Best AI Governance and Security Tools in 2026

Between 22 July 2025 and 9 March 2026, six independent AI security startups agreed to become parts of larger companies.

Five security vendors and OpenAI did the buying, so much of what last year's roundups listed as standalone "AI governance tools" is now a module inside a suite you may already pay for. The regulatory clock moved too: the EU pushed its main high-risk AI obligations from August 2026 to 2 December 2027.

If you run IT or security at a company of 50 to 500 people and the board has just asked what your AI governance is, the useful question is not which startup to call. It is which of four jobs you need done, and who on your vendor list already does it.

Hokai timeline of AI security acquisitions, from each buyer's own announcement as checked on 4 November 2026.

AI governance and AI security are four separate jobs

Vendors use both words for everything, so start with the job instead. Each one stops a different failure. Most of those failures are named in the 2025 edition of the OWASP Top 10 for LLM applications, which puts prompt injection at LLM01 and sensitive information disclosure at LLM02.

Governance, in the narrow sense an auditor uses, is the first row: a register of every AI system, who owns it, which policy applies, and dated evidence that someone checked. Security is the other three rows. A platform that claims all four usually does one of them well and wraps the rest in a dashboard.

That is why the starting point matters more than the feature grid. Openlayer starts from testing and audit evidence. Cyera starts from data classification and works outward to agents. Neither is wrong. They simply answer different first questions, and the right one depends on whether your first worry is a model behaving badly or a person or agent seeing data they should never have been able to reach.

How to choose: five questions to ask any vendor

These five work whether or not you ever read our shortlist. Ask them in the first call. Write the answers down.

1. Can it show you AI you did not approve? Shadow AI is the usual first finding. Ask where the sensor sits: a browser extension, an endpoint agent, a network gateway, or an SDK inside your own app. Each sees a different slice. Microsoft's documentation, for example, says Purview needs its browser extension and onboarded devices before it can see third-party sites such as ChatGPT and Gemini.
2. Does it produce evidence, or only alerts? An auditor wants a dated record of what was tested, what failed and who signed off. Ask for a sample report before you sit through a demo.
3. Where do your prompts go? A runtime guardrail reads every prompt and every answer. That makes the security tool a data processor in its own right. Ask whether it runs in your VPC or on-premises, and what telemetry it sends home.
4. Does it cover agents, not just chat? An agent that can send email or merge code needs scoped credentials and approval steps, not only a prompt filter. Our walkthrough of approval gates for personal agents shows the pattern at small scale.
5. Who will own it in a year? Six acquisitions in under nine months is a buying risk by itself. Ask what happens to your contract, your data and any open-source edition if the vendor is sold.

Six AI security specialists were bought in under nine months

This is the part most buyer's lists skip. The table below uses each buyer's own announcement.

Palo Alto Networks said on 22 July 2025 that it had completed the Protect AI deal and would fold model scanning, posture management, red teaming and runtime protection into Prisma AIRS. SentinelOne signed for Prompt Security on 5 August 2025, describing a product that watches staff use of tools like Cursor across browsers, desktop apps and APIs.

Check Point's 16 September 2025 announcement claims Lakera detects more than 98% of attacks with under 50 milliseconds of latency and false positives below 0.5%. Those are the vendor's figures. We have not tested them.

Varonis announced on 3 February 2026 that it would buy AllTrue.ai, which finds shadow AI and enforces guardrails in real time. Nine days later, Proofpoint said it had acquired Acuvity, whose sensors reach endpoints, browsers, MCP servers and local tools such as OpenClaw. On 9 March, Promptfoo's founders wrote that they had agreed to join OpenAI.

The shortlist: the best AI governance and security tools by job

Hokai tracks the dedicated vendors in its AI security posture category. The picks below are chosen per job, not ranked against each other, because a test runner and a data classifier do not compete.

Hokai chart of which pick fits which situation, from the vendor pages cited in this guide as checked on 4 November 2026.

Free and open source: Promptfoo, garak and NeMo Guardrails

Start here whatever your budget. All three run on your own machines and cost nothing to try.

Promptfoo: the free default for pre-launch testing

Promptfoo is an MIT-licensed eval and red-teaming tool with 26,824 GitHub stars when we checked on 4 November 2026. Its founders say more than 350,000 developers have used it, 130,000 use it each month, and teams at over 25% of the Fortune 500 rely on it. The Community tier is free and includes red teaming up to 10,000 probes a month, run locally or self-hosted.

The caveat is ownership: OpenAI now controls the roadmap of a tool that many teams use to test models from OpenAI's own competitors, and the founders' written promise that the open-source suite stays open and keeps supporting other model providers is the only guarantee on offer so far. Watch it.

garak: a second scanner from NVIDIA

garak is an Apache-2.0 scanner from NVIDIA with 9,856 stars. It probes a model for hallucination, data leakage, prompt injection, misinformation, toxicity and jailbreaks, and its README compares it to nmap for LLMs. Run it beside Promptfoo. Always. Two scanners with different probe sets miss less than one. Its limit: it tests a model endpoint, not your app's business logic.

NeMo Guardrails: runtime rails you host yourself

NeMo Guardrails has 7,431 stars and adds input rails (jailbreak checks, masking sensitive data), output rails and dialog rails written in its own Colang language. It runs as a library or a server in your environment. The catch is telemetry, covered in the data section below.

Governance platforms: Openlayer, Credo AI and Cyera

The next three picks are where most of the paid budget goes. They differ less in features than in which team they expect to own the work.

Openlayer: governance evidence with a free start

Openlayer's Basic plan is free for one member, five projects, 20 tests per project, 20,000 inference logs a month and three months of data retention. Enterprise adds unlimited seats, SAML SSO, on-premise deployment and a 99.99% SLA, at a quoted price. One seat is a pilot, not a programme, so treat Basic as a trial of the Openlayer workflow rather than the plan you will run on.

Credo AI: a system of record for audit-heavy teams

Credo AI says it has worked on AI governance since 2020. Its platform centres on registries for AI systems, vendors and agents, with policy packs mapped to standards and regulations and a risk library for agent failures such as tool misuse and scope drift. Mastercard is quoted on its homepage as using the AI Registry and Vendor Registry. It publishes no price, and it governs rather than blocks: you still need the testing and runtime rows.

Cyera: when the risk is the data

Cyera classifies data across cloud, SaaS and on-premises stores, then adds DLP and an Agent Guardian module to control what agents can see and do. Its site says it produces auditor-ready evidence mapped to regulatory controls. Pick it when your real worry is a copilot reading the wrong folder. Cyera's record notes it sells to enterprises only, with no public rates.

Specialists for models, agents and scripts

These four do one job each. Buy one only when that job is the gap your suite leaves.

HiddenLayer: when you ship your own models

HiddenLayer covers four stages on its homepage: AI discovery, supply chain security that scans model files, attack simulation, and a runtime firewall, plus agentic and MCP protection. Most of that value lands if you train or fine-tune models. If you only call a hosted API, the model-scanning half has nothing to scan.

Clawvisor: agents that never hold the keys

Clawvisor is an open-source gateway with 286 GitHub stars. The agent declares a task, a person approves the scope once, and Clawvisor injects credentials and logs every request; pending approvals expire after 300 seconds by default. Its own README is blunt: experimental, not audited for security, and not to be used as your only safeguard.

Dynamo AI and BotCity: two narrower jobs

Dynamo AI pairs DynamoEval, its automated red-teaming, with DynamoGuard, runtime guardrails for compliance violations, data leakage, hallucinations and jailbreaks, plus a human review step on results. Pricing is by quote.

BotCity solves a quieter shadow-AI problem: Python that staff and agents generate and run on laptops. Its Sprav product discovers those scripts on endpoints and decides before they execute whether they may run, and the BotCity Orchestrator moves approved ones into a governed pipeline.

• Promptfoo26,824 Leader
• garak9,856
• NeMo Guardrails7,431
• Clawvisor286

Read from each project's GitHub repository.

Openlayer or Credo AI: deciding who owns the evidence

Most buyers who need audit evidence end up choosing between these two shapes of product. The deciding fact is not a feature. It is who in your company will do the work every week.

Openlayer starts from the system. Engineers connect a repo or pipeline, run tests against it before release and watch it in production, and the evidence is a by-product of that testing. Its free plan lets one engineer prove the workflow on five projects before anyone signs a contract, which is the cheapest pilot in this guide.

Credo AI starts from the policy. A risk or compliance lead registers each AI system and vendor, applies a policy pack, and tracks agent risks such as scope drift from a library. The evidence is the register itself. That suits a company whose auditor asks "show me every AI vendor and who approved it" before asking how any model was tested.

So pick by owner. If your security engineers will run governance, start with Openlayer. If a risk, legal or compliance team will, shortlist Credo AI and ask for its policy packs for the frameworks you report against. Larger firms often end up with both, wired together. That is fine, as long as one register is the source of truth.

What it costs: free testing, quoted everything else

Only two products here publish any price, and both are free tiers. Promptfoo's Community edition is listed as free forever, and Openlayer Basic is free within the limits above. Credo AI, Cyera, HiddenLayer and Dynamo AI publish no rates. The acquired modules are priced inside each suite's contract, which is where you can negotiate.

The real cost is time. Someone has to wire the scanners into CI, read the findings and keep the register current. A free scanner nobody runs costs nothing and protects nothing.

If you are on Microsoft 365, check before you budget. Microsoft's own documentation says Purview DSPM for AI runs a weekly data risk assessment of your top 100 SharePoint sites with no activation needed, aimed at oversharing risk around Microsoft Copilot. We did not verify which Microsoft licences include which of those features, so ask your reseller.

Start free: the testing steps you can run this week

The three open-source tools above cover testing and runtime for a first LLM app. The commands come from each project's own documentation.

1. Generate and run a red-team scan with Promptfoo, then read the report.

npx promptfoo@latest redteam setup
npx promptfoo@latest redteam run
npx promptfoo@latest redteam report

1. Scan the underlying model with garak. Listing the probes first shows what it will try.

python -m pip install -U garak
garak --list_probes
python3 -m garak --target_type openai --target_name gpt-5-nano --spec probes.encoding

1. Turn NeMo Guardrails telemetry off before the library starts, then install it.

export NEMO_GUARDRAILS_NO_USAGE_STATS=1
pip install nemoguardrails

1. Start the register. List every AI system, its owner, the data it touches and the date it was last tested. Openlayer's free plan or a shared sheet both work for a first pass.

Data handling: where your prompts go once a guardrail reads them

A security tool that reads every prompt is a new place for your data to leak. Treat it like one. Check these before anything goes live:

• Telemetry. NeMo Guardrails sends a usage event when it starts and periodic heartbeats to NVIDIA. Its README says the opt-out must be set before the library starts, and that changing it later does not stop a running heartbeat. It also says NVIDIA Build, the hosted endpoint, is for evaluation only and not production.
• Sensors. Browser and endpoint sensors see what staff type into ChatGPT and other chat tools. Decide in writing who may read captured prompts, and for how long.
• Hosting. Promptfoo, garak, NeMo Guardrails and Clawvisor all run on your own machines. Openlayer's Enterprise plan and Promptfoo's On-Premise plan offer self-hosting too.
• Agent traces. If you already trace agent runs, our piece on the three jobs of agent observability shows where tracing stops and security has to start.

Compliance: what the EU AI Act and NIST ask of you now

The Digital Omnibus on AI was published in the EU's Official Journal on 24 July 2026 and entered into force on 27 July. It moved the Annex III high-risk obligations from 2 August 2026 to 2 December 2027, and rules for AI built into regulated products to 2 August 2028. Several top-ranking tool lists still cite August 2026. They are out of date.

The nearer deadline is 2 December 2026, for marking AI-generated content. Our analysis of the EU agent deadlines covers that date in detail, so this guide will not repeat it.

In the US, the NIST AI Risk Management Framework was released on 26 January 2023 for voluntary use. NIST added a Generative AI Profile, NIST-AI-600-1, on 26 July 2024. Neither requires a tool. Both are easier to show evidence for with a register and dated test runs.

Who should skip buying an AI security tool

Plenty of readers should close this tab without buying anything:

• Small teams on business chat plans. If staff only use ChatGPT or Claude through a business plan and you ship no LLM features, the plan's admin controls plus a written policy cover you. Our comparison of ChatGPT plans lists which tiers carry those controls.
• Teams wanting AI that does security work. Scanning your own code with an agent is a different shelf. Codex Security is OpenAI's application security agent. Vega is another agent built to hunt bugs.
• Physical security buyers. Directories file camera analytics such as Coram AI under "AI security" too. Those watch buildings, not models.
• Compliance teams that want AI to do compliance. Hokai's AI governance category also holds Readily, which uses AI for health-plan audits. The trust and safety platform Cinder sits there as well, and neither governs your models.

The case for buying a specialist anyway

The strongest objection to this guide's verdict is that acquired products slow down. A startup inside a suite is judged by its parent's roadmap, gets bundled into price rises, and loses the founders who built it. The independents that remain, such as Clawvisor, Dynamo AI and HiddenLayer, can ship against agent risks that change month to month.

That is right for one group: teams shipping agents that hold production credentials, where a quarter's delay on a new control is real exposure.

For them, a specialist is worth a second console. Most buyers are not in that group. For the median buyer, whose exposure is staff pasting data into chat tools, the suite already on every laptop sees the browser and the endpoint, and a second console is one more thing nobody reads. Still unsure? Describe your stack to Smart Match and it will weigh these picks against what your team runs today.

What would change this verdict

• Independent tests. If bundled AI modules are shown to miss attacks that specialists catch, the "use what you pay for" advice weakens.
• Promptfoo's direction. If it drops non-OpenAI providers or moves features out of the free tier, garak becomes the first scanner.
• The EU calendar. The Omnibus moved the dates once; another delay or a firm 2027 start changes how fast a register is needed.
• The next deal. Another round of acquisitions taking out the remaining independents would leave this shortlist mostly open source.

The next date on the EU calendar is 2 December 2026. The one a register exists for is 2 December 2027, and if the last nine months are a guide, a few of the vendors pitching it today will be someone else's module by then.

Frequently asked questions

What is the difference between AI governance and AI security tools?

Governance tools keep the record: which AI systems exist, who owns them, which policy applies and when they were last tested. Security tools act on the system itself, by testing it before launch, filtering prompts and answers at runtime, or limiting what data and credentials an agent can reach. Most companies need both, often from different vendors.

Are there free AI security tools worth using?

Yes. Promptfoo's Community edition, NVIDIA's garak scanner and NeMo Guardrails are all open source and run on your own machines. Openlayer also has a free Basic plan for one member and five projects. Together they cover pre-launch testing, runtime rails and a first evidence trail.

Do I still need a standalone AI security vendor if I use Palo Alto, Check Point or SentinelOne?

Often not. Palo Alto Networks bought Protect AI, Check Point agreed to buy Lakera and SentinelOne agreed to buy Prompt Security, and each now sells that work inside its own platform. Ask for the AI module's price first, and buy a specialist only for a gap it leaves, such as agent credentials.

When do EU AI Act high-risk obligations apply now?

The Digital Omnibus on AI, in force since 27 July 2026, moved the Annex III high-risk obligations from 2 August 2026 to 2 December 2027. AI built into products covered by EU sector law moved to 2 August 2028. The nearer date is 2 December 2026, for marking AI-generated content.

Is Promptfoo still open source after OpenAI bought it?

Its founders wrote on 9 March 2026 that Promptfoo agreed to be acquired by OpenAI and will remain open source, with support for other model providers. The project was MIT licensed when we checked on 4 November 2026. Watch for changes to provider support or to the free tier's 10,000 monthly red-team probes.

Covered in this guide

• Clawvisor: Open-source authorization gateway for AI agents that vaults credentials and enforces purpose-based access control. YC Spring 2026-backed, free cloud trial.
• Cyera: AI data security platform for enterprises: agentless DSPM, AI-SPM, and DLP at 95%+ classification precision across cloud and on-premises data stores.
• Openlayer: AI governance platform with an AI system inventory, 175+ evaluation tests and runtime guardrails that produce audit-ready evidence for regulators.
• BotCity: BotCity has raised $15.3M so IT teams can see and govern the Python code that AI copilots and staff quietly run on company endpoints.
• ChatGPT: ChatGPT is OpenAI's AI assistant, with 1.2 billion weekly users by OpenAI's count, the GPT-6 model family and plans that run from a free tier to a premium Pro tier.
• Cinder: Cinder gives trust and safety teams at OpenAI, Spotify, and Midjourney one platform for policy, cases, and AI agents across 400M+ daily safety events.
• Claude: Claude is Anthropic's AI assistant, with a free tier, Pro, Max and Ultra personal plans, and Team and Enterprise seats. Opus access starts at Pro.
• Codex Security: OpenAI's application security agent scans connected GitHub repositories, tests likely bugs in a sandbox, and drafts fixes for review as pull requests.
• Coram AI: AI-native physical security platform: plain-English video search, gun detection and access control layered onto any IP camera. 4.9/5 on G2 from 189 reviews. Per-camera license, quote only.
• Cursor: Cursor is an AI code editor built on VS Code, widely adopted across large enterprise engineering teams, with Agent Mode, Tab completion, and Cloud Agents.
• Dynamo AI: Enterprise AI guardrail platform whose AgentWarden cut a tested MCP deployment's attack surface by 97% in under 5 minutes.
• HiddenLayer: AI security platform that scans 35+ ML model formats for backdoors, blocks runtime prompt injection, and tracks agentic AI behavior. SOC 2 Type II certified.
• Microsoft: Microsoft, founded 1975, is a public company (NASDAQ: MSFT) and the Redmond maker of Windows, Azure, GitHub and the Copilot assistants, with $331.8B of fiscal 2026 revenue.
• Microsoft Copilot: Microsoft's AI assistant across Windows, Edge, Word, Excel, Outlook and Teams, from a free tier to per-seat work plans on OpenAI's latest GPT-5 models.
• NVIDIA: Santa Clara chipmaker that supplies the GPUs, networking, CUDA software and open Nemotron models behind most large AI training and inference clusters.
• OpenAI: OpenAI builds ChatGPT, the GPT-6 family (Astra, Sol, Luna), Codex and the OpenAI API. It reports 1.2B weekly ChatGPT users and an $852B valuation after its March 2026 round.
• OpenClaw: OpenClaw is a free, MIT-licensed agent gateway: one self-hosted process connects your chat apps to the AI model you choose, with the OpenClaw Foundation as steward.
• Readily: AI compliance platform for healthcare payers that cites audit evidence and drafts policy redlines; one customer cut consulting spend $734K a year.
• Vega: Vega is Nebula Security's AI agent that has found 730+ real bugs, including 3 Chrome V8 RCEs, and now scans codebases via GitHub App, CLI, or MCP.

Sources