Vanta Signs Deal to Buy AI Security Firm Pillar Security

Vanta, which serves more than 20,000 companies, has signed a definitive agreement to acquire Pillar Security, the AI security startup announced on November 9, 2026. The deal would connect Pillar's agent testing and runtime protection technology with Vanta's Trust Graph, linking AI governance policies directly to the systems those policies are meant to control.

The acquisition matters because it targets a structural gap in enterprise AI adoption: organizations write AI policies, but the technical controls applied to a running AI agent rarely connect back to those written rules. The companies' stated aim is to narrow that gap by making policy enforcement and compliance evidence a single, continuous trail.

What Does the Acquisition Change?

Under the planned integration, an organization's rules would inform how Pillar's software tests AI agents and constrains their live actions. Test results would feed back into Vanta's platform by showing where controls need reinforcement, while runtime security events would become proof that required safeguards are actually operating.

That last point is the deal's rationale. Activity used to enforce AI policies — tests run, boundaries enforced, actions blocked — can also demonstrate compliance inside Vanta's trust programs. For Vanta, the acquisition would add testing and enforcement telemetry to the policies and ownership records already in its platform.

Pillar's stated purpose, in its own words, is to reach more teams and connect its technology to the trust programs organizations already run. The integration remains future joint work, which makes a continuous evidence trail from written policy to live agent behavior the central deliverable of the pending deal.

Who Built Pillar and What Does Its Software Do?

Dor Sarig and Ziv Karliner founded Pillar in 2023 after concluding that AI would move beyond answering prompts to acting for organizations through data, tools and decisions. That founding thesis — autonomous agents rather than chat interfaces — now shapes the entire product.

Pillar says its software covers AI applications and agents throughout their lifecycle. The system performs three functions: finding agents, testing their defenses, and stopping actions outside authorized boundaries. Its test design and operational limits are based on each agent's business role, granted authority and risk owner. Pillar's researchers also analyze failure modes in AI systems and use the results to develop new tests and safeguards.

The company frames this as moving from a model where security teams inspect code toward one where they test behavior. An agent that holds credentials, calls tools and makes decisions cannot be evaluated the same way as a static application. Testing must reflect what the agent is allowed to do and who owns the risk when it exceeds those limits.

Where Does Pillar Sit Inside Vanta?

Vanta operates a trust and compliance business. Its platform links security and compliance policies and controls with their owners and organizational commitments, and it serves more than 20,000 companies according to Pillar's announcement.

Vanta's AI Governance product page describes an inventory spanning developer laptops, production code and vendor platforms. The inventory attaches each agent's models, prompts and data access to the Trust Graph — Vanta's map of how policies, systems and owners connect.

The product page also lists current capabilities:

• policy-based restrictions on agent access and behavior;
• real-time monitoring for activity beyond approved boundaries;
• evidence for buyers, auditors or regulators delivered through Vanta's Trust Center.

The Pillar acquisition would extend this governance work from documenting and controlling agents toward testing their behavior and enforcing boundaries while agents operate. In practice, Vanta would move from describing what agents may do to verifying and constraining what they actually do.

What Is the SAIL Framework?

Pillar has also developed a shared methodology for AI security controls. The company reports that its Secure AI Lifecycle framework, abbreviated SAIL, has passed 50,000 downloads and maps 91 AI risks across seven lifecycle phases.

The framework gives development, machine-learning operations, security and governance teams a common approach to AI risk from initial development into live operation. The seven phases proceed in a defined order:

1. policy and asset discovery;
2. security-posture analysis;
3. adversarial testing;
4. deployment controls;
5. isolated execution;
6. monitoring;
7. retirement.

SAIL's structure signals Pillar's broader ambition beyond product: setting the shared vocabulary that lets security engineers, ML operations staff and compliance officers evaluate the same agent against the same risk map. The 50,000-download figure, reported by the company itself, suggests that methodology has reached a substantial practitioner audience.

How Does Enforcement Become Audit Evidence?

Pillar's governance and compliance documentation describes a rule engine with several enforcement capabilities. The engine can:

• prevent deployments using unapproved models;
• keep AI data in approved regions;
• identify licensing conflicts;
• limit who may deploy models or change policies.

Separate controls for third-party AI evaluate external systems against internal requirements before those systems can reach company data or production environments. That matters for enterprises adopting vendor-built agents, where the buyer does not control the model but still owns the risk.

For compliance, Pillar combines asset-discovery records, adversarial test results and telemetry from runtime guardrails into documentation for auditors, with governance findings and runtime logs tied to regulatory requirements.

This evidence trail explains the acquisition's logic. The same telemetry that blocks an unauthorized action can also prove to an auditor that the safeguard existed and fired. Compliance documentation stops being a separate exercise from enforcement; it becomes a byproduct of it.

Why Does This Deal Matter for the Market?

The acquisition sits at the intersection of two growing enterprise demands: governance of AI systems and demonstrable compliance. As organizations deploy agents that access data, call tools and make decisions, regulators and buyers increasingly want proof that those agents operate within authorized boundaries.

Vanta's platform already records policies, owners and organizational commitments. Pillar adds the missing pieces: behavioral testing of agents and runtime enforcement, plus the telemetry that turns enforcement into evidence. Combined, the two would cover the arc from written AI policy through adversarial testing to live operation and audit documentation.

The deal also reflects consolidation in the AI security category. Startups that built agent testing and runtime protection are becoming acquisition targets for compliance platforms that already hold the customer relationships and the audit workflows. Pillar, founded in 2023, reached acquisition in roughly three years.

No financial terms were disclosed in the announcement. The deal is described as a definitive agreement, meaning it is signed but pending completion.

What Comes Next?

The integration remains joint future work rather than a shipped product. Its central deliverable, as the companies describe it, is a continuous evidence trail running from written policy to live agent behavior — one where every test, every blocked action and every runtime event strengthens both security and compliance at once.