Compliance automation platform with Comply AI features for policies, remediation, risk, questionnaires and TPRM, plus Trust Center and CMMC/Defense packages.
FedRAMP compliance automation tools
Quick answer
19 verified listings are tagged FedRAMP. A tag means relevance for FedRAMP work, not an authorization.
19 have a stored FedRAMP Marketplace record whose own product is Authorized (scope “listing”). 15 other listings have a stored FedRAMP record that is platform-only or not Authorized.
Order is mechanical, not a ranking. Confirm current status on the Marketplace.
FedRAMP compliance automation covers the work that goes into a US federal cloud authorization: the system security plan (SSP), OSCAL packages, continuous monitoring, and the plan of action and milestones (POA&M). A tag on this page is relevance, not a FedRAMP authorization of the tool.
Official hub with sources and tag rules: FedRAMP framework hub. The frameworks tag is used only when the FedRAMP Marketplace lists the product (or the cloud offering the vendor documents as the boundary for the agent) as FedRAMP Authorized. Vendor-only FedRAMP claims, Ready packages, and in-process listings stay in frameworks_claimed. Authorization of a Government Cloud package is not a ranking or an endorsement of the agent.
Related: FedRAMP hub · FedRAMP 3PAOs · GovRAMP hub · GovRAMP 3PAO list. Program definition: fedramp.gov · Scope of FedRAMP (2026 rules).
Authorized on the FedRAMP Marketplace
19 tagged listings have a stored Marketplace record whose own product is Authorized (scope “listing”). Status, product and ID come from agents.json authorization fields already sourced to marketplace.fedramp.gov. Confirm current status there. Not a ranking.
| Listing | Marketplace record | Pricing (as stored) |
|---|---|---|
| Secureframe | Secureframe Platform · FedRAMP Authorized · FR2529360449 · 20x Moderate · authorized 2026-06-23 | Quote-based. Public page lists Fundamentals / Complete / Defense feature packages without dollar amounts on the pricing page at last check. |
| Drata | Drata Trust Management Platform · FedRAMP Authorized · FR2600167032 · 20x Low · authorized 2025-12-05 | Quote-based. AWS Marketplace Foundation Package listed at $15,000/year for 1–50 employees (third-party census of marketplace listing). Drata says Agentic TPRM is not priced by vendor count: every vendor gets a free inherent-risk assessment and customers pay only when a vendor needs a full security review (amounts not published). |
| Vanta | Vanta Trust Management Platform · FedRAMP Authorized · FR2525556241 · 20x Low · authorized 2025-07-25; Vanta Government Cloud · FedRAMP Authorized · FR2525556241XM · 20x Moderate · authorized 2026-04-24 | Quote-based. AWS Marketplace lists Essentials from $14,000/year for 1–20 employees (12-month contracts); modules priced separately. |
| IntelliGRC Evan and Alfie AI agents | IntelliGRC · FedRAMP Authorized · FR2605341343 · 20x Low · authorized 2025-12-05 | Not published |
| Anecdotes Agentic GRC (Agent Library and Agent Studio) | Anecdotes · FedRAMP Authorized · FR2620235600 · 20x Moderate · authorized 2026-06-23 | Not published |
| RegScale RegML AI agents (RegScale CCM) | RegScale CCM · FedRAMP Authorized · FR2414158717 · High · authorized 2025-06-24 | Not published |
| Cav Compliance OS agents (formerly Caveonix) | Caveonix · FedRAMP Authorized · FR2530025267 · High · authorized 2026-04-06 | Not published |
| Andesite Human-AI SOC (Azimuth for Government) | Andesite Azimuth for Government · FedRAMP Authorized · FR2520950455 · High · authorized 2026-02-26 | Not published |
| Appian Agent Studio (AI agents) | Appian Government Cloud - High · FedRAMP Authorized · FR2318051429 · High · authorized 2025-04-03 | Not published |
| Wiz | Wiz for U.S. Government · FedRAMP Authorized · FR2308034636A · High · authorized 2025-09-25 | Custom quote (wiz.io/pricing). |
| Abnormal AI Security Mailbox (Abnormal AI for Government) | Abnormal AI for Government · FedRAMP Authorized · FR2425960757 · Moderate · authorized 2025-04-11 | Not published |
| Pega AI agents (Pega Cloud for Government) | Pega Cloud for Government · FedRAMP Authorized · F1306282198A · High · authorized 2025-03-18 | Not published |
| SentinelOne Purple AI (agentic AI security analyst) | SentinelOne Singularity Platform High · FedRAMP Authorized · FR1919071020A · High · authorized 2024-09-10 | Purple AI pricing not published; Singularity platform tiers listed from $179.99 per endpoint/year (Complete) and $229.99 (Commercial) on sentinelone.com/pricing. |
| Agentforce for Public Sector | Salesforce Government Cloud Plus · FedRAMP Authorized · FR2003061248 · High · authorized 2020-05-27 | Not published for Public Sector editions (30-day Public Sector Solutions trial offered) |
| IBM watsonx Orchestrate (incl. watsonx Orchestrate for Government) | IBM Data Services for Government (watsonx Orchestrate for Government) · FedRAMP Authorized · FR2524349489 · Moderate · authorized 2026-02-10 | Published on ibm.com (commercial SaaS): 30-day free trial; Essentials from $530/month; Standard from $6,360/month. Government offering pricing not published. |
| KnowBe4 AIDA (AI Defense Agents) | KnowBe4 Platform · FedRAMP Authorized · FR2201340492 · Moderate · authorized 2023-11-14 | Published MSRP on knowbe4.com (May 2026 list, per seat per month, 3-year term): SAT Advanced, which includes AIDA, from $3.75 (25–50 seats) down to $2.79 (501–1,000 seats); 1,001+ seats by quote. |
| ReliaQuest GreyMatter Agentic Teammates (GreyMatter for Government) | GreyMatter for Government · FedRAMP Authorized · FR2428740308 · Moderate · authorized 2026-07-08 | Not published (vendor says pricing is based on endpoint count with no AI usage meter). |
| Box AI Agents (Box Agent, Extract, Classification and custom agents; Box for Government) | Box Enterprise Cloud Content Collaboration Platform (BoxAI in boundary) · FedRAMP Authorized · F1212191840A · High · authorized 2025-03-25 | Not published for agents. Box lists custom AI agents, agentic workflows and Box Agent Pro Mode under the Enterprise Advanced plan (box.com/agents); plan price not captured. |
| Kiro (agent platform with security integrations) | AWS GovCloud (Kiro in scope) · FedRAMP Authorized · F1603047866 · High · authorized 2016-06-21 | Published: Free $0 (50 credits); Pro $20/user/month (1,000 credits); Pro+ $40 (2,000 credits); Pro Max $100 (5,000 credits); Power $200; extra credits $0.04 each (kiro.dev/pricing at last check). |
Compliance and trust management platform with AI-assisted evidence collection, continuous control monitoring, and multi-framework programs.
Agentic trust and compliance automation platform for continuous evidence collection, control monitoring, policies, and security questionnaire responses.
CMMC- and NIST 800-171-focused GRC platform whose AI agents auto-map evidence to assessment objectives (Evan) and run automated control gap assessments with remediation steps (Alfie); FedRAMP 20x Low authorized.
Enterprise GRC platform with built-in agents for evidence analysis, control assessment, risk enrichment and findings extraction, plus an Agent Studio for custom GRC agents and agentic TPRM.
Continuous controls monitoring platform whose RegML AI agents monitor controls, collect evidence, draft control documentation and trigger remediation for FedRAMP, CMMC and NIST programmes; RegScale CCM is FedRAMP High authorized.
Agentic cyber assurance and continuous compliance platform whose AI agents collect evidence, test controls, find gaps against 50+ frameworks (FISMA, NIST 800-53, FedRAMP, CMMC) and generate ATO artifacts; the platform is FedRAMP High authorized.
A
Agentic SOC platform with configurable agents for alert triage, enrichment, investigation and remediation under analyst oversight; its government offering is FedRAMP High authorized.
Generally available Agent Studio for deploying AI agents inside Appian processes that reason over enterprise data and act under platform guardrails; Appian Government Cloud is FedRAMP High authorized.
Cloud security / CNAPP platform with agentless visibility, risk prioritization and security graph across cloud environments.
Autonomous agent for email security operations that triages user-reported emails, removes related malicious campaign messages across the organisation and replies to reporters; included in Abnormal AI for Government, which is FedRAMP and GovRAMP Moderate authorized.
Enterprise workflow platform whose AI agents (Coach, Knowledge Buddy, Automate, developer agents and the Blueprint design agent) run on Pega's trusted workflows; Pega Cloud for Government, including these gen AI agents, is FedRAMP High authorized.
Agentic AI security analyst in the Singularity platform that runs alert investigations to a verdict and, with Singularity Hyperautomation, triggers response within pre-approved policies; SentinelOne says Purple AI is FedRAMP High authorized.
Pre-built Agentforce agents for federal, state and local government, covering complaint management, benefits and licensing, code-violation compliance and internal IT compliance; Salesforce says Agentforce is FedRAMP High authorized in Government Cloud Plus.
IBM's agent platform to build, deploy, orchestrate and govern AI agents (IBM, custom and partner agents for HR, procurement and other domains); watsonx Orchestrate for Government is in scope of IBM Data Services for Government, FedRAMP Moderate.
Suite of AI agents for human risk management that automatically generate and deliver personalised phishing simulations, training, remedial and policy-quiz content per user; the FedRAMP Moderate KnowBe4 Platform covers AIDA (except AIDA Deepfakes).
Agentic AI security operations platform whose six persona-based Agentic Teammates investigate and triage alerts and execute approved containment actions; GreyMatter for Government is FedRAMP Authorized (Moderate).
Permissions-aware AI agents on Box's content platform: the Box Agent plans multi-step work across files, Extract agents turn documents into structured metadata, a Classification agent labels sensitive content, and Box AI Studio builds custom agents; Box AI sits inside Box's FedRAMP High boundary per the Marketplace listing.
Agent platform with security integrations: AWS's agentic IDE and autonomous agent, with Kiro Powers for Snyk, Aikido, SonarQube and Sonatype scanning.
Support FedRAMP work; not themselves Authorized on Marketplace
15 other listings have a stored FedRAMP authorization that is platform-only or a status other than Authorized. These fields are already in agents.json. They are not tagged FedRAMP. Not a ranking.
| Listing | Stored FedRAMP record | Scope |
|---|---|---|
| AppOmni Marlin AI (autonomous SaaS and agentic-AI risk investigation) | AppOmni SaaS Security for Government · FedRAMP Authorized · FR2431264500 · Moderate | Vendor platform; agent scope not stated |
| BlackLine Verity AI agents (Verity Prepare multi-agent reconciliation, Verity Accruals and other close agents) | BlackLine Government Solution · Agency In Process · FR2507664687 · Moderate · authorized 2025-11-05 | Vendor platform; agent scope not stated |
| Check Point Email Security AI agents (Harmony Email & Collaboration, formerly Avanan) | Check Point Infinity Platform for Government · FedRAMP Authorized · FR2511048038 · Moderate · authorized 2025-09-24 | Vendor platform; agent scope not stated |
| CLEAR Investigate (agentic AI investigations for government, risk and fraud teams) | Thomson Reuters Risk & Fraud (TR R&F) · Agency In Process · FR2333543855 · Moderate | Vendor platform; agent scope not stated |
| Datadog Bits AI Security Analyst | Datadog for Government · FedRAMP Authorized · FR2023864279A · High · authorized 2026-05-05 | Vendor platform; agent scope not stated |
| Devin | Palantir Federal Cloud Service – Supporting Services (PFCS-SS) (Devin Desktop) · FedRAMP Authorized · FR2315464863 · High · authorized 2024-11-19 | Vendor platform; agent scope not stated |
| Docusign Iris agents and Agent Studio (Intelligent Agreement Management) | DocuSign CLM · FedRAMP Authorized · F1605027893 · Moderate · authorized 2017-08-24 | Vendor platform; agent scope not stated |
| Docusign Iris agents and Agent Studio (Intelligent Agreement Management) | Docusign - IAM eSignature · FedRAMP Authorized · F1609267945 · Moderate · authorized 2017-08-10 | Vendor platform; agent scope not stated |
| Google Security Operations Triage and Investigation Agent | Google Services (Google Cloud Platform Products and underlying Infrastructure) · FedRAMP Authorized · FR1805751477 · High · authorized 2019-12-04 | Vendor platform; agent scope not stated |
| Halo AI Agents (service management with FedRAMP GRC module) | Halo · FedRAMP Authorized · FR2621445678 · 20x Moderate · authorized 2026-05-06 | Vendor platform; agent scope not stated |
| Icertis Vera agents (Redline, Risk Review, Playbook Creation, Composer, Fulfillment and Insights agents) | Icertis Contract Intelligence (ICI) for Government · FedRAMP Ready · FR2022963780 · Moderate · authorized 2026-04-20 | Vendor platform; agent scope not stated |
| Ironclad Agent and specialized contracting agents | Ironclad CLM · FedRAMP Ready · FR2614247985 · Moderate · authorized 2026-02-25 | Vendor platform; agent scope not stated |
| Lexis+ with Protégé (agentic legal AI) | Lexis+ for Government · FedRAMP Authorized · FR2510634052 · Moderate · authorized 2026-07-06 | Vendor platform; agent scope not stated |
| Synack Sara AI Pentesting | On-Demand Security Testing Platform · FedRAMP Authorized · FR2134635186 · Moderate · authorized 2023-12-19 | Vendor platform; agent scope not stated |
| Vulcan Justinian (AI agent for government legal, regulatory and permitting work; VulcanGov) | VulcanGov · FedRAMP Ready · FR2619254906 · Moderate · authorized 2026-06-09 | listing |
| Workiva Agent Studio (finance, audit and GRC agents) | Workiva Platform · FedRAMP Authorized · FR1726564822 · Moderate · authorized 2019-10-09 | Vendor platform; agent scope not stated |
Use-case comparisons
- AI SOC and security-analyst agents — 51 listings
- Email security and phishing-response AI agents — 16 listings
- TPRM and vendor-risk AI agents — 40 listings
- US public-sector and FedRAMP AI agents — 25 listings
- Enterprise agent platforms — 8 listings
Popular comparisons
- Vanta vs Drata
- Vanta vs Secureframe
- Anecdotes Agentic GRC (Agent Library and Agent Studio) vs Cav Compliance OS agents (formerly Caveonix)
- Anecdotes Agentic GRC (Agent Library and Agent Studio) vs Drata
- Anecdotes Agentic GRC (Agent Library and Agent Studio) vs IntelliGRC Evan and Alfie AI agents
- Anecdotes Agentic GRC (Agent Library and Agent Studio) vs RegScale RegML AI agents (RegScale CCM)
- Anecdotes Agentic GRC (Agent Library and Agent Studio) vs Secureframe
- Anecdotes Agentic GRC (Agent Library and Agent Studio) vs Vanta
- Cav Compliance OS agents (formerly Caveonix) vs Drata
- Cav Compliance OS agents (formerly Caveonix) vs IntelliGRC Evan and Alfie AI agents
- Cav Compliance OS agents (formerly Caveonix) vs RegScale RegML AI agents (RegScale CCM)
- Cav Compliance OS agents (formerly Caveonix) vs Secureframe
Related
- Guide: FedRAMP 3PAOs
- Guide: GovRAMP 3PAO list
- FedRAMP framework hub
- Best DPDP
- Best CERT-In
- Best SOC 2
- Best ISO 27001
- Best HIPAA
- Best CMMC
- Best GovRAMP
- Best TX-RAMP
- Best DORA
- Best compliance
- Best security
- Best risk
- Best privacy
- Best business operations
- Best code security
FAQ
What is FedRAMP compliance automation?
FedRAMP compliance automation is software that helps a cloud service prepare and maintain FedRAMP authorization work — typically the system security plan (SSP), OSCAL machine-readable packages, continuous monitoring, and the plan of action and milestones (POA&M). FedRAMP itself is the US government-wide program for assessment, authorization and continuous monitoring of cloud products used by federal agencies.
Is a FedRAMP-tagged tool FedRAMP authorized?
A FedRAMP tag on Agent Index means the listing is relevant to FedRAMP work. It is not itself an authorization. 19 of the 19 tagged listings on this page have a stored FedRAMP Marketplace record whose own product (scope “listing”) is Authorized. Confirm current status on the Marketplace before you rely on it.
Do I still need a 3PAO?
Yes. FedRAMP recognizes Third-Party Assessment Organizations (3PAOs) after A2LA accreditation. Automation can prepare evidence and packages; it does not replace an independent 3PAO assessment. See the FedRAMP 3PAO guide. FedRAMP 3PAO guide.