Agentic trust and compliance automation platform for continuous evidence collection, control monitoring, policies, and security questionnaire responses.
North America
Vendors headquartered in the United States or Canada.
183 listings · HQ country as published by each vendor · Open in directory filters
Key facts
From this dataset
- 183 verified listings on this page, with headquarters in 1 HQ region and 2 countries.
- Dataset version 0.1.27, generated 2026-10-27.
- Vendors headquartered in the United States or Canada.
Cite as: Agent Index by Heritage Services, North America AI agents, dataset v0.1.27 (https://theagentindex.io/regions/north-america/)
FAQ (from this dataset)
What is listed on this region page?
Vendors headquartered in the United States or Canada. 183 verified listings from Agent Index dataset v0.1.27.
How many listings are on this page?
183 verified listings in dataset v0.1.27 (2026-10-27).
Which listings are headquartered in India, Asia-Pacific or Australia/NZ?
None of the 183 listings on this page publish an HQ in India, Asia-Pacific or Australia/New Zealand in the dataset.
Is this a ranking?
No. This is not a ranking or score. Order is mechanical (from dataset fields such as name, framework-tag count or table membership), not a paid placement or quality judgement.
How many AI agents are headquartered in North America?
183 verified listings in dataset v0.1.27 publish an HQ in North America.
Which categories are covered?
Security: 83; Compliance: 71; Risk: 67; Business operations: 48; Code security: 24; Privacy: 7. Categories come from each listing.
Which countries are included?
HQ countries on this page: Canada, United States. Country is as published by each vendor.
Use-case comparisons with listings from this region: AML and transaction-monitoring AI agents · KYC and identity AI agents · AI SOC and security-analyst agents · Email security and phishing-response AI agents · AI code security agents · Contract and legal-review AI agents · Agentic pentesting AI agents · TPRM and vendor-risk AI agents · Privacy operations AI agents · US public-sector and FedRAMP AI agents · AP and finance-automation AI agents · Cloud security (CNAPP) AI agents · AI governance agents and platforms · Identity governance AI agents · Enterprise agent platforms · IT service-management AI agents · Security questionnaire AI agents · Procurement and autonomous-sourcing AI agents
Compliance and trust management platform with AI-assisted evidence collection, continuous control monitoring, and multi-framework programs.
Open-source-leaning AI compliance software that automates evidence collection, policy generation, and continuous monitoring for SOC 2, ISO 27001, HIPAA and GDPR.
Compliance automation platform with Comply AI features for policies, remediation, risk, questionnaires and TPRM, plus Trust Center and CMMC/Defense packages.
AI-powered GRC platform for program management, evidence, audits and multi-framework compliance.
Compliance platform that combines software with audit delivery pathways for SOC 2 and related frameworks.
Compliance platform with published product pricing pages for building and maintaining security certification programs.
Featured
Agentic AI platform for enterprise GRC that executes third-party risk, controls testing, evidence collection, questionnaires and gap analyses with explainability.
AI governance platform for policy packs, model risk and responsible AI compliance including EU AI Act and NIST AI RMF oriented programs.
AI GRC platform (Risk Cloud) with GRC Agents that act under human supervision for third-party risk, AI governance, enterprise risk and business continuity.
Featured
Developer-first application security platform. Snyk Agent Fix validates AI-suggested fixes for Snyk Code findings, and the Evo Agentic AppSec agents (scanning, dependency firewall, security review, remediation and secrets) run Snyk's engines as tools. Several of these agents are still in preview.
Cloud security / CNAPP platform with agentless visibility, risk prioritization and security graph across cloud environments.
Agentic AI analyst for cybersecurity within the CrowdStrike Falcon platform, assisting detection, investigation and response workflows.
Exposure management platform with Tenable Hexa AI agentic orchestration for vulnerability triage and remediation workflows.
Agentic vulnerability management that finds, prioritizes, remediates and verifies fixes with policy-as-code and approval gates.
Privacy, GRC and responsible AI governance platform used by large organizations for consent, preference, third-party risk and AI oversight.
Data security, privacy and DSPM platform whose AgentIQ agentic layer runs data-risk work from a request: four BigID agents at launch (Remediate Sensitive Data, AI Governance Enforcement, Access Exposure Analysis, Privacy Operations) investigate, prioritise and act, e.g. revoking access, remediating exposure, applying retention, quarantining data and fulfilling data subject requests.
Data privacy infrastructure for DSRs, consent and data governance, plus Transcend Rails policy-as-code controls for what AI agents may do.
Third-party cyber risk platform with security ratings and TITAN AI agents running TPRM intake, assessment, monitoring and remediation.
Customer trust platform with ConveyorAI for answering security questionnaires and sharing trust center content.
Trust Center and AI Questionnaire Assistance for customer security reviews, now part of Drata (SafeBase brand being unified into Drata).
Enterprise AI assistant platform that automates employee support and business operations workflows across IT, HR and related systems.
Enterprise automation platform with Autopilot and agentic automation for business operations and process orchestration.
Generative AI assistance across the ServiceNow platform for IT, employee and customer workflows.
AI-powered GRC Intelligence Platform (formerly AuditBoard) with domain-trained agents for audit testing, compliance, third-party risk and AI governance.
Governed AI agent for bank AML alert triage, case investigation and SAR narrative drafting, with analyst confirmation required before any case is closed, escalated or filed.
Compliance automation built into Rippling's HR and IT platform, with AI framework setup, evidence collection, in-platform AI remediation, an audit portal and Trust Centers.
Autonomous financial-oversight platform that analyses 100% of transactions to surface anomalies, control failures and fraud risk for finance and audit teams.
LLM-generated suggested fixes for GitHub code-scanning alerts (CodeQL), plus agentic autofix (generally available 15 Oct 2026), where an alert is assigned to Copilot, which investigates, validates a fix and opens a pull request. Part of GitHub Code Security / Advanced Security.
Anthropic automated security review in Claude Code: the /security-review command and the anthropics/claude-code-security-review GitHub Action for pull-request comments.
Cursor’s AI pull-request reviewer. Official docs say it identifies bugs, security issues and code-quality problems and comments with explanations and suggested fixes.
Semgrep’s AI layer (successor branding to Semgrep Assistant) for detection, triage, remediation guidance and optional autofix on the Semgrep AppSec Platform.
GitLab Duo features that explain SAST vulnerabilities and open merge requests with proposed AI remediations, including an agentic resolution flow.
Veracode’s AI-assisted remediation for SAST flaws and SCA dependency vulnerabilities, with suggested patches in IDE, CLI and SCM workflows.
Amazon Q Developer code reviews that scan for SAST issues, secrets, IaC misconfigurations, quality issues, deployment risks and SCA, with some in-IDE suggested fixes.
Agent orchestration platform (not a dedicated AppSec scanner) that opens auto-fix PRs from Snyk vulnerability scans and Sentry production errors.
Cognition’s autonomous coding agent. Listed here only for documented Snyk MCP/CLI scanning and SonarQube/Snyk/Checkmarx IDE plugins — not as a dedicated security product.
Factory’s Droid coding agents. Listed here only because Factory’s own pages document Snyk Studio integration for scan/fix/verify inside Droid workflows.
GitHub Copilot’s coding agent. Listed here only for the official workflow that assigns Dependabot security alerts to Copilot (or other agents) to open a draft fix PR.
AI agents for the SOC: an AI SOC Analyst that investigates alerts end to end and shows its reasoning, plus an AI Threat Hunter and AI Threat Intel Analyst.
AI agents for transactional lawyers and legal teams: Associate plans and executes multi-document drafting and review projects, and Autonomous Contract Management (GA Oct 2026) runs intake, first-pass review, approvals and redline review.
AI agents for financial-crime compliance: a Research Agent that gathers and synthesises subject evidence and a Review Agent that fills out case reviews per your procedures, on an agent orchestration platform with analyst approval.
AI agents that run fraud and AML alert triage and investigations: they pull transaction history, check watchlists, run open-source research, assemble evidence, draft narratives and recommend dispositions for analyst approval.
AI GRC platform whose agents collect and map evidence, test controls continuously, assess policies against frameworks, run natural-language 'TI Playbooks' and answer security questionnaires.
AI privacy agent built into DataGrail's privacy platform that autofills privacy and AI-risk assessments, classifies cookies, detects AI risk, suggests processing activities and troubleshoots DSR integration errors, acting only with user approval.
AI privacy agent that runs privacy assessments end to end: it monitors tools like Jira, CLM and procurement for new activity, triggers the right PIA/DPIA/TIA/RoPA, researches risk, populates assessments with evidence and routes approvals.
Agent layer behind Ketch's privacy platform that self-populates data maps, runs always-on gap analysis between regulations, your commitments and live systems, and proposes reviewable configuration changes, DPIAs and RoPA exports.
Agentic vendor-assessment workflow in which four agents (Initiator, Collector, Analyst, Reporter) start assessments, gather evidence, produce cited findings and route an executive summary for human approval.
Third-party cyber risk agent made of sub-agents (Assessment, Incident Response, Threat Actor Intelligence, Investigation, Prioritization, Procurement) that assess vendors, investigate exposures, trigger rescans and draft outreach.
Team of risk-informed AI agents for each stage of the third-party risk lifecycle, covering intake checks, evidence review, issues management and executive reporting, with the customer's team in control.
Multi-agent cybersecurity engine across Cyble's threat-intelligence, endpoint and cloud products: agents hunt, correlate IOCs, isolate endpoints, block domains and draft reports, with human-in-the-loop guardrails.
Four role-based AI agents (Detect, Triage, Investigate, Respond) on Exaforce's own security data platform, covering detection engineering, tier-3 triage, threat hunting and playbook-driven response with approval gates.
AI-native AppSec platform that finds business-logic and auth flaws, validates findings from existing SAST tools, runs PR security reviews and generates one-click patches refined in natural language.
Security 'harness' that triages SAST/SCA/DAST/secrets findings for exploitability, opens fix pull requests with the analysis attached, works inside coding agents, and builds design-stage threat models.
Outcome-driven AI agents inside Sysdig Secure for cloud and container security: Vuln, SOC, Posture, Risk and Response agents that investigate, prioritise and drive remediation on Falco-based runtime data.
Palo Alto Networks' agentic layer for Cortex: prebuilt and custom security agents that investigate and resolve cloud and SOC issues across Cortex Cloud, XSIAM and XDR, with configurable autonomy and approvals.
AI agent built into the Lumos identity governance platform that designs roles, completes access reviews (approve/flag with peer and usage analysis) and investigates identity risk, explaining every decision.
Security Copilot agent in Microsoft Entra that scans a tenant for users, apps and agent identities not covered by Conditional Access, recommends or updates policies and applies one-click remediation.
Autonomous pentesting platform that runs unlimited self-directed internal, external, cloud, Kubernetes and AD pentests, plans attack paths, guides remediation and re-tests to verify fixes.
Purpose-built legal AI agents that split large legal tasks, work in parallel and return cited, review-ready output for law firms and in-house teams.
Audit-engagement agents inside Caseware: the Disclosure Checklist Agent drafts cited Yes/No/N-A checklist responses from financial statements, and the Risk Suggestion Agent drafts engagement-specific risks for auditor review.
Agent workforce for audit and advisory firms: agents plan engagements, run testing through to workpapers, review conclusions against evidence and draft financial statements, coordinated by Field Orchestrator.
Agentic AI platform with pre-built 'AI Colleagues' that auto-resolve employee IT, HR, finance and procurement back-office requests through 200+ enterprise connectors.
Generally available Agent Studio for deploying AI agents inside Appian processes that reason over enterprise data and act under platform guardrails; Appian Government Cloud is FedRAMP High authorized.
Continuous controls monitoring platform whose RegML AI agents monitor controls, collect evidence, draft control documentation and trigger remediation for FedRAMP, CMMC and NIST programmes; RegScale CCM is FedRAMP High authorized.
CMMC- and NIST 800-171-focused GRC platform whose AI agents auto-map evidence to assessment objectives (Evan) and run automated control gap assessments with remediation steps (Alfie); FedRAMP 20x Low authorized.
A
Agentic SOC platform with configurable agents for alert triage, enrichment, investigation and remediation under analyst oversight; its government offering is FedRAMP High authorized.
Pre-built Agentforce agents for federal, state and local government, covering complaint management, benefits and licensing, code-violation compliance and internal IT compliance; Salesforce says Agentforce is FedRAMP High authorized in Government Cloud Plus.
Fraud and AML platform with named agents that disposition screening alerts, run enhanced due diligence and business verification, analyse networks, draft SAR narratives, tune monitoring rules and build dispute packages.
Named AI agents that act as L1/L2 AML analysts: they review and disposition sanctions, PEP and watchlist alerts, transaction screening and monitoring alerts, adverse media, EDD and KYC work, escalating or closing cases with justification.
Agent platform for bank and fintech financial-crime operations: pre-built and custom agents gather evidence, apply the institution's policy and draft full cases for EDD, monitoring alerts, sanctions, SAR drafting and KYB, with every action logged.
AI-native GRC platform whose agents monitor controls, collect evidence, map controls, flag gaps, draft security-questionnaire responses and remediate gaps across 40+ frameworks, with a dedicated compliance expert per customer.
Agentic third-party risk management: a swarm of 100+ specialised agents runs the vendor lifecycle from intake and due diligence through remediation, continuous monitoring and offboarding.
Agentic third-party cyber risk assessments that scope each vendor by inherent risk, analyse outside-in ratings, inside-out control evidence and vendor artifacts, and produce cited risk summaries with continuous drift monitoring.
Agentic SOC platform that autonomously triages, investigates and responds across the full alert lifecycle, grading every verdict by its evidence and deferring to a human when uncertain.
Prophet AI (AI SOC Analyst, Threat Hunter and Detection Engineer agents)
Prophet Security
United States
Agentic AI SOC platform whose agents investigate every alert end to end, respond through scoped Agent Actions autonomously or with sign-off, hunt threats and tune detections.
Boston-based agentic security platform where swarms of specialised AI agents categorise, investigate and reach a determination on every alert, escalating only what needs a person, with optional managed service (PLAID ELITE).
Pre-built AppSec agents that read Endor findings against your source, write SAST fixes or file exceptions, pick safe dependency upgrades and open PRs, and answer malware-exposure and CI/CD posture questions inside your coding agents.
Agentic AI application security tool (GA March 2026) with role- and task-based agents that analyse new code in any language, filter findings by exploitability and apply verified fixes, callable from Claude Code, Gemini and GitHub Copilot via MCP.
OpenHands Vulnerability Fixer (agent platform with security integrations)
All Hands AI (OpenHands)
United States
Agent platform with security integrations, not a dedicated AppSec scanner: OpenHands' open-source Vulnerability Fixer runs Trivy scans or ingests Snyk, Veracode or Checkmarx reports, then has OpenHands agents write and test fixes and open GitHub PRs.
Specialised AI agents inside Upwind's runtime-first cloud security platform: Blue investigates threats to a verdict, Red proves which risks are exploitable, Green finds root-cause fixes and opens PRs, coordinated by Choppy.
AI offensive security platform whose agents run black- or white-box autonomous pentests, chain vulnerabilities across code, APIs, cloud and infrastructure, reproduce every finding, and re-test on each deployment.
AWS Continuum for penetration testing (formerly AWS Security Agent)
Amazon Web Services
United States
AWS frontier agent (formerly AWS Security Agent) that runs on-demand penetration tests of your applications with tailored multi-step attack scenarios, reproducible proof and ready-to-implement fixes, billed per task-hour.
Agentic legal AI from Thomson Reuters that plans and executes multi-step legal work (research, document analysis, drafting and verification) grounded in Westlaw and Practical Law, including a Drafting Agent in Word that reviews agreements against playbooks.
Agentic AI for accounts payable, expense audit and card spend: AI agents built from finance SOPs audit expenses and cards, process invoices and escalate uncertain decisions to humans, with explainable, auditable actions.
No-code agent builder and prebuilt agents on Workiva's reporting, audit and GRC platform, used for finance tie-outs and roll-forwards and for evidence collection, control testing and remediation, with configurable review and approval steps.
Enterprise workflow platform whose AI agents (Coach, Knowledge Buddy, Automate, developer agents and the Blueprint design agent) run on Pega's trusted workflows; Pega Cloud for Government, including these gen AI agents, is FedRAMP High authorized.
Agentic AI security operations platform whose six persona-based Agentic Teammates investigate and triage alerts and execute approved containment actions; GreyMatter for Government is FedRAMP Authorized (Moderate).
Agentic AI security analyst in the Singularity platform that runs alert investigations to a verdict and, with Singularity Hyperautomation, triggers response within pre-approved policies; SentinelOne says Purple AI is FedRAMP High authorized.
Autonomous agent for email security operations that triages user-reported emails, removes related malicious campaign messages across the organisation and replies to reporters; included in Abnormal AI for Government, which is FedRAMP and GovRAMP Moderate authorized.
Castellum.AI Arbiter AI agents (alert resolution, transaction and fraud monitoring agents)
Castellum.AI
United States
AML/KYC agents that resolve L1 and L2 screening alerts (sanctions, PEPs, adverse media) against the institution's own policies, plus transaction-monitoring and fraud-monitoring agents, with a documented rationale for every decision.
Financial-crime agents on SymphonyAI's agent-native Symphony Risk Intelligence platform: manager and specialist agents that prepare TM and screening investigations, enrich watchlist records, track threat and regulatory intelligence, and run KYC/EDD workflows.
Library of prebuilt risk and GRC agents on Salesforce Agentforce inside Riskonnect: risk-register signal, risk builder, regulatory mapping, policy impact and horizon-monitoring agents, plus claims and incident intake/audit agents.
Wolfia Questionnaire Agent (security questionnaires and trust center)
Wolfia (Wolfia Inc.)
United States
Security-questionnaire agent that drafts every answer with a citation from the company's own corpus, routes ungrounded questions to the owning expert, returns the file in its original format, and fills portal-only questionnaires via a Chrome extension.
Procurement-embedded third-party risk agents that screen and score vendors, fast-track low-risk ones, route high-risk ones for deeper review, analyse surveys and documents for key risks, and schedule re-assessments by risk tier.
AI agent in Google Security Operations that autonomously investigates SIEM alerts and returns a verdict, confidence score, timeline and next steps.
Security Copilot agent in Microsoft Defender that autonomously triages user-reported phishing, resolves false positives and explains each verdict.
Agent platform with security integrations: AWS's agentic IDE and autonomous agent, with Kiro Powers for Snyk, Aikido, SonarQube and Sonatype scanning.
AI agent in Datadog Cloud SIEM that autonomously investigates security signals and returns evidence-backed Benign or Suspicious verdicts.
AI identity agent in Opal that reviews access requests, investigates context and approves, denies or escalates with recorded reasoning.
Synack's Autonomous Red Agent (Sara) for agentic pentesting, with exploitable findings validated by the Synack Red Team.
CLM platform with Ironclad Agent, a conversational front door that routes requests to specialized agents (Intake, Contract Review, Playbook, Renewal, Search, Analytics, Workflow Designer and others) working inside live contracting workflows with human-in-the-loop review.
Litera's legal AI agent for law firms: it reviews and redlines contracts against the firm's playbook, applies changes across closing sets and chains Litera's deterministic engines (comparison and others) as skills at workflow milestones.
LexisNexis's legal AI platform: Protégé Work presents a plan and then executes skills and workflows (contract comparison, playbook-based review, due diligence, compliance review), and purpose-built drafting agents produce review-ready contracts, motions and briefs grounded in LexisNexis content.
Close-management and accounting platform whose agents turn source records (leases, commission plans, card spend, payables) into subledgers, propose the accounting treatment for approval, build schedules and derive journal entries automatically.
Agentic process automation platform for building goal-driven AI agents that use the Process Reasoning Engine to reason, bring in a human where needed and orchestrate bots, APIs, documents and other agents, with built-in governance and guardrails.
Agentic cyber assurance and continuous compliance platform whose AI agents collect evidence, test controls, find gaps against 50+ frameworks (FISMA, NIST 800-53, FedRAMP, CMMC) and generate ATO artifacts; the platform is FedRAMP High authorized.
Suite of AI agents for human risk management that automatically generate and deliver personalised phishing simulations, training, remedial and policy-quiz content per user; the FedRAMP Moderate KnowBe4 Platform covers AIDA (except AIDA Deepfakes).
IBM's agent platform to build, deploy, orchestrate and govern AI agents (IBM, custom and partner agents for HR, procurement and other domains); watsonx Orchestrate for Government is in scope of IBM Data Services for Government, FedRAMP Moderate.
Oracle Nexus for financial crime investigations (Nexus Case Flow and Nexus Reach agents)
Oracle (Oracle Financial Services)
United States
Oracle's financial-crime case management with agentic AI that pre-investigates AML, fraud, sanctions and KYC cases unprompted, gathers evidence and entity context, runs adverse-media scans and drafts investigation narratives for human review.
Veeam PrivacyOps AI agents (Consent Agent, DSR and Assessment agents)
Veeam Software (Securiti AI, a Veeam company)
United States
Privacy-operations agents on Veeam's DataAI Command Platform: a generally available Consent Agent that builds, tests, monitors and auto-remediates consent across sites and downstream systems, plus announced DSR intake-form and assessment-autofill agents.
VISO TRUST AI Agent (agentic third-party risk management)
VISO TRUST (a Protecht company; Valente Sherman, Inc.)
United States
TPRM agent that launches due diligence as soon as a vendor is added, requests and renews SOC 2, ISO and pen-test artifacts, sends focused follow-ups, monitors breach advisories and drafts impact reports, escalating only exceptions to the team.
AI analyst agents for financial-crime compliance that run KYC and KYB onboarding reviews, disposition sanctions, PEP and adverse-media alerts, perform enhanced due diligence and rescreenings, and draft SAR/UAR filings with audit-ready decision logs.
An AI SOC analyst built into the Securonix Unified Defense SIEM that triages, correlates and enriches alerts, writes investigation summaries and prepares cases, coordinated by the Agentic Mesh of specialized agents under human approval.
Swimlane's AI SOC product, built on its Turbine automation platform, uses autonomous 'deep agents' to plan and run alert investigations, with explainable decisions, auditable actions and AI-generated plans that analysts can review and turn into playbooks.
An AI agent that runs as a GitHub Action, takes vulnerabilities found by Contrast's IAST (Assess) and SAST, writes code fixes using runtime context, runs your build and tests, and opens pull requests for developers to review.
An autonomous AI agent for on-demand, ongoing penetration testing that adapts its testing logic in real time and focuses findings on each customer's business context, developed with LRQA's pentesting methodology.
Workato's agent layer on its integration and automation platform: Agent Studio builds AI agents ('genies') that understand context and execute skills built from Workato workflows and recipes, with prebuilt genies for IT, sales, HR, support and other functions.
Permissions-aware AI agents on Box's content platform: the Box Agent plans multi-step work across files, Extract agents turn documents into structured metadata, a Classification agent labels sensitive content, and Box AI Studio builds custom agents; Box AI sits inside Box's FedRAMP High boundary per the Marketplace listing.
Agents in Docusign IAM that review agreements against company standards and playbooks, suggest edits, request approvals, monitor contracts for risks and obligations, and can be built as custom agents in Agent Studio and used as steps in Workflow Builder.
Multi-agent orchestration for financial-statement audits: an orchestrator staffs engagements with long-running agents that draft disclosure-checklist answers, categorise trial balances, generate PBC request lists, prepare and perform procedures and draft workpapers, all ending in a human sign-off queue.
Archer Evolv AI Operators (Evolv Foundation and Evolv Workplace)
Archer (Archer Technologies LLC)
United States
Governed GRC agents ('AI Operators') inside the Archer system of record: identity-bound, scope-limited, human-supervised agents for control generation and assurance, regulatory change, reportable-event review and record hygiene; the Archer Evolv product is TX-RAMP Level 2 certified.
Deep Fathom Compliance Readiness Platform (agentic CMMC / NIST SP 800-171 readiness)
Deep Fathom, Inc.
United States
CMMC and NIST SP 800-171 readiness platform for US defence contractors where AI agents interpret obligations, plan and advance routine readiness work, continuously map the CMMC boundary and collect evidence, with human review gates on consequential decisions.
Ironscales AI agents (Phishing SOC Agent, Red Teaming Agent and Phishing Simulation Agent)
Ironscales
United States
API-based email security for Microsoft 365 and Google Workspace that runs three AI agents: a Phishing SOC Agent for L2-style forensic investigation of suspicious emails, a Red Teaming Agent that models attacks aimed at your organisation and hardens detection, and a Phishing Simulation Agent. Plans include agentic autonomous remediation.
Sublime Security ASA and ADÉ (Autonomous Security Analyst and Autonomous Detection Engineer)
Sublime Security
United States
Email security platform whose AI agents triage user-reported and flagged emails end to end (ASA, with passive or active auto-remediation modes) and write backtested detections for new attacks (ADÉ), which default to one-click human approval and can auto-activate when they clear a precision threshold. Runs as SaaS or self-hosted in AWS, including GovCloud.
Material Security AI agents (user-reported phishing agent and OAuth Remediation Agent)
Material Security
United States
Cloud workspace security for Google Workspace and Microsoft 365 with an AI agent that triages, clusters and remediates user-reported phishing across the organisation, plus an OAuth Remediation Agent that investigates third-party app and AI-agent grants and can revoke tokens on its own. Per-user pricing is published.
Agentic AI layer inside Proofpoint's platform. The Satori Abuse Mailbox Agent classifies every user-reported email that needs manual review (phish, malware, spam or clean) and can trigger configured quarantine or tagging workflows. A DLP Triage Agent does the same for data-loss alerts, with guardrails, chat explanations and audit logs.
StrongestLayer TRACE agents (Inbox Advisor, Threat Triage and Threat Hunt)
StrongestLayer
United States
AI-native email security for Microsoft 365 and Google Workspace in which a multi-LLM reasoning engine (TRACE) investigates each email's intent against your business context and blocks attacks. Three classes of agents give employees plain-English verdicts in Outlook and Gmail, send pre-investigated, MITRE-mapped cases to the SOC, and hunt and remediate across mailboxes.
Adaptive Security Agentic Email Security and Phish Triage
Adaptive Security (TeamGuard AI Inc.)
United States
API-based 'agentic email security' that re-analyses inbound mail after native filtering with ML and LLM reasoning and removes confirmed threats across every inbox automatically (configurable human-in-the-loop thresholds). AI Phish Triage classifies employee-reported emails and acts on them, feeding Adaptive's simulations and awareness training.
AiPrise AI agents (AML Agent, Website Agent and Document Agent)
AiPrise (AiPrise, Inc.)
United States
KYC/KYB and compliance platform whose AI agents review AML screening hits (sanctions, PEP, adverse media) and recommend a decision under the customer's AML policy, check business websites for legitimacy and risk with ongoing monitoring, and review documents, with an analyst confirming the outcome.
INETCO BullzAI Investigate (agentic AI fraud investigation agents)
INETCO (INETCO Systems Limited)
Canada
Payment-fraud prevention platform for banks, processors and payment service providers whose agentic AI fraud agents collate transaction data, triage alerts, prioritise high-risk cases and give explainable risk scores and recommendations, running on a proprietary small language model that can be deployed on-premise.
Doppel agentic social engineering defense (Email Security, Phishing Triage and agentic takedowns)
Doppel (Doppel Inc.)
United States
Social engineering defense platform where AI agents triage employee-reported phishing, remove malicious mail automatically, tune email detection policies and trace phishing back to its sending infrastructure and links to execute takedowns, alongside brand-impersonation takedowns across web, social, ads and app stores.
Cloud-delivered SOC platform (SIEM, SOAR, UEBA, ITDR, threat intelligence and case management in one SaaS) whose agentic AI investigates and correlates alerts across assets and identities, then recommends or executes response actions under analyst oversight.
Arctic Wolf Aurora Agentic SOC (Swarm of Experts agents)
Arctic Wolf (Arctic Wolf Networks)
United States
Agent-led managed SOC on the Aurora Superintelligence Platform: a 'Swarm of Experts' of oversight, authoritative and process agents runs triage, investigation, response, threat hunting, threat intel and detection engineering, with Arctic Wolf's human experts in the loop for novel cases and critical decisions.
StackHawk Wingman (find-fix-verify security for AI coding agents)
StackHawk (StackHawk, Inc.)
United States
Security plugin for AI coding agents (Claude Code, Cursor, GitHub Copilot, Codex, Antigravity) that runs dynamic tests against the running app during the coding session, has the agent triage and fix what it finds, then rescans to prove the fix before the pull request. Published at US$10 per user per month.
C1 Autonomous Worker and C1 Agents (identity governance AI agent, formerly ConductorOne)
C1 (ConductorOne, Inc. d/b/a C1)
United States
Governed AI agent on C1's identity platform that carries out identity work end to end from a plain-language request (revoking stale admin grants, building access reviews, assembling audit evidence on who reached production, finding orphaned entitlement owners), acting only within the operator's own permissions and logging every action.
Icertis Vera agents (Redline, Risk Review, Playbook Creation, Composer, Fulfillment and Insights agents)
Icertis (Icertis, Inc.)
United States
Contract AI agents in the Icertis contract intelligence platform that review third-party paper against a playbook, score risk Red/Amber/Green with plain-language explanations, generate playbook-aligned redlines in Microsoft Word, create playbooks and track obligations.
Auditoria AI agents (AP Helpdesk, AP Invoices, AP Accruals, AP Vendor Watch, AP Statement Reconciliation, AR Collections, AR Remittances)
Auditoria (Auditoria.AI)
United States
AI agents that run accounts payable and receivable work inside finance's own ERP and inboxes: they answer vendor emails, capture and code invoices, chase accruals, monitor supplier bank, tax ID and sanctions data, reconcile vendor statements, and run collections and remittance matching within policy guardrails.
Freshservice Freddy AI Agent and Freddy AI Agent Studio (IT and HR service agents)
Freshworks (Freshworks Inc.)
United States
AI agents in Freshworks' Freshservice ITSM that resolve employee IT and HR requests end-to-end (access provisioning, password resets, device setup, onboarding, leave queries) across Teams, Slack, Microsoft 365 Copilot and the portal, with an Agent Studio to build and govern pre-built and custom agents.
Vulcan Justinian (AI agent for government legal, regulatory and permitting work; VulcanGov)
Vulcan Technologies (Vulcan Technologies, Inc.)
United States
AI agent for US government knowledge workers, grounded in a large corpus of federal and state statutes, regulations, court cases and fiscal data. It runs 50-state research in parallel with citations, monitors legal changes, reviews permit applications against the code, drafts memos and comment responses, and builds internal tools inside the agency boundary.
CLEAR Investigate (agentic AI investigations for government, risk and fraud teams)
Thomson Reuters
Canada
Agentic investigation tool built on Thomson Reuters CLEAR public-records data. From a plain-language question it plans and runs searches across CLEAR data and the open web, resolves conflicting records and returns concise cited findings with a record of the searches it ran, for AML, fraud, program-integrity and law-enforcement investigators.
Generally available agentic AML module for banks: a central orchestrator coordinates specialised agents that gather data, analyse transactions and customer behaviour, review prior alerts and deliver a decision-ready Level 1 alert recommendation with documented rationale, with analysts making every final decision.
Oscilar Agent Hub (AML, sanctions, fraud and onboarding agents)
Oscilar (Oscilar, Inc.)
United States
Risk-decisioning platform with 30+ orchestrated agents on a shared risk memory, including AML L1 review, sanctions screening dispositions, adverse media, EDD dossier, SAR narrative, fraud L1 review, fraud-network and KYB review agents, where every recommendation is confirmed by a human analyst.
Zscaler Agentic SOC (specialized AI agents for triage, investigation and inline containment)
Zscaler (Zscaler, Inc.)
United States
AI-first security operations product launched September 2026. Specialized autonomous AI agents triage alerts, investigate root cause, assign evidence-backed verdicts and trigger response workflows, and Zscaler's inline Zero Trust controls can automatically isolate users, block command-and-control traffic and cut off lateral movement.
FloQast Transform AI agents (accounting close agents built from finished work, plus prebuilt agents)
FloQast (FloQast, Inc.)
United States
Close-management platform whose Transform AI agents run accounting workflows end to end (reconciliations, journal entries, close tasks); Transform can rebuild a finished close into a governed, documented agent tested against approved numbers, and each agent needs accountant sign-off before it runs.
BlackLine Verity AI agents (Verity Prepare multi-agent reconciliation, Verity Accruals and other close agents)
BlackLine (BlackLine, Inc.)
United States
Suite of specialised AI agents in BlackLine's financial close platform; Verity Prepare (GA July 2026) is a multi-agent system that ingests supporting documents, matches transactions, isolates anomalies, explains variances and assembles audit-ready reconciliation packages for human approval, and Verity Accruals automates the accruals process.
Healthcare third-party risk agent in Censinet RiskOps that reviews vendor questionnaire responses and supporting documents (such as SOC 2 and penetration-test reports), captures integration details from requests, identifies findings and drafts assessment reports and corrective action plans for the risk assessor to validate.
Command Zero Agent Zero (autonomous security analyst)
Command Zero (Command Zero, Inc.)
United States
Autonomous and AI-assisted SOC investigation platform from Austin, Texas. Its LLM agent, Agent Zero, investigates alerts end to end across identity, endpoint, cloud, email and SaaS, auto-closes routine cases with documented reasoning, and escalates the rest with a replayable chain of evidence for analysts to confirm or override.
Bricklayer AI security agents (agentic platform for the AI security workforce)
Bricklayer AI (Bricklayer AI Inc.)
United States
Agentic cybersecurity platform that deploys, coordinates and governs teams of role-based and tool-specialist AI agents to triage alerts, investigate incidents, run threat-intelligence and threat-hunting work and track vulnerability remediation inside analyst-approved procedures, with every agent action auditable.
depthfirst autonomous security agents (code, supply chain, secrets and agentic pentesting)
depthfirst (DepthFirst AI, Inc.)
United States
San Francisco application-security platform whose autonomous AI agents trace business logic and data flows to find exploitable code vulnerabilities, check dependency reachability and secrets, review pull requests with proposed fixes, and run agentic pentests against running applications, re-running each attack after a fix merges to confirm it is closed.
Ridge Security RidgeGen (agentic AI red teaming) and RidgeBot
Ridge Security (Ridge Security, Inc.)
United States
Offensive-security vendor from Milpitas, California. Its on-premises, model-agnostic RidgeGen agent does agentic AI red teaming: it reasons through multi-step attack chains to find business-logic and non-CVE risks, verifies every finding with reproducible exploit evidence, gives fix guidance and re-runs to confirm fixes. It sits alongside RidgeBot automated pentesting.
Trintech AI agents (Variance Analysis, Flux, Exception Management, Accruals Intelligence and Data Access agents)
Trintech (Trintech, Inc.)
United States
Financial-close platform (Cadency, Adra) with five AI agents that investigate variances and account fluctuations, triage and root-cause reconciliation exceptions, generate and roll forward accruals, and build governed data pipelines, keeping evidence, approvals and audit trails for reviewers.
Agentic AI embedded in Kyriba's treasury and payments platform that queries live treasury data, analyses variances, tracks and reconciles payments, runs reusable Skills (operations checks, data validations, ISO 20022 address audits, compliance reviews) and prepares and executes actions such as money-market investments and stablecoin payments only with explicit approval.
Clio Work agentic mode (goal-based multi-step legal work with Vincent)
Clio (Themis Solutions Inc.)
Canada
Legal AI workspace for law firms whose agentic mode takes a single goal-based prompt (for example 'find everything that could kill this deal before signing'), picks the legal skills it needs and runs the multi-step work itself, showing live reasoning traces that the lawyer can interrupt or redirect.
Nasdaq Verafin Agentic AI Workforce (Agentic Sanctions, AML, EDD and Fraud Analysts)
Nasdaq Verafin (Verafin, a Nasdaq company)
Canada
A suite of role-based agentic AI analysts for bank and credit-union financial-crime teams. They triage and disposition sanctions, money-laundering and fraud alerts and prepare EDD recommendations. Institutions can switch on auto-dispositioning, run them inside the Verafin platform or overlay them on third-party systems.
Point Predictive Predictor Agents (agentic forensic fraud reviews for lenders)
Point Predictive
United States
Specialist fraud agents for auto lenders, banks, credit unions and finance companies, launched Oct 16, 2026. They review consortium loan applications in real time for fraud rings and produce agentic forensic fraud reviews of loan files in seconds. Plain-language portfolio and dealer-risk questions run over Point Predictive's lending-fraud consortium.
episki Autonomous GRC (AI Orchestration agents for policies, questionnaires, vendors and evidence)
episki (episki, llc)
United States
A GRC platform built around agents that draft policies, answer inbound security questionnaires, review vendors' SOC 2 and CAIQ responses, map controls, assess risks and write deterministic evidence-collection recipes. Every plan, step-run and sensitive action goes through human approvals and safety floors. Pricing is published.
Blackpoint AI SOC Agent for ITDR (autonomous identity threat containment for Microsoft 365 and Google Workspace)
Blackpoint Cyber (Blackpoint Holdings, LLC)
United States
AI SOC agent inside Blackpoint's managed ITDR service that autonomously contains high-confidence credential attacks on Microsoft 365 and Google Workspace accounts: it suspends the account, forces a password reset, ends active sessions and logs its reasoning, and escalates anything below its confidence threshold to a human SOC analyst. Generally available since July 8, 2026.
BILL AI agents (W-9 Agent, Reconciliation Agent and other touchless AP agents)
BILL (BILL Holdings, Inc.)
United States
AI agents inside the BILL finance platform for small and midsize businesses: the W-9 Agent requests, follows up on, collects and pre-validates vendor W-9s (names and TINs), and the Reconciliation Agent codes and reconciles receipts, with the customer's team approving the final data.
An agentic orchestration platform for procurement and supply chain that coordinates domain-trained agents across sourcing, category management, contract lifecycle, supplier risk and compliance, and procure-to-pay, including obligation-management, clause-risk, supplier risk assessment, fraud/anomaly detection and invoice n-way matching agents.
Ranger is Levelpath's autonomous source-to-pay platform in which AI agents run sourcing events, generate RFPs and qualify suppliers, scan contract repositories and flag risks, continuously monitor operational and compliance signals across suppliers, and match invoices to orders and receipts, with configurable autonomy and logged actions.
Middesk Agents (KYB investigation agents for OFAC false positives, ownership, address and merchant risk)
Middesk (Middesk, Inc.)
United States
Business-identity platform whose specialised AI agents investigate and resolve KYB review work (OFAC false positives, address discrepancies, beneficial-ownership verification, litigation matches, operating-status checks and merchant-risk monitoring) across 400+ data sources, returning evidence-backed, audit-ready decisions through one API.
Qualys Cyber Risk Agents in Enterprise TruRisk Management (Agent Val, Sara, Insta, Nyra, Sid)
Qualys (Qualys, Inc.)
United States
Agent marketplace inside Qualys Enterprise TruRisk Management where teams 'hire' AI agents that detect new exposures without scanning, safely validate exploitability, re-rank risk by active threat campaigns and run confidence-gated patch and patchless remediation with rollback and re-validation.
Workday Financial Audit Agent (part of Workday Accounting Agent)
Workday (Workday, Inc.)
United States
Generally available Workday Financials agent for audit readiness. It finds the supporting evidence for transactions (invoices, supplier contracts, receipts, POs, journals, bank reconciliations) across the Workday tenant, compiles auditor-ready evidence packages and flags high-priority risks such as duplicate invoices.
Crogl sovereign AI SOC (autonomous alert investigation, threat hunting and evidence-gated auto-remediation)
Crogl (Crogl, Inc.)
United States
Self-hosted AI SOC whose agents pick up alerts from SIEM, SOAR and ticketing queues, investigate each one end to end across the customer's own tools, hunt threats and investigate advisories, and only trigger SOAR playbooks once an evidence gate is passed, with a full audit trail for the analyst's decision.
Anomali Agentic AI in ThreatStream Next-Gen and the Anomali Data Lake (autonomous triage, scoring and investigation agents)
Anomali (Anomali, Inc.)
United States
Intelligence-native agentic SOC layer: ThreatStream Next-Gen and the Anomali Data Lake ship with autonomous triage, scoring and investigation steps, Tier 1/2 triage agents, a stack-ranked decision queue and automated Priority Intelligence Requirement monitoring, with analysts setting how much autonomy the agents get.
Agentic exposure-operations platform whose AI Exposure Eliminators continuously discover exposures across identity, attack surface, control gaps and vulnerabilities, investigate which attack paths are actually exploitable given existing controls, pick the neutralization path (config hardening, control deployment or patch) for one-click approval, route the work and verify from the sensor that the fix holds.
Generally available Workday Contract Lifecycle Management (ex-Evisort) agent. It reviews whole pre-signature agreements against the company playbook, flags risk and missing terms and drafts pinpoint redlines with a rationale for each; users apply the redlines. The Contract Workflow Agent is Early Access and is not covered by this listing.
Barracuda Integrated Email Protection agentic threat investigation and clawback (BarracudaONE)
Barracuda Networks (Barracuda Networks, Inc.)
United States
API-based email security for Microsoft 365 and Google Workspace in which AI agents triage threat activity, correlate cross-domain BarracudaONE signals and run real-time, tenant-wide clawback of malicious messages after delivery without SOC intervention, with Bailey AI explaining every verdict and action.
Lio multi-agent procurement workforce (Lio OS agents for direct and indirect procurement)
Lio (Lio Technologies; Lio Technologies GmbH)
United States
Multi-agent system for enterprise direct and indirect procurement. Lio's agents take over the operational procurement work that companies usually give to shared-service centres or BPOs (matching, chasing suppliers and handling exceptions end to end, including edge cases). They also support strategic work such as should-cost models, negotiation preparation and contract and supplier lifecycle management.
US SaaS-security product whose Marlin AI engine autonomously correlates posture, identity and threat signals across SaaS and AI apps, opens investigations without a prompt, and delivers expert-guided remediation steps so teams can cut investigation and resolution time.
US agentic development platform whose Security Agent reviews a project's full codebase (threat model plus Semgrep/HoundDog static analysis), Level 3 AI pentest black-box tests the running Preview, and accepted findings can be sent to Agent for parallel remediation with a follow-up rescan — listed as an agent platform with security integrations, not a dedicated AppSec scanner.
SOCRadar AI Agents (specialist threat-intelligence, attack-surface, digital-risk and alarm-triage agents)
SOCRadar (SOCRadar Cyber Intelligence Inc.)
United States
Roster of specialist agents inside the SOCRadar threat-intelligence platform: customers deploy agents, set each one's skills, scope and access, and green-light sensitive steps. Agents cover threat-actor and ransomware intelligence, detection-rule writing, IoC enrichment, identity/credential exposure, vulnerability analysis, brand and dark-web monitoring, phishing-domain hunting, external attack surface and Shodan recon, and alarm triage that records verdicts and asks before changing an alarm's status.
Strike48 agentic SecOps platform (pre-built SOC agent team and no-code agent builder over federated logs, cloud or air-gapped on-prem)
Strike48 (Devo Technology, Inc.)
United States
Agentic orchestration platform for SOC and IT teams from the company behind the Devo log platform: purpose-built micro agents triage and investigate alerts, analyse phishing, hunt threats, write and tune detections and help with compliance over logs queried in place across SIEMs and data lakes, with configurable human approval and an audit trail; available as SaaS, isolated compute or an air-gapped on-prem appliance.
Agentic AI inside Trulioo's KYB verification workflow from Vancouver-headquartered Trulioo. When registries run out, the UBO Discovery Agent researches filings, disclosures, legal and public records, OSINT and verified third-party databases, reaches registries without API connectivity in real time, reconstructs the beneficial-ownership chain with jurisdiction-specific control logic, cites every finding and reports gaps instead of guessing.
QAD ChampionAI Champions (background agents for accounts payable, procurement follow-up and sourcing in manufacturing)
QAD | Redzone (QAD Inc.)
United States
ChampionAI "Champions" from US manufacturing-software vendor QAD | Redzone are persona-based agents that run continuously in the background of a workflow. The Accounts Payable Champion (generally available since Sep 22, 2026) captures invoices from email, supplier portals and EDI, matches them to PO and goods receipt, clears in-tolerance invoices toward payment and routes only exceptions to people. The Procurement Champion chases suppliers and keeps POs and the ERP in sync; the Sourcing Champion creates RFQs, follows up suppliers and prepares award packs.
Pilot AI Accountant (autonomous bookkeeping agent: categorisation, reconciliation and monthly close)
Pilot (Pilot.com, Inc.)
United States
Bookkeeping agent from US back-office provider Pilot. It connects to a company's bank and card accounts and tools such as Stripe and Gusto, then categorises transactions, identifies vendors, reconciles accounts, closes the books each month and produces P&L, balance sheet and cash-flow statements, flagging only unusual items such as duplicate charges or new vendors for review. The AI-only Essentials plan is $99 a month; higher plans add human bookkeepers.
DataVisor Vera and Vera Code (agentic AI for fraud and AML strategy, tuning, alert summaries and SAR drafting)
DataVisor (DataVisor, Inc.)
United States
AI teammate for fraud and AML teams on the DataVisor platform. From a plain-language request, Vera orchestrates agents that author detection rules, features and lists, tune strategies against production telemetry, summarise alerts and draft FinCEN-aligned SAR narratives; changes are proposal-only and a human approves before anything reaches production. Vera Code turns requirements into tested, documented configurations.
Uptiq compliance and risk agents (sanctions screening, BSA/AML and regulatory reporting agents for banks)
Uptiq (UPTIQ, Inc.)
United States
Agents for bank and credit-union compliance teams on Uptiq's Qore platform. A Sanctions Screening Agent screens every transaction and party and prioritises alerts by risk, a BSA/AML Agent assembles case files and drafts SAR and CTR narratives for disposition, and a Regulatory Reporting Agent prepares and validates filings and tracks regulatory changes to policy; agents run under the institution's own policies, permissions and approval gates, with every action logged.
Sonrai WALLy (cloud privileged access management agent)
Sonrai Security (Sonrai Security Inc.)
United States
Cloud PAM agent that works with Sonrai's Cloud Permissions Firewall across AWS and GCP. WALLy flags identities carrying privilege risk (overpermissioned roles, external accounts with IAM access, unused permissions), prioritises the fixes that cut the most risk, writes remediation policies (quarantine zombie identities, block third-party access, enforce just-in-time access, remove dangerous privileges) and stages them for a human to review and approve before deployment, then confirms the risk is closed.
Atomicwork IGA Agent (agentic access provisioning on Atomicwork's AI Workforce)
Atomicwork (Atomicwork Inc.)
United States
AI coworker on Atomicwork's agentic ITSM/ESM platform that handles access requests end to end: it reviews context, applies policy, routes approvals to the right owners in Slack or Teams, provisions and deprovisions access and enforces just-in-time access, acting without human intervention unless policy requires it. Listed tools include Okta, Azure AD, Google Workspace, JumpCloud and Microsoft Intune.
Agentic pentesting agent for internal security teams and MSSPs. Sable plans and executes authorised tests against web applications, APIs, internal networks and Active Directory, runs real tools, proves impact with reproducible evidence and exploit traces, and supports targeted retests after remediation; teams steer it in plain language and can approve every command or let it run fully autonomously.
AI agent for enhanced due diligence (EDD) on high-risk customers: it gathers internal and external data, unifies KYC/KYB data, sanctions, adverse media and ownership/associate risk, flags risk factors and mitigants, recommends next steps and drafts a fully cited risk narrative for regulatory review, while the analyst makes the final decision.
Saved
Reference:
We'll email you when a matching listing is added; no other automatic emails. Nothing is sent automatically now.