Methodology

How we decide what is listed, where every fact comes from, and how to get something corrected. The dataset currently covers 410 agents across 10 framework hubs and 516 Verified · 11 registry-listed audit firms, and was last updated on 27 October 2026.

Inclusion criteria

• The product is an AI agent, or a platform with documented AI-agent features, used for compliance, security, code security, risk or related business operations. Coding platforms appear in Code security only when the vendor’s own docs show a concrete security-scanner or vulnerability-fix integration; they are tagged “agent platform with security integrations”.
• It is publicly available or publicly announced by the vendor, with an official product page we can cite.
• Duplicates, renamed products and merged brands are consolidated into a single listing, with redirects from former names.
• Listing is free. Payment never decides whether a product is included or how it is described.

How facts are sourced

• Every listing records a primary source and a list of source URLs, shown on the agent page under “Sources”.
• Facts come from the vendor's official site, documentation, pricing pages, press releases, marketplace listings or reputable press coverage.
• If we cannot verify a field on a public page — pricing is the common case — we leave it blank rather than estimate.
• Headquarters: we use the vendor’s own site when it states an HQ. When the vendor’s own pages state no headquarters, we may show the legal parent company’s HQ from an official filing, labelled “HQ (parent company)” and linked to that filing. Country and region filters still use that country.
• Each listing shows a “Last verified” date: the most recent day we re-checked it against its sources.
• Logos are the vendor's own site icon, fetched from its official domain and hosted by us. Where none is available we show a letter badge.

Framework tags and vendor-claimed labelling

Listings label these tags as “Frameworks (vendor-stated)”. Framework tags (SOC 2, ISO 27001, HIPAA, FedRAMP, CMMC, GovRAMP, TX-RAMP, DORA, DPDP, CERT-In) mean the product is relevant to that framework according to the vendor's own documentation or an official registry. They are not certifications and not an endorsement. FedRAMP is tagged only when the official FedRAMP Marketplace lists the product (or the documented Government Cloud boundary) as Authorized. GovRAMP is tagged only when the Authorized Product List shows the listed product (or that same government boundary) as Authorized. TX-RAMP is tagged only when Texas DIR's certified-products list shows the listed product (or that boundary) at Level 1 or Level 2. CMMC is tagged when the vendor's own pages document CMMC program support (framework library, mapping, evidence, POA&M or affirmation workflows) — not a CMMC certification of the tool. DORA is tagged when the vendor's own pages document DORA support (requirement mapping, ICT third-party/register workflows, incident or testing evidence) — not a DORA certification of the tool or of your organisation. Vendor-only claims, Ready / Pending / In Process / Provisional statuses, and platform-only certifications stay off the tag (and, for GovRAMP/TX-RAMP, appear in a separate hub table). The separate “Vendor-claimed” list repeats frameworks as the vendor markets them; we have not audited those claims.

Corrections process

Vendors and readers can request a correction through Submit / Claim or by email to [email protected]. Include the listing URL, the change and a public source. We review corrections against the source and record accepted changes in the dated changelog that feeds the newsletter.

Update cadence

The dataset is reviewed daily: new agents, listing changes, pricing changes and relevant regulatory notes are checked and logged. The full dataset is published as agents.json under CC BY 4.0.

Audit-firm listings

The Auditors section lists firms, not people, in two labelled tiers. Verified firms use completely verifiable data: every fact must be confirmable on an official registry or the firm’s own website, with the source linked and the date checked. This firm appears on the official registry, not independently verified by Agent Index. Firms with a regulatory or board-action flag, an unclear or inactive licence, or an unconfirmed address are left out of the Verified tier. A government_body flag marks public-sector certification or audit bodies (STQC, C-DAC, NSAI and the Standards Institution of Israel); the auditors listing can include or exclude them. Listings are facts only, with no rankings or scores. Agent Index is 100% free to use through Q1 2027: you cannot buy inclusion, rankings or editorial notes. Optional labelled sponsorships, if they open in Q2 2027, will always be labelled “Sponsored” and kept separate from listings. Paying never gets a firm listed and never changes who is listed or in what order. Registries and the full method are on the auditors hub.

Independence and sponsorship

Agent Index is published by Heritage Services. The directory is 100% free to use through Q1 2027, and listings cannot be bought. “Featured” marks editorial picks. Optional labelled sponsorships, if they open in Q2 2027, will be clearly labelled “Sponsored” and will never change listing facts, framework tags, comparison tables or the order of best-of lists, which are generated from dataset fields.