Pillar Security announced on November 9, 2026 that Vanta had signed a definitive agreement to acquire the AI security company. The planned deal would connect Pillar’s agent testing and runtime protection with Vanta’s Trust Graph, linking AI governance policies to the systems they are meant to control.
Dor Sarig and Ziv Karliner founded Pillar in 2023 after concluding that AI would move beyond answering prompts to acting for organizations through data, tools and decisions. Pillar says its software covers AI applications and agents throughout their lifecycle, finding them, testing their defenses and stopping actions outside authorized boundaries. Its test design and operational limits are based on each agent’s business role, granted authority and risk owner. Pillar’s researchers analyze failure modes in AI systems and use the results to develop new tests and safeguards.
The deal would place that technology inside Vanta’s trust and compliance business. Pillar’s announcement reports that Vanta serves more than 20,000 companies. Vanta’s platform links security and compliance policies and controls with their owners and organizational commitments.
Connecting Policy to Runtime Protection
Under the plan, an organization’s rules would inform how Pillar tests agents and constrains their live actions. Test results would feed back into Vanta by showing where controls need reinforcement, while runtime security events would become proof that required safeguards are operating.
Vanta’s AI Governance product page describes an inventory spanning developer laptops, production code and vendor platforms, attaching each agent’s models, prompts and data access to the Trust Graph. The software also covers policy-based restrictions on agent access and behavior, real-time monitoring for activity beyond approved boundaries and evidence for buyers, auditors or regulators through Vanta’s Trust Center.
This would extend Vanta’s governance work from documenting and controlling agents toward testing their behavior and enforcing boundaries as they operate. The companies’ stated aim is to narrow the gap between a written AI policy and the technical controls applied to a running agent.
A Lifecycle Framework for AI Security
Pillar has also developed a shared methodology for those controls. The company reports that its Secure AI Lifecycle, or SAIL, framework has passed 50,000 downloads and maps 91 AI risks across seven lifecycle phases. The framework gives development, machine-learning operations, security and governance teams a common approach to AI risk from initial development into live operation. The phases begin with policy and asset discovery, proceed through security-posture analysis, adversarial testing, deployment controls and isolated execution, and end with monitoring and retirement.
From Enforcement to Audit Evidence
Pillar’s governance and compliance documentation describes a rule engine that can prevent deployments using unapproved models, keep AI data in approved regions, identify licensing conflicts and limit who may deploy models or change policies. Separate controls for third-party AI evaluate external systems against internal requirements before those systems can reach company data or production environments. For compliance, Pillar combines asset-discovery records, adversarial test results and telemetry from runtime guardrails into documentation for auditors, with governance findings and runtime logs tied to regulatory requirements. That evidence trail explains the acquisition’s rationale: activity used to enforce AI policies can also demonstrate compliance inside Vanta’s trust programs.
For Vanta, the acquisition would add testing and enforcement telemetry to the policies and ownership records already in its platform. Pillar’s stated purpose is to reach more teams and connect its technology to the trust programs organizations already run. The integration remains future joint work, making a continuous evidence trail from written policy to live agent behavior the central deliverable of the pending deal.
Credit: Source link
