T-NEX
Menu
DEEN
GRC provider register · Category 5 of 11 · Part 2 of 3

GRC software for information security, F to R:
34 providers with AI classification.

In short: Part 2 of 3 of the Information security category: full entries for 34 of the 106 providers, alphabetically from F to R, as of 18 October 2026. Of these, 27 document specific AI functions (79%). In Germany, Austria or Switzerland, eight have a documented headquarters, seven of them in Germany.

By and Published: As of: · Subpage of the GRC provider register Reviewed by Andreas Unruh and Christoph Gembruch, managing directors of T-NEX GmbH, on
Illustration: globe with networked GRC providers whose AI evidence flows into a checked provider register

Neither completeness nor a general suitability for banks is claimed. Providers are listed alphabetically. The order is not a performance rating.

All 682 GRC providers in the market overview · 379 European GRC providers · Information security category page (106)

Publisher: T-NEX GmbH. Andreas Unruh and Christoph Gembruch are managing directors of T-NEX. This editorial market overview is based on vendor sources and specialist primary sources. It contains no ranking and is not based on a joint product test. The market overview covers 682 providers from GRC and adjacent specialist areas. Acquired brands and former product names are not counted separately. Methodology and sources

Context, figures, review questions and the regulatory framework are on the Information security & cyber compliance category page.

Entries from F to R: functions, AI classification and sources.

The assignment describes the offering considered, not all of the company's products. AI information names specific functions or limits of the public documentation. Scope of delivery, data storage and regional availability must be checked for each offering. Download provider overview as CSV (German), licensed under CC BY 4.0, credit “T-NEX GRC-Anbieterregister, t-nex.de”.

Is a provider missing or an entry out of date? Send us a note with a source via the contact form. Accepted changes are marked in the entry with the date they were checked.

Information security & cyber compliance: F to R

34 entries

Information security & cyber compliance · F to R · 34 providers
Provider / productDocumented focusAI functions and classification
FEHA Assurtech · Product: FEHA GRC; GuardRisk · Headquarters: Singapore [1] · GuardRisk terms and conditions name FEHA Assurtech Pte. Ltd. in Singapore as the exclusive contracting entity. The vendor website additionally names FEHA International Consulting B.V. in Amsterdam as group HQ, KVK 86193562. Group counted once under the designated software contracting entity. · FEHA International Consulting B.V.; FEHA Assurtech Pte. Ltd.; GuardRisk; FEHA GRC; 3rdComplyDocumented focus: FEHA GRC brings together frameworks, controls, evidence and audits. GuardRisk supplements the platform as a separate assistant for regulatory research and the review of compliance documents.AI functions and classification: The GuardRisk manual describes the review of uploaded documents against frameworks, control-specific gap reports and draft policies. A research assistant answers compliance questions with framework references; results must be reviewed by subject-matter experts.[2] [3] [1] [4] · Specific AI functions documented
Check documents against requirements · Identify control gaps · Draft policies
AI evidence: [3] [2] · According to the vendor, GuardRisk was launched in October 2025. Despite the stated September 2026 date, the current 2.0 page still shows a waiting list and a limited private beta; confirm the actually accessible version and functions before procurement.
Source check: 2026-10-15
fuentis · Product: fuentis Suite · Headquarters: Germany [5] · fuentis AG; fuentis SuiteDocumented focus: The fuentis Suite combines information security, data protection, risk management and emergency preparedness on a shared database. Assets, requirements, risks and actions can be linked to one another and assigned to responsible persons. Customisable catalogues and questionnaires support protection requirement analyses and target/actual comparisons; tasks, evidence and reports accompany ongoing implementation and audit preparation.AI functions and classification: No specific AI work step of the fuentis Suite is documented in the source check. Support for ISO 42001 and automated ISMS workflows alone are not evidence of AI being used.[6] [7] [8] [5] [9]Not specifically documented in the source check
Product and function overview read; a targeted search of the vendor domain mainly returned an AI governance standard and generic tool requirements.
Sources checked: [6] [8] [9] · AI availability not specifically documented in the source check.
Source check: 2026-10-14
Galea · Product: Galea Cyber; TARS · Headquarters: France [10] · The legal notice names Galea SAS in Boulogne-Billancourt. According to the legal notice, Phishia is a brand of the same legal entity and is not counted separately. · Galea SAS; Galea Cyber; Phishia; TARSDocumented focus: Galea Cyber links cyber risks, control requirements and measures. The platform supports EBIOS RM analyses, risk matrices and the preparation of compliance evidence.AI functions and classification: TARS generates context-specific risk scenarios from technical and business information. The AI proposes risk assessments and measures; experts can correct assessments with a justification.[11] [10] · Specific AI functions documented
Design cyber risk scenarios · Propose risk assessments · Prioritise measures
AI evidence: [11] · Demo, trial offer and product packages presented. Vendor information on the model and hosting architecture must be checked contractually before procurement; no product test of our own.
Source check: 2026-10-15
GRiCk · Product: Governance, Risk, Intelligent Controls Kit · Headquarters: Australia [12] · YUMA IT PTY LTD, ABN 62 684 389 839, ACN 684 389 839; registered address Watson, ACT, Australia. · YUMA IT PTY LTD; Yuma ITDocumented focus: Cyber GRC for controls, evidence, review status and authorisation decisions. Evidence remains linked to its origin, currency and human assessment.AI functions and classification: An MCP interface gives authorised AI agents client-specific control context. Agents can prepare evidence and submit it via limited, logged write permissions; assessment and approval remain with humans.[13] [12] · Specific AI functions documented
Provide control context for AI agents · Prepare evidence with AI agents · Log evidence handovers
AI evidence: [13] · Commercial offering on order with demo. The integration of external AI agents is documented; specific functions and deployment depend on the engagement.
Source check: 2026-10-15
Guardiso · Product: Guardiso; Guardiso Assistant · Headquarters: Poland [14] · The terms of use name Guardiso Michał Lewandowski, NIP 6060011996, with an address in Poznań, Poland. · Guardiso Michał Lewandowski; Guardiso AssistantDocumented focus: Guardiso manages security policies, risks, controls, evidence, incidents and audit documentation. The platform links several security and data protection frameworks and supports internal teams as well as external auditors.AI functions and classification: The optional AI drafts policies and risk descriptions, supports security questionnaires and searches the organisation's internal documentation. Suggestions on controls and summaries remain reviewable drafts; decisions and approvals lie with humans.[15] [16] [14] · Specific AI functions documented
Draft policies · Analyse risks · Answer security questionnaires · Propose controls · Search documentation
AI evidence: [16] [14] · Commercial subscription with trial access; AI is optional and tied to the package scope and query quotas. The transparency page names Anthropic for the assistant and analysis, and OpenAI for semantic search vectors.
Source check: 2026-10-15
Hicomply · Product: Hicomply · Headquarters: United Kingdom [17] · Hicomply LtdDocumented focus: Hicomply links an ISMS with a risk register, control mappings, policies and audit preparation. Risks are assigned owners and treatment plans; evidence and reports support several frameworks. Additional functions handle security incidents and data protection tasks and link the results with ongoing compliance work.AI functions and classification: Hicomply AI searches documents and emails to collect evidence, maps risks to selected assets and provides context-specific compliance assistance.[18] [19] [20] [17] · Specific AI functions documented
Collect evidence from documents and emails · Map risks to assets · Answer compliance questions
AI evidence: [19] · Documented by the vendor; agree the specific licence and implementation scope. No product test.
Source check: 2026-10-14
HiScout GRC Suite · To the detailed profile · Headquarters: Germany [21] · HiScout GmbH; Berlin, Germany; HRB 119470 B.Documented focus: HiScout brings together IT baseline protection (Grundschutz), information security, data protection and BCM on a common data basis.AI functions and classification: The HiScout pages checked describe low-code configuration, a common data model and GRC workflows. Specific AI support for these tasks is not documented in the source check.[22] [23] [24]Not specifically documented in the source check
Technology page read; targeted search on the vendor domain without specific evidence of an AI function. Rule-based Business Logic Engine not counted as AI.
Sources checked: [22] [24] · No specific AI availability can be derived from the sources checked.
Source check: 2026-10-14
HyperproofDocumented focus: Shared controls and evidence for several frameworks, risks and audits.AI functions and classification: AI Guided Experiences proposes links between controls, policies, risks and evidence, identifies the evidence required and supports reviewing it for audit gaps.[25] [26] · Specific AI functions documented
Control mapping · Evidence selection · Evidence review · Validation tests
AI evidence: [26] · Available to existing customers; according to the announcement, selected functions are in the early-access beta programme.
Source check: 2026-10-14
i-doit GRC Suite+ · Headquarters: Germany [27] · i-doit GmbH; Düsseldorf; Düsseldorf commercial register no. 33104.Documented focus: i-doit GRC Suite+ links ISMS, IT contingency planning, data protection and BCM via shared assets, risks and measures.AI functions and classification: i-doit documents AI add-ons for CMDB queries, data maintenance, document creation and IT workflows. A specific AI function in the GRC Suite+ modules is not clearly attributed in the sources checked.[28] [29] [30] [31]Not specifically documented in the source check
No transfer of AI functions of a neighbouring product to the GRC suite without specific evidence; no evidence of the absence of AI.
Sources checked: [28] [31] · CMDB AI documented; specific use in GRC Suite+ not documented within the scope of sources.
Source check: 2026-10-14
infodas (Airbus) · Product: SAVe · Headquarters: Germany [32] · infodas; INFODAS Gesellschaft für Systementwicklung und Informationsverarbeitung mbH; SAVe; Airbus Defence and SpaceDocumented focus: SAVe supports the set-up and operation of an information security management system in accordance with IT-Grundschutz and ISO 27001. The software links business processes and target objects with protection requirements, risks and security requirements. Modelling, baseline protection checks, risk analysis and reports accompany the work. Custom catalogues and consistency checks complement the methodological work; the provider is the German Airbus subsidiary infodas.AI functions and classification: For SAVe ISMS, no specific AI work step was documented in the product pages checked or in the targeted vendor search. infodas's AI consulting and general AI articles are separate offerings.[33] [32] [34] [35] [36]Not specifically documented in the source check
The assessment refers to SAVe ISMS and not to all Airbus/infodas products.
Sources checked: [33] [36] · No specific AI function documented in the sources checked.
Source check: 2026-10-14
IntelliGRC · Product: IntelliGRC / AI-CISO · Headquarters: USA [37] · Legal documentation names Tiber Creek Consulting, Inc. – IntelliGRC with an address in Fairfax, Virginia. · Tiber Creek Consulting, Inc.; AI-CISODocumented focus: Multi-tenant cyber compliance platform for IT service providers and their clients, with asset scoping, control mapping, evidence and measures for CMMC, NIST, SOC 2, ISO 27001 and further frameworks.AI functions and classification: The AI support, called AI-CISO, maps evidence, analyses compliance gaps and supports context-specific workflows as well as the preparation of auditable documentation.[38] [37] · Specific AI functions documented
Map evidence to controls · Analyse compliance gaps · Prepare context-specific compliance documentation
AI evidence: [38] · The current product page describes integrated AI and offers a personalised demo. Functional scope and activation must be checked in the offer.
Source check: 2026-10-15
Intervalid · Product: Intervalid ISMS · Headquarters: Austria [39] · Intervalid ISMS; Intervalid DSMS; Intervalid GmbHDocumented focus: Intervalid ISMS links security requirements with assets, protection requirements, risks and measures. Responsibilities, deadlines and approvals steer implementation; versioned policies, evidence and reports support audits and statements of applicability. Further functions record incidents and supplier assessments. Additional modules use the common data basis for data protection as well as business impact analyses and contingency planning in the company.AI functions and classification: Intervalid describes AI assistance for maintaining ISMS/DSMS data: the application suggests more complete and more comprehensible content and offers context-specific templates and guidance.[40] [39] [41] · Specific AI functions documented
Supplement ISMS/DSMS documentation with suggestions · Provide context-specific templates for data entry
AI evidence: [40] [41] · According to the vendor, Intervalid 2.0 has been rolled out gradually since the beginning of 2026; new features are included in the usage fee. Check the instance-specific rollout. No product test.
Source check: 2026-10-14
Intuitem CISO Assistant · To the detailed profile · Headquarters: France [42] · intuitem SARL; Vélizy-Villacoublay, France; SIRET 84450819200029, RCS Versailles.Documented focus: Open GRC platform for security programmes with risk assessment, control mapping, evidence, audits and third parties.AI functions and classification: CISO Assistant integrates an AI chat and MCP for suggestions on risk assessment, mapping of controls and analysis of compliance gaps. Custom models can be used in the chosen environment.[43] [44] [45] · Specific AI functions documented
Prepare risk assessments · Map controls · Analyse compliance gaps
AI evidence: [45] · According to the vendor, local AI engine in Community and Pro; own model required. Managed SaaS model option still in development and not counted as available. Not tested in practice.
Source check: 2026-10-14
isidaten · Product: isidaten · Headquarters: Germany [46] · isidaten GmbHDocumented focus: isidaten maps the relationship between risk register, risk treatment, controls and statement of applicability for ISO 27001. Assets and responsibilities are linked with measures and evidence. Document approvals, acknowledgements, internal audits and the handling of findings support operations. Key figures and reports make the implementation status and the effectiveness of controls traceable.AI functions and classification: isidaten describes AI queries on current risks, measures, assets and firewall governance via MCP. The product assistant answers subject-matter questions and suggests form content or changes for confirmation.[47] [48] [46] [49] · Specific AI functions documented
Query risk and measure status conversationally · Suggest GRC form content · Provide governance data for AI analyses
AI evidence: [49] [48] · AI activation and authorised AI client/MCP access required; changes only after confirmation. No product test.
Source check: 2026-10-14
ISMS.online · Headquarters: United Kingdom [50] · Contracting party ALLIANTIST LIMITED; registered in England and Wales, no. 04922343; registered office Brighton, England.Documented focus: Management system for assets, risks, controls, suppliers, audits and several standards.AI functions and classification: ISMS.online describes AI governance and ISO 42001 support. Its own AI assistance for risk, control or compliance tasks is not specifically documented in the product sources checked.[51] [52]Not specifically documented in the source check
Product overview and indexed Virtual Coach description read: videos, checklists and guides are not AI evidence. ISMS Copilot is a different provider.
Sources checked: [51] [52] · No specific AI availability can be derived from the sources checked.
Source check: 2026-10-14
Isodora · Product: Isodora Compliance Platform · Headquarters: Sweden [53] · Isodora AB, organisation number 559565-0424, Enskede, Sweden. · Isodora AB; IsoDoraDocumented focus: Compliance platform with requirements, controls, owners, evidence and audit history. Automated controls against connected systems complement the documentation of several sets of rules.AI functions and classification: Specialised AI assistants generate draft documentation from answers about the organisation and map the same answers to several sets of rules. An assistant answers questions about controls, gaps and audit readiness.[54] [55] [53] · Specific AI functions documented
Draft compliance documentation · Map answers to several sets of rules · Answer control and audit questions
AI evidence: [54] · According to a vendor announcement, open to new customers since 1 September 2026; seven-day trial access offered. The terms of use require AI-generated content to be reviewed before use for certification or by authorities.
Source check: 2026-10-15
Kertos · To the detailed profile · Headquarters: Germany [56] · Kertos GmbH; Munich, Germany; HRB 271165.Documented focus: Links information security, data protection and AI governance with evidence and expert support. The platform addresses European compliance requirements in particular.AI functions and classification: Kertos AI fills in compliance documents, suggests suitable policies and next work steps and supports the identification of risks in the compliance context.[57] [58] [59] · Specific AI functions documented
Draft and fill in compliance documents · Suggest suitable policies and next measures · Analyse compliance risks
AI evidence: [58] · Documented by the vendor within the platform; the offering combines software with expert support. Not tested in practice.
Source check: 2026-10-14
KRES.ID · Product: Pakem NGRC · Headquarters: Indonesia [60] · The vendor and product pages name PT Karya Siber Mandiri with an address in Depok, West Java, Indonesia. KRES offers consulting and a separately described software product; the Nogo GRC brand from older product pages is not counted separately. · PT Karya Siber Mandiri; KRES; Pakem NGRC; Nogo GRC SystemDocumented focus: Pakem NGRC links risk register, control mapping, statement of applicability, evidence and compliance assessments. Alongside international security standards, KRES.ID names Indonesian data protection and financial sector requirements.AI functions and classification: The product page describes an AI pipeline that analyses control, evidence and risk data, identifies gaps and overlaps and proposes risk assessments and prioritised measures. Suggestions for improving controls are named as a further use.[61] [60] [62] · Specific AI functions documented
Identify control and evidence gaps · Assess risks with GRC data · Prioritise remediation measures
AI evidence: [61] · Product and implementation offering via vendor contact. The publicly described AI pipeline has not been tested by us; confirm the model, specific licence version and scope of local control libraries before procurement.
Source check: 2026-10-15
Lutech · Product: Lutech GRC; Eyes on Threats · Headquarters: Italy [63] · The company page names Lutech S.p.A., with registered office and headquarters in Milan, and REA 1666842. · Lutech S.p.A.; Lutech GRC; Eyes on ThreatsDocumented focus: Lutech describes an in-house developed GRC platform for security risks and compliance. It links information on assets, threats and safeguards and is used, among other things, in its own cyber defence offering.AI functions and classification: AI supports the processing of regulatory documents and corporate policies as well as compliance assessments. For cyber risks, Lutech also describes context-specific risk assessments and generative summaries of technical reports.[64] [63] · Specific AI functions documented
Analyse regulatory documents · Support compliance assessments · Assess cyber risks in context · Summarise security reports
AI evidence: [64] · Own platform documented in the Lutech offering, including use in the A3 CyberDefence Center. Stand-alone SaaS booking or separate licensing cannot be derived from the source; clarify the offering model.
Source check: 2026-10-15
Make IT Safe · Product: Make IT Safe; DORA Toolkit · Headquarters: France [65] · MakeITSafe; Digitemis Make IT SafeDocumented focus: Make IT Safe supports security and data protection teams with internal assessments, supplier reviews, risks and shared action plans. The platform links reference frameworks such as ISO 27001, NIS2 and DORA with questionnaires and evidence. Additional tools address the DORA register of information and the integration of security into projects.AI functions and classification: The Make IT Safe DORA Toolkit uses AI for structured import suggestions from existing files and for checking ICT contracts against DORA requirements. An assistant labelled as beta answers DORA questions with reference to the organisation's own data and regulatory texts.[66] [65] [67] [68] · Specific AI functions documented
Import suggestions for DORA data · DORA contract review · DORA questions with reference to company data
AI evidence: [68] · AI assistant in beta with usage quotas. According to the vendor, contract analysis twice in trial access, unlimited in the subscription. Import suggestions require confirmation. No product test.
Source check: 2026-10-14
Meta-Data Digital · Product: Secutiva · Headquarters: Spain [69] · Meta-Data; Meta-Data Digital S.L.; Meta-Data Digital SL; SecutivaDocumented focus: Secutiva by Meta-Data Digital combines information security management, control mappings, evidence and risk analyses. A common control model supports several sets of rules; document versions and approvals accompany the management of evidence. Further functions concern suppliers, incidents, internal audits and continuity. For consultancies and outsourced security officers, the platform offers separate tenants and reusable templates for supporting several organisations.AI functions and classification: The product page names AI-generated policies and procedure descriptions as well as answering security questionnaires. A context-specific copilot complements these functions within the specialist modules. General control mapping and evidence collection are not classed across the board as AI processes.[70] [69] [71] · Specific AI functions documented
Draft policies and procedure descriptions · Answer security questionnaires · Provide module-specific assistance
AI evidence: [70] · Documented by the vendor; not tested in practice
Source check: 2026-10-14
Mindlapse · Product: Mindlapse OS; Ernest · Headquarters: France [72] · The legal notice names Mindlapse SAS, 9 rue des Colonnes, Paris, RCS 939 571 535. · Mindlapse SASDocumented focus: Mindlapse links cyber risks, third-party reviews and compliance. Company context, controls and evidence flow into a shared data set for assessments and reports.AI functions and classification: Ernest proposes risk scenarios, treatments and control mappings. The AI drafts answers to supplier questionnaires from existing documents and checks statements against evidence; suggestions carry sources and are confirmed or rejected by subject-matter experts.[73] [74] [72] · Specific AI functions documented
Propose risk scenarios and measures · Map controls · Draft questionnaire answers from evidence
AI evidence: [73] [74] · Demo offering; check the productive scope and operating conditions. The vendor describes source references and human approval; no independent performance test.
Source check: 2026-10-15
Naq · Product: Naq · Headquarters: Netherlands [75] · Naq Cyber; Naq Cyber B.V.; Naq Cyber UK LtdDocumented focus: Naq combines controls, risks, policies, measures and evidence for several compliance frameworks. A particular focus is on healthcare companies and requirements such as NHS DSPT and DTAC. The platform also manages clinical hazards, training, suppliers and the versioning of policies.AI functions and classification: Naq describes a read-only AI assistant for compliance questions, summaries and evidence reviews across the entire compliance programme. The assistant does not change any formal records in doing so.[76] [75] [77] · Specific AI functions documented
Answer compliance questions · Summarise the compliance programme · Review evidence
AI evidence: [76] · Documented by the vendor as a read-only assistant; no product test.
Source check: 2026-10-14
neonotu · Product: Sightadel · Headquarters: Germany [78] · neonotu GmbH; Edelsbergstraße 8, Munich; HRB 313206, Munich Local Court. Sightadel remains a product of this provider. Geography checked on 15 October 2026; no inference about hosting or owners from the registered office. · Provider: neonotu; product: SightadelDocumented focus: Links requirements, assessments, risks, evidence and measures across several frameworks. Answers and documents remain assigned to the respective review items.AI functions and classification: Sightadel uses AI to prepare draft policies and evidence from existing information, assets, evidence and previous answers. Bullet points can be developed into reviewable sections; adoption requires human confirmation.[79] [80] [78] · Specific AI functions documented
Create draft policies from existing information · Pre-formulate control and evidence documentation · Develop bullet points for ISMS documents
AI evidence: [80] · Documented by the vendor; not tested in practice.
Source check: 2026-10-14
OptiTech · Product: OptiTech Compliance Platform · Headquarters: Sweden [81] · The contract terms name OptiTech Sverige AB, org. no. 559489-8917, Karlslundsvägen 8 in Sweden. · OptiTech Sverige AB; OptiTech ComplianceDocumented focus: OptiTech links security requirements, policies, control evidence, incidents and supplier registers. The offering is aimed particularly at Nordic organisations and includes Swedish as well as European frameworks.AI functions and classification: The platform uses AI to create drafts of policies, procedures, gap analyses and questionnaire answers. It suggests control mappings and offers an assistant for organisation-specific compliance questions. Generated content must be reviewed and approved.[82] [81] · Specific AI functions documented
Draft policies · Summarise gap analyses · Prepare questionnaire answers · Suggest control mappings
AI evidence: [81] · Commercial platform with demo and published pricing. Scope of service depends on the package; any beta or trial functions are subject to separate terms.
Source check: 2026-10-15
ORBIT · Product: AssetControl · Headquarters: Czechia [83] · ORBIT s.r.o., Prague, IČ 16628110, register C 156620. · ORBIT s.r.o.; AssetControl; SUDOP CITDocumented focus: Cyber GRC platform for assets, risks, suppliers, controls and continuity planning. Approvals and reports link the assessment with evidence on NIS2, DORA and security standards.AI functions and classification: AI reads internal documents and maps them to requirements. For uploaded IT supplier contracts, it identifies security clauses and missing provisions, for example on audit rights, incident reporting or subcontractors.[84] [83] · Specific AI functions documented
Map documents to requirements · Pre-review supplier contracts · Identify missing security clauses
AI evidence: [84] · Product version 1.3 described with access and SaaS/self-hosted variants. AI contract review in a higher package; price table labelled as a draft. Confirm the binding functional scope.
Source check: 2026-10-15
Ostendio · Product: OstendioDocumented focus: Brings together security requirements, tasks, evidence and risk assessments. Auditors, internal owners and external partners can be involved in the work.AI functions and classification: No specific AI GRC work step was documented within the product scope checked. Ostendio's terms of use mention AI functionality but do not specify any individual function; content about AI risks is likewise not sufficient for this.[85] [86]Not specifically documented in the source check
Product page and AI clause as well as targeted vendor search checked. The status only means that specific evidence of a function is missing, not that AI is missing.
Sources checked: [85] [86] · No specific AI work step documented in the source check; no statement about the absence of AI.
Source check: 2026-10-14
Paramify · Product: ParamifyDocumented focus: Focus on security and risk documentation for US federal requirements such as FedRAMP, FISMA and CMMC. Shared data supports gap analyses, implementation planning and recurring SSP and POA&M documentation.AI functions and classification: Paramify offers optional AI for drafting cross-framework control responses and for identifying required elements when importing existing System Security Plans. In-app agents and further AI workflows are described separately as Coming Soon.[87] [88] · Specific AI functions documented
Draft control responses from existing risk information · Identify elements from existing System Security Plans
AI evidence: [88] · According to the vendor, existing AI functions are optional; model choice and AI permission in the workspace. In-app agents, Evidence Scoring and questionnaire functions that are still announced are not counted as available; no product test.
Source check: 2026-10-14
Perium · Product: Perium · Headquarters: Netherlands [89] · Perium B.V.Documented focus: Perium links risk registers, control measures, assessment results and continuous improvement cycles. Predefined standards and management systems support information security and data protection in particular; custom requirement catalogues are also possible. The platform is also aimed at smaller organisations and sector-specific applications, for example in Dutch healthcare and the public sector.AI functions and classification: No specific AI function for GRC work steps is documented in the source check. The AI topic page describes the management of AI risks; automated control tests are not in themselves AI evidence.[89] [90] [91] [92] [93]Not specifically documented in the source check
Product, AI governance and control testing pages as well as targeted vendor searches checked. The result does not mean that the provider does not use AI.
Sources checked: [91] [92] [93] · No specific AI-in-GRC function documented in the vendor sources checked.
Source check: 2026-10-14
Phinasoft · Product: Phinasoft · Headquarters: France [94] · PHINASOFT SASDocumented focus: Phinasoft offers a platform for cyber risks, information security management and compliance. It links risk analyses according to EBIOS RM or custom methods with impact analyses, recurring controls, evidence and action plans. Security approvals, time-limited exemptions, data protection and supplier assessments complement the functional scope. Several sets of rules can be evaluated together; dashboards and reports support management.AI functions and classification: The vendor documents a context-specific assistant, document pre-analysis and an agent mode. The AI suggests assessments, measures and reports; changes require human approval. Documents and sets of rules used are referenced and interactions are logged.[95] [96] [97] [94] · Specific AI functions documented
Evaluate documents and pre-fill risk or compliance assessments · Map evidence to requirements · Suggest threat scenarios and action plans · Generate context-specific answers and reports
AI evidence: [96] · Documented by the vendor; not tested in practice
Source check: 2026-10-14
Reglyze · Product: Reglyze NIS2 · Headquarters: France [98] · Operator Cyril Poder, French sole proprietorship (micro-entreprise), Mantes-la-Jolie; SIREN 440554541. Not a corporation. · Cyril Poder; Reglyze NIS2Documented focus: Software for NIS2 applicability checks, gap assessment, policies, incidents and supplier risks. The offering is aimed particularly at smaller companies and supports country-specific sets of rules.AI functions and classification: AI supports the identification of relevant obligations, creates editable draft policies and evidence and prepares answers to security questionnaires as well as incident reports. Approvals and reports to authorities remain with the user.[99] [98] · Specific AI functions documented
Draft policies · Answer security questionnaires · Prepare incident reports
AI evidence: [99] · Free entry level and paid platform plans offered; local operation also available on request. Public product demos and self-created compliance evidence are described.
Source check: 2026-10-15
RegO · Product: RegO; Compliance Companion · Headquarters: Singapore [100] · The vendor names Singapore as HQ and Tamil Nadu as development location. The contact refers to DevOpsLabs; its general terms and conditions name DevOpsLabs Private Ltd. in Singapore. Confirm the RegO contracting entity separately. · RegO OSCAL; DevOpsLabs (contact attribution)Documented focus: RegO brings together controls, evidence, assessments and measures in an OSCAL-based platform. Several frameworks can use shared controls and evidence; technical checks complement manual assessments.AI functions and classification: The Compliance Companion reads evidence, maps controls and answers questions on compliance status in natural language. The AI analysis complements the shared control and evidence model.[101] [102] [100] [103] · Specific AI functions documented
Evaluate evidence · Map controls · Answer compliance questions
AI evidence: [101] · Demo on request. The public AI description is brief; check processing, production scope and specific contract terms separately.
Source check: 2026-10-15
RegScaleDocumented focus: Continuous control capture, compliance documentation and evidence with technical automation and system connections.AI functions and classification: RegScale RegML creates drafts of System Security Plans from documents or onboarding answers. The AI auditor checks the documentation for gaps; AI functions must be explicitly activated.[104] [105] [106] · Specific AI functions documented
SSP text drafts from documents · SSP drafts from questionnaire answers · AI-assisted gap review of security plans
AI evidence: [105] [106] · Opt-in with administrative activation; SaaS activation via Customer Success, local deployment described for suitable resources. No product test.
Source check: 2026-10-14
Risk Hunter · Product: Risk Hunter / QANTIX · Headquarters: France [107] · Legal provider information on riskhunter.eu: YMUNIT, SIRET 87918933000027, France. · YMUNIT; RiskHunter; QANTIXDocumented focus: Cyber GRC platform for risks, controls, measures and audit evidence with risk analyses oriented to EBIOS and ISO 27005.AI functions and classification: AI supports risk analyses and action plans, explains and prioritises suggestions and documents their links to controls and evidence. Humans validate the results.[108] [109] [110] [107] · Specific AI functions documented
Analyse cyber risks · Prioritise measures · Document decisions with evidence
AI evidence: [108] [109] [110] · Current product offering with demo; local and optional external models according to the provider.
Source check: 2026-10-15

Sources.

The numbers in square brackets refer to this list. It is numbered consecutively for this page.

  1. FEHA Assurtech: vendor source, headquarters evidence checked 15.10.2026
  2. FEHA Assurtech: main source, AI evidence checked 15.10.2026
  3. FEHA Assurtech: vendor source, AI evidence checked 15.10.2026
  4. FEHA Assurtech: vendor source checked 15.10.2026
  5. fuentis: vendor source, headquarters evidence checked 14.10.2026
  6. fuentis: main source checked 14.10.2026
  7. fuentis: vendor source checked 14.10.2026
  8. fuentis: vendor source checked 14.10.2026
  9. fuentis: vendor source checked 14.10.2026
  10. Galea: vendor source, headquarters evidence checked 15.10.2026
  11. Galea: main source, AI evidence checked 15.10.2026
  12. GRiCk: vendor source, headquarters evidence checked 15.10.2026
  13. GRiCk: main source, AI evidence checked 15.10.2026
  14. Guardiso: vendor source, AI evidence, headquarters evidence checked 15.10.2026
  15. Guardiso: main source checked 15.10.2026
  16. Guardiso: vendor source, AI evidence checked 15.10.2026
  17. Hicomply: vendor source, headquarters evidence checked 14.10.2026
  18. Hicomply: main source checked 14.10.2026
  19. Hicomply: vendor source, AI evidence checked 14.10.2026
  20. Hicomply: vendor source checked 14.10.2026
  21. HiScout GRC Suite: headquarters evidence checked 14.10.2026
  22. HiScout: platform technology and shared database HiScout · vendor source, checked 14.10.2026
  23. About HiScout: company and target groups HiScout · vendor source, checked 14.10.2026
  24. HiScout GRC Suite: vendor source checked 14.10.2026
  25. Hyperproof: AI-Powered GRC Platform Hyperproof · vendor source, checked 14.10.2026
  26. Hyperproof: AI Guided Experiences, 9 April 2026 Hyperproof · vendor source, AI evidence, checked 14.10.2026
  27. i-doit GRC Suite+: headquarters evidence checked 14.10.2026
  28. i-doit GRC Suite+: modules and shared database i-doit · vendor source, checked 14.10.2026
  29. i-doit up: AI in IT asset management i-doit · vendor source, checked 14.10.2026
  30. i-doit: acquisition of CONTECHNET, 3 June 2025 i-doit · vendor source, checked 14.10.2026
  31. i-doit GRC Suite+: vendor source checked 14.10.2026
  32. infodas (Airbus): vendor source, headquarters evidence checked 14.10.2026
  33. infodas (Airbus): main source checked 14.10.2026
  34. infodas (Airbus): vendor source checked 14.10.2026
  35. infodas (Airbus): vendor source checked 14.10.2026
  36. infodas (Airbus): vendor source checked 14.10.2026
  37. IntelliGRC: vendor source, headquarters evidence checked 15.10.2026
  38. IntelliGRC: main source, AI evidence checked 15.10.2026
  39. Intervalid: vendor source, headquarters evidence checked 14.10.2026
  40. Intervalid: main source, AI evidence checked 14.10.2026
  41. Intervalid: vendor source, AI evidence checked 14.10.2026
  42. Intuitem CISO Assistant: headquarters evidence checked 14.10.2026
  43. Intuitem: CISO Assistant and AI functions Intuitem · vendor source, checked 14.10.2026
  44. CISO Assistant: official community repository Intuitem · vendor source, checked 14.10.2026
  45. Intuitem CISO Assistant: vendor source, AI evidence checked 14.10.2026
  46. isidaten: vendor source, headquarters evidence checked 14.10.2026
  47. isidaten: main source checked 14.10.2026
  48. isidaten: vendor source, AI evidence checked 14.10.2026
  49. isidaten: vendor source, AI evidence checked 14.10.2026
  50. ISMS.online: headquarters evidence checked 14.10.2026
  51. ISMS.online: Platform Overview ISMS.online · vendor source, checked 14.10.2026
  52. ISMS.online: vendor source checked 14.10.2026
  53. Isodora: vendor source, headquarters evidence checked 15.10.2026
  54. Isodora: main source, AI evidence checked 15.10.2026
  55. Isodora: vendor source checked 15.10.2026
  56. Kertos: headquarters evidence checked 14.10.2026
  57. Kertos: platform for continuous compliance Kertos · vendor source, checked 14.10.2026
  58. Kertos: AI functions within the platform Kertos · vendor source, AI evidence, checked 14.10.2026
  59. Kertos: AI Management System Kertos · vendor source, checked 14.10.2026
  60. KRES.ID: vendor source, headquarters evidence checked 15.10.2026
  61. KRES.ID: main source, AI evidence checked 15.10.2026
  62. KRES.ID: vendor source checked 15.10.2026
  63. Lutech: vendor source, headquarters evidence checked 15.10.2026
  64. Lutech: main source, AI evidence checked 15.10.2026
  65. Make IT Safe: vendor source, headquarters evidence checked 14.10.2026
  66. Make IT Safe: main source checked 14.10.2026
  67. Make IT Safe: vendor source checked 14.10.2026
  68. Make IT Safe: vendor source, AI evidence checked 14.10.2026
  69. Meta-Data Digital: vendor source, headquarters evidence checked 14.10.2026
  70. Meta-Data Digital: main source, AI evidence checked 14.10.2026
  71. Meta-Data Digital: vendor source checked 14.10.2026
  72. Mindlapse: vendor source, headquarters evidence checked 15.10.2026
  73. Mindlapse: main source, AI evidence checked 15.10.2026
  74. Mindlapse: vendor source, AI evidence checked 15.10.2026
  75. Naq: vendor source, headquarters evidence checked 14.10.2026
  76. Naq: main source, AI evidence checked 14.10.2026
  77. Naq: vendor source checked 14.10.2026
  78. neonotu: vendor source, headquarters evidence checked 14.10.2026
  79. neonotu: main source checked 14.10.2026
  80. neonotu: vendor source, AI evidence checked 14.10.2026
  81. OptiTech: vendor source, AI evidence, headquarters evidence checked 15.10.2026
  82. OptiTech: main source checked 15.10.2026
  83. ORBIT: vendor source, headquarters evidence checked 15.10.2026
  84. ORBIT: main source, AI evidence checked 15.10.2026
  85. Ostendio: main source checked 14.10.2026
  86. Ostendio: vendor source checked 14.10.2026
  87. Paramify: main source checked 14.10.2026
  88. Paramify: vendor source, AI evidence checked 14.10.2026
  89. Perium: main source, headquarters evidence checked 14.10.2026
  90. Perium: vendor source checked 14.10.2026
  91. Perium: vendor source checked 14.10.2026
  92. Perium: vendor source checked 14.10.2026
  93. Perium: vendor source checked 14.10.2026
  94. Phinasoft: vendor source, headquarters evidence checked 14.10.2026
  95. Phinasoft: main source checked 14.10.2026
  96. Phinasoft: vendor source, AI evidence checked 14.10.2026
  97. Phinasoft: vendor source checked 14.10.2026
  98. Reglyze: vendor source, headquarters evidence checked 15.10.2026
  99. Reglyze: main source, AI evidence checked 15.10.2026
  100. RegO: vendor source, headquarters evidence checked 15.10.2026
  101. RegO: main source, AI evidence checked 15.10.2026
  102. RegO: vendor source checked 15.10.2026
  103. RegO: vendor source checked 15.10.2026
  104. RegScale: compliance automation RegScale · vendor source, checked 14.10.2026
  105. RegScale documentation: RegML and explicit activation RegScale · vendor source, AI evidence, checked 14.10.2026
  106. RegScale: vendor source, AI evidence checked 14.10.2026
  107. Risk Hunter: vendor source, headquarters evidence checked 15.10.2026
  108. Risk Hunter: main source, AI evidence checked 15.10.2026
  109. Risk Hunter: vendor source, AI evidence checked 15.10.2026
  110. Risk Hunter: vendor source, AI evidence checked 15.10.2026
Back to top