Category 12 of 12 · Controls: Accountability and evidence

AI governance and GRC

Inventory, policy, risk assessment, and evidence collection for AI systems and agents, mapped to frameworks such as the EU AI Act, ISO 42001, and the NIST AI RMF.

Vendors, by signal score

• #1
  Credo AI

  AI governance platform: a registry of AI use cases, models, vendors, and agents with agent cards, risk and control libraries including agentic risks, policy packs for the EU AI Act, NIST AI RMF, and ISO 42001, and audit-ready reporting.

  10
• #2
  PromptArmor

  AI third-party risk intelligence for the agent supply chain: vendor reports scored across 26 AI risk vectors and mapped to the NIST AI RMF, OWASP LLM Top 10, and MITRE ATLAS, indirect prompt injection assessment of vendor connectors, and continuous monitoring of vendor AI changes.

  10

Ranked within this category only. How the score works.

Also covers this category

• Aurascape

  AI usage control and agent governance: discovers public, embedded, and shadow AI apps and agents, protects sensitive data in prompts, governs coding assistants, and routes agent tool calls through a gateway that enforces policy before actions reach external systems.

  23
• Securiti AIAcquired by Veeam

  Data security posture management, privacy, and AI governance platform; its Gencore AI builds permission-aware retrieval pipelines with prompt, retrieval, and response firewalls. Acquired by Veeam in 2025.

  30
• Zenity

  Agent security and governance platform: catalogs agents across SaaS, custom frameworks, and endpoints, correlates each agent's identities with its tools, data, and behavior, and detects and blocks prompt injection, data leakage, and unauthorized tool calls at runtime.

  49

Questions to ask a vendor

1. Does the inventory include agents and their owners, not only models?
2. Does it collect evidence automatically from your runtime controls?
3. Which frameworks does it map to out of the box?

Go deeper

• Buying an AI governance platform
• AI governance shortlist

FAQ

Where do I compare AI governance platforms in depth?

GRC Compass keeps the full governance vendor profiles and a buyer guide. This map lists governance vendors only where they cover agents.

What does ISO 42001 certify?

An organisation's AI management system: its policies, roles, and processes for developing or using AI. It does not certify that a specific model or agent is safe.