grc
(37)
Optro sees the risk between the spreadsheets.
It began with two friends and a neglected customer: the auditor. Now the company formerly called AuditBoard is teaching AI to do the paperwork - and helping businesses keep an eye on AI.
AuditBoard made the paperwork talk.
Two auditors built a business around the work nobody wanted to repeat. Now called Optro, AuditBoard is taking the same idea from SOX checklists to AI agents.
Pathlock follows the money. And the permissions.
A valid login can still lead to a bad payment. Pathlock connects access rights to business transactions, giving enterprises a closer look at what their people - and their machines - can actually do.
Vendict wants your next deal to escape the spreadsheet
A security questionnaire can hold a sale hostage. Vendict turns company documents into answers with evidence attached - and its most revealing customer story begins with a team that did not want to switch.
SecurityPal AI sells the relief of a finished security review
A nearly 200-page questionnaire gave Pukar Hamal his business idea. SecurityPal AI now pairs software with human analysts to get enterprise assurance work off the desk and out the door.
ControlCase and the art of doing the audit once
Every new security standard can bring another request for the same evidence. ControlCase has built a business around a sensible objection: why collect it twice?
Ncontracts and the Bank That Forgot Its Own Spreadsheet
A bank can remember every transaction and still forget how its own rules work. Ncontracts has built a business around that peculiar lapse, turning contracts, compliance and institutional knowledge into something people can actually use.
Andera's 43,000-Line Answer to a Spreadsheet
An early customer handed the audit startup a mountain of unruly workbooks. The fix became a 43,000-line Excel engine - and a revealing lesson in where useful AI actually begins.
Anecdotes and the Evidence That Refused to Sit Still
A compliance record can be correct on Monday and wrong by Friday. Anecdotes built its business around that awkward interval - and the enterprises willing to stop treating an audit as an annual scavenger hunt.
Ideagen built a billion-pound business on “prove it”
A missing signature. An outdated procedure. Sixty people reviewing the same document. Ideagen sells order to organizations that cannot afford to lose the paper trail.
GRC Solutions wrote the rulebook. Now it does the work.
A business that began with security books now sells the people, software and testing behind compliance. Its next bet puts round-the-clock cyber response on the same shopping list.
Drata Turned the Audit Scramble Into an Always-On Machine - Then Went After the Sales Cycle
The founders met compliance as a recurring evidence hunt. Five years later, Drata had crossed $100 million in annual recurring revenue and was selling a bigger idea: make proof of trust useful every day, not just during an audit.
Origami Risk Built a 1,000-Client Business by Fixing Insurance’s Unglamorous Plumbing
The Chicago software company won by treating claims, safety reports and policy records as one connected data problem. Now its bet is that the same platform can carry insurers from first incident to final invoice - with AI tucked into the paperwork.
The $5.3 Billion Cookie-Banner Company Had to Grow Up - Now OneTrust Wants to Govern Your AI
OneTrust turned a deadline called GDPR into one of software's fastest growth stories. After a bruising reset, the company behind countless cookie pop-ups is betting that the next compliance emergency will be every company's unruly fleet of AI models and agents.
Strike Graph Wants to Turn Your Next Security Audit From a Fire Drill Into a Background Task
The Seattle startup began with one founder's bruising SOC 2 experience. Six years and $20.4 million later, it is betting that graph-based data and small, private AI models can make compliance useful between audits - not merely survivable during them.
The Company That Made Audit Season Boring
Meiran Galis spent years at EY watching startups treat security audits like a fire drill. Scytale is his bet that compliance can run in the background instead of eating a quarter.
The Startup That Taught AI to Read the Rulebook
Most companies drown in regulation. 4CRisk.ai built specialized AI that reads the rulebook for them - and turned a six-month compliance grind into a four-day job.
Compyl
Compyl is a New York-based SaaS company that unifies governance, risk, and compliance (GRC) on a single platform. Founded in 2020 by former CISOs, it pulls evidence directly from more than 125 integrated systems, maps controls across 70+ frameworks like SOC 2, ISO 27001 and HIPAA, and uses agentic AI to draft evidence, score vendors and answer security questionnaires while keeping humans in control of decisions. Compyl raised a $12M Series A in June 2025 to scale its AI-led platform for mid-market and enterprise security teams.
CyberSaint
CyberSaint is a Boston-based cybersecurity software company whose CyberStrong platform helps enterprises assess, quantify, and communicate cyber risk. It converges compliance, security operations, and risk management, using AI to automate control scoring, translate cyber risk into financial terms, and produce board-ready reporting for Fortune 500 companies and high-growth organizations.
Lema AI
Lema AI is a New York-based cybersecurity startup building an agentic AI platform for third-party risk management (TPRM). Founded by three veterans of Israel's Unit 8200, Lema replaces static vendor questionnaires and check-the-box compliance with continuous, behavior-based analysis that maps how vendors actually operate inside an enterprise - tracking data access, permission changes and 'risk drift' to surface real attack paths. The company emerged from stealth in February 2026 with roughly $24M in total funding, including a $17.5M Series A led by Team8.
Process Street
Process Street is a San Francisco-based SaaS company that helps teams turn recurring, human-driven work into structured, trackable workflows. Founded in 2014 by Vinay Patankar and Cameron McKay to tame the repetitive processes of their remote marketing agency, it began as no-code, checklist-based process software and has since repositioned as an AI-powered compliance operations platform. Today it lets non-technical teams document policies, run standardized workflows, capture data through forms, automate approvals, and prove control for standards like ISO 9001 and SOC 2 - with AI agents such as Cora monitoring execution and flagging risk.
Rescana
Rescana is a cybersecurity company that builds autonomous, AI-agent-driven third-party risk management (TPRM) and external attack surface management software. Its platform discovers, classifies, assesses, monitors, and helps remediate risk across a company's vendor ecosystem - including vendors with no web presence - using agentic AI and open-source intelligence (OSINT). Founded by Guy Halfon and based between New York and Tel Aviv, Rescana targets regulated, vendor-heavy industries such as banking, telecom, healthcare, real estate and government, promising vendor-risk oversight that scales without a proportional increase in security headcount.
Supply Wisdom
Supply Wisdom is a New York-based SaaS company that delivers real-time, continuous third-party and location risk intelligence. Its platform monitors suppliers and business locations across seven risk domains - financial, cyber, operational, compliance, ESG/sustainability, nth-party, and location - tracking 350+ risk metrics and pushing early-warning alerts so enterprises can act before a disruption hits. Its clients are Fortune 100 and Global 2000 firms in financial services, insurance, healthcare, and technology.
Thoropass
Thoropass is a New York-based compliance and audit company that pairs compliance-automation software with an in-house, tech-enabled CPA and security audit firm. Founded in 2019 as Laika and rebranded in 2023, it lets companies get and stay certified across 30+ frameworks - SOC 2, ISO 27001, HIPAA, PCI DSS, HITRUST, GDPR, and ISO 42001 for AI - through a single platform where the auditor is assigned on day one. By reusing evidence across frameworks and layering AI features like First Pass AI and Smart Sort AI on top of continuous control monitoring, Thoropass helps growing businesses complete audits meaningfully faster than the traditional consultant-plus-auditor route.
Hitachi Cyber
Hitachi Cyber is the global cybersecurity and performance analytics arm of the Hitachi Group, operating under Hitachi Systems Trusted Cyber Management Inc. With roots going back to 1999, it delivers 24/7 managed security services, threat intelligence, governance-risk-compliance advisory, and performance analytics to more than 350 private and government organizations across 50-plus countries. A network of Security Operations Centers spanning Canada, Switzerland, Japan, India and Poland - integrated with Google Security Operations, Microsoft Sentinel and Splunk - anchors its detection and response work across IT, OT and AI environments.
Trustero
Trustero is a Palo Alto AI company building software for security and compliance teams. Founded in 2020 by SignalFx co-founder Phillip Liu, it applies generative AI and a patent-pending 'Trust Graph' to automate the grind of governance, risk and compliance (GRC): gap analysis, evidence collection, control testing, security questionnaires, third-party risk reviews and audit prep across frameworks like SOC 2, ISO 27001, FedRAMP, PCI, SOX and DORA. In November 2024 it raised a $10.35M Series A led by Bright Pixel Capital.
VComply
VComply is a cloud-based governance, risk, and compliance (GRC) platform that helps mid-market organizations turn compliance from scattered spreadsheets and missed deadlines into a single system of record. Founded in 2019 by Harshvardhan Kariwala after a costly missed filing at a prior business, the Sunnyvale-based, Accel-backed company packages compliance, risk, policy, and case management into four connected modules - ComplianceOps, RiskOps, PolicyOps, and CaseOps - that it now frames as a Compliance & Risk Operating System (CROS). It serves thousands of customers across healthcare, financial services, education, energy, and nonprofits in more than 100 countries.
BEMO
BEMO is a Redmond, Washington-based managed IT and security service provider built specifically for small and mid-sized businesses that run on Microsoft 365 and Azure. Founded in 2010 by ex-Microsoft veterans Bruno Lecoq and Joel Lachance, the fully remote company bundles cybersecurity, compliance (SOC 2, ISO 27001, CMMC, NIST 800-171), managed helpdesk, and AI/Copilot security into packaged tiers so 10-to-500-person organizations can meet audit requirements without hiring an in-house security team. BEMO is a repeat Microsoft US Partner of the Year and a four-time Inc. 5000 honoree.
SolidCore.ai
SolidCore.ai is a Menlo Park cybersecurity startup building the security and governance layer for enterprise generative AI. Founded in 2024 by HyTrust veteran Eric Chiu and former Microsoft security architect Hemma Prafullchandra, its platform captures an immutable record of every LLM prompt, response, and configuration inside a customer's own cloud, then continuously monitors for misconfigurations, policy violations, and risky usage while generating audit-ready evidence for frameworks like NIST AI RMF, ISO 42001, and the EU AI Act. The company emerged from stealth in September 2025 with $4M in seed funding led by Runtime Ventures.
ServiceNow
ServiceNow is the enterprise software company behind the Now Platform, a single cloud system that turns the messy, cross-departmental work of large organizations - IT tickets, HR cases, customer issues, security incidents - into digital workflows that can be automated. Founded in 2004 by Fred Luddy and now led by CEO Bill McDermott, the company has grown into one of the most valuable software firms in the world, generating over $13 billion in annual revenue and racing to embed agentic AI into every business process for the 8,000-plus enterprises and the vast majority of the Fortune 500 that run on it.