AI governance and security
As agents multiply, nobody knows what is running where. These tools cover the four things that matter: an inventory, permissions, runtime defence and regulatory mapping.
Published · updated
How we ranked these
Stated before the list, so you can disagree with the weighting rather than the result.
The ranking
- 01
Credo AI4.2Contact sales
AI governance with policy packs for the EU AI Act, NIST AI RMF and ISO 42001, and audit-ready evidence.
Relevant once you are regulated or large enough to have lost track. Not a starting purchase.
- 02
Lakera4.3Contact sales
Security for generative AI: runtime defence against prompt attacks and data leakage, plus red teaming.
Worth evaluating once agents touch untrusted content. Ask specifically about indirect injection.
- 03
Credal4.2Contact sales
Governance for AI agents: tool-call permissions, an agent registry, and existing document permissions enforced at query time.
Buy it when agents are multiplying. Design for it earlier if you can.
- 04
Dynamiq4.2Contact sales
Agents that run on your own infrastructure, designed around approval gates and audit trails. The SDK is Apache-2.0.
Credible where data cannot leave your infrastructure. Overkill if it can.
- 05
Guru4.3Contact sales
Verified internal knowledge delivered as AI answers with citations, across 100+ integrations and MCP.
Worth it where stale answers are already causing real cost. Otherwise a cheaper wiki will do.
Questions we get
- When does this become necessary?
- Once agents start multiplying. For most teams the entry point is attempting an inventory and discovering nobody knows how many exist. Regulated sectors need to prepare earlier.
- What is the biggest RAG risk?
- Information the user has no right to see appearing in an answer. If indexing does not carry source permissions, salary data returns to anyone. Permissions must be applied from the source system at query time.
- What is indirect prompt injection?
- An instruction sitting inside an indexed document that executes as if the user had typed it, the moment retrieval pulls that document. Inspecting direct input does not prevent it — ask vendors about this case explicitly.