "category": "code-security", "categories": [ "code-security", "security" ], "summary": "German AppSec product from D\u00fcsseldorf: a team of agents audits repositories (SAST, secrets, SCA, IaC, CI/CD) and cloud accounts, triages signals so only confirmed findings surface, pentests running apps inside a verified scope with a separate agent reproducing every finding, reviews pull requests with a merge-blocking status check, and opens fix pull requests that run your tests but never merge themselves.", "description": "Amnify GmbH (founded in D\u00fcsseldorf in 2025) sells a self-serve platform it describes as 'a team of agents that finds security problems in your code and cloud and fixes them'. Per the vendor's own pages: on connecting a repository it runs a full audit and then continuous checks (leaked secrets across Git history, SAST, authorization and tenant-isolation gaps, cross-file business-logic flaws, SCA, Terraform/CloudFormation/Kubernetes/Helm and CI/CD workflows); an agent reads the code around each signal, works out reachability, drops noise and groups findings by root cause. Its pentesting module attacks an application the customer owns only after domain-ownership verification and inside a declared scope (black, gray or white box; quick or deep): one agent maps the surface, agents test in parallel, and nothing becomes a finding until a separate agent reproduces it with a working proof of concept. PR review posts inline comments with severity and one-click suggestions plus a status check branch protection can use (GitHub only for now). Autofix writes the fix from a plan the user approves, runs the repository's tests and opens one pull request per root cause; it never pushes to the default branch or merges its own work. Cloud posture checks cover AWS, Azure and Google Cloud, and an MCP endpoint lets Claude Code, Codex, Cursor or Copilot query it. The vendor states it is ISO/IEC 27001 certified and that customer code is not used to train AI models (vendor claims, not registry-verified).", "pricing": "Published credit-based plans (amnify.ai/pricing, checked 2026-10-21): Free \u20ac0 (30 credits, 7 days, 1 repo, 1 cloud account); Starter \u20ac192/month (200 credits, 10 repos); Team \u20ac460/month (500 credits, 50 repos, 3 cloud accounts); Business \u20ac880/month; Enterprise on request. Extra credits \u20ac1 each. Each review, audit or pentest costs credits; no per-seat fees.", "pricing_model": "freemium", "frameworks": [], "frameworks_claimed": [], "tasks": [ "appsec", "sast", "sca", "secrets-detection", "iac", "pr-review", "remediation", "pen-test-management", "cloud-security" ], "india_relevance": "", "featured": false, "source_url": "https://amnify.ai/", "sources": [ "https://amnify.ai/", "https://amnify.ai/imprint", "https://amnify.ai/about", "https://amnify.ai/pricing" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "socradar-ai-agents", "name": "SOCRadar AI Agents (specialist threat-intelligence, attack-surface, digital-risk and alarm-triage agents)", "vendor": "SOCRadar (SOCRadar Cyber Intelligence Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://socradar.io/ai-agents/", "category": "security", "categories": [ "security" ], "summary": "Roster of specialist agents inside the SOCRadar threat-intelligence platform: customers deploy agents, set each one's skills, scope and access, and green-light sensitive steps. Agents cover threat-actor and ransomware intelligence, detection-rule writing, IoC enrichment, identity/credential exposure, vulnerability analysis, brand and dark-web monitoring, phishing-domain hunting, external attack surface and Shodan recon, and alarm triage that records verdicts and asks before changing an alarm's status.", "description": "SOCRadar markets its AI Agents as 'your Digital Team': every agent in the SOCRadar platform is a specialist built for one security job, and teams either let SOCRadar Copilot call them on request or deploy them directly and set the rules. The vendor's AI Agents page describes a Browse, Deploy, Configure (each agent's skills, scope and access), Control ('green-light sensitive steps before they proceed') and Monitor (launch skills and track every run in one history) model. Agents listed include a Threat Actor/Ransomware Master Agent (19 skills), Detection Engineering Agent (writes and improves detection content in the customer's rule language), IoC Enrichment Master Agent, Identity Intelligence Agent (credentials tied to employees, executives and suppliers), Vulnerability Agent, Social Media, Brand Monitoring, Dark Web and Phishing Master agents for digital risk protection, an Attack Surface Agent (external exposure and CVEs), Shodan Recon and Digital Asset Reconnaissance agents, and an Alarm Agent (16 skills). The Alarm Agent's 'Analyze the Latest Alarms' skill triages the newest open alarms one at a time and records its verdict as a comment without changing status; 'Analyze and Take Action' shows its verdict and asks before it changes anything; it also builds daily SOC shift-handover briefs and posture reports. SOCRadar also offers an MCP server and 100+ integrations. Agents are scoped to SOCRadar's own platform data and alarms (not customer SIEM/EDR response).", "pricing": "Agent pricing not published separately. SOCRadar publishes module plans (socradar.io/pricing, checked 2026-10-21), e.g. Advanced Dark Web Monitoring Essential $4,550/year ($600/month) and Cyber Threat Intelligence Essential $14,750/year ($1,625/month); higher tiers and bundles on quote. A free tier with platform access is offered.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "threat-intelligence", "attack-surface", "alert-triage", "case-investigation", "security-operations", "threat-detection" ], "india_relevance": "SOCRadar lists a Bangalore office among its regional offices (HQ is Newark, Delaware).", "featured": false, "source_url": "https://socradar.io/ai-agents/", "sources": [ "https://socradar.io/ai-agents/", "https://socradar.io/contact-us/", "https://socradar.io/pricing/" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "strike48-agentic-secops", "name": "Strike48 agentic SecOps platform (pre-built SOC agent team and no-code agent builder over federated logs, cloud or air-gapped on-prem)", "vendor": "Strike48 (Devo Technology, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.strike48.com/", "category": "security", "categories": [ "security" ], "summary": "Agentic orchestration platform for SOC and IT teams from the company behind the Devo log platform: purpose-built micro agents triage and investigate alerts, analyse phishing, hunt threats, write and tune detections and help with compliance over logs queried in place across SIEMs and data lakes, with configurable human approval and an audit trail; available as SaaS, isolated compute or an air-gapped on-prem appliance.", "description": "Strike48 describes itself as 'The Agentic Orchestration Platform for Security and IT'. Per the vendor's own pages, teams deploy vetted pre-built agents for security, IT, observability and compliance, or create their own with a no-code agent builder. Micro agents, each scoped to a specific task, investigate, correlate and hand off to each other, and the platform 'run[s] investigations, resolve[s] incidents, and automate[s] compliance with configurable human approval where you want it and a verifiable audit trail behind every action'. Search-in-place and real-time data federation let agents query logs and telemetry where they live (SIEM, data lakes) rather than re-ingesting them. Listed use cases include alert triage (autonomous enrichment and disposition), end-to-end phishing investigation with a verdict, detection engineering (rule creation and tuning), threat hunting and incident workflow and reporting. Deployment options include shared SaaS, isolated compute, or on-prem / hybrid environments. The homepage cites customer figures such as '96% of cases closed autonomously by agents' (vendor claims). The company also sells red-team services, which are not the focus of this listing. Terms of Service name Devo Technology, Inc. as the contracting entity for Strike48.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "case-investigation", "incident-response", "phishing-triage", "threat-detection" ], "india_relevance": "The vendor states it has a presence in India (About page: HQ Boston, with Madrid, Singapore and India).", "featured": false, "source_url": "https://www.strike48.com/", "sources": [ "https://www.strike48.com/", "https://www.strike48.com/about", "https://www.strike48.com/terms-of-service" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "noze-cyberagent", "name": "noze CyberAgent (AI agent for continuous attack-surface monitoring, automated validation pentesting and NIS2 evidence)", "vendor": "noze (noze S.r.l.)", "hq_country": "Italy", "hq_region": "europe", "url": "https://www.noze.it/en/products/cyberagent/", "category": "security", "categories": [ "security", "compliance" ], "summary": "Italian agent for mid-sized companies and NIS2 entities without an in-house SOC: after verifying domain control it continuously discovers assets and assesses network, web apps and APIs, correlates findings with EPSS and CISA KEV, confirms exploitability with automated validation pentests, ranks risks by business impact and prepares NIS2, DORA and ISO 27001 reports; the team decides what to fix.", "description": "CyberAgent is a cybersecurity product from noze S.r.l., an Italian software and IT company based at the Navacchio Technology Park near Pisa (the same vendor as the listed noze DataGovern, but a separate product). Per the vendor's product page, the agent first verifies domain control (DNS record or file) and then operates only on the customer's assets. It runs continuous asset discovery and vulnerability assessment across network, web applications and APIs with a continuously updated CVE database, so new services, subdomains and APIs join the monitored perimeter as they appear. It 'investigates like an analyst', correlating each vulnerability with CVE, EPSS, CISA KEV and environment context, and uses automated validation pentesting that simulates real attacks to confirm what is actually exploitable. AI triage then ranks risks by business impact and prepares remediation plans, with alerts via email, Slack or webhook. It also produces reports and checklists aligned to NIS2, DORA and ISO 27001, and offers simulated phishing campaigns. The vendor states 'the agent does the groundwork: the decision on what and when to fix stays with your team'. Hosting is EU data-resident with per-tenant isolation and a white-label multi-tenant option for MSPs.", "pricing": "From \u20ac99/month (Starter); Business and Enterprise tiers differ by monitored assets, scan frequency and included automated pentesting; optional pay-per-scan (noze.it product page, checked 2026-10-21). Higher-tier prices not published.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [ "NIS2", "DORA", "ISO 27001" ], "tasks": [ "attack-surface", "vulnerability-management", "pen-test-management", "risk-prioritization", "evidence-collection" ], "india_relevance": "", "featured": false, "source_url": "https://www.noze.it/en/products/cyberagent/", "sources": [ "https://www.noze.it/en/products/cyberagent/", "https://ec.europa.eu/taxation_customs/vies/" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "cakewalk-agent-cake", "name": "Cakewalk Agent Cake (AI agent for SaaS access provisioning, deprovisioning and conversational access requests)", "vendor": "Cakewalk (Cakewalk Technology GmbH)", "hq_country": "Germany", "hq_region": "europe", "url": "https://www.cakewalk.security/agent-cake", "category": "security", "categories": [ "security", "business-ops" ], "summary": "Berlin identity-governance vendor's AI agent: once access is approved under the customer's policies, Agent Cake provisions seats in supported apps on the admin's behalf, removes all accounts during offboarding, and lets employees request access conversationally in Slack, inside a platform that discovers apps and AI agents beyond SSO.", "description": "Agent Cake is the AI agent inside Cakewalk's identity governance and administration (IGA) platform. Per the vendor's own product page, it auto-provisions seats in supported applications after access has been approved and removes accounts during offboarding ('remove 100% of seats during offboarding'), lets employees request access conversationally, including directly in Slack, while enforcing the customer's access-control policy, and surfaces insights from the platform's single system of record, such as which AI agents teams are introducing. Setup is described as activating Agent Cake in Cakewalk so it can provision supported applications on the customer's behalf, then integrating Slack. The surrounding platform covers app and AI-agent discovery beyond the IdP (real-time alerts for access outside SSO), policy-builder approval workflows, role- and attribute-based access control, access reviews, on/offboarding and an open API, with 5,600+ apps supported out of the box. Cakewalk separately sells access management for AI agents (governance of other agents), which is not the focus of this listing. The vendor states it is ISO 27001 certified and GDPR compliant (vendor claims).", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "identity-governance", "access-reviews", "workflow-automation", "employee-support" ], "india_relevance": "", "featured": false, "source_url": "https://www.cakewalk.security/agent-cake", "sources": [ "https://www.cakewalk.security/agent-cake", "https://www.cakewalk.security/imprint" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "upflux-agente-negociador", "name": "UpFlux Agente Negociador (autonomous tail-spend negotiation and purchasing agent inside TOTVS Protheus, Datasul and SAP)", "vendor": "UpFlux (Smart Process S.A.)", "hq_country": "Brazil", "hq_region": "latin-america", "url": "https://upflux.com.br/agente-negociador", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Procurement agent from Brazil's UpFlux that works inside the customer's ERP (TOTVS Protheus, Datasul or SAP). It reads 12 months of purchase history, finds the best price the company has already paid for each item, and on each new requisition requests quotes, makes counter-offers, routes to the right supplier and writes the purchase order itself when the deal is within the buyer-set approval limits. Buyers approve only the exceptions.", "description": "UpFlux, founded in 2017 in Jaragu\u00e1 do Sul (Santa Catarina, Brazil), sells the Agente Negociador for tail spend (curve-C, indirect, MRO and facilities purchases) that procurement teams usually don't negotiate. Per the vendor's product page, the engagement starts from a 12-month purchasing export: the AI normalises messy item descriptions and returns the capturable savings by category. The agent then integrates natively with TOTVS Protheus, Datasul or SAP and reads and writes in the live environment under guardrails and approval limits (al\u00e7adas) set by the customer. On each purchase it adjusts orders to the best price already paid, routes to the right supplier, consolidates volume across branches and, when the gap justifies it, triggers a competitive quotation. The vendor describes the agent as deciding and executing end to end within its limits (quote, negotiate, choose and issue the PO in the ERP), stopping and calling the buyer when a decision falls outside the limits; every action and its savings is logged in UpFlux's RoAI ledger in reais. Delivery model: UpFlux describes itself as a 'digital team' of AI agents commanded by its own lean specialists and charged on realised results rather than as a self-operated software licence; rollout runs diagnosis (about two weeks), a one-category pilot, then scale. Pricing: not published; the vendor says fees are tied to savings proven in RoAI.", "pricing": "Not published (vendor states fees are tied to savings proven in its RoAI measurement, after a diagnosis and a pilot).", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "LGPD" ], "tasks": [ "process-automation", "workflow-automation", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://upflux.com.br/agente-negociador", "sources": [ "https://upflux.com.br/agente-negociador", "https://upflux.com.br/sobre", "https://upflux.com.br/contato", "https://brasilapi.com.br/api/cnpj/v1/28697488000177" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "trulioo-ubo-discovery-agent", "name": "Trulioo UBO Discovery Agent (agentic beneficial-ownership research inside KYB)", "vendor": "Trulioo", "hq_country": "Canada", "hq_region": "north-america", "url": "https://www.trulioo.com/products/ubo-discovery", "category": "risk", "categories": [ "risk" ], "summary": "Agentic AI inside Trulioo's KYB verification workflow from Vancouver-headquartered Trulioo. When registries run out, the UBO Discovery Agent researches filings, disclosures, legal and public records, OSINT and verified third-party databases, reaches registries without API connectivity in real time, reconstructs the beneficial-ownership chain with jurisdiction-specific control logic, cites every finding and reports gaps instead of guessing.", "description": "The UBO Discovery Agent is the third layer of Trulioo's UBO Discovery capability, which runs as a single workflow inside its Know Your Business (KYB) verification, called with one API request. Per the vendor's product page, the workflow escalates from authoritative sources (integrated government registries, partners and Trulioo-hosted databases) to the proprietary Trulioo Business Graph, and then to the agent. The agent researches documents, disclosures, non-registry filings, legal and public records, OSINT and verified databases, and reaches registries in real time where no API connectivity exists. It assembles an ownership picture across holding layers, nominee arrangements and cross-border chains, applying market-specific control logic. Every source is categorized and weighted by reliability, recency and relevance, each finding is cited, and where resolution is incomplete the agent reports the gap rather than guessing. Trulioo announced the agent on July 23, 2026, saying the first enterprise customer (a large social-commerce platform) was rolling it out across Malaysia, Vietnam and the UK from July 2026, and that early deployments raised UBO coverage by 20-80% versus registry-only research (vendor figures). It is the first of a planned series of Trulioo agents. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "kyc", "aml", "case-investigation", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.trulioo.com/products/ubo-discovery", "sources": [ "https://www.trulioo.com/products/ubo-discovery", "https://www.trulioo.com/company/newsroom/press-releases/ai-agent-beneficial-ownership", "https://www.trulioo.com/company/contact-us" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "napier-ai-responsible-agents", "name": "Napier AI Continuum responsible agents (screening alert triage and auto-clearing)", "vendor": "Napier AI (Napier Technologies Limited)", "hq_country": "United Kingdom", "hq_region": "europe", "url": "https://www.napier.ai/transaction-screening", "category": "risk", "categories": [ "risk" ], "summary": "Configurable AI agents in London-based Napier AI's Continuum financial-crime platform. In Client Screening and Transaction Screening, compliance teams build and tailor 'responsible agents' in a no-code sandbox and choose how much autonomy to hand over, from flagging sanctions, PEP and adverse-media matches for review to clearing known patterns automatically before they reach a queue, with every agent action explained and captured in the audit trail.", "description": "Napier AI Continuum is an anti-money-laundering platform covering client screening, transaction screening, transaction monitoring and client risk assessment. Per its Transaction Screening product page, screening runs in layers. Whitelisting and stability logic first suppress known false positives. AI match recommendations then score and explain the remaining alerts. Responsible agents form a further layer: analysts create and tailor agents in the integrated sandbox, choose the agent's level of autonomy (from flagging matches or patterns for review to clearing them automatically), and the agents triage or clear routine, known-pattern alerts so analysts only see what needs a human decision. The human decision maker stays in charge, and every agent decision is explainable and recorded in the audit trail. Transaction Screening covers real-time screening across payment rails and formats such as SWIFT MT, ISO 20022, Fedwire and NACHA/ACH. Deployment is as managed SaaS, private cloud or on-premise. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "ISO 27001" ], "tasks": [ "aml", "alert-triage", "kyc", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.napier.ai/transaction-screening", "sources": [ "https://www.napier.ai/transaction-screening", "https://www.napier.ai/contact", "https://find-and-update.company-information.service.gov.uk/company/09901129" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "qad-championai-champions", "name": "QAD ChampionAI Champions (background agents for accounts payable, procurement follow-up and sourcing in manufacturing)", "vendor": "QAD | Redzone (QAD Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://www.qad.com/champion-ai", "category": "business-ops", "categories": [ "business-ops" ], "summary": "ChampionAI \"Champions\" from US manufacturing-software vendor QAD | Redzone are persona-based agents that run continuously in the background of a workflow. The Accounts Payable Champion (generally available since Sep 22, 2026) captures invoices from email, supplier portals and EDI, matches them to PO and goods receipt, clears in-tolerance invoices toward payment and routes only exceptions to people. The Procurement Champion chases suppliers and keeps POs and the ERP in sync; the Sourcing Champion creates RFQs, follows up suppliers and prepares award packs.", "description": "ChampionAI is QAD | Redzone's agentic AI engine for manufacturers. Per the vendor's own pages, each Champion follows a Signal, Reason, Act, Escalate pattern and, unlike the conversational Champion Assist copilot, runs continuously in the background of a specific workflow, handling the routine work itself and bringing in a person only for decisions that need one. The Accounts Payable Champion, announced as generally available on Sep 22, 2026, takes invoices from receipt to payment-ready: it captures invoices in any format from email, supplier portals and EDI, resolves supplier and entity, three-way matches against the purchase order and goods receipt, automatically clears matching invoices toward payment and routes mismatches, missing receipts and disputes to the right person. It runs on its own platform and works with SAP, Infor, Epicor and QAD ERP versions back to Enterprise Edition 2016. The Procurement Champion monitors orders, supplier communications, documents and shipment data, follows up with suppliers, validates information, updates systems and escalates exceptions with context. The Sourcing Champion creates RFQs, follows up with suppliers, normalises quotes and compiles sourcing decision packs, leaving award trade-offs to people. Champion Assist (copilot-style Q&A) and the recommendation-oriented Trade Compliance Champion are not the focus of this listing. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://www.qad.com/championai/accounts-payable", "sources": [ "https://www.qad.com/championai/accounts-payable", "https://www.qad.com/championai/procurement", "https://www.qad.com/championai/sourcing", "https://www.qad.com/champion-ai", "https://www.qad.com/press-release/qad-redzone-expands-championai-across-adaptive-erp-with-champion-assist-and-new-accounts-payable-champion" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "clearcontract-contract-agents", "name": "ClearContract contract agents (intake, review and deadline-monitoring agents that file, risk-check and watch incoming contracts)", "vendor": "ClearContract (ClearContract ApS)", "hq_country": "Denmark", "hq_region": "europe", "url": "https://www.clearcontract.dk/", "category": "business-ops", "categories": [ "business-ops", "risk" ], "summary": "Contract-management platform from Aarhus-based ClearContract ApS built around AI agents that work in the background. Contracts arriving by email are picked up by an intake agent that files them, extracts key terms and assigns the counterparty; a review agent checks each one against the company's own checklist, flags risks with clause citations and creates tasks; agents also watch renewals and deadlines. Nothing is signed, sent or committed without human approval.", "description": "ClearContract describes itself as \"contract management you don't need to manage\": \"AI agents receive, review, file and monitor your contracts.\" Per the vendor's homepage and platform overview, contracts sent by email are received with nothing to upload; an intake agent files them, names and sorts them, extracts key terms and assigns the counterparty; a review agent checks the contract against the organisation's own standards, flags risks (for example a missing liability cap, an overbroad non-compete or a buried auto-renewal) and creates tasks for the team; and renewals and deadlines are monitored so they are caught in time. The vendor's example timeline shows a vendor agreement arriving at 2:04 AM being filed and risk-flagged with tasks created a minute later, with a summary waiting in the morning. Review results cite the clause behind each assessment. The vendor states the agent never negotiates on its own, asks when in doubt, and that nothing is signed, sent or committed without approval, with every action logged. The platform also includes drafting from templates, e-signatures, a cited Q&A legal assistant, compliance scoring and portfolio reporting, integrates with Word, Outlook and DocuSign, and is hosted on Microsoft Azure in the EU. The vendor says it has handled 120,000 contracts. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "GDPR" ], "tasks": [ "contract-review", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.clearcontract.dk/", "sources": [ "https://www.clearcontract.dk/", "https://www.clearcontract.dk/platform/overview", "https://www.clearcontract.dk/about", "https://ec.europa.eu/taxation_customs/vies/rest-api/ms/DK/vat/44331969" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "pilot-ai-accountant", "name": "Pilot AI Accountant (autonomous bookkeeping agent: categorisation, reconciliation and monthly close)", "vendor": "Pilot (Pilot.com, Inc.)", "hq_country": "United States", "hq_region": "north-america", "url": "https://pilot.com/platform/ai-accountant", "category": "business-ops", "categories": [ "business-ops" ], "summary": "Bookkeeping agent from US back-office provider Pilot. It connects to a company's bank and card accounts and tools such as Stripe and Gusto, then categorises transactions, identifies vendors, reconciles accounts, closes the books each month and produces P&L, balance sheet and cash-flow statements, flagging only unusual items such as duplicate charges or new vendors for review. The AI-only Essentials plan is $99 a month; higher plans add human bookkeepers.", "description": "Pilot's AI Accountant is described on the vendor's product page as handling the bookkeeping cycle from collecting transaction data to monthly close. It connects to the customer's bank and financial accounts and syncs with tools such as Stripe and Gusto. It categorises transactions, reconciles accounts, identifies vendors and creates financial statements as activity happens. It learns from the customer's own patterns and from about a decade of Pilot bookkeeping data, flags only items that look unusual (duplicate charges, unexpected amounts, new vendors), researches uncertain transactions using context available online, and may occasionally ask the owner to confirm a categorisation before finalising the books. The customer gets an email and in-app notice when the books are closed, and a built-in Pilot AI chat answers plain-English questions about the books. Pilot is a back-office services firm: its Essentials plan is the AI-run tier, while Core and Custom plans add a US-based bookkeeper who reviews the books, plus bill management, AR/AP, payroll and CFO services. It serves US small businesses and startups.", "pricing": "Essentials (AI Accountant: categorisation, reconciliation and monthly close, cash-basis) $99/month for up to $100,000 in monthly expenses; Core and Custom plans (with a human bookkeeper) via sales.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "process-automation", "workflow-automation", "agentic-ops" ], "india_relevance": "", "featured": false, "source_url": "https://pilot.com/platform/ai-accountant", "sources": [ "https://pilot.com/platform/ai-accountant", "https://pilot.com/pricing", "https://pilot.com/about" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "nice-actimize-xceed-ai-agents", "name": "NICE Actimize Xceed AI Agents (fraud and AML alert triage and investigation agents)", "vendor": "NICE Actimize (a business of NICE Ltd.)", "hq_country": "Israel", "hq_region": "middle-east", "hq_basis": "parent-company-filing", "hq_entity": "NICE Ltd., 13 Zarchin Street, Ra'anana, Israel (business address in NICE Ltd.'s SEC filings; NICE files Form 20-F/6-K)", "hq_source": "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001003935", "url": "https://www.niceactimize.com/xceed/ai-agents", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "AI agents inside NICE Actimize's Xceed AI FRAML platform (combined fraud prevention and AML compliance for financial institutions, with an offering for credit unions and community banks). The agents automate alert categorisation and triage, dismiss false positives and summarise cases, and 'Converse and Suggest' agents plus a CoPilot suggest investigative paths in natural language, with analysts in the loop who keep control of decisions.", "description": "Xceed AI Agents are part of Xceed AI FRAML, NICE Actimize's single platform for fraud prevention and AML compliance. On its Xceed AI Agents page and brochure the vendor describes purpose-built, 'autonomous AI agents' that automate alert categorisation and triage (FraudDESK-powered alert prioritisation that works down backlogs and elevates high-risk cases), segment customers and profile transactions to cut false positives, and automate routine tasks such as dismissing false positives and summarising cases. 'Converse and Suggest' agents and an LLM-based CoPilot capture the analyst's intent, suggest investigative paths in natural language, provide semantic search and orchestrate workflows that involve several agents. The model is 'analyst-in-the-loop': agents learn from analyst actions such as labelling false positives and confirming fraud, and analysts keep full control over decisions. Vendor-claimed figures on the page: 80% faster alert triage and review, 60% reduction in case-to-SAR processing time and 40% fewer false positives (vendor claims, not independently verified). NICE Actimize's own pages do not state a headquarters; the HQ shown is that of its parent company NICE Ltd. (Ra'anana, Israel) from NICE's SEC filings. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "fraud-detection", "alert-triage", "case-investigation" ], "india_relevance": "", "featured": false, "source_url": "https://www.niceactimize.com/xceed/ai-agents", "sources": [ "https://www.niceactimize.com/xceed/ai-agents", "https://www.niceactimize.com/xceed", "https://resources.niceactimize.com/wp-content/uploads/2025/09/xceed_ai_agents_brochure.pdf", "https://www.nice.com/company/legal/terms-of-use", "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001003935" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "thetaray-ray-aml-investigations", "name": "ThetaRay Ray (agentic AML investigation suite)", "vendor": "ThetaRay (ThetaRay Ltd.)", "hq_country": "Israel", "hq_region": "middle-east", "hq_basis": "own-site", "hq_entity": "ThetaRay Ltd., International Headquarters, 8 Hanagar Street, Hod HaSharon, Israel (own privacy policy); matches the Israel Corporations Authority registry record for ThetaRay Ltd (company no. 514807965, Hod HaSharon, active)", "hq_source": "https://www.thetaray.com/privacy-policy/", "url": "https://thetaray.com/ray-the-agentic-ai-aml-investigation-suite-that-transforms-case-resolution/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "AML investigation suite inside ThetaRay's Investigation Center, working on top of ThetaRay's transaction monitoring. Ray analyses each alert end to end (case data, customer and counterparty behaviour, KYC/profile alignment, jurisdictions, related past alerts), produces a full investigation report with a narrative, explained decision and recommended next steps, and gives analysts an on-demand assistant; analysts make the final decision.", "description": "ThetaRay markets its RAY platform as 'the agentic AI intelligence layer for financial crime compliance'. Ray, its AI suite for AML investigations, runs inside the ThetaRay Investigation Center on top of ThetaRay's Cognitive AI transaction monitoring. Per the vendor's product page, Ray automatically analyses each alert end to end and generates a full investigation report: it gathers case data, evaluates customer and counterparty behaviour, checks KYC/profile alignment, assesses jurisdictions and geographies, identifies contradictions and anomalies, correlates historical alerts and past cases, organises documentation and provides recommended next steps. An on-demand AI assistant summarises long documents, explains alert context, performs controlled open-source scanning and helps analysts validate and finalise decisions. The vendor states analysts remain in control. It is aimed at banks, fintechs, PSPs, correspondent banks, remittance companies and digital banks. ThetaRay's privacy policy names ThetaRay Ltd. and lists its International Headquarters in Hod HaSharon, Israel (with UK offices in London). Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "case-investigation", "alert-triage" ], "india_relevance": "", "featured": false, "source_url": "https://thetaray.com/ray-the-agentic-ai-aml-investigation-suite-that-transforms-case-resolution/", "sources": [ "https://thetaray.com/ray-the-agentic-ai-aml-investigation-suite-that-transforms-case-resolution/", "https://www.thetaray.com/", "https://www.thetaray.com/privacy-policy/", "https://data.gov.il/dataset/ica_companies" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "pentera-ai-exposure-validation", "name": "Pentera AI-powered exposure validation (automated pentesting with AI-guided attack execution)", "vendor": "Pentera (Pentera Security Ltd.)", "hq_country": "Israel", "hq_region": "middle-east", "hq_basis": "parent-company-filing", "hq_entity": "Pentera Security Ltd., Derech Begin 132, Tel Aviv-Yafo, Israel (Israel Corporations Authority registry, company no. 515342186, active). Pentera's privacy policy names Pentera Security Ltd. 'together with its affiliates'. Own pages state no HQ.", "hq_source": "https://data.gov.il/dataset/ica_companies", "url": "https://pentera.io/ai-powered-exposure-validation/", "category": "security", "categories": [ "security" ], "summary": "Security-validation platform that continuously runs automated, production-safe pentests across internal networks, the external attack surface, cloud and identity, web apps and APIs. AI guides attack execution in real time (adapting techniques, generating payloads, chaining exploits) while Pentera's deterministic engine keeps every action controlled and auditable; users can approve or stop execution within guardrails, and Pentera Resolve turns validated findings into automated remediation workflows.", "description": "Per Pentera's 'AI-powered exposure validation' page, AI gives Pentera's deterministic attack engine real-time context awareness: it adjusts techniques based on the environment, generates and refines payloads, chains successful steps and retries failed attempts with new data, and reads application structure, inputs and responses for web attack testing, while 'every AI-assisted action is governed by Pentera's deterministic attack engine'. Testing covers internal networks (Pentera Core), external attack surface (Pentera Surface), cloud identity and hybrid environments (Pentera Cloud) and web applications/APIs. Pentera Peer lets teams query validated attack data in natural language, generate role-based reports and 'approve or stop execution within defined guardrails'. Pentera Resolve turns validated attack data into automated remediation workflows (what to fix, who owns it, and confirmation that the fix worked). Pentera states it is ISO/IEC 42001 certified for AI management (vendor statement). Pentera's own pages state no headquarters; the HQ shown is the registered address of Pentera Security Ltd. from the Israeli companies registry. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pen-test-management", "exposure-management", "attack-surface", "remediation" ], "india_relevance": "", "featured": false, "source_url": "https://pentera.io/ai-powered-exposure-validation/", "sources": [ "https://pentera.io/ai-powered-exposure-validation/", "https://pentera.io/", "https://pentera.io/privacy-policy/", "https://data.gov.il/dataset/ica_companies" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "datavisor-vera-agents", "name": "DataVisor Vera and Vera Code (agentic AI for fraud and AML strategy, tuning, alert summaries and SAR drafting)", "vendor": "DataVisor (DataVisor, Inc.)", "hq_country": "United States", "hq_region": "north-america", "hq_basis": "parent-company-filing", "hq_entity": "DataVisor, Inc. (Delaware), 967 North Shoreline Blvd, Mountain View, CA (business address on SEC Form D filings, latest Dec 16, 2022; matches the address in the site footer). Own pages state no HQ.", "hq_source": "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001730686", "url": "https://www.datavisor.com/agentic-ai/vera", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "AI teammate for fraud and AML teams on the DataVisor platform. From a plain-language request, Vera orchestrates agents that author detection rules, features and lists, tune strategies against production telemetry, summarise alerts and draft FinCEN-aligned SAR narratives; changes are proposal-only and a human approves before anything reaches production. Vera Code turns requirements into tested, documented configurations.", "description": "DataVisor's AI Agents line (Strategy Creation, Strategy Tuning, Investigation and Reporting agents) is fronted by Vera, which the vendor calls an AI teammate for fraud and AML teams. Per the Vera page, users express intent in plain language and Vera orchestrates agents across DataVisor to author rules, features and lists, tune strategies, summarise alerts and draft FinCEN-aligned SAR narratives, 'with a human approving before anything reaches production'; it can investigate a shared fraud pattern, propose a detection strategy and build the feature and rule, pausing for approval. The strategy-tuning page says tuning and discovery agents work on production data, show their arithmetic and never ship a change on their own (checkpoint gating, analyst override, before/after change summaries). Vera Code, announced Oct 20, 2026, turns requirements into tested, documented configurations. The vendor says Vera agents run statelessly on Amazon Bedrock and can be orchestrated over MCP. DataVisor's own pages give an address but no HQ statement; the HQ shown is DataVisor, Inc.'s business address from its SEC Form D filings. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "fraud-detection", "aml", "alert-triage", "sar-narratives", "case-investigation" ], "india_relevance": "", "featured": false, "source_url": "https://www.datavisor.com/agentic-ai/vera", "sources": [ "https://www.datavisor.com/agentic-ai/vera", "https://www.datavisor.com/agentic-ai/strategy-creation-tuning", "https://www.datavisor.com/products/ai-agents", "https://www.businesswire.com/news/home/20261020005356/en/DataVisor-Cuts-Financial-Crime-Solution-Deployment-from-Months-to-Days-with-Agentic-AI", "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001730686" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "uptiq-compliance-agents", "name": "Uptiq compliance and risk agents (sanctions screening, BSA/AML and regulatory reporting agents for banks)", "vendor": "Uptiq (UPTIQ, Inc.)", "hq_country": "United States", "hq_region": "north-america", "hq_basis": "parent-company-filing", "hq_entity": "UPTIQ, Inc. (Delaware), 7300 State Highway 121, Ste 300, McKinney, Texas (business address on SEC Form D, Oct 24, 2024, amended Feb 10, 2025). The website shows an Austin, TX 'Address' but no HQ statement; country is the same.", "hq_source": "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0002042350", "url": "https://www.uptiq.ai/compliance-risk-solution", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Agents for bank and credit-union compliance teams on Uptiq's Qore platform. A Sanctions Screening Agent screens every transaction and party and prioritises alerts by risk, a BSA/AML Agent assembles case files and drafts SAR and CTR narratives for disposition, and a Regulatory Reporting Agent prepares and validates filings and tracks regulatory changes to policy; agents run under the institution's own policies, permissions and approval gates, with every action logged.", "description": "Uptiq describes itself as an AI platform for financial services. Its compliance and risk page lists running agents for sanctions screening (every transaction and party screened, alerts scored and prioritised by real risk), BSA/AML (case files assembled the same way every time, patterns analysed, SAR and CTR narratives drafted for disposition, every decision recorded with its evidence) and regulatory reporting (filings prepared and validated from governed data, regulatory changes mapped to policy and tracked to completion, actions logged as they happen). Per the page, agents run under the customer's policies and permissions, inside scoped roles, with approval gates the customer defines, and every agent runs governed on Uptiq's Qore platform; Uptiq says this is aligned to the NIST AI RMF (vendor statement). An agent marketplace also covers account opening, onboarding, lending, fraud review, collections and servicing; the homepage cites 52 agents, 190+ capabilities and 150+ institutions, and the compliance page says one workflow goes live in about five business days via 100+ integrations (vendor claims). Uptiq's own pages give an address but no HQ statement; the HQ shown is UPTIQ, Inc.'s business address from its SEC Form D. Pricing is not published.", "pricing": "Not published", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [ "NIST AI RMF" ], "tasks": [ "aml", "alert-triage", "case-investigation", "sar-narratives", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.uptiq.ai/compliance-risk-solution", "sources": [ "https://www.uptiq.ai/compliance-risk-solution", "https://www.uptiq.ai/", "https://www.uptiq.ai/terms-conditions", "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0002042350" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "sonrai-wally-cloud-pam-agent", "name": "Sonrai WALLy (cloud privileged access management agent)", "vendor": "Sonrai Security (Sonrai Security Inc.)", "hq_country": "United States", "hq_region": "north-america", "hq_basis": "parent-company-filing", "hq_entity": "Sonrai Security Inc. (Delaware), New York, NY (business address on SEC Form D, Oct 27, 2021). Own site lists offices in New York and New Brunswick, Canada, with no HQ label.", "hq_source": "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001830367", "url": "https://sonraisecurity.com/wally/", "category": "security", "categories": [ "security" ], "summary": "Cloud PAM agent that works with Sonrai's Cloud Permissions Firewall across AWS and GCP. WALLy flags identities carrying privilege risk (overpermissioned roles, external accounts with IAM access, unused permissions), prioritises the fixes that cut the most risk, writes remediation policies (quarantine zombie identities, block third-party access, enforce just-in-time access, remove dangerous privileges) and stages them for a human to review and approve before deployment, then confirms the risk is closed.", "description": "Per Sonrai's WALLy page, WALLy scans the cloud environment through the Cloud Permissions Firewall and surfaces privilege risk across human, machine and third-party identities: overpermissioned roles, external accounts with IAM access and identities with unused permissions. It prioritises the changes that cut the most risk, writes the remediation policies and stages them in the Cloud Permissions Firewall; 'a human reviews and approves before anything is deployed in your cloud', and once protections are live WALLy confirms the risk has been closed. Actions include quarantining zombie identities, blocking third-party access, enforcing just-in-time access and removing dangerous privileges, with role-based access controls, change history and exception handling. It can be triggered from CNAPP or CIEM tools. Sonrai offers a 14-day free trial; its published Cloud Permissions Firewall pricing is a $15k/year minimum for small cloud footprints, $150 per account per month for 10-50 accounts across AWS, Azure and GCP, and custom pricing above 50 accounts (WALLy is not priced separately on that page). The HQ shown is Sonrai Security Inc.'s business address from its SEC Form D.", "pricing": "14-day free trial. Cloud Permissions Firewall (which WALLy works with): $15k/year minimum for small cloud footprints; $150 per account per month for 10-50 accounts (AWS, Azure, GCP); 50+ accounts custom. WALLy is not priced separately.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "cloud-security", "identity-governance", "remediation" ], "india_relevance": "", "featured": false, "source_url": "https://sonraisecurity.com/wally/", "sources": [ "https://sonraisecurity.com/wally/", "https://sonraisecurity.com/pricing/", "https://sonraisecurity.com/blog/meet-wally-your-pam-ai-agent-for-cloud/", "https://sonraisecurity.com/privacy-policy/", "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001830367" ], "integrations": [ "aws", "gcp" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "atomicwork-iga-agent", "name": "Atomicwork IGA Agent (agentic access provisioning on Atomicwork's AI Workforce)", "vendor": "Atomicwork (Atomicwork Inc.)", "hq_country": "United States", "hq_region": "north-america", "hq_basis": "parent-company-filing", "hq_entity": "Atomicwork Inc. (Delaware), 355 Bryant Street, San Francisco, CA (business address on SEC Form D, Jan 21, 2025, amended Mar 3, 2025). Own site describes hubs in San Francisco and Bengaluru, no HQ label.", "hq_source": "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001958600", "url": "https://www.atomicwork.com/features/access-management", "category": "security", "categories": [ "security", "business-ops" ], "summary": "AI coworker on Atomicwork's agentic ITSM/ESM platform that handles access requests end to end: it reviews context, applies policy, routes approvals to the right owners in Slack or Teams, provisions and deprovisions access and enforces just-in-time access, acting without human intervention unless policy requires it. Listed tools include Okta, Azure AD, Google Workspace, JumpCloud and Microsoft Intune.", "description": "Atomicwork sells an AI-native IT and enterprise service desk staffed by 'AI Coworkers'. Its IGA Agent, per the AI agents and access-management pages, handles access requests end to end by reviewing context, applying policy and provisioning the right access to the right user at the right time, including deprovisioning and just-in-time enforcement, 'without human intervention unless policy requires it'. It routes approval requests to the right people in Slack or Teams (multi-owner and group policies), shows every active grant across the app catalogue with instant revocation, and recommends access policies based on how employees request and use access. Listed tools: Okta, Azure AD, Google Workspace, JumpCloud and Microsoft Intune. Published pricing: Professional plan from $25,000/year billed annually (25,000 credits, 2 AI Coworkers, up to 250 end users), additional AI Coworkers $499 per worker per month, and an outcome-based option that lists access automation at $2 per handled access request; Business and Enterprise plans are by quote. The HQ shown is Atomicwork Inc.'s business address from its SEC Form D.", "pricing": "Professional from $25,000/year billed annually (includes 25,000 credits and 2 AI Coworkers, up to 250 end users); additional AI Coworkers $499/worker/month; outcome-based option: access automation $2 per outcome. Business and Enterprise by quote.", "pricing_model": "published-tiers", "frameworks": [], "frameworks_claimed": [], "tasks": [ "identity-governance", "it-service", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.atomicwork.com/features/access-management", "sources": [ "https://www.atomicwork.com/features/access-management", "https://www.atomicwork.com/features/ai-agents", "https://www.atomicwork.com/pricing", "https://www.atomicwork.com/terms", "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001958600" ], "integrations": [ "okta", "google-workspace", "microsoft-365-entra", "slack" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "vulnetic-sable", "name": "Vulnetic Sable (AI pentesting agent)", "vendor": "Vulnetic (Vulnetic Inc.)", "hq_country": "United States", "hq_region": "north-america", "hq_basis": "parent-company-filing", "hq_entity": "Vulnetic Inc. (Virginia), Nokesville, Virginia (business address on SEC Form D, May 18, 2026). The site footer says 'Washington DC, United States' with no HQ statement; country is the same.", "hq_source": "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0002135626", "url": "https://www.vulnetic.ai/ai-pentesting-agent", "category": "security", "categories": [ "security" ], "summary": "Agentic pentesting agent for internal security teams and MSSPs. Sable plans and executes authorised tests against web applications, APIs, internal networks and Active Directory, runs real tools, proves impact with reproducible evidence and exploit traces, and supports targeted retests after remediation; teams steer it in plain language and can approve every command or let it run fully autonomously.", "description": "Per Vulnetic's site, Sable is 'an AI pentesting agent that plans, executes, and proves every finding, with your team in control'. Teams define scope, encode their methodology, inspect execution and steer the assessment in plain language, and can 'approve every command or let it run fully autonomous'. Sable attacks web applications, APIs, internal networks and Active Directory, runs real tools, preserves exploit traces and produces reviewable findings with reproducible proof; reports and targeted retests of single findings follow remediation. Use cases listed include continuous pentesting, vulnerability validation, pentesting firms and on-premises enterprise deployments. The HQ shown is Vulnetic Inc.'s business address from its SEC Form D (May 18, 2026). Plan prices were not readable on the vendor's pages on 2026-10-21.", "pricing": "Not published on the pages we could read on 2026-10-21 (check the vendor pricing section)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "pen-test-management", "vulnerability-management" ], "india_relevance": "", "featured": false, "source_url": "https://www.vulnetic.ai/ai-pentesting-agent", "sources": [ "https://www.vulnetic.ai/ai-pentesting-agent", "https://www.vulnetic.ai/", "https://www.vulnetic.ai/terms-of-service", "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0002135626" ], "last_checked": "2026-10-21", "added": "2026-10-21" }, { "slug": "mave-agentic-secops", "name": "Mave agentic SecOps (AI SOC agents)", "vendor": "Mave (Mave Security Ltd.)", "hq_country": "Israel", "hq_region": "middle-east", "hq_basis": "parent-company-filing", "hq_entity": "Mave Security Ltd. (\u05de\u05d9\u05d9\u05d1 \u05e1\u05e7\u05d9\u05d5\u05e8\u05d9\u05d8\u05d9 \u05d1\u05e2\"\u05de), Tel Aviv-Yafo, Israel (Israel Corporations Authority registry, company no. 517108403, active, incorporated 26/01/2025). Mave's privacy policy names Mave Security Ltd. 'and our affiliates' and refers to Israeli law; the Oct 22, 2026 launch release is datelined Tel Aviv-Yafo. Own pages state no HQ.", "hq_source": "https://data.gov.il/dataset/ica_companies", "url": "https://www.mave.com/solutions/ai-soc", "category": "security", "categories": [ "security" ], "summary": "Agentic SecOps platform whose governed AI agents investigate every alert across the security tools a company already runs, hunt threats, improve detections and trigger authorised response actions, without ingesting data into a new lake; teams set policies, permissions and approval gates.", "description": "Per Mave's site, its 'governed AI agents investigate alerts, apply threat intelligence, hunt across tools, improve detections, and execute authorized response actions', querying live data in the systems that already hold it rather than migrating telemetry, a duplicate data lake or fixed SOAR playbooks. Investigations can launch hunts, improve detections and trigger containment or remediation through connected tools. Controls listed: approval gates for workflow actions and detection updates, least-privileged per-platform API permissions ('read-only on day one'), and a complete audit trail of what every agent queried, correlated and concluded. Solutions pages cover AI SOC, reducing MDR reliance, on-prem SecOps, SIEM cost offload, threat hunting, detection engineering, threat intelligence, multi-SIEM and MSSP multi-tenant use. Mave came out of stealth on Oct 22, 2026 with $34 million in funding (a $28 million Series A led by Red Dot Capital Partners plus a $6 million seed). Pricing is by number of endpoints and security-team size via a custom-quote form; no prices are published.", "pricing": "Not published; priced by number of endpoints and security-team size (custom quote form on mave.com/pricing, checked 2026-10-23)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "security-operations", "alert-triage", "case-investigation", "threat-detection", "incident-response", "threat-intelligence" ], "india_relevance": "", "featured": false, "source_url": "https://www.mave.com/solutions/ai-soc", "sources": [ "https://www.mave.com/solutions/ai-soc", "https://www.mave.com/", "https://www.mave.com/pricing", "https://www.mave.com/privacy-policy", "https://www.mave.com/resources/mave-launches-with-34-million", "https://www.prnewswire.com/news-releases/mave-raises-34-million-to-build-the-agentic-secops-system-for-the-modern-enterprise-302916859.html", "https://data.gov.il/dataset/ica_companies" ], "last_checked": "2026-10-23", "added": "2026-10-23" }, { "slug": "nuix-neo-ai-agent", "name": "Nuix Neo AI Agent (investigations and compliance)", "vendor": "Nuix (Nuix Limited, ASX: NXL)", "hq_country": "Australia", "hq_region": "australia-new-zealand", "hq_basis": "own-site", "hq_entity": "Nuix contact page: 'Sydney (Global HQ)', Level 29 & 30, 1 Market Street, Sydney NSW 2000, Australia (USA HQ listed separately in Reston). Nuix is listed on the ASX as NXL.", "hq_source": "https://www.nuix.com/contact-us", "url": "https://www.nuix.com/news/nuix-launches-agentic-ai-nuix-neo-audit-trail-built", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "AI agent inside the Nuix Neo investigative analytics platform for legal, regulatory, investigations and compliance-monitoring matters: it picks and calls Neo tools on its own to answer plain-language questions across a case, links every answer to source items, tags items and writes findings back to the case, and records each step for audit.", "description": "Nuix launched the Nuix Neo AI Agent on Oct 22, 2026 (Sydney). Nuix software analyses large volumes of unstructured data such as emails and chats for 'high-stakes legal, regulatory and criminal matters and compliance monitoring'. Per Nuix's capability overview, given a question the agent 'selects the most appropriate tools, calls them autonomously, records its reasoning, interprets the results, and delivers a direct answer with full evidence traceability'; a single turn can combine Nuix Query Language queries, semantic search, Knowledge Graph traversal and item retrieval, and the agent 'tags items and writes results to custom metadata fields' on the case. It draws on over 20 Nuix Neo tools with role-based access controls, and investigators can export the full conversation including steps and findings. Built on the Neo Gen AI Framework (customer's chosen supported LLM), administrators can cap Gen AI spend by cost, calls or tokens and apply guardrail policies on prompts and outputs. Nuix says outputs support, not replace, the judgement of qualified professionals. Pricing is not published.", "pricing": "Not published (request a demo on nuix.com, checked 2026-10-23)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "case-investigation", "data-discovery", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.nuix.com/news/nuix-launches-agentic-ai-nuix-neo-audit-trail-built", "sources": [ "https://www.nuix.com/news/nuix-launches-agentic-ai-nuix-neo-audit-trail-built", "https://www.nuix.com/sites/default/files/2026-10/NuixNeo-AI-Agent_CapabilityOverview%20%281%29.pdf", "https://www.nuix.com/nuix-neo", "https://www.nuix.com/contact-us" ], "last_checked": "2026-10-23", "added": "2026-10-23" }, { "slug": "sigma360-edd-agent", "name": "Sigma360 EDD Agent (enhanced due diligence)", "vendor": "Sigma360 (Sigma Ratings, Inc.)", "hq_country": "United States", "hq_region": "north-america", "hq_basis": "parent-company-filing", "hq_entity": "Sigma Ratings, Inc., New York, NY (SEC EDGAR CIK 0001733537, business address 43 West 23rd Street, New York, NY 10010, Form D 2018). Sigma360's privacy policy gives the postal address Sigma Ratings, Inc., 40 Wall Street, 28th Floor, New York, NY 10005, and the Oct 22, 2026 launch release is datelined New York. The site has no HQ statement; city and country agree.", "hq_source": "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001733537", "url": "https://www.sigma360.com/solutions/enhanced-due-diligence-ai-agent/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "AI agent for enhanced due diligence (EDD) on high-risk customers: it gathers internal and external data, unifies KYC/KYB data, sanctions, adverse media and ownership/associate risk, flags risk factors and mitigants, recommends next steps and drafts a fully cited risk narrative for regulatory review, while the analyst makes the final decision.", "description": "Sigma360 launched its Enhanced Due Diligence (EDD) Agent on Oct 22, 2026. Per its release and product page, the agent automates 'collecting internal and external data, summarizing findings across structured modules, identifying risk factors and mitigants, recommending next steps, and generating a fully cited narrative ready for regulatory review', with configurable modules including industry risk, source of wealth and source of funds, beneficial ownership/UBO, associates and geographic risk. It unifies KYC/KYB data, watchlists, adverse media and Sigma360's risk intelligence into one cited risk profile and scores each finding for source authority. 'The analyst remains the decision-maker throughout', and every risk rating and action is documented. Vendor-stated figures: up to 87% less case-handling time and up to 90% lower EDD cost per case. An API is documented. Pricing is not published.", "pricing": "Not published (request a demo on sigma360.com, checked 2026-10-23)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "kyc", "aml", "case-investigation", "risk-assessment" ], "india_relevance": "", "featured": false, "source_url": "https://www.sigma360.com/solutions/enhanced-due-diligence-ai-agent/", "sources": [ "https://www.sigma360.com/solutions/enhanced-due-diligence-ai-agent/", "https://www.sigma360.com/sigma360-launches-ai-powered-enhanced-due-diligence-agent-to-synthesize-compliance-data-and-cut-investigation-time-by-87-percent/", "https://www.prnewswire.com/news-releases/sigma360-launches-ai-powered-enhanced-due-diligence-agent-to-synthesize-compliance-data-and-cut-investigation-time-by-87-percent-302916908.html", "https://www.sigma360.com/privacy-policy/", "https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001733537" ], "last_checked": "2026-10-23", "added": "2026-10-23" }, { "slug": "mozn-focal-agentic-ai", "name": "FOCAL by MOZN Agentic AI (AML and fraud investigation agents)", "vendor": "MOZN", "hq_country": "Saudi Arabia", "hq_region": "middle-east", "hq_basis": "own-site-statement", "hq_entity": "MOZN, 'Headquartered in Riyadh' (About MOZN boilerplate on mozn.ai news page, Aug 31, 2026); FOCAL site footer: 'HQ Office, Street Address: RRQB3536, 3536 Prince Saud Ibn Abdullah Ibn Jalawi, Al Qirawan, Riyadh, Saudi Arabia'.", "hq_source": "https://www.getfocal.ai/", "url": "https://www.getfocal.ai/", "category": "risk", "categories": [ "risk", "compliance" ], "summary": "Financial-crime platform from Riyadh-based MOZN whose built-in agentic AI triages AML alerts, summarises cases, recommends dispositions, auto-closes low-risk or duplicate cases and drafts SARs, alongside a Fraud Investigation Agent; humans keep consequential decisions.", "description": "Per FOCAL's own pages, its 'built-in Agentic AI' works inside the FOCAL case manager: when transaction monitoring raises an alert, the agent provides customer activity summaries, case context and recommended actions with explainability, gives case disposition recommendations, can auto-dispose low-risk or duplicate cases, flags medium/high-risk cases for continued monitoring or customer blocking, and can auto-generate a Suspicious Activity Report (FAQ: 'automates alert triaging, disposition, and auto closures'). FOCAL combines ML models, a rules engine and the agentic layer for AML screening, transaction monitoring, KYC/CDD and enterprise fraud management, with Arabic and Latin name matching. On Aug 31, 2026 MOZN announced a Fraud Investigation Agent (analyses transaction, device, network and IP signals against known typologies and gathers evidence while investigators keep the decision) and a Data Analyst Agent. Pricing is not published (demo request).", "pricing": "Not published (demo request on getfocal.ai, checked 2026-10-25)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "aml", "case-investigation", "sar-narratives", "fraud-detection", "kyc", "alert-triage" ], "india_relevance": "", "featured": false, "source_url": "https://www.getfocal.ai/use-cases/suspicious-transaction-monitoring", "sources": [ "https://www.getfocal.ai/use-cases/suspicious-transaction-monitoring", "https://www.getfocal.ai/", "https://www.getfocal.ai/report/agentic-ai-report", "https://www.mozn.ai/blog/mozn-expands-agentic-ai-portfolio-new-ai-agents", "https://www.mozn.ai/" ], "last_checked": "2026-10-25", "added": "2026-10-25" }, { "slug": "trail-governance-agents", "name": "trail Governance Agents (GRC and AI governance agents)", "vendor": "trail (trail GmbH, part of Collibra since Oct 2026)", "hq_country": "Germany", "hq_region": "europe", "hq_basis": "own-site-imprint", "hq_entity": "trail GmbH, Georgenstr. 38, 80799 Munich, Germany (imprint per \u00a75 DDG; Munich District Court, HRB 283398). Collibra announced the acquisition of 'trail ML, a Munich-based AI governance company' on Oct 5, 2026; trail's site banner says 'trail is now part of' Collibra.", "hq_source": "https://www.trail-ml.com/imprint", "url": "https://www.trail-ml.com/agents", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Munich-based trail's Governance Agents run GRC busywork in the background: they read your project files and sources to collect and link evidence, assess controls, classify systems, run risk and vendor assessments and draft policies, proposing changes that a human approves before anything is written.", "description": "Per trail's own pages, its 'Governance Agents' are 'purpose-built agents for IT compliance and governance' that 'run in the background, connect to your existing tools' and handle tasks such as evidence collection ('find and link suitable evidence from your sources to controls. Continuously, instead of point-in-time'), control assessments, control identification, classification of systems and AI use cases, risk assessments, project analysis against a framework, and policy drafting. Agents can be linked into flows with triggers to 'run full workflows on autopilot'; for mid-market teams trail lists automated vendor risk screening against your policies, AI-based control gap analysis with source citations and automatic questionnaire processing. trail's 'Copy-on-Write' mechanism means 'agents propose, but never commit without your approval'. The same platform covers AI governance (AI registry, EU AI Act, ISO/IEC 42001, AI risk management), deploys as SaaS (EU data centres), on-premises or BYOC, and integrates with OneTrust, Collibra, ServiceNow, SAP LeanIX, Jira, Confluence, GitHub and others. Collibra announced its acquisition of trail on Oct 5, 2026. Pricing is not published (demo request).", "pricing": "Not published (demo request on trail-ml.com, checked 2026-10-26)", "pricing_model": "quote", "frameworks": [ "EU AI Act", "ISO 42001" ], "frameworks_claimed": [ "EU AI Act", "ISO 42001", "NIST AI RMF" ], "tasks": [ "evidence-collection", "control-testing", "risk-assessment", "vendor-risk", "policy-management", "gap-analysis", "questionnaire-automation", "ai-governance", "workflow-automation" ], "india_relevance": "", "featured": false, "source_url": "https://www.trail-ml.com/agents", "sources": [ "https://www.trail-ml.com/agents", "https://www.trail-ml.com/", "https://www.trail-ml.com/imprint", "https://www.collibra.com/company/newsroom/press-releases/collibra-acquires-trail-ml-to-automate-ai-governance-from-policy-to-production" ], "last_checked": "2026-10-26", "added": "2026-10-26", "integrations": [ "OneTrust", "Collibra", "ServiceNow", "SAP LeanIX", "Jira", "Confluence", "GitHub", "GitLab", "SharePoint", "Notion", "Databricks", "MLflow" ] }, { "slug": "regask-regulatory-ai-agents", "name": "RegASK AI agents (regulatory intelligence and action workflows)", "vendor": "RegASK (RegASK Pte. Ltd.)", "hq_country": "Singapore", "hq_region": "asia-pacific", "hq_basis": "own-site", "hq_entity": "RegASK PTE. LTD., 79 Science Park Drive, #06-01, Cintech IV, Singapore 118264 (Organization structured data on regask.com, legalName and PostalAddress, checked 2026-10-27). Oct 22, 2026 release is datelined New York & Singapore.", "hq_source": "https://regask.com/privacy-policy/", "url": "https://regask.com/product/", "category": "compliance", "categories": [ "compliance", "risk" ], "summary": "Singapore-based RegASK monitors regulatory change in 160+ markets for life sciences and consumer products companies, and its AI agents assess impact on products and markets, assign follow-up tasks and execute subsequent actions in configurable workflows, with expert review and a recorded outcome for each run.", "description": "Per RegASK's own pages, RegASK is an 'AI-native regulatory operating system' that combines 'agentic AI, human expertise, and enterprise governance'. Alerts detect and prioritise regulatory change across 160+ markets; 'agentic AI agents translate, summarize, triage, and structure regulatory content at scale' for impact assessment; ActionHub tracks changes, manages workflows and triggers actions; and a RegGenius assistant answers questions with source citations. On Oct 22, 2026 RegASK announced Automation Builder: teams configure workflows triggered by regulatory alerts or schedules in which 'AI agents can assess impact, assign follow-up tasks and execute subsequent actions, retaining a record of each outcome', for example identifying products affected by a changed ingredient limit and flagging active Label Compliance projects; regulatory decisions remain subject to human review. Integrations listed include Veeva RIM, Esko, API, A2A and MCP, and it is available on Microsoft Marketplace. RegASK states it holds ISO/IEC 42001 certification. Pricing is not published (demo request).", "pricing": "Not published (demo request on regask.com, checked 2026-10-27)", "pricing_model": "quote", "frameworks": [], "frameworks_claimed": [], "tasks": [ "workflow-automation", "compliance-workflows", "risk-assessment" ], "india_relevance": "", "featured": false, "source_url": "https://regask.com/regask-expands-ai-agents-to-automate-regulatory-action-across-160-markets/", "sources": [ "https://regask.com/regask-expands-ai-agents-to-automate-regulatory-action-across-160-markets/", "https://regask.com/product/", "https://regask.com/", "https://regask.com/partnerships-and-integrations/", "https://regask.com/privacy-policy/" ], "last_checked": "2026-10-27", "added": "2026-10-27", "integrations": [ "Veeva RIM", "Esko", "Microsoft Marketplace", "MCP" ] } ], "categories": [ { "slug": "compliance", "name": "Compliance", "description": "AI agents and platforms that help achieve and maintain compliance frameworks such as SOC 2, ISO 27001, HIPAA and related audit programs." }, { "slug": "security", "name": "Security", "description": "AI agents for application, cloud and security operations \u2014 vulnerability management, detection, response and trust automation." }, { "slug": "risk", "name": "Risk", "description": "AI agents for enterprise, third-party, privacy and financial crime risk programs." }, { "slug": "privacy", "name": "Privacy", "description": "AI agents for privacy operations: data discovery and mapping, consent, data-subject and data-principal rights requests, DPIAs and privacy-law programmes such as GDPR and India's DPDP Act." }, { "slug": "business-ops", "name": "Business operations", "description": "AI agents that automate workplace, process and service operations for security and compliance teams' broader business context." }, { "slug": "code-security", "name": "Code security", "description": "AI agents and assistants for application security in the software development lifecycle: SAST/SCA findings, suggested or automated fixes, pull-request security review, and related AppSec workflows. Coding platforms that only reach this category through a security-scanner integration are tagged as such and are not presented as dedicated security products." } ], "frameworks": [ { "slug": "dpdp", "name": "DPDP Act (India)", "short_name": "DPDP", "description": "India's DPDP Act 2023 and DPDP Rules 2025 (GSR 846(E)): Rule 4 (Consent Manager registration) is in force from 13 November 2026. Most remaining notice, security, breach and retention duties (Rules 3, 5\u201316, 22 and 23) apply from 13 May 2027. This page does not claim that the Data Protection Board has opened applications.", "official_url": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "notes": "Few global vendors publish India-DPDP-branded modules yet. Listings here are tools commonly evaluated for privacy inventory, consent, DSR and security \u2014 confirm DPDP fit with each vendor.", "last_checked": "2026-10-27", "sources": [ "https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025-gDOxUjMtQWa", "https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf", "https://www.meity.gov.in/static/uploads/2026/10/daf495a7b5798a3dfa72a944b51fc176.pdf" ], "key_facts": [ { "text": "The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) is implemented through the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), Gazette of 13 November 2025).", "source_url": "https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025-gDOxUjMtQWa" }, { "text": "Rule 4 (Consent Manager registration and obligations) comes into force one year after publication of G.S.R. 846(E) (13 November 2025), i.e. 13 November 2026. This page does not claim that the Data Protection Board has opened applications.", "source_url": "https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf" }, { "text": "Rules 3, 5\u201316, 22 and 23 come into force 18 months after publication, i.e. from 13 May 2027.", "source_url": "https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf" }, { "text": "On 5 October 2026 MeitY issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E), Gazette of 6 October 2026, in force on publication). It amends Section 9(1) to read 'child or of a person with disability' and replaces 'audit' with 'data audit' in Section 10(2)(c)(ii) for Significant Data Fiduciaries.", "source_url": "https://www.meity.gov.in/static/uploads/2026/10/daf495a7b5798a3dfa72a944b51fc176.pdf" } ] }, { "slug": "cert-in", "name": "CERT-In Directions (2022)", "short_name": "CERT-In", "description": "Indian Computer Emergency Response Team directions dated 28 April 2022 require reporting of listed incidents within 6 hours and retention of ICT system logs for 180 days within India, among other obligations.", "official_url": "https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf", "notes": "Security operations, logging, vulnerability and incident-response agents can support CERT-In capability building. No listing here is a certified CERT-In compliance product unless the vendor states so.", "last_checked": "2026-10-19", "sources": [ "https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf", "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0049" ], "key_facts": [ { "text": "CERT-In directions dated 28 April 2022 require reporting of listed incidents within 6 hours and retention of ICT system logs for 180 days within India, among other obligations.", "source_url": "https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf" }, { "text": "On 15 October 2026 CERT-In issued advisory CIAD-2026-0049 (severity: Critical), 'AI Agents as Attack Vectors', after AI model providers disclosed that agents under research and evaluation had exceeded their task authorization and reached live systems of Indian organisations, and after CERT-In observed attackers using open-source agentic AI tools; the affected organisations had not detected the access themselves.", "source_url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0049" }, { "text": "For organisations deploying AI agents, CIAD-2026-0049 recommends a separate short-lived least-privilege identity for each agent run, default-deny network egress and a tamper-resistant log of agent activity covering at least all actions affecting production systems and data, alongside credential audits and rotation, API inventory, MFA on admin access and log retention of at least 180 days.", "source_url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0049" } ] }, { "slug": "soc2", "name": "SOC 2", "short_name": "SOC 2", "description": "AICPA System and Organization Controls 2 reports on security, availability, processing integrity, confidentiality and/or privacy trust services criteria \u2014 widely requested in B2B SaaS due diligence.", "official_url": "https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2", "notes": "Most compliance automation vendors in this index target SOC 2 evidence collection and continuous monitoring." }, { "slug": "iso27001", "name": "ISO/IEC 27001", "short_name": "ISO 27001", "description": "International standard for information security management systems (ISMS), commonly required by global enterprise customers.", "official_url": "https://www.iso.org/standard/27001", "notes": "Many compliance automation and GRC platforms map controls to ISO 27001 Annex A." }, { "slug": "hipaa", "name": "HIPAA (United States)", "short_name": "HIPAA", "description": "The US Health Insurance Portability and Accountability Act of 1996 and its HHS rules: the Privacy Rule (uses and disclosures of protected health information), the Security Rule (administrative, physical and technical safeguards for electronic PHI) and the Breach Notification Rule. It applies to covered entities and their business associates.", "official_url": "https://www.hhs.gov/hipaa/index.html", "notes": "There is no official HIPAA certification. Listings here are tools commonly evaluated for HIPAA risk analysis, safeguards, evidence and audit readiness; tags indicate relevance, not certification. Confirm HIPAA scope and BAA availability with each vendor." }, { "slug": "fedramp", "name": "FedRAMP (United States)", "short_name": "FedRAMP", "description": "The US Federal Risk and Authorization Management Program is the government-wide program that provides a standardized approach to security assessment, authorization and continuous monitoring for cloud products used by US federal agencies. Listings tagged here appear as FedRAMP Authorized on the official FedRAMP Marketplace (not merely vendor marketing).", "official_url": "https://www.fedramp.gov/", "notes": "The frameworks tag is used only when the FedRAMP Marketplace lists the product (or the cloud offering the vendor documents as the boundary for the agent) as FedRAMP Authorized. Vendor-only FedRAMP claims, Ready packages, and in-process listings stay in frameworks_claimed. Authorization of a Government Cloud package is not a ranking or an endorsement of the agent." }, { "slug": "cmmc", "name": "CMMC (US Department of War / DoD)", "short_name": "CMMC", "description": "The Cybersecurity Maturity Model Certification program verifies that defense contractors and subcontractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). As of 18 Oct 2026 the program is paused in Phase 1 (self-assessments).", "official_url": "https://dodcio.defense.gov/CMMC/About/", "notes": "Tag means the vendor's own pages document CMMC program support (framework library, requirement mapping, evidence, POA&M or affirmation workflows). It is not a CMMC certification of the tool or of your organisation.", "last_checked": "2026-10-18", "sources": [ "https://dodcio.defense.gov/CMMC/About/", "https://dodcio.defense.gov/CMMC/" ], "key_facts": [ { "text": "On 13 Jul 2026 the Department of War (DoW) suspended CMMC Phase II requirements, which had been scheduled for 10 Nov 2026, and set up a CMMC reform task force. Phase I self-assessment requirements remain in place.", "source_url": "https://dodcio.defense.gov/CMMC/About/" }, { "text": "Phase 1 began 10 Nov 2025; the program is paused in Phase 1. During this period DoW enforces NIST SP 800-171 Rev 2 compliance through self-assessments and select government-led assessments.", "source_url": "https://dodcio.defense.gov/CMMC/About/" }, { "text": "CMMC protects FCI (FAR 4.1901) and CUI (32 CFR 2002.4(h)); DoW contractors and subcontractors handling FCI/CUI must achieve a specified CMMC level as a condition of contract award.", "source_url": "https://dodcio.defense.gov/CMMC/About/" }, { "text": "Level 1 (Self): annual self-assessment and affirmation against the 15 requirements of FAR 52.204-21; results in SPRS; POA&Ms not permitted.", "source_url": "https://dodcio.defense.gov/CMMC/About/" }, { "text": "Level 2 (Self): self-assessment every 3 years with annual affirmation against the 110 requirements of NIST SP 800-171 Rev 2 (DFARS 252.204-7012); results in SPRS; POA&Ms permitted per 32 CFR 170.21(a)(2) and must be closed within 180 days.", "source_url": "https://dodcio.defense.gov/CMMC/About/" }, { "text": "The pause does not remove the obligation to protect information under DFARS 252.204-7012.", "source_url": "https://dodcio.defense.gov/CMMC/About/" } ] }, { "slug": "govramp", "name": "GovRAMP (formerly StateRAMP)", "short_name": "GovRAMP", "description": "GovRAMP is a nonprofit membership organization with a standardized, NIST-aligned framework for verifying the security of cloud services and third-party technology used by government (state, local, tribal, education).", "official_url": "https://govramp.org/", "notes": "Tag only when GovRAMP's Authorized Product List shows the listed product (or the government boundary the listing already documents) as Authorized. Ready / Core / Provisionally Authorized / Progressing / Pending / In Process and platform-only listings are shown on the hub but not tagged.", "last_checked": "2026-10-18", "sources": [ "https://govramp.org/", "https://govramp.org/about/", "https://govramp.org/program-participants", "https://govramp.org/news/blog/stateramp-announces-rebrand-to-govramp-reflecting-mission-to-unite-public-and-private-sectors-in-advancing-cybersecurity" ], "key_facts": [ { "text": "GovRAMP is a nonprofit membership organization with a standardized, NIST-aligned framework for verifying the security of cloud services and third-party technology used by government (state, local, tribal, education).", "source_url": "https://govramp.org/about/" }, { "text": "StateRAMP announced on 14 Feb 2025 that it operates as (dba) GovRAMP; StateRAMP remains the legal entity and existing certifications continue.", "source_url": "https://govramp.org/news/blog/stateramp-announces-rebrand-to-govramp-reflecting-mission-to-unite-public-and-private-sectors-in-advancing-cybersecurity" }, { "text": "Statuses on the Authorized Product List (APL): Core (validated by the GovRAMP PMO), Ready, Provisionally Authorized, Authorized (independent 3PAO assessment; 3PAOs are A2LA-accredited); impact levels Low/Moderate/High; verified providers are continuously monitored. The Progressing Product List (PPL) covers products working toward a status (Active, In Process, Pending, Progressing, Not Progressing).", "source_url": "https://govramp.org/program-participants" } ] }, { "slug": "tx-ramp", "name": "TX-RAMP (Texas)", "short_name": "TX-RAMP", "description": "TX-RAMP is run by the Texas Department of Information Resources (DIR): a standardized approach for security assessment, certification and continuous monitoring of cloud computing services that process the data of Texas state agencies.", "official_url": "https://dir.texas.gov/information-security/texas-risk-and-authorization-management-program-tx-ramp", "notes": "Tag only when Texas DIR's TX-RAMP Certified Cloud Products list (updated 13 Oct 2026) shows the listed product (or the documented government boundary) at Level 1 or Level 2. Provisional and platform-only entries are shown on the hub but not tagged. DIR notes publishing issues: products missing from the list may not have lost certification, so this hub never says a vendor is not TX-RAMP certified.", "last_checked": "2026-10-18", "sources": [ "https://dir.texas.gov/information-security/texas-risk-and-authorization-management-program-tx-ramp", "https://dir.texas.gov/information-security/texas-risk-and-authorization-management-program-tx-ramp/tx-ramp-eligibility", "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" ], "key_facts": [ { "text": "Run by the Texas Department of Information Resources (DIR): a standardized approach for security assessment, certification and continuous monitoring of cloud computing services that process the data of Texas state agencies.", "source_url": "https://dir.texas.gov/information-security/texas-risk-and-authorization-management-program-tx-ramp" }, { "text": "Applies to state agencies, institutions of higher education and public community colleges (Texas Government Code 2054.003(13)); only cloud computing services as defined in Texas Government Code 2054.0593(a) are in scope.", "source_url": "https://dir.texas.gov/information-security/texas-risk-and-authorization-management-program-tx-ramp/tx-ramp-eligibility" }, { "text": "Level 1: public/non-confidential information or low-impact systems (Level 1 assessment, or evidence of StateRAMP Category 1 / FedRAMP Low). Level 2: confidential/regulated data in moderate or high impact systems (Level 2 assessment, or StateRAMP Category 2 / FedRAMP Moderate).", "source_url": "https://dir.texas.gov/information-security/texas-risk-and-authorization-management-program-tx-ramp/tx-ramp-eligibility" }, { "text": "Provisional status lets an agency contract for a product for up to 18 months without full certification; the product must be certified within that period.", "source_url": "https://dir.texas.gov/information-security/texas-risk-and-authorization-management-program-tx-ramp" }, { "text": "The certified-products spreadsheet was last updated 13 Oct 2026. DIR notes publishing issues: products missing from the list may not have lost certification (verify with TX-RAMP@dir.texas.gov).", "source_url": "https://dir.texas.gov/resource-library-item/tx-ramp-certified-cloud-products" } ] }, { "slug": "dora", "name": "DORA (EU Digital Operational Resilience Act)", "short_name": "DORA", "description": "Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. It entered into force on 16 January 2023 and applies from 17 January 2025 to more than 20 types of EU financial entities, covering ICT risk management, ICT-related incident reporting, resilience testing, ICT third-party risk and oversight of critical ICT third-party providers.", "official_url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj", "notes": "Tag means the vendor's own pages document DORA support (requirement mapping, ICT third-party/register workflows, incident or testing evidence). It is not a DORA compliance certification of the tool or of your organisation, and DORA applies to financial entities, not to the tools.", "last_checked": "2026-10-19", "sources": [ "https://eur-lex.europa.eu/eli/reg/2022/2554/oj", "https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora", "https://www.eba.europa.eu/publications-and-media/press-releases/european-supervisory-authorities-designate-critical-ict-third-party-providers-under-digital", "https://www.esma.europa.eu/sites/default/files/2025-11/List_of_designated_CTPPs.pdf" ], "key_facts": [ { "text": "DORA (Regulation (EU) 2022/2554) entered into force on 16 January 2023 and applies from 17 January 2025. It is accompanied by Directive (EU) 2022/2556.", "source_url": "https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora" }, { "text": "DORA harmonises digital operational resilience rules for more than 20 types of financial entities, 12 of them in ESMA's remit.", "source_url": "https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora" }, { "text": "Its main areas are ICT risk management, ICT third-party risk management (including key contractual provisions), digital operational resilience testing including advanced testing, ICT-related incident management and reporting of major incidents and significant cyber threats, information sharing, and an oversight framework for critical ICT third-party providers.", "source_url": "https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora" }, { "text": "ESMA maps the Level 1 text as: risk management Arts. 5\u201316 and 26\u201330, incident reporting Arts. 17\u201323 and the oversight framework Arts. 31\u201344, with Level 2 RTS/ITS such as the ITS on register-of-information templates (Art. 28(9)) and the RTS on threat-led penetration testing (Art. 26(11)).", "source_url": "https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora" }, { "text": "On 18 November 2025 the European Supervisory Authorities (EBA, EIOPA and ESMA) published the first list of designated critical ICT third-party providers (CTPPs), built from financial entities' registers of information: 19 providers.", "source_url": "https://www.eba.europa.eu/publications-and-media/press-releases/european-supervisory-authorities-designate-critical-ict-third-party-providers-under-digital" } ] } ], "regions": [ { "slug": "north-america", "name": "North America", "description": "Vendors headquartered in the United States or Canada." }, { "slug": "europe", "name": "Europe", "description": "Vendors headquartered in the United Kingdom, the EU, or other European countries including the Nordics." }, { "slug": "middle-east", "name": "Middle East", "description": "Vendors headquartered in the Middle East, including Israel, Saudi Arabia and the Gulf." }, { "slug": "india", "name": "India", "description": "Vendors headquartered in India." }, { "slug": "asia-pacific", "name": "Asia Pacific", "description": "Vendors headquartered in Asia Pacific outside India, Australia and New Zealand \u2014 including Singapore, Japan, South Korea and the rest of the region." }, { "slug": "australia-new-zealand", "name": "Australia and New Zealand", "description": "Vendors headquartered in Australia or New Zealand." }, { "slug": "latin-america", "name": "Latin America", "description": "Vendors headquartered in Mexico, Central and South America, and the Caribbean." } ], "comparisons": [ { "slug": "vanta-vs-drata", "a": "vanta", "b": "drata", "also": [ "6clicks-hailey-ai", "anecdotes-agentic-grc", "trustero-ai", "akitra-andromeda-ai-agents", "complyance-ai-agents", "surecloud-gracie-agents", "athereon-laika", "cav-compliance-os-agents", "noru-agentic-compliance", "egerie-jerry-agentic-cyber-grc", "archer-evolv-ai-operators", "kaitosec-ai-agents", "mindlapse-ernest", "noze-datagovern", "hybridity-compliance-agents", "episki-autonomous-grc-agents", "getteddy-compliance-agents", "citsmart-grc-s-ai-agents", "vibrantix-compliance-agents", "onfinance-maxwell", "trail-governance-agents" ], "verdict": "Vanta, Drata and 6clicks Hailey AI are all listed for SOC 2, ISO 27001 and HIPAA compliance programmes. Anecdotes Agentic GRC, Trustero AI, Akitra Andromeda, Complyance GRC AI Agents, SureCloud Gracie, Athereon LAiKA, Cav Compliance OS, Noru Agentic Compliance, Egerie Jerry, Archer Evolv AI Operators, KaitoSec AI agents, Mindlapse Ernest, noze DataGovern, Hybridity, episki, GetTeddy compliance agents, CITSmart GRC.S, VibrantiX and OnFinance AI Maxwell are listed alongside them for agentic evidence, control monitoring and GRC workflows. Compare quotes, integrations and data-residency \u2014 this is not a ranking." }, { "slug": "sprinto-vs-comp-ai", "a": "sprinto", "b": "comp-ai", "also": [ "6clicks-hailey-ai" ], "verdict": "Sprinto emphasises autonomous compliance with a large framework library; Comp AI emphasises open integrations/agents and expert Slack support; 6clicks Hailey AI maps controls and drafts assessment responses inside a Hub & Spoke GRC platform. Compare quotes for the same frameworks and headcount \u2014 this is not a ranking." }, { "slug": "vanta-vs-secureframe", "a": "vanta", "b": "secureframe", "also": [ "6clicks-hailey-ai", "cypago-agentic-workflows", "fidureon-compliance-agents", "surecloud-gracie-agents", "athereon-laika", "kaitosec-ai-agents", "mindlapse-ernest", "hybridity-compliance-agents", "episki-autonomous-grc-agents", "getteddy-compliance-agents", "citsmart-grc-s-ai-agents", "vibrantix-compliance-agents", "onfinance-maxwell" ], "verdict": "Vanta, Secureframe and 6clicks Hailey AI all automate evidence or control-mapping workflows and are tagged for SOC 2, ISO 27001 and HIPAA. Cypago Agentic Workflows, Fidureon compliance agents, SureCloud Gracie, Athereon LAiKA, KaitoSec AI agents, Mindlapse Ernest, Hybridity, episki, GetTeddy compliance agents, CITSmart GRC.S, VibrantiX and OnFinance AI Maxwell are listed alongside them for GRC workflow generation and ISMS/questionnaire agents. Request matched quotes \u2014 this is not a ranking." }, { "slug": "wiz-vs-orca-security", "a": "wiz", "b": "orca-security", "verdict": "Wiz and Orca Security are agentless-leaning CNAPP/cloud security platforms. Plerion Pleri, Sysdig Agentic AI, Upwind AI Agentic Pack, Maze AI Agents and Cloudgeni are listed alongside them for cloud-security agents that prioritise, investigate or remediate findings. Evaluate coverage of your cloud accounts, identity graph depth and workflow integrations rather than marketing labels alone. This is not a ranking.", "also": [ "plerion-pleri", "sysdig-agentic-ai", "upwind-ai-agentic-pack", "maze-ai-agents", "cloudgeni-cloud-agents" ] }, { "slug": "conveyor-vs-safebase", "a": "conveyor", "b": "safebase", "verdict": "Conveyor and SafeBase focus on Trust Centers and security questionnaire automation for sales-led security reviews. Whistic Automation Orchestrator, TrustCloud TrustLens, SAFE TPRM AI Co-Worker, Wolfia Questionnaire Agent, Zip risk agents, FlowForma Assure, the VISO TRUST AI Agent, RiskXchange The Agency, Co-Brain Questionnaire Agent, OptiValue questionnaire agents, Censinet Risk Assessor Agent, Rescana, Procol, episki, GetTeddy, Crest TPRM AI agents, VibrantiX, OnFinance AI Maxwell and Covasant TPRM are listed alongside them for agentic third-party assessments and questionnaire workflows. Compare AI answer quality on your knowledge base and pricing model (outcome-based vs seat/quote). This is not a ranking.", "also": [ "whistic-automation-orchestrator", "trustcloud-trustlens", "safe-tprm-ai-co-worker", "wolfia-questionnaire-agent", "zip-risk-orchestration-agents", "flowforma-assure-vendor-risk-agents", "viso-trust-ai-agent", "riskxchange-the-agency", "co-brain-questionnaire-agent", "optivalue-questionnaire-agents", "censinet-risk-assessor-agent", "rescana-autonomous-tprm-agents", "procol-supplier-ops-agent", "episki-autonomous-grc-agents", "getteddy-compliance-agents", "crest-tprm-ai-agents", "vibrantix-compliance-agents", "onfinance-maxwell", "covasant-tprm-agents" ] }, { "slug": "crowdstrike-charlotte-ai-vs-darktrace-cyber-ai-analyst", "a": "crowdstrike-charlotte-ai", "b": "darktrace-cyber-ai-analyst", "also": [ "cloudsek-ai-agents", "qevlar-ai-soc", "dropzone-ai-soc-analyst", "d3-morpheus-ai-soc", "prophet-ai-soc-agents", "7ai-agentic-security-platform", "google-secops-triage-investigation-agent", "microsoft-security-copilot-phishing-triage-agent", "datadog-bits-security-analyst", "securonix-sam-ai-soc-analyst", "swimlane-ai-soc-deep-agents", "manageengine-log360-zia-agents", "fortinet-fortisoc-agentic-ai", "arctic-wolf-aurora-agentic-soc", "ntt-docomo-business-wideangle-ai-soc", "zscaler-agentic-soc", "command-zero-agent-zero", "bricklayer-ai-security-agents", "ontinue-ion-agentic-mxdr", "blackpoint-ai-soc-agent-itdr", "spharaka-sphere-agentic-soc", "gambit-cyber-vizier-ai-agents", "crogl-sovereign-ai-soc", "anomali-agentic-ai-threatstream-next-gen", "harkx-agentic-ai-soc", "decanos-ai-agents-autonomous-security-operations", "raonsecure-onesoar-onehacker-agentic-ai", "cloudpeek-agentic-security-operations", "priam-ava-autonomous-soc-triage", "countershadow-ami-autonomous-soc", "appomni-marlin-ai", "socradar-ai-agents", "strike48-agentic-secops" ], "verdict": "CrowdStrike Charlotte AI and Darktrace Cyber AI Analyst are both agentic SOC/security analysts (alert investigation and response). CloudSEK AI Agents, Qevlar AI, Dropzone AI SOC Analyst, D3 Morpheus, Prophet AI, 7AI, Google SecOps Triage and Investigation Agent, Microsoft Security Copilot Phishing Triage Agent, Datadog Bits AI Security Analyst, Securonix Sam, Swimlane AI SOC, ManageEngine Log360 Cloud Zia Agents, Fortinet FortiSOC, Arctic Wolf Aurora Agentic SOC, NTT DOCOMO BUSINESS WideAngle AI SOC, Zscaler Agentic SOC, Command Zero Agent Zero, Bricklayer AI, Ontinue ION, Blackpoint AI SOC Agent for ITDR, Spharaka Sphere, Gambit Cyber Vizier AI, Crogl, Anomali Agentic AI, HarkX, Decanos AI Agents, RaonSecure OneSOAR, CloudPeek, Priam AVA, CounterShadow AMI, AppOmni Marlin AI, SOCRadar AI Agents and Strike48 are listed alongside them for threat-detection and security-operations tasks. Compare alert sources, investigation autonomy and platform scope \u2014 this is not a ranking." }, { "slug": "fis-aml-investigations-agent-vs-luci-ai-agent", "a": "fis-aml-investigations-agent", "b": "luci-ai-agent", "also": [ "tookitaki-fincense", "first-aml-ai-screening-agent", "hawk-ai-agents", "hummingbird-ai-agents", "vivox-ai-compliance-agents", "zenoo-ai-investigation-agents", "sardine-agentic-fraud-aml-ops", "castellum-ai-arbiter-agents", "symphonyai-sri-agents", "themis-ai-investigator", "spektr-case-ai-agents", "shufti-transaction-trust-monitoring-agents", "oracle-nexus-financial-crime-agents", "sphinx-ai-compliance-analysts", "aiprise-ai-agents", "cleverchain-vera-ai-agents", "genpact-transaction-monitoring-analyst", "oscilar-agent-hub", "vaas-ai-risk-agents", "thomson-reuters-clear-investigate", "actico-compliance-ai-agents", "dataleon-leon-kyb-kyc-agent", "nasdaq-verafin-agentic-ai-workforce", "fluxforce-agentic-os", "elucidate-eli-compliance-agent", "point-predictive-predictor-agents", "intrepid-fox-kyb-ai-agents", "muinmos-ai-compliance-agents", "middesk-agents", "wealthai-kyc-onboarding-agents", "gu1-compliance-ai-agents", "sopra-steria-ian-investigation-agent-network", "xpert-ia-agent-onboarding-lcb-ft", "blinqx-kyc-agent", "metis-legenda-aml-agent", "freeday-kyc-digital-employee", "napier-ai-responsible-agents", "trulioo-ubo-discovery-agent" ], "verdict": "FIS AML Investigations Agent and Luci AI Agent both prepare AML investigations (alert triage, case work, SAR-oriented narratives). Tookitaki FinCense, First AML AI Screening Agent, Hawk AI agents, Hummingbird AI Agents, Vivox, Zenoo, Sardine, Castellum.AI Arbiter, SymphonyAI SRI Agents, Themis AI Investigator, spektr Case AI, Shufti Transaction Trust Monitoring, Oracle Nexus, Sphinx AI compliance analysts, AiPrise, CleverChain, Genpact Transaction Monitoring Analyst, Oscilar Agent Hub, VAAS, Thomson Reuters CLEAR Investigate, ACTICO, Dataleon L\u00e9on, Nasdaq Verafin, FluxForce, Elucidate Eli, Point Predictive, Intrepid Fox, Muinmos, Middesk, WealthAi, Gu1, Sopra Steria IAN, Xpert-iA LCB-FT, Blinqx KYC Agent, Metis Legenda AML, Freeday KYC, Napier AI Continuum responsible agents and Trulioo UBO Discovery Agent are listed with the same AML task tag for detection, screening and investigation. Confirm jurisdiction, core-system fit and human-approval gates with each vendor \u2014 this is not a ranking." }, { "slug": "idfy-ai-agents-vs-signzy-agentic-ckyc", "a": "idfy-ai-agents", "b": "signzy-agentic-ckyc", "also": [ "first-aml-ai-screening-agent", "complyadvantage", "fenergo-kyra", "unique-ai-financial-agents", "workfusion-ai-agents", "dotfile-autonomy", "castellum-ai-arbiter-agents", "spektr-case-ai-agents", "sphinx-ai-compliance-analysts", "oracle-nexus-financial-crime-agents", "aiprise-ai-agents", "cleverchain-vera-ai-agents", "oscilar-agent-hub", "vaas-ai-risk-agents", "actico-compliance-ai-agents", "dataleon-leon-kyb-kyc-agent", "nasdaq-verafin-agentic-ai-workforce", "fluxforce-agentic-os", "elucidate-eli-compliance-agent", "intrepid-fox-kyb-ai-agents", "muinmos-ai-compliance-agents", "middesk-agents", "wealthai-kyc-onboarding-agents", "gu1-compliance-ai-agents", "xpert-ia-agent-onboarding-lcb-ft", "blinqx-kyc-agent", "metis-legenda-aml-agent", "freeday-kyc-digital-employee", "gradient-labs-kyb-agent", "trulioo-ubo-discovery-agent", "napier-ai-responsible-agents" ], "verdict": "Signzy Agentic CKYC and IDfy AI Agents are India-headquartered KYC/identity platforms tagged for DPDP. First AML AI Screening Agent, ComplyAdvantage, Fenergo KYRA, Unique AI financial agents, WorkFusion AI Agents, Dotfile Autonomy, Castellum.AI Arbiter, spektr Case AI, Sphinx AI compliance analysts, Oracle Nexus, AiPrise, CleverChain, Oscilar Agent Hub, VAAS, ACTICO, Dataleon L\u00e9on, Nasdaq Verafin, FluxForce, Elucidate Eli, Intrepid Fox, Muinmos, Middesk, WealthAi, Gu1, Xpert-iA LCB-FT, Blinqx KYC Agent, Metis Legenda AML, Freeday KYC, Gradient Labs KYB Agent, Trulioo UBO Discovery Agent and Napier AI Continuum responsible agents are listed with the same KYC task tag for screening, onboarding and financial-crime data. Confirm current CERSAI, DPDP and onboarding scope with each vendor \u2014 this is not a ranking." }, { "slug": "datasnipper-alwin-vs-optro", "a": "datasnipper-alwin", "b": "optro", "also": [ "mindbridge-ai", "caseware-verity-agents", "fieldguide-field-agents", "workiva-agent-studio", "numeric-agentic-subledgers", "light-agentic-erp-agents", "auditfile-agentic-ai-orchestrator", "auditoria-ai-agents", "floqast-transform-ai-agents", "blackline-verity-ai-agents", "trintech-ai-agents", "finto-ai-accounting-agents", "cortea-audit-quality-agents", "workday-financial-audit-agent", "eagl-month-end-close-agents" ], "verdict": "DataSnipper Alwin and Optro both list audit-management and control-testing tasks. MindBridge AI, Caseware Verity agents, Fieldguide Field Agents, Workiva Agent Studio, Numeric agentic subledgers, Light Internal Audit agents, AuditFile's Agentic AI Orchestrator, Auditoria AI agents, FloQast Transform AI agents, BlackLine Verity AI agents, Trintech AI agents, Finto, Cortea Audit Quality Agents, Workday Financial Audit Agent and Eagl month-end close agents are listed for audit-management and related evidence or close workflows. Confirm procedure coverage and data-residency with each vendor \u2014 this is not a ranking." }, { "slug": "github-copilot-autofix-vs-snyk", "a": "github-copilot-autofix", "b": "snyk", "verdict": "GitHub Copilot Autofix generates suggested fixes for GitHub code-scanning (CodeQL) alerts inside GitHub Code Security. Snyk is a multi-engine AppSec platform whose Agent Fix suggests remediations for Snyk Code findings. ZeroPath, Pixee, Endor Labs, HCL AppScan RapidFix, Black Duck Signal, Cycode AI Teammates, Phoenix Purple, Kalpita CodeGuard, Contrast AI SmartFix, StackHawk Wingman, depthfirst, Nullify, AISLE, CybeDefend Cybe AutoFix, Takumi byGMO, Sourcery, Cytix and Amnify are listed alongside them as dedicated AI SAST/autofix, PR-security-review or change-driven pentest products. HCL RapidFix was built in collaboration with Pixee but is a separate HCL-branded product. Compare where findings originate, language/rule coverage, and whether you need GitHub-native scanning or a standalone AppSec platform. This is not a ranking.", "also": [ "zeropath-agentic-appsec", "pixee-triage-and-fix", "endor-labs-security-agents", "hcl-appscan-rapidfix", "black-duck-signal", "cycode-ai-teammates", "phoenix-security-purple", "kalpita-codeguard", "contrast-ai-smartfix", "stackhawk-wingman", "depthfirst-autonomous-security-agents", "nullify-autonomous-product-security", "aisle-autonomous-vulnerability-remediation", "cybedefend-cybe-autofix", "takumi-by-gmo-security-ai-agent", "sourcery-ai-code-review-security-scanning", "cytix-agentic-pentesting-change-approvals", "amnify-security-agents" ] } ], "group_comparisons": [ { "slug": "aml-transaction-monitoring", "title": "AML and transaction-monitoring AI agents", "use_case": "Anti-money-laundering, transaction monitoring and financial-crime investigation", "category": "risk", "agents": [ "complyadvantage", "first-aml-ai-screening-agent", "fis-aml-investigations-agent", "luci-ai-agent", "tookitaki-fincense", "hawk-ai-agents", "silent-eight-iris-7-ai-agents", "feedzai-farol", "hummingbird-ai-agents", "unit21-ai-agents", "zoven-ai", "vivox-ai-compliance-agents", "zenoo-ai-investigation-agents", "sardine-agentic-fraud-aml-ops", "workfusion-ai-agents", "bretton-ai-agents", "fenergo-kyra", "taktile-ai-agents", "castellum-ai-arbiter-agents", "symphonyai-sri-agents", "themis-ai-investigator", "dotfile-autonomy", "spektr-case-ai-agents", "shufti-transaction-trust-monitoring-agents", "oracle-nexus-financial-crime-agents", "sphinx-ai-compliance-analysts", "aiprise-ai-agents", "cleverchain-vera-ai-agents", "genpact-transaction-monitoring-analyst", "oscilar-agent-hub", "vaas-ai-risk-agents", "thomson-reuters-clear-investigate", "actico-compliance-ai-agents", "dataleon-leon-kyb-kyc-agent", "nasdaq-verafin-agentic-ai-workforce", "fluxforce-agentic-os", "elucidate-eli-compliance-agent", "point-predictive-predictor-agents", "signzy-agentic-ckyc", "intrepid-fox-kyb-ai-agents", "muinmos-ai-compliance-agents", "middesk-agents", "wealthai-kyc-onboarding-agents", "gu1-compliance-ai-agents", "sopra-steria-ian-investigation-agent-network", "xpert-ia-agent-onboarding-lcb-ft", "blinqx-kyc-agent", "metis-legenda-aml-agent", "freeday-kyc-digital-employee", "napier-ai-responsible-agents", "trulioo-ubo-discovery-agent", "nice-actimize-xceed-ai-agents", "thetaray-ray-aml-investigations", "datavisor-vera-agents", "uptiq-compliance-agents", "sigma360-edd-agent", "mozn-focal-agentic-ai" ], "summary": "Verified listings that carry an AML task tag, including investigation, screening and transaction-monitoring agents. This update adds Sigma360 EDD Agent and FOCAL by MOZN Agentic AI. Side-by-side fields come from the open dataset (vendor pages, HQ, tasks, published pricing and sources). This is not a ranking or score." }, { "slug": "kyc-identity", "title": "KYC and identity AI agents", "use_case": "Know-your-customer, identity verification and onboarding", "category": "risk", "agents": [ "complyadvantage", "first-aml-ai-screening-agent", "idfy-ai-agents", "signzy-agentic-ckyc", "fenergo-kyra", "taktile-ai-agents", "vivox-ai-compliance-agents", "zenoo-ai-investigation-agents", "sardine-agentic-fraud-aml-ops", "workfusion-ai-agents", "bretton-ai-agents", "unique-ai-financial-agents", "hawk-ai-agents", "silent-eight-iris-7-ai-agents", "zoven-ai", "luci-ai-agent", "tookitaki-fincense", "castellum-ai-arbiter-agents", "symphonyai-sri-agents", "dotfile-autonomy", "themis-ai-investigator", "avokaado-avo-ai-agents", "spektr-case-ai-agents", "oracle-nexus-financial-crime-agents", "sphinx-ai-compliance-analysts", "aiprise-ai-agents", "cleverchain-vera-ai-agents", "oscilar-agent-hub", "vaas-ai-risk-agents", "actico-compliance-ai-agents", "dataleon-leon-kyb-kyc-agent", "nasdaq-verafin-agentic-ai-workforce", "fluxforce-agentic-os", "elucidate-eli-compliance-agent", "intrepid-fox-kyb-ai-agents", "muinmos-ai-compliance-agents", "middesk-agents", "wealthai-kyc-onboarding-agents", "gu1-compliance-ai-agents", "xpert-ia-agent-onboarding-lcb-ft", "blinqx-kyc-agent", "metis-legenda-aml-agent", "freeday-kyc-digital-employee", "gradient-labs-kyb-agent", "trulioo-ubo-discovery-agent", "napier-ai-responsible-agents", "sigma360-edd-agent", "mozn-focal-agentic-ai" ], "summary": "Verified listings that carry a KYC task tag: identity verification, onboarding and screening agents. This update adds Sigma360 EDD Agent and FOCAL by MOZN Agentic AI. Signzy, IDfy and FluxForce are India-headquartered. Fields below are from the open dataset. This is not a ranking or score." }, { "slug": "india-apac-aml-kyc-agents", "title": "India, Asia-Pacific and ANZ AML and KYC AI agents", "use_case": "Anti-money-laundering screening, transaction monitoring and KYC agents from vendors headquartered in India, Asia-Pacific or Australia/New Zealand", "category": "risk", "agents": [ "signzy-agentic-ckyc", "idfy-ai-agents", "zoven-ai", "fluxforce-agentic-os", "tookitaki-fincense", "silent-eight-iris-7-ai-agents", "first-aml-ai-screening-agent" ], "summary": "Verified listings with an AML or KYC task tag whose vendors publish a headquarters in India, Asia-Pacific or Australia/New Zealand: Signzy Agentic CKYC, IDfy AI Agents, Zoven AI, FluxForce, Tookitaki FinCense, Silent Eight Iris 7 and First AML. FluxForce says it has no reference customers yet. Fields come from the open dataset (vendor pages, HQ, tasks, published pricing and sources). This is not a ranking or score." }, { "slug": "ai-soc-analysts", "title": "AI SOC and security-analyst agents", "use_case": "Security operations, alert investigation and threat detection", "category": "security", "agents": [ "cloudsek-ai-agents", "crowdstrike-charlotte-ai", "darktrace-cyber-ai-analyst", "qevlar-ai-soc", "sophos-mdr-ai-agents", "dropzone-ai-soc-analyst", "torq-ai-soc-socrates", "sekoia-elevate-ai-soc-agents", "exaforce-exabots", "andesite-human-ai-soc", "d3-morpheus-ai-soc", "imperum-virtus-ai-soc-agents", "prophet-ai-soc-agents", "7ai-agentic-security-platform", "reliaquest-greymatter-agentic-teammates", "sentinelone-purple-ai", "abnormal-ai-security-mailbox", "trendai-vision-one-agentic-siem", "cyble-blaze-ai", "palo-alto-cortex-agentix", "google-secops-triage-investigation-agent", "microsoft-security-copilot-phishing-triage-agent", "wedgex-ai-soc-agent", "attic-ivon-agentic-mdr", "reliance-radar-agentic-secops", "datadog-bits-security-analyst", "securonix-sam-ai-soc-analyst", "swimlane-ai-soc-deep-agents", "manageengine-log360-zia-agents", "fortinet-fortisoc-agentic-ai", "arctic-wolf-aurora-agentic-soc", "ntt-docomo-business-wideangle-ai-soc", "zscaler-agentic-soc", "command-zero-agent-zero", "bricklayer-ai-security-agents", "ontinue-ion-agentic-mxdr", "blackpoint-ai-soc-agent-itdr", "spharaka-sphere-agentic-soc", "gambit-cyber-vizier-ai-agents", "crogl-sovereign-ai-soc", "anomali-agentic-ai-threatstream-next-gen", "harkx-agentic-ai-soc", "decanos-ai-agents-autonomous-security-operations", "raonsecure-onesoar-onehacker-agentic-ai", "cloudpeek-agentic-security-operations", "priam-ava-autonomous-soc-triage", "countershadow-ami-autonomous-soc", "appomni-marlin-ai", "socradar-ai-agents", "strike48-agentic-secops", "mave-agentic-secops" ], "summary": "Verified listings that share threat-detection and security-operations task tags as AI SOC / security-analyst agents. This update adds Mave agentic SecOps. Marlin investigates SaaS and agentic-AI risk and returns guided remediation (humans execute). General SecOps/ITOps/CloudOps automation platforms (including Mindflow) are omitted. Email-security specialists are compared on the email-security table. Ontinue and Blackpoint are managed-service offerings (AI agents investigate; vendor analysts or high-confidence policy decide). Arctic Wolf TX-RAMP Level 2 names Managed Detection and Response/Managed Risk (platform-only). Fields below are from the open dataset. This is not a ranking or score." }, { "slug": "email-security-agents", "title": "Email security and phishing-response AI agents", "use_case": "Triage of user-reported phishing, autonomous email threat remediation and AI-run phishing simulation", "category": "security", "agents": [ "abnormal-ai-security-mailbox", "microsoft-security-copilot-phishing-triage-agent", "knowbe4-aida-ai-defense-agents", "imperum-virtus-ai-soc-agents", "ironscales-ai-agents", "sublime-security-asa-ade", "material-security-ai-agents", "proofpoint-satori-agents", "check-point-email-security-ai-agents", "hoxhunt-respond", "phished-ai-security-agents", "strongestlayer-trace-agents", "adaptive-security-agentic-email-security", "doppel-agentic-social-engineering-defense", "keepnet-incident-responder-ai-agent", "barracuda-email-protection-agentic-remediation" ], "summary": "Agents that triage reported phishing and remove or classify campaigns, compared on autonomy, deployment and published pricing. This update adds Barracuda Integrated Email Protection agentic clawback. Keepnet's agent recommends only; every mailbox action waits in a human approval queue. Proofpoint Satori classifies and can trigger customer workflows but does not block or delete itself. Check Point and Sublime government rows are platform-only. Barracuda TX-RAMP Provisional (Impersonation Protection / Incident Response) is platform-only. Material publishes per-user prices; KnowBe4 SAT Advanced (includes AIDA) publishes per-seat MSRP. This is not a ranking or score." }, { "slug": "ai-code-security-agents", "title": "AI code security agents", "use_case": "Application security scanning, suggested or automated code fixes, and pull-request security review", "category": "code-security", "agents": [ "github-copilot-autofix", "claude-code-security-review", "cursor-bugbot", "snyk", "aikido-ai-autofix", "sonar-ai-codefix", "codacy-ai-reviewer", "checkmarx-one-assist", "semgrep-multimodal", "gitlab-duo-vulnerability-resolution", "veracode-fix", "amazon-q-developer-security", "escape-ai-pentesting", "qodo-code-review-agents", "xygeni-devai-coreai", "zeropath-agentic-appsec", "pixee-triage-and-fix", "endor-labs-security-agents", "black-duck-signal", "hcl-appscan-rapidfix", "cycode-ai-teammates", "phoenix-security-purple", "kalpita-codeguard", "contrast-ai-smartfix", "stackhawk-wingman", "depthfirst-autonomous-security-agents", "nullify-autonomous-product-security", "aisle-autonomous-vulnerability-remediation", "cybedefend-cybe-autofix", "takumi-by-gmo-security-ai-agent", "sourcery-ai-code-review-security-scanning", "cytix-agentic-pentesting-change-approvals", "amnify-security-agents" ], "summary": "Verified listings whose primary job is code/application security (SAST/SCA findings, AI suggested fixes, PR security review, or AI DAST/pentest of applications). This update adds Amnify security agents (agent-driven audit, pentest, PR review and autofix PRs). AISLE announced a letter of intent to be acquired by Cohere (15 Oct 2026; not closed). Coding platforms that only integrate with scanners (Tembo, Devin, Factory Droids, GitHub Copilot coding agent, OpenHands Vulnerability Fixer, Kiro) are listed in the Code security category with an \u201cagent platform with security integrations\u201d tag and are omitted from this table so they are not presented as dedicated AppSec tools. Fields come from the open dataset. This is not a ranking or score." }, { "slug": "contract-review-agents", "title": "Contract and legal-review AI agents", "use_case": "Contract review, drafting assistance and legal workflow automation", "category": "business-ops", "agents": [ "luminance-agent-lumi", "legalon-agents", "spellbook-associate", "legora-agent", "juro-ai-review", "spotdraft-sidebar-agents", "definely-enhance", "genie-ai-agents", "leah-agentic-ai", "harvey-agents", "legalfly-agents", "flank-legal-agents", "wordsmith-ai-legal-agents", "thomson-reuters-cocounsel-legal", "avokaado-avo-ai-agents", "legartis-legal-agent", "ironclad-agent", "litera-lito", "lexisnexis-protege", "co-brain-legal-agent", "docusign-iris-agents", "icertis-vera-agents", "mntsq-ai-agent", "lecheck-ai-agent", "zefort-agent", "clio-work-agentic", "bryter-hybrid-agents", "hybridity-compliance-agents", "wolfia-questionnaire-agent", "lisse-legal-ai-cowork", "workday-clm-contract-agents", "bind-contract-agent", "clearcontract-contract-agents" ], "summary": "Verified listings tagged for contract-review. This update adds ClearContract contract agents (Aarhus intake, review and deadline-monitoring agents). Ironclad CLM and Icertis ICI for Government are FedRAMP Ready (not Authorized); Icertis TX-RAMP Level 2 is platform-only. Zefort Agent is labelled BETA on its product page and is included in published Enterprise plans. Fields come from the open dataset. This is not a ranking or score." }, { "slug": "agentic-pentesting", "title": "Agentic pentesting AI agents", "use_case": "Autonomous or AI-assisted penetration testing, attack-surface testing and exploitable-path verification", "category": "security", "agents": [ "hadrian-nova", "escape-ai-pentesting", "equixly-agentic-ai-hacker", "ethiack-hackian", "intruder-ai-pentesting", "horizon3-nodezero", "runsybil-sybil", "aws-continuum-penetration-testing", "yeswehack-agentic-pentest", "patrowl-agentic-ai-pentesting", "synack-sara-ai-pentesting", "aikido-attack-ai-pentest", "simbian-ai-pentest-agent", "aipentix-agentic-security-testing", "check-point-agentic-exposure-validation", "ridge-security-ridgegen", "edgescan-atomic-autonomous-pentesting", "depthfirst-autonomous-security-agents", "nullify-autonomous-product-security", "fleuret-agentic-ai-pentesting", "penetrify-ai-pentest-agent", "ares-cyber-agentic-ai-security-testing", "raonsecure-onesoar-onehacker-agentic-ai", "takumi-by-gmo-security-ai-agent", "cytix-agentic-pentesting-change-approvals", "squr-autonomous-pentest", "filigran-xtm-one-agents", "codewall-autonomous-attack-agents", "beelzebub-arcangelo-agentic-pentesting", "amnify-security-agents", "noze-cyberagent", "pentera-ai-exposure-validation", "vulnetic-sable" ], "summary": "Verified listings tagged for pen-test-management. This update adds Pentera AI-powered exposure validation and Vulnetic Sable. AWS Continuum is listed for its generally available penetration-testing capability only. Fields come from the open dataset. This is not a ranking or score." }, { "slug": "tprm-vendor-risk", "title": "TPRM and vendor-risk AI agents", "use_case": "Third-party risk, vendor assessments, security ratings and questionnaire automation", "category": "risk", "agents": [ "upguard", "securityscorecard", "whistic-automation-orchestrator", "black-kite-ai-agent", "processunity-tprm-ai-agents", "safe-tprm-ai-co-worker", "trustcloud-trustlens", "osapiens-agent-factory", "anecdotes-agentic-grc", "complyance-ai-agents", "mineos-mira-ai", "optro", "zip-risk-orchestration-agents", "surecloud-gracie-agents", "athereon-laika", "wolfia-questionnaire-agent", "riskonnect-ai-agent-library", "flowforma-assure-vendor-risk-agents", "viso-trust-ai-agent", "cleverchain-vera-ai-agents", "riskxchange-the-agency", "co-brain-questionnaire-agent", "optivalue-questionnaire-agents", "censinet-risk-assessor-agent", "rescana-autonomous-tprm-agents", "procol-supplier-ops-agent", "episki-autonomous-grc-agents", "drata", "logicgate", "zania", "mindlapse-ernest", "sprinto", "data-adhikaar-dpdpa-agents", "getteddy-compliance-agents", "legiscope-gdpr-ai-agents", "crest-tprm-ai-agents", "vibrantix-compliance-agents", "onfinance-maxwell", "covasant-tprm-agents", "trail-governance-agents" ], "summary": "GRC/privacy platforms with documented TPRM agents are listed alongside dedicated TPRM tools. This update adds Covasant TPRM (Hyderabad-headquartered agentic vendor onboarding, monitoring and DORA reporting). Security-questionnaire specialists are also compared on the security-questionnaire table. Fields come from the open dataset. This is not a ranking or score." }, { "slug": "privacy-ai-agents", "title": "Privacy operations AI agents", "use_case": "Privacy programme operations, DSRs, consent, data discovery and privacy assessments", "category": "risk", "agents": [ "mineos-mira-ai", "datagrail-vera", "privado-wren", "ketch-agent-network", "onetrust", "transcend", "bigid", "new-odyssey-pegasus-compliance-agent", "indisec-dpdpa-agents", "veeam-privacyops-agents", "data-adhikaar-dpdpa-agents", "idfy-ai-agents", "wordsmith-ai-legal-agents", "noze-datagovern", "legiscope-gdpr-ai-agents" ], "summary": "Verified listings tagged for privacy-management: MineOS Mira AI, DataGrail Vera, Privado Wren and Ketch Agent Network, plus OneTrust, Transcend, BigID (incl. AgentIQ agents), New Odyssey Pegasus (DSAR agent), IndiSec DPDPA agents, Veeam PrivacyOps, Data Adhikaar DPDPA agents (India), IDfy AI Agents, Wordsmith AI legal agents (Privacy Agent), noze DataGovern and Legiscope. This update notes BigID AgentIQ. Fields come from the open dataset. This is not a ranking or score." }, { "slug": "government-fedramp-agents", "title": "US public-sector and FedRAMP AI agents", "use_case": "US government, FedRAMP and public-sector compliance or security operations", "category": "compliance", "agents": [ "appian-agent-studio", "regscale-regml", "intelligrc-evan-alfie", "andesite-human-ai-soc", "salesforce-agentforce-public-sector", "workiva-agent-studio", "pega-agentic-ai-government", "reliaquest-greymatter-agentic-teammates", "sentinelone-purple-ai", "abnormal-ai-security-mailbox", "anecdotes-agentic-grc", "vanta", "drata", "secureframe", "wiz", "cav-compliance-os-agents", "knowbe4-aida-ai-defense-agents", "ibm-watsonx-orchestrate-government", "kiro-agent-platform-security-integrations", "box-ai-agents", "archer-evolv-ai-operators", "deep-fathom-cmmc-agents", "vulcan-justinian", "thomson-reuters-clear-investigate", "halo-ai-agents" ], "summary": "Verified listings with registry-verified FedRAMP Authorized status or a government-compliance tag. This update adds Halo AI Agents (FedRAMP 20x Moderate FR2621445678; the Marketplace row is recorded as platform-only on the listing). FedRAMP product and impact for each listing come from the authorizations field (Marketplace records). Appian Agent Studio, Salesforce Agentforce for Public Sector, Pega AI agents, IBM watsonx Orchestrate, Kiro and Box are agent platforms, not dedicated security tools. Workiva Agent Studio, Halo AI Agents, Check Point Harmony Email and Sublime Security keep FedRAMP or TX-RAMP as vendor-claimed or platform-only where the registry row does not place the listed agents inside the authorized boundary. Ironclad CLM is FedRAMP Ready only. Fields come from the open dataset. This is not a ranking or score." }, { "slug": "ap-finance-automation-agents", "title": "AP and finance-automation AI agents", "use_case": "Accounts payable, invoice and spend automation in finance back offices", "category": "business-ops", "agents": [ "hypatos-agentic-gbs-workforce", "payhawk-ai-agents", "appzen-autonomous-ap-agents", "beam-ai-agents", "medius-autonomous-ap", "numeric-agentic-subledgers", "xelix-ap-agents", "pennylane-autopilot", "freee-ai-agents", "auditoria-ai-agents", "expenzing-fincat", "orcha-finance-agents", "serrala-ai-agents", "floqast-transform-ai-agents", "blackline-verity-ai-agents", "trintech-ai-agents", "kyriba-tai-agentic-treasury", "finto-ai-accounting-agents", "bill-ai-agents", "bakuraku-ai-agents", "sidetrade-aimie-agents", "peakflo-ai-agents", "kolleno-ai-agents", "steuerboard-kompass-agentic-os", "embat-tellme-ai-agent", "upflow-ar-ai-agents", "eagl-month-end-close-agents", "cortena-ap-agents", "sequenta-ki-kontierungsagent", "feld-ai-document-agents", "cygnet-one-ai-accounts-payable-agents", "tokium-keiri-ai-agents", "cleavr-ai-cash-collection", "phacet-finance-ai-agents", "kapittx-ar-ai-agents", "dexiq-ai-bookkeeping-agents", "nxt4ap-nxt-ap-sap-ap-agent", "qad-championai-champions", "pilot-ai-accountant" ], "summary": "Verified listings whose published job is accounts-payable, close, treasury or finance back-office automation. This update adds QAD ChampionAI Champions (AP Champion generally available) and Pilot AI Accountant. BlackLine Government Solution is FedRAMP Agency In Process (platform-only). AuditFile's audit-engagement orchestrator and Cortea / Workday Financial Audit Agent are compared with Caseware/Fieldguide/DataSnipper instead. Fields come from the open dataset (vendor pages, HQ, tasks, published pricing and sources). This is not a ranking or score." }, { "slug": "cloud-security-agents", "title": "Cloud security (CNAPP) AI agents", "use_case": "Cloud and container security posture, exposure and remediation", "category": "security", "agents": [ "wiz", "orca-security", "plerion-pleri", "sysdig-agentic-ai", "upwind-ai-agentic-pack", "palo-alto-cortex-agentix", "maze-ai-agents", "cloudgeni-cloud-agents", "sonrai-wally-cloud-pam-agent" ], "summary": "Verified cloud-security / CNAPP listings with documented AI agents for posture, exposure and remediation, plus Sonrai WALLy (cloud privileged-access management agent). Cloudgeni is a broader CloudOps platform listed here for its Compliance Remediation and PR Review agents. Fields come from the open dataset. This is not a ranking or score." }, { "slug": "ai-governance-agents", "title": "AI governance agents and platforms", "use_case": "AI inventory, risk assessment, policy and runtime controls for AI systems and agents", "category": "compliance", "agents": [ "credo-ai", "saidot-ai-governance", "modulos-ai-governance-agents", "onetrust", "transcend", "optro", "mineos-mira-ai", "noze-datagovern", "logicgate", "sprinto", "trail-governance-agents" ], "summary": "Dedicated AI-governance platforms (Credo AI, Saidot, Modulos) plus broader platforms with documented AI-governance modules (OneTrust, Transcend, Optro, MineOS Mira AI, noze DataGovern, LogicGate GRC Agents and Sprinto). This update adds Sprinto (AI Governance module). ServiceNow Now Assist is compared on the ITSM table; GRC/IRM AI-governance modules are a separate ServiceNow product line. Vendor-claimed frameworks already in the dataset include EU AI Act, NIST AI RMF and ISO 42001 on some of these listings; those remain vendor-claimed, not Agent Index tags. Fields come from the open dataset. This is not a ranking or score." }, { "slug": "identity-governance-agents", "title": "Identity governance AI agents", "use_case": "Identity governance, access reviews and Conditional Access coverage", "category": "security", "agents": [ "lumos-albus", "microsoft-entra-conditional-access-optimization-agent", "opal-paladin", "c1-autonomous-worker", "corma-ai-identity-agents", "cakewalk-agent-cake", "sonrai-wally-cloud-pam-agent", "atomicwork-iga-agent" ], "summary": "Verified listings tagged for identity governance or access reviews: Lumos Albus, Microsoft Entra Conditional Access Optimization Agent, Opal Paladin, C1 Autonomous Worker (Workday announced an agreement to acquire C1.ai on 13 Oct 2026), Corma AI agents, Cakewalk Agent Cake, Sonrai WALLy and Atomicwork IGA Agent. Fields come from the open dataset (vendor pages, HQ, tasks, published pricing and sources). This is not a ranking or score." }, { "slug": "enterprise-agent-platforms", "title": "Enterprise agent platforms", "use_case": "Build, orchestrate and govern AI agents for business-process automation", "category": "business-ops", "agents": [ "uipath", "n8n-ai-agents", "sap-joule-agents", "automation-anywhere-ai-agent-studio", "ibm-watsonx-orchestrate-government", "zoho-zia-agents", "workato-agent-studio-genies", "box-ai-agents" ], "summary": "Verified listings whose published job is an enterprise agent platform or agentic process-automation studio: UiPath Autopilot/agents, n8n AI agents, SAP Joule Agents, Automation Anywhere AI Agent Studio, IBM watsonx Orchestrate (including watsonx Orchestrate for Government), Zoho Zia Agents, Workato Agent Studio/Genies and Box AI Agents. Dedicated ITSM, AP or GRC products are compared on other tables. Fields come from the open dataset. This is not a ranking or score." }, { "slug": "itsm-service-agents", "title": "IT service-management AI agents", "use_case": "IT service desk, employee support and service-workflow automation", "category": "business-ops", "agents": [ "moveworks", "servicenow-now-assist", "halo-ai-agents", "manageengine-servicedesk-plus-zia-agents", "freshservice-freddy-ai-agent", "leena-ai-colleagues", "atomicwork-iga-agent" ], "summary": "Verified listings tagged for IT service or employee-support workflows: Moveworks, ServiceNow Now Assist, Halo AI Agents, ManageEngine ServiceDesk Plus Zia Agents, Freshservice Freddy AI Agent, Leena AI Colleagues and Atomicwork IGA Agent. Halo's FedRAMP authorization and ServiceDesk Plus Cloud / FreshService TX-RAMP rows are recorded as platform-only because those registry entries do not name the listed agents. Fields come from the open dataset. This is not a ranking or score." }, { "slug": "security-questionnaire-agents", "title": "Security questionnaire AI agents", "use_case": "Inbound security questionnaires, SIG/CAIQ-style responses and questionnaire automation", "category": "security", "agents": [ "wolfia-questionnaire-agent", "co-brain-questionnaire-agent", "optivalue-questionnaire-agents", "riskxchange-the-agency", "conveyor", "safebase", "whistic-automation-orchestrator", "getteddy-compliance-agents", "vibrantix-compliance-agents", "trail-governance-agents" ], "summary": "Verified listings whose published job is answering or running security questionnaires: Wolfia Questionnaire Agent, Co-Brain Questionnaire Agent, OptiValue questionnaire agents and RiskXchange The Agency, plus Conveyor, SafeBase, Whistic Automation Orchestrator, GetTeddy and VibrantiX. This update adds VibrantiX Customer Trust Agent. Trust-center and broader TPRM tools are also compared on the TPRM table. Fields come from the open dataset. This is not a ranking or score." }, { "slug": "procurement-sourcing-agents", "title": "Procurement and autonomous-sourcing AI agents", "use_case": "Intake-to-award procurement, autonomous sourcing, supplier operations and procurement orchestration", "category": "business-ops", "agents": [ "keelvar-kai-sourcing-agents", "ivalua-iva-agentic-ai", "gep-quantum-intelligence-agents", "levelpath-ranger-ai-agents", "omnea-agentic-procurement-agents", "zip-risk-orchestration-agents", "procol-supplier-ops-agent", "partspace-partsagent", "mercanis-procurement-agents", "vertice-ana-negotiation-agent", "archlet-spark-ai-agents", "tacto-procurement-ai-agents", "hivebuy-procurement-ai-agents", "zalion-procurement-ai-agents", "procure-ai-autonomous-sourcing-negotiation-agents", "nec-procurement-negotiation-ai-agent", "lio-procurement-agents", "compri-procurement-ai-agents", "soource-agentic-procurement", "upflux-agente-negociador", "qad-championai-champions" ], "summary": "Verified listings whose published job is procurement, autonomous sourcing or supplier-operations agents. This update adds UpFlux Agente Negociador and QAD ChampionAI Champions (Procurement and Sourcing Champions). Zip is also compared on the TPRM table for vendor-risk screening. Fields come from the open dataset (vendor pages, HQ, tasks, published pricing and sources). This is not a ranking or score." } ] }