Vanta Agrees to Buy Pillar Security to Enforce AI Governance at Runtime

The deal is a bet that companies will soon have to prove, not just document, that their AI systems follow the rules they have set. Vanta made its name automating audits for standards such as SOC 2, and introduced an AI governance product in July. Pillar adds technical controls that watch what AI agents actually do and can stop them from taking unauthorised actions.

"Customers, regulators and auditors want proof that a company's AI does what it says on the tin," said Christina Cacioppo, Vanta's chief executive and co-founder.

Pillar was founded in 2023 by Ziv Karliner, its chief executive, and Dor Sarig. Its software offers red-teaming, runtime guardrails and governance mapped to frameworks including OWASP, MITRE ATLAS, NIST and the EU AI Act, according to its website. "Vanta is the governance platform thousands of companies already rely on," Karliner said in the release.

The Integration Schedule

Vanta set out a staged plan to fold Pillar into its Trust Platform over 2027. In January, it expects to release an AI inventory that automatically maps a company's AI applications, models, agents, skills and MCP servers, tying each to an owner, approved uses, data access, vendors, controls and risks. Runtime monitoring and detection, which flags suspicious behaviour and guardrail violations, is also due in January.

Adversarial testing tailored to each customer's business is planned for spring 2027, followed in summer 2027 by runtime enforcement, which Vanta said would turn governance requirements into boundaries that block unauthorised actions in real time.

Vanta cited its own survey of 3,500 IT and business leaders, conducted by Sapio Research in July 2025, in which 65% said their use of agentic AI was outpacing their understanding of it and only 48% had a framework for granting or limiting AI autonomy.

Phil Harris, a research director for governance, risk and compliance at IDC, said in the release that deals of this kind show "the market shifting from AI governance on paper to governance at runtime."

Vanta's Growth

Pillar is Vanta's third acquisition, after Trustpage in January 2023 and Riskey in July 2025. The company said it now serves more than 20,000 customers, up from 16,000 in the first quarter of 2026, and that three in four companies on the Forbes AI 50 list use its software. In April it said annual recurring revenue had passed $300 million, up 63% from a year earlier.

Vanta said the early access programme for its AI governance product was its most requested to date, with a waitlist six times oversubscribed, and that daily users of its Vanta Agent had risen 253% over the past three quarters. Named customers include Snowflake, GitHub, Ramp and Cursor.

The first Pillar-based features are scheduled to reach Vanta customers in January 2027.