T-NEX
Menu
DEEN
GRC provider register · Category 5 of 11 · Part 3 of 3

GRC software for information security, S to Z:
37 providers with AI classification.

In short: Part 3 of 3 of the Information security category: full entries for 37 of the 106 providers, alphabetically from S to Z, as of 18 October 2026. Of these, 33 document specific AI functions (89%). In Germany, Austria or Switzerland, nine have a documented headquarters, eight of them in Germany.

By and Published: As of: · Subpage of the GRC provider register Reviewed by Andreas Unruh and Christoph Gembruch, managing directors of T-NEX GmbH, on
Illustration: globe with networked GRC providers whose AI evidence flows into a checked provider register

Neither completeness nor a general suitability for banks is claimed. Providers are listed alphabetically. The order is not a performance rating.

All 682 GRC providers in the market overview · 379 European GRC providers · Information security category page (106)

Publisher: T-NEX GmbH. Andreas Unruh and Christoph Gembruch are managing directors of T-NEX. This editorial market overview is based on vendor sources and specialist primary sources. It contains no ranking and is not based on a joint product test. The market overview covers 682 providers from GRC and adjacent specialist areas. Acquired brands and former product names are not counted separately. Methodology and sources

Context, figures, review questions and the regulatory framework are on the Information security & cyber compliance category page.

Entries from S to Z: functions, AI classification and sources.

The assignment describes the offering considered, not all of the company's products. AI information names specific functions or limits of the public documentation. Scope of delivery, data storage and regional availability must be checked for each offering. Download provider overview as CSV (German), licensed under CC BY 4.0, credit “T-NEX GRC-Anbieterregister, t-nex.de”.

Is a provider missing or an entry out of date? Send us a note with a source via the contact form. Accepted changes are marked in the entry with the date they were checked.

Information security & cyber compliance: S to Z

37 entries

Information security & cyber compliance · S to Z · 37 providers
Provider / productDocumented focusAI functions and classification
ScalePad · Product: ControlMap · ControlMapDocumented focus: Supports managed service providers with compliance and vCISO services for multiple clients. Assessments, frameworks, evidence, tasks and reports accompany ongoing audit preparation.AI functions and classification: ControlMap Copilot supports answers to security questionnaires, policy drafts and gap analyses at requirement level. Recommendations and next steps use the context of the respective client environment.[1] [2] · Specific AI functions documented
Answer security questionnaires · Draft policies · Analyse requirement-specific gaps · Recommend follow-up steps
AI evidence: [2] · Documented beta for US-based ControlMap MSP partners and Pro client environments; end-customer users excluded at launch. Global rollout only planned. No product test.
Source check: 2026-10-14
Scrut AutomationDocumented focus: Organises security frameworks, risks, evidence, supplier reviews and audit preparation. Controls and documentation are used across several requirements.AI functions and classification: Scrut Teammates suggests policy-to-control mappings, identifies policy and evidence gaps and creates drafts of questionnaire answers as well as SOC 2 system descriptions.[3] [4] [5] [6] · Specific AI functions documented
Control mapping · Evidence review · Questionnaire answers · SOC 2 system description
AI evidence: [4] [6] · Integrated into Scrut, optionally activatable and configurable; plan limits not stated in the help pages checked.
Source check: 2026-10-14
ScytaleDocumented focus: Combines continuous control monitoring, evidence, risks and audit management with expert support. Overlapping security, data protection and AI frameworks can be mapped.AI functions and classification: Scytale describes AI agents for reviewing evidence, identifying control gaps and preparing policies and measures. Scy also supports mapping controls between frameworks.[7] [8] [9] · Specific AI functions documented
Check evidence against control requirements · Flag control gaps · Draft policies and measures · Map controls between frameworks
AI evidence: [8] · Documented by the vendor with human compliance expertise in the process; no product test.
Source check: 2026-10-14
Secani · Product: Secani; Secani MCP · Headquarters: Germany [10] · The legal notice explicitly names Jonathan Bezdek in Berlin as sole provider and contracting party. Secani is a product and business name, not an independent registered company. · Secani; Jonathan Bezdek; Secani MCP; Secani EveDocumented focus: Secani links requirements, controls, risks, evidence and review decisions in an ISMS workspace. Among other things, the platform uses OSCAL for structured and portable security information.AI functions and classification: The documented MCP service allows authorised AI clients to research compliance context, qualify evidence and map requirements. Write-access evidence and inventory workflows require approvals; AI provenance and versions are recorded.[11] [12] [10] [13] · Specific AI functions documented
Research compliance context · Qualify evidence · Map evidence to requirements · Maintain inventories with AI
AI evidence: [11] · MCP documentation names a productive service for authenticated users and external AI clients. The roadmap still lists extended workflow control, review creation and further approval functions as in progress; confirm the actual version scope.
Source check: 2026-10-15
Secfix · Product: Secfix · Headquarters: Germany [14]Documented focus: Secfix links security audits, risks, policies and supplier assessments for European companies. Integrations take over information from cloud, HR and identity systems; tasks and evidence support ongoing work on ISO 27001, TISAX, NIS2 and further frameworks. Expert support complements the software.AI functions and classification: CISO AI answers compliance questions, guides users through implementing controls in Secfix and explains steps for handling audit nonconformities.[15] [16] [14] · Specific AI functions documented
Answer compliance questions · Guide control implementation · Help handle audit nonconformities
AI evidence: [16] · According to the vendor, part of the platform subscription for all Secfix customers. No product test.
Source check: 2026-10-14
SECJUR · Product: Digital Compliance Office · Headquarters: Germany [17] · Datenschutz hoch 4Documented focus: The Digital Compliance Office combines information security, data protection and further compliance tasks on one platform. In addition to ISMS requirements, it manages processing activities, data subject requests and impact assessments. Additional modules concern quality management, whistleblower protection and the documentation and risk assessment of AI systems in companies.AI functions and classification: The Digital Compliance Office connects external AI assistants to the organisation's own compliance data via MCP. The assistants answer, for example, questions about published policies, open risks and outstanding training. Access is read-only and remains limited to booked modules and existing user permissions.[18] [17] [19] [20] [21] [22] · Specific AI functions documented
Answer questions about policies and compliance evidence · Query open risks and measures via AI assistant · Query outstanding compliance training
AI evidence: [20] [21] · MCP connection publicly documented; deactivated by default. SECJUR must activate the organisation, after which the customer administrator grants user rights. An external MCP-capable AI assistant with OAuth is required; no write function and no product test of our own.
Source check: 2026-10-15
SecTepe · Product: SecTepe.Core / KI-Automation · Headquarters: Germany [23] · Eckel SecTepe UG (haftungsbeschränkt), Wülfrath; Wuppertal Local Court HRB 33864. · Eckel SecTepe UG; SecTepe.CoreDocumented focus: Platform for ISMS, risks, controls, policies, audits and supplier evidence. Several security frameworks and a shared audit trail support compliance work.AI functions and classification: The RAG assistant answers audit and questionnaire questions from the organisation's own documents, with sources. AI drafts policies, suggests evidence-to-control mappings and summarises changes. Draft policies go through a human approval process.[24] [25] [23] · Specific AI functions documented
Answer audit questions with sources · Draft policies · Map evidence to controls
AI evidence: [25] · Product and demo offered. The current AI page describes IONOS models and optional local operation; agree the operating variant and scope specifically. Draft policies remain in suggestion mode.
Source check: 2026-10-15
SecureframeDocumented focus: Security controls, risk assessments, audit evidence and security questionnaires.AI functions and classification: Comply AI reviews evidence, supports the remediation of failed control tests, supplements risk assessments and drafts source-referenced answers for security questionnaires.[26] [27] · Specific AI functions documented
Evidence review · Test remediation · Risk assessment · Questionnaire answers
AI evidence: [27] · Comply AI is activated by default and can be switched off by administrators. Questionnaire AI requires LLM approval; AI supplier review may require a higher plan.
Source check: 2026-10-14
SecureSlate · Product: SecureSlateDocumented focus: Combines software and expert support for security audits. Controls, integrations, evidence, policies and supplier risks support, for example, SOC 2 and ISO 27001 preparation.AI functions and classification: SecureSlate describes AI for analysing control gaps, preparing evidence-based remediation and drafting answers to security questionnaires from the organisation's own knowledge base.[28] [29] · Specific AI functions documented
Analyse control gaps and prepare remediation for approval · Find evidence for controls and check it against framework requirements · Answer security questionnaires from policies and evidence
AI evidence: [28] · Offering documented by the vendor, consisting of platform and compliance support; suggested remediation and answers are submitted for review and approval. No product test.
Source check: 2026-10-14
Sekit · Product: Sekit; Sekura · Headquarters: Spain [30] · The provider page names the Sekit team in Valencia. A software legal entity of the same name can be found in the Spanish BORME; the legal attribution to the web offering has not been conclusively confirmed. · Sekit AI; SekuraDocumented focus: Sekit offers a GRC workspace for consultancies and internal compliance teams. It links framework assessments, risk registers, evidence, measures and reports with a change history for human and agent-assisted work.AI functions and classification: Sekura and connected AI assistants support gap analyses, check uploaded evidence against open controls and suggest risks together with treatment. Assessments and generated records remain editable in the workspace and are intended for human review.[31] [32] [30] · Specific AI functions documented
Analyse compliance gaps · Check evidence against controls · Draft risks and treatments · Prepare compliance reports
AI evidence: [31] [32] · Explicitly beta. Connection of external AI assistants via MCP described as available for consultancies; agent access for company workspaces on request. Public skills/plugin repository on the Spanish page still announced.
Source check: 2026-10-15
Sigea · Product: Sigea GRC · Headquarters: France [33] · Publisher and operator EURL Pierre Duval, SIREN 105332589; Avensan, France. · EURL Pierre Duval; Sigea GRCDocumented focus: Cyber GRC software for risk analyses, controls, compliance and audits, including in the EBIOS context.AI functions and classification: AI supports risk assessments and suggests risk mitigation measures. The function is listed in paid offerings.[34] [33] · Specific AI functions documented
Assess cyber risks · Suggest risk mitigation measures · Support control work
AI evidence: [34] · Free offering explicitly without AI; Pro offering with AI and demo.
Source check: 2026-10-15
Sokigo (Addnode Group) · Product: Aquil · Headquarters: Sweden [35] · The website names Sokigo AB, org. no. 556550-6309, Köping, Sweden. Addnode confirms the group affiliation; Aquil is not counted separately as a vendor. · Sokigo AB; Aquil; Addnode Group; Addnode Group ABDocumented focus: Aquil links ISMS documentation, control evidence, requirement tracking, processes and audit planning. The platform supports security and other management systems as well as their recurring reviews.AI functions and classification: AI generates organisation-specific policies, procedures and risk assessments and helps revise them. Further functions support gap analyses and the clean-up of duplicate requirements; existing documents can be used as context.[35] [36] · Specific AI functions documented
Draft policies · Prepare risk assessments · Analyse compliance gaps · Identify duplicate requirements
AI evidence: [35] · Free entry level and paid packages. According to the plan overview, audit planning and requirement tracking are assigned to the Enterprise package.
Source check: 2026-10-15
SprintoDocumented focus: Control monitoring, audits, risks and evidence with requirement and data connections.AI functions and classification: Sprinto AI reviews supplier documents, supports answering security questionnaires and summarises or revises policies. Results are reviewable and editable.[37] [38] · Specific AI functions documented
Supplier review · Questionnaire answers · Policy summary · Policy editing
AI evidence: [38] · Can be activated and deactivated via Settings > Sprinto AI; then available in the supported modules. Plan limits not stated in the documentation checked.
Source check: 2026-10-14
Strike Graph · Product: Strike GraphDocumented focus: Links security controls, evidence and audit preparation. Shared security programmes can cover several audit requirements and reuse evidence.AI functions and classification: With Verify AI, Strike Graph describes AI-assisted review of security controls. The AI Security Assistant answers questions from internal evidence; AI security reports use existing compliance data for supplier assessments.[39] [40] · Specific AI functions documented
AI-assisted control validation · Querying internal security documentation · Security reports for supplier assessments
AI evidence: [39] · Documented by the vendor; no product test.
Source check: 2026-10-14
TameTrust · Product: TameTrust / Claude agent team · Headquarters: Belgium [41] · Fabindias SRL, Brussels, company number BE0730815024, referred to in the contract as Tametrust. · Fabindias SRL; TametrustDocumented focus: Compliance workspaces for ISO 27001, NIS2, data protection and further sets of rules. Links policies, risk treatment, supplier review and audit evidence along the PDCA cycle.AI functions and classification: A locally integrated Claude agent team accesses TameTrust via MCP. Specialised agents support the review of requirements and SoA decisions, identify evidence gaps and prepare evidence packages as well as management overviews.[42] [41] · Specific AI functions documented
Investigate evidence gaps · Pre-review SoA decisions · Compile audit evidence
AI evidence: [42] · SaaS platform with contract terms and product tour. The AI team is described as an extension that can be combined locally via MCP; clarify Claude access, configuration and scope of service separately.
Source check: 2026-10-15
Teddy Technologies · Product: Teddy · Headquarters: Germany [43] · The legal notice names Teddy Technologies GmbH, Berlin, HRB 289626 at Charlottenburg Local Court. · Teddy Technologies GmbH; TeddyDocumented focus: Teddy links requirements, controls, policies, evidence and measures across several security frameworks. The platform supports audit preparation as well as the handling of questionnaires and supplier contracts.AI functions and classification: The provider describes AI agents for gap analyses, policy drafts, evidence mapping and source-referenced questionnaire answers. Contract drafts and other outward-facing results require human approval.[44] [43] · Specific AI functions documented
Analyse compliance gaps · Draft policies · Map evidence to controls · Answer security questionnaires
AI evidence: [44] · The vendor describes six agents as available and offers a demo. Individual additional workflows are marked as announced; check the specific contractual scope.
Source check: 2026-10-15
Telcon · Product: Telconis · Headquarters: Austria [45] · The legal notice names Telcon OG in Donnerskirchen, Austria, FN 537381t. · Telcon OG; TelconisDocumented focus: Telconis combines ISMS controls, risk registers, assets, measures and continuity documentation. The platform links several security frameworks and provides reports as well as templates.AI functions and classification: An integrated AI assistant answers organisation-specific questions on ISO controls, NIS2 measures and BCM requirements. The documented AI scope is context-specific subject-matter assistance; standard reports and framework mappings are not classed across the board as AI.[46] [45] · Specific AI functions documented
Answer ISMS subject-matter questions · Explain control requirements · Explain BCM requirements
AI evidence: [46] · Trial access and paid packages are offered. AI quotas and the variant described as offline differ by plan and should be specified in the offer.
Source check: 2026-10-15
Telefónica Tech · Product: SandaS GRC · Headquarters: Spain [47] · Telefónica; Telefonica; Telefónica Tech; Govertis; ElevenPaths; GesConsultor GRC; SandaS GRCDocumented focus: SandaS GRC is Telefónica Tech's own platform for security governance, risk management and regulatory assessments. It supports assessments across several standards, the assessment of risks and controls and traceable justifications for non-applicable controls. Additional modules concern data protection and business continuity; a particular focus is on the Spanish security framework ENS.AI functions and classification: SandaS GRC describes governance of AI use cases and the associated risk and evidence documentation. Specific AI support for a GRC work step is not documented in the product articles checked.[48] [49] [50] [47] [51]Not specifically documented in the source check
Current GRC announcement and Spanish product article read, targeted vendor search. SandaS SOC offerings and governance of AI not counted as separate AI GRC assistance.
Sources checked: [49] [51] · No specific available AI support documented in the source check; no product test.
Source check: 2026-10-14
ThoropassDocumented focus: Combines an audit lifecycle platform with its own audit services. Evidence, control mappings and auditor communication are managed from the preparation stage through to the report.AI functions and classification: First Pass uses AI to check audit evidence for missing documents, incorrect periods and inconsistencies. Smart Sort analyses GRC exports and maps the evidence they contain to matching controls and audit requests.[52] [53] [54] [55] · Specific AI functions documented
Pre-check audit evidence for gaps · Classify evidence from GRC exports · Map evidence to controls and audit requests
AI evidence: [53] [54] · Smart Sort documented as a launched platform function; First Pass described at introduction as an opt-in preview for full platform and audit customers. The current activation scope must be checked contractually; no product test.
Source check: 2026-10-14
TicTac · Product: StartComply · Headquarters: Greece [56] · The terms of use name the Greek operator TicTac Cyber Security & Data Recovery Services S.A. in Athens, VAT 800782394, GEMI 140756708000. StartComply is not additionally counted as a separate vendor. · TicTac Cyber Security & Data Recovery Services S.A.; StartComply; Start Comply; TicTac LaboratoriesDocumented focus: StartComply manages compliance assessments, policies, supplier risks and audit evidence. The offering focuses on European security and resilience requirements and links controls, gaps and measures in one platform.AI functions and classification: The vendor describes an AI engine that identifies compliance gaps and suggests remediation measures. Progress and assessments are linked with the compliance workflows; the existing template library is not equated with generative policy creation.[57] [56] · Specific AI functions documented
Identify compliance gaps · Suggest remediation measures · Support compliance assessments
AI evidence: [57] · Commercial SaaS with demo and subscription. Confirm the specific AI scope in the chosen package. The publicly available contract terms contain editorial leftovers; request a cleaned-up contract version and data processing terms before procurement.
Source check: 2026-10-15
TrustCloud · Product: TrustCloud · Former name: KintentDocumented focus: Links ongoing control monitoring with compliance evidence and risk relationships. Can also be used as an automation layer for existing GRC systems.AI functions and classification: TrustCloud documents AI-assisted answers to security questionnaires from the organisation's own controls, policies and documents. For custom compliance frameworks, AI suggests suitable controls and policies for approval.[58] [59] [60] · Specific AI functions documented
Answer security questionnaires · Map controls and policies to frameworks
AI evidence: [59] [60] · Documented by the vendor; agree the specific licence and implementation scope. No product test.
Source check: 2026-10-14
Trustero · Product: TrusteroDocumented focus: Supports evidence collection and control mapping, the assessment of control gaps and security questionnaires. Existing policies, controls and documents form the working basis.AI functions and classification: Trustero uses AI to map evidence to controls, frameworks, risks and policies. Further documented tasks are gap analyses, recommendations for measures and answering security questionnaires.[61] [62] [63] · Specific AI functions documented
Map evidence to controls and frameworks · Analyse control gaps · Recommend measures for the compliance roadmap · Answer security questionnaires
AI evidence: [63] · Documented by the vendor; no product test.
Source check: 2026-10-14
TrustMAPP · Product: TrustMAPPDocumented focus: Links security maturity with compliance, measures and management reports. One focus is on economic improvement planning, including capital and staffing costs.AI functions and classification: In the joint offering with Uno.ai, TrustMAPP describes AI-assisted third-party assessments as well as the automation of evidence, control and compliance work. The AI is attributable to the partner offering.[64] [65] · Specific AI functions documented
Support third-party assessments with AI · Handle evidence and control validation in the joint compliance workflow · Map controls between compliance frameworks
AI evidence: [65] · Joint offering with Uno.ai documented by the vendor; no statement about identical AI functions in the stand-alone TrustMAPP product. No product test.
Source check: 2026-10-14
TrusTrak Solutions · Product: RiskGuard · Headquarters: United Kingdom [66] · The terms of use name TrusTrak Solutions Ltd as operator and registration in England and Wales; the website names London. · TrusTrak Solutions Ltd; Trustrak Solutions Limited; RiskGuard; riskguardhq.comDocumented focus: RiskGuard links a risk register with controls, evidence, audit workflows and reports. Auditors receive access limited in time and scope for reviewing the documentation.AI functions and classification: The Claude-based assistant drafts risk entries and treatments, suggests controls and checks evidence gaps per control. It answers security questionnaires on the basis of the organisation's own documents and writes management summaries from current audit data.[67] [68] [66] · Specific AI functions documented
Draft risk entries · Suggest controls · Analyse evidence gaps · Answer security questionnaires · Summarise audit data
AI evidence: [68] · Paid subscription and demo offered. Publicly described functions were not tested in practice; AI assessments require expert review.
Source check: 2026-10-15
TTS Trusted Technologies and Solutions · Product: TTS trax · Headquarters: Germany [69] · TTS trax; TTS Trusted Technologies and Solutions GmbHDocumented focus: TTS trax organises information security via linked assets, business processes, risks and measures. Assessment workflows, deadlines, reminders and key figures support the treatment and monitoring of risks. Forms and workflows involve further participants in data collection. Additional modules link the ISMS with compliance, data protection and business continuity on the same platform.AI functions and classification: The TTS trax function description checked documents ISMS and compliance workflows, but no sufficiently specifically described AI work step. References to AI support in writing blog articles are not evidence of AI in the product.[70] [71] [72] [69] [73]Not specifically documented in the source check
Product page and targeted vendor domain search for KI and artificial intelligence checked. No evidence of a general absence of AI.
Sources checked: [70] [73] · No specific AI function documented in the sources checked.
Source check: 2026-10-14
UESE Italia · Product: ISOPILOT / ISO 27001 ISMS Workspace · Headquarters: Italy [74] · UESE ITALIA S.p.A.; ISOPILOT; UESE DigitalDocumented focus: ISOPILOT offers a dedicated ISMS workspace that links assets, risk assessment, risk treatment, Annex A controls and statement of applicability. Owners document control decisions and evidence, plan audits and track nonconformities and corrective actions. UESE's platform also supports controlled documents and approvals; risk acceptance and decisions on control applicability remain explicitly assigned to authorised persons.AI functions and classification: ISOPILOT's HoloAssistant explains missing evidence in the project context and uses facts extracted from attachments with source and confidence information. Pre-checks can pre-fill fields on the basis of documented information and flag contradictory evidence for review.[75] [74] [76] · Specific AI functions documented
Explain evidence status and documentation gaps · Extract project information from attachments · Pre-fill documented assessment fields · Flag contradictory evidence
AI evidence: [76] [75] · Documented by the vendor with trial access; role- and project-specific context. Control applicability, risk acceptance and approvals remain human. No product test.
Source check: 2026-10-14
Uncia · Product: Uncia SI / Conformité · Headquarters: France [77] · Uncia SAS, Boulogne-Billancourt; SIRET 91970590500017 according to the legal notice. · Uncia SAS; Uncia SIDocumented focus: IT architecture and documentation platform with supplementary compliance checking. It links system overviews, dependencies and data flows with ISO 27001/NIS2 requirements, deviation notices and audit exports.AI functions and classification: AI analyses the system inventory, suggests structured modelling and creates or updates architecture documentation. These documents and overviews support evidence work; the framework-specific control check is not classed across the board as AI.[78] [79] [77] · Specific AI functions documented
Generate system documentation for security evidence · Suggest architecture models · Update documentation when systems change
AI evidence: [78] · Commercial platform with demo. The focus remains IT architecture; check the scope of the compliance functions and usable evidence formats in the offer.
Source check: 2026-10-15
Unicis.Tech · Product: Unicis Platform; Unicis MCP Server · Headquarters: Estonia [80] · The legal notice names Unicis.Tech OÜ in Tallinn, registry code 16566212. · Unicis.Tech OÜ; Unicis; Unicis PlatformDocumented focus: Unicis combines data protection records, security controls, risks and evidence in an open-core platform. The company also offers Atlassian applications for selected compliance processes.AI functions and classification: The documented MCP server connects external AI assistants with compliance data. This allows users to query and update controls and risks in natural language and to edit tasks and data protection records.[81] [82] [80] · Specific AI functions documented
Query control status via AI assistant · Edit risk register via AI assistant · Create compliance tasks from natural language
AI evidence: [81] [82] · According to the documentation, MCP functions in Premium and Ultimate, not in the Community plan. External AI assistant, API access and set-up required; no proprietary foundation model of the provider is claimed.
Source check: 2026-10-15
UPRIVER / AuditFlow · Product: AuditFlow ISMS · Headquarters: Japan [83] · A vendor press release names 株式会社UPRIVER with an address in Ginza, Chuo-ku, Tokyo; the current ISMS offering confirms UPRIVER as operator. · 株式会社UPRIVER; UPRIVER Inc.; AuditFlow ISMS; オーディットフローDocumented focus: Specialist in setting up and operating an ISO 27001 management system in small companies. Guides users through work steps, registers, documentation and preparation for the certification audit.AI functions and classification: AI creates drafts for information asset recording, risk assessment and ISMS documents on the basis of the organisation's data. Users review and amend the drafts. Completeness checks of the audit documentation, by contrast, are explicitly based on fixed rules.[84] [85] [83] · Specific AI functions documented
Draft ISMS documents · Prepare asset recording · Prepare risk assessments
AI evidence: [84] · AuditFlow ISMS is offered as a paid self-service with a 14-day document preview; downloads after paid registration. Individual ISMS consulting is not included.
Source check: 2026-10-15
Vailor · Product: Vailor · Headquarters: France [86] · VAILOR SASDocumented focus: Vailor develops a platform for cyber risks and compliance with a common organisational model. Risk analyses according to EBIOS RM, risk registers, measures and controls are linked. Evidence supports the assessment of several sets of rules; configurable scales and roles represent corporate groups. The provider offers an accompanied pilot launch and a design partner programme.AI functions and classification: The AI reads documents provided and pre-fills preliminary analyses as well as EBIOS RM analyses. An assistant answers questions in the context of the respective analysis. Suggestions cite document passages and must be confirmed by a human. AI analysis of supplier questionnaires is explicitly described as only planned.[87] [86] · Specific AI functions documented
Pre-fill preliminary analyses from project documents · Prepare EBIOS RM analyses on the basis of the organisation's own documents and security policies · Answer questions in the context of a risk analysis
AI evidence: [87] · Pilot/design partner offering documented by the vendor; not tested in practice
Source check: 2026-10-14
VantaDocumented focus: Automated security evidence, continuous control checks, risk management and Trust Center.AI functions and classification: The Vanta AI Agent creates draft policies, reviews evidence, suggests questionnaire answers and identifies discrepancies between policies and actual implementation.[88] [89] · Specific AI functions documented
Policy drafts · Evidence review · Questionnaire answers · Discrepancy analysis
AI evidence: [89] · Functional scope depends on the products purchased; the AI review of supplier documents, for example, requires the TPRM offering.
Source check: 2026-10-14
VectaIA · Product: VectaIA; Julie; Oscar · Headquarters: France [90] · The legal notice names VectaIA SAS, SIREN 994 933 257, with its registered office at Campus Cyber Région Sud in Marseille. · VECTAIA SAS; VectaIA Copilote; Julie; OscarDocumented focus: VectaIA supports the documentation and assessment of cyber security requirements. The platform links internal documents, audit and control plans, findings and measures with several security frameworks.AI functions and classification: AI agents compare existing documents with requirements, identify gaps and suggest prioritised measures. They draft security policies and audit reports, answer security questionnaires from the internal document base and analyse the impact of changed requirements.[91] [90] · Specific AI functions documented
Check documents against requirements · Identify compliance gaps · Answer security questionnaires · Draft audit reports · Analyse impact of changes
AI evidence: [91] · Platform offered with demo and expert support; clarify the scope of the agents and cloud or local deployment before procurement.
Source check: 2026-10-15
verinice · Headquarters: Germany [92] · Software provider SerNet GmbH; Göttingen; HRB 2816 Göttingen Local Court.Documented focus: verinice by SerNet is an open-source platform for information security, data protection and BCM.AI functions and classification: No specific AI work step is documented in the verinice product sources checked. The representation of AI risks in IT-Grundschutz describes governance of AI and is not sufficient for this.[93] [94] [95] [96]Not specifically documented in the source check
Product presentation of the new generation and official search results on AI and assistants checked. General APIs and AI-related training not counted as an AI function.
Sources checked: [93] [96] · AI availability not specifically documented in the source check.
Source check: 2026-10-14
VibrantiX · Product: VibrantiX · Headquarters: Singapore [97] · The contact page names Singapore as Global Headquarters, with further offices in the UAE and India. The terms of use choose UAE law; this does not evidence the registered office of a particular contracting company. The full corporate structure remains open. · Vibrantix; Vibrantix Inc.; VibrantiX AIDocumented focus: VibrantiX links security controls, policies, evidence, risks and third-party assessments in a compliance platform. Interfaces bring in information from existing cloud and enterprise systems. Teams can provide documents for control reviews, handle security questionnaires and track measures. The public presentation names pilot customers and combines the software with ongoing support for compliance work.AI functions and classification: VibrantiX describes agents that check document evidence against controls and flag gaps, draft answers to security questionnaires from policies and create context-specific draft policies.[98] [97] [99] [100] [101] · Specific AI functions documented
Check evidence against controls and flag gaps · Answer security questionnaires from existing policies · Create context-specific draft policies
AI evidence: [98] · The vendor describes active pilot customers and bookable product demos; a comprehensive general availability status is not claimed. No product test.
Source check: 2026-10-14
Virtualis · Product: SIGVERA · Headquarters: Croatia [102] · The vendor website names VIRTUALIS VIRTUALNI SUSTAVI d.o.o. with an address in Zagreb, Croatia, and OIB 55336668657. The SIGVERA cookie policy attributes the product to this company. The country evidence is thus secured via the company's own website rather than via LinkedIn alone. · VIRTUALIS virtualni sustavi d.o.o.; SIGVERA; SIGVERA EUDocumented focus: SIGVERA links technical security data with compliance assessments and audit evidence. The platform brings together information from security monitoring, firewalls and identity services and links findings with requirements and measures.AI functions and classification: The AI analyses security data, maps findings to regulatory controls and supports the identification and prioritisation of gaps. The provider also describes the creation of context-specific remediation steps and reports with references to evidence.[103] [104] [105] [102] · Specific AI functions documented
Analyse security data against controls · Prioritise compliance gaps · Map findings to requirements · Draft remediation steps
AI evidence: [103] · NIS2 offering with contact and demo request documented; public video tour still announced. DORA and ISO 27001 are explicitly marked as upcoming extensions in the section on regulatory coverage. Confirm specific delivery and integrations before procurement.
Source check: 2026-10-15
xmera Solutions · Product: xmera Omnia · Headquarters: Germany [106] · xmera Omnia; xmera Solutions GmbHDocumented focus: xmera Omnia links information security management with operational tasks, tickets and changes. Assets, protection requirements, risks and security requirements form the basis for action planning and risk treatment. Functions for audits, document approvals, key figures and recurring tasks support ongoing operations. Shared data can also be used for data protection, incidents and further management processes.AI functions and classification: In the source check of the functions and release description, no specific AI work step in xmera Omnia was documented. Automated routines and tasks alone are not AI evidence.[107] [108] [106]Not specifically documented in the source check
Functions and targeted vendor search for KI/AI checked. No evidence in the material checked does not mean that AI is fundamentally absent.
Sources checked: [107] [108] · No specific AI work step documented in the source check; no statement about the absence of AI.
Source check: 2026-10-14
Zania · Product: Zania AI Agents · Headquarters: USA [109] · The privacy policy names the US headquarters; provider information Zania Inc., 1950 University Ave, Palo Alto, California. · Zania Inc.; Zania AIDocumented focus: Zania links compliance evidence, control checks, internal risks and supplier assessments. The platform maps controls to several frameworks and records the status of the associated evidence. Owners can review results, sources and identified gaps and follow up on measures. Configurable responsibilities and approvals are intended to make integration into existing GRC workflows easier.AI functions and classification: The AI agents collect evidence, test the design and effectiveness of controls and flag deviations with source references. Browser-based evidence collection under human supervision and suggestions for prioritising and handling gaps are also documented.[110] [111] [109] [112] [113] · Specific AI functions documented
Collect and map evidence · Check control design and effectiveness · Identify control gaps with sources · Prioritise and forward measures
AI evidence: [110] · Documented by the vendor; human supervision and configurable approvals provided for. No product test.
Source check: 2026-10-14

Sources.

The numbers in square brackets refer to this list. It is numbered consecutively for this page.

  1. ScalePad: main source checked 14.10.2026
  2. ScalePad: vendor source, AI evidence checked 14.10.2026
  3. Scrut: compliance automation Scrut Automation · vendor source, checked 14.10.2026
  4. Scrut Teammates: documented AI workflows Scrut Automation · vendor source, AI evidence, checked 14.10.2026
  5. Scrut MCP: connection to AI tools Scrut Automation · vendor source, checked 14.10.2026
  6. Scrut Automation: vendor source, AI evidence checked 14.10.2026
  7. Scytale: compliance platform and expert support Scytale · vendor source, checked 14.10.2026
  8. Scytale: agentic compliance and human oversight Scytale · vendor source, AI evidence, checked 14.10.2026
  9. Scytale: acquisition of AudITech Scytale · vendor source, checked 14.10.2026
  10. Secani: vendor source, headquarters evidence checked 15.10.2026
  11. Secani: main source, AI evidence checked 15.10.2026
  12. Secani: vendor source checked 15.10.2026
  13. Secani: vendor source checked 15.10.2026
  14. Secfix: vendor source, headquarters evidence checked 14.10.2026
  15. Secfix: main source checked 14.10.2026
  16. Secfix: vendor source, AI evidence checked 14.10.2026
  17. SECJUR: vendor source, headquarters evidence checked 15.10.2026
  18. SECJUR: main source checked 15.10.2026
  19. SECJUR: vendor source checked 15.10.2026
  20. SECJUR: vendor source, AI evidence checked 15.10.2026
  21. SECJUR: vendor source, AI evidence checked 15.10.2026
  22. SECJUR: vendor source checked 15.10.2026
  23. SecTepe: vendor source, headquarters evidence checked 15.10.2026
  24. SecTepe: main source checked 15.10.2026
  25. SecTepe: vendor source, AI evidence checked 15.10.2026
  26. Secureframe: Security, Risk and Compliance Platform Secureframe · vendor source, checked 14.10.2026
  27. Secureframe Help: Overview of AI Capabilities, 16 July 2026 Secureframe · vendor source, AI evidence, checked 14.10.2026
  28. SecureSlate: main source, AI evidence checked 14.10.2026
  29. SecureSlate: vendor source checked 14.10.2026
  30. Sekit: vendor source, headquarters evidence checked 15.10.2026
  31. Sekit: main source, AI evidence checked 15.10.2026
  32. Sekit: vendor source, AI evidence checked 15.10.2026
  33. Sigea: vendor source, headquarters evidence checked 15.10.2026
  34. Sigea: main source, AI evidence checked 15.10.2026
  35. Sokigo (Addnode Group): main source, AI evidence, headquarters evidence checked 15.10.2026
  36. Sokigo (Addnode Group): vendor source checked 15.10.2026
  37. Sprinto: Autonomous Trust Platform Sprinto · vendor source, checked 14.10.2026
  38. Sprinto Docs: Sprinto AI Overview Sprinto · vendor source, AI evidence, checked 14.10.2026
  39. Strike Graph: main source, AI evidence checked 14.10.2026
  40. Strike Graph: vendor source checked 14.10.2026
  41. TameTrust: vendor source, headquarters evidence checked 15.10.2026
  42. TameTrust: main source, AI evidence checked 15.10.2026
  43. Teddy Technologies: vendor source, headquarters evidence checked 15.10.2026
  44. Teddy Technologies: main source, AI evidence checked 15.10.2026
  45. Telcon: vendor source, headquarters evidence checked 15.10.2026
  46. Telcon: main source, AI evidence checked 15.10.2026
  47. Telefónica Tech: vendor source, headquarters evidence checked 14.10.2026
  48. Telefónica Tech: main source checked 14.10.2026
  49. Telefónica Tech: vendor source checked 14.10.2026
  50. Telefónica Tech: vendor source checked 14.10.2026
  51. Telefónica Tech: vendor source checked 14.10.2026
  52. Thoropass: audit lifecycle platform and audit services Thoropass · vendor source, checked 14.10.2026
  53. Thoropass: introduction of First Pass AI Thoropass · vendor source, AI evidence, checked 14.10.2026
  54. Thoropass: Smart Sort AI for GRC exports Thoropass · vendor source, AI evidence, checked 14.10.2026
  55. Thoropass: renaming of Laika Thoropass · vendor source, checked 14.10.2026
  56. TicTac: vendor source, headquarters evidence checked 15.10.2026
  57. TicTac: main source, AI evidence checked 15.10.2026
  58. TrustCloud: main source checked 14.10.2026
  59. TrustCloud: vendor source, AI evidence checked 14.10.2026
  60. TrustCloud: vendor source, AI evidence checked 14.10.2026
  61. Trustero: main source checked 14.10.2026
  62. Trustero: vendor source checked 14.10.2026
  63. Trustero: vendor source, AI evidence checked 14.10.2026
  64. TrustMAPP: main source checked 14.10.2026
  65. TrustMAPP: vendor source, AI evidence checked 14.10.2026
  66. TrusTrak Solutions: vendor source, headquarters evidence checked 15.10.2026
  67. TrusTrak Solutions: main source checked 15.10.2026
  68. TrusTrak Solutions: vendor source, AI evidence checked 15.10.2026
  69. TTS Trusted Technologies and Solutions: vendor source, headquarters evidence checked 14.10.2026
  70. TTS Trusted Technologies and Solutions: main source checked 14.10.2026
  71. TTS Trusted Technologies and Solutions: vendor source checked 14.10.2026
  72. TTS Trusted Technologies and Solutions: vendor source checked 14.10.2026
  73. TTS Trusted Technologies and Solutions: vendor source checked 14.10.2026
  74. UESE Italia: vendor source, headquarters evidence checked 14.10.2026
  75. UESE Italia: main source, AI evidence checked 14.10.2026
  76. UESE Italia: vendor source, AI evidence checked 14.10.2026
  77. Uncia: vendor source, headquarters evidence checked 15.10.2026
  78. Uncia: main source, AI evidence checked 15.10.2026
  79. Uncia: vendor source checked 15.10.2026
  80. Unicis.Tech: vendor source, headquarters evidence checked 15.10.2026
  81. Unicis.Tech: main source, AI evidence checked 15.10.2026
  82. Unicis.Tech: vendor source, AI evidence checked 15.10.2026
  83. UPRIVER / AuditFlow: vendor source, headquarters evidence checked 15.10.2026
  84. UPRIVER / AuditFlow: main source, AI evidence checked 15.10.2026
  85. UPRIVER / AuditFlow: vendor source checked 15.10.2026
  86. Vailor: vendor source, headquarters evidence checked 14.10.2026
  87. Vailor: main source, AI evidence checked 14.10.2026
  88. Vanta: Automated Compliance Vanta · vendor source, checked 14.10.2026
  89. Vanta AI Vanta · vendor source, AI evidence, checked 14.10.2026
  90. VectaIA: vendor source, headquarters evidence checked 15.10.2026
  91. VectaIA: main source, AI evidence checked 15.10.2026
  92. verinice: headquarters evidence checked 14.10.2026
  93. SerNet: the new verinice generation verinice · vendor source, checked 14.10.2026
  94. verinice: BCM domains available, 13 August 2026 verinice · vendor source, checked 14.10.2026
  95. verinice: public interfaces and APIs verinice · vendor source, checked 14.10.2026
  96. verinice: vendor source checked 14.10.2026
  97. VibrantiX: vendor source, headquarters evidence checked 14.10.2026
  98. VibrantiX: main source, AI evidence checked 14.10.2026
  99. VibrantiX: vendor source checked 14.10.2026
  100. VibrantiX: vendor source checked 14.10.2026
  101. VibrantiX: vendor source checked 14.10.2026
  102. Virtualis: vendor source, headquarters evidence checked 15.10.2026
  103. Virtualis: main source, AI evidence checked 15.10.2026
  104. Virtualis: vendor source checked 15.10.2026
  105. Virtualis: vendor source checked 15.10.2026
  106. xmera Solutions: vendor source, headquarters evidence checked 14.10.2026
  107. xmera Solutions: main source checked 14.10.2026
  108. xmera Solutions: vendor source checked 14.10.2026
  109. Zania: vendor source, headquarters evidence checked 14.10.2026
  110. Zania: main source, AI evidence checked 14.10.2026
  111. Zania: vendor source checked 14.10.2026
  112. Zania: vendor source checked 14.10.2026
  113. Zania: vendor source checked 14.10.2026
Back to top