Landscape
The AI-Agent Governance Vendor Map
Who sells what in agent identity, permissions, MCP security, and spend governance. The list is verified and maintained: each entry was checked against a published source, and each ownership change carries the month it closed and a link to the source we used.
The briefing
Follow changes to this map
Funding, launches and acquisitions that change this map are reported in Landscape Watch, a section of the briefing, each with an evidence link. At least once a week, free.
You confirm by email. Unsubscribe in one click.
No vendors match. Try a shorter term, or suggest one we're missing.
Agent identity & NHI 9
Identity, authentication, and lifecycle for AI agents and non-human identities. Read the explainer
- Oasis Security acquired by Cyera (September 2026)
- Saviynt
- Cyera
- SailPoint acquired Entro Security (June 2026)
- Rig Security
- C1.ai (ConductorOne) acquisition by Workday announced (October 2026)
- Okta
- Microsoft Entra
- Permiso acquired by Okta (August 2026)
MCP security & gateways 7
Gateways, allowlisting, and security tooling for Model Context Protocol deployments. Read the explainer
- Runlayer
- Helmet Security
- Operant AI
- Manufact
- Kong
- MintMCP
- Composio
AI security platforms 6
Broader platforms securing AI applications, models, and agents.
- Noma Security
- WitnessAI
- Lasso Security
- Rein Security
- Lakera acquired by Check Point (October 2025)
- Protect AI acquired by Palo Alto Networks (July 2025)
Agentic SOC 4
AI agents doing security operations work.
- Torq
- 7AI
- Dropzone AI
- Qevlar AI
Offensive & testing 3
Automated pentesting and adversarial testing of AI systems.
- XBOW
- RunSybil
- Armadin
Exposure management 3
Discovering and managing AI-related attack surface.
- Astelia
- Eclypsium
- Surf AI
LLM gateways & spend 6
Model routing, observability, and cost governance. Read the explainer
- TrueFoundry
- Maxim AI
- Concentrate AI
- LiteLLM
- Portkey acquired by Palo Alto Networks (May 2026)
- OpenRouter acquisition by Stripe announced (August 2026)
Agent observability 5
Tracing, logging, and evaluation: the audit trail for what agents actually did.
- Langfuse acquired by ClickHouse (January 2026)
- LangSmith (LangChain)
- Arize acquired by Dynatrace (October 2026)
- Braintrust
- W&B Weave acquired by CoreWeave, via parent Weights & Biases (May 2025)
Data flow & AI-DLP 7
Controlling what data reaches agents, and what agents can leak back out.
- Nightfall
- Harmonic Security
- Metomic
- BigID
- Varonis acquisition by Proofpoint announced (October 2026)
- SquareX acquired by Zscaler (February 2026)
- Cyera
Shadow-AI discovery 5
Finding and governing the AI tools employees adopted without asking. Read the explainer
- Nudge Security
- Reco
- Grip Security
- Island
- Pluto Security
AI governance & compliance 6
Policy, risk, and regulatory compliance for AI programs (EU AI Act, NIST RMF). Read the explainer
- Credo AI
- Holistic AI
- OneTrust
- IBM (watsonx.governance)
- Vanta
- Drata
Agent sandboxing (watchlist) 2
Runtime isolation for the code agents write and run. The escapes are real: in July 2026 researchers disclosed sandbox escapes in four widely used coding agents, and a CVE published in September let a sandboxed agent switch off its own confinement with a single shell command.
- E2B
- Daytona
Agent payments (watchlist) 3
Wallets, virtual cards, mandates, and spend limits for agents that pay for things. The rails are live: Visa ran agent purchases at independent merchants with more than 30 European issuers in July 2026, Santander and Mastercard completed Europe's first end-to-end agent payment on live banking rails in March, and an August 2026 security analysis of Google's AP2 catalogued 48 threats.
- Stripe (agent tooling) agreed to acquire OpenRouter (August 2026)
- Skyfire
- Payman
Platform giants 10
Hyperscalers and incumbents shipping agent-governance features.
- Microsoft
- Okta acquired Permiso (August 2026)
- AWS
- ServiceNow
- Palo Alto Networks acquired Protect AI (July 2025) acquired Portkey (May 2026) acquired Console (September 2026)
- Cloudflare
- F5 acquired CalypsoAI (September 2025)
- Rippling
- Salesforce
Vendor-neutral: inclusion is editorial, never paid. Ownership notes link to the source we checked. Corrections: [email protected]