Vanta signs deal to acquire AI security company Pillar Security – Unite.AI

Pillar Security announced on November 9, 2026 that Vanta had signed a definitive agreement to acquire the AI ​​security company. The planned deal would connect Pillar’s agent testing and runtime protection with Vanta’s Trust Graph, linking AI governance policies to the systems they are supposed to control.

Dor Sarig and Ziv Karliner founded Pillar in 2023 after concluding that AI would go beyond responding to requests to take action for organizations through data, tools and decisions. Pillar says its software covers AI applications and agents throughout their lifecycle, finding them, testing their defenses, and stopping actions outside authorized boundaries. The test structure and operational limits are based on each agent’s business role, granted authority, and risk owner. Pillar researchers analyze failure modes in AI systems and use the results to develop new tests and safeguards.

The deal would place that technology within Vanta’s trust and compliance business. Pillar’s announcement reports that Vanta serves more than 20,000 businesses. Vanta’s platform connects security and compliance policies and controls with organizational owners and commitments.

Connecting the policy to runtime protection

Under the plan, an organization’s rules would inform how Pillar tests agents and limits their live actions. Test results would feed back to Vanta showing where controls need strengthening, while run-time security events would become evidence that the required safeguards are working.

Vanta’s AI Governance product page describes an inventory that includes developer laptops, production code, and vendor platforms, attaching each agent’s models, prompts, and data access to the Trust Graph. The software also covers policy-based restrictions on agent access and behavior, real-time monitoring of activity beyond approved boundaries, and evidence for buyers, auditors or regulators through Vanta’s Trust Center.

This would extend Vanta’s governance work from documenting and monitoring agents to testing their behavior and enforcing limits as they operate. The companies’ stated goal is to narrow the gap between a written AI policy and the technical controls applied to a running agent.

A lifecycle framework for AI security

Pillar has also developed a shared methodology for these checks. The company reports that its Secure AI Lifecycle framework, or SAIL, has surpassed 50,000 downloads and maps 91 AI risks into seven lifecycle stages. The framework gives development, machine learning operations, security, and governance teams a common approach to AI risk from early development through real-time operation. The phases begin with policy and resource discovery, proceed through security posture analysis, adversarial testing, deployment controls, and isolated execution, and end with monitoring and retirement.

From application to audit tests

Pillar’s governance and compliance documentation describes a rules engine that can prevent deployments using unapproved models, keep AI data in approved regions, identify licensing conflicts, and limit who can deploy models or change policies. Separate third-party AI checks evaluate external systems against internal requirements before those systems can reach enterprise data or production environments. On the compliance side, Pillar combines asset discovery records, adversarial test results, and telemetry from runtime guardrails in documentation for auditors, with governance findings and runtime logs tied to regulatory requirements. This trail of evidence explains the rationale for the acquisition: the business used to enforce AI policies can also demonstrate compliance within Vanta’s trust programs.

For Vanta, the acquisition would add testing and enforcement telemetry to the policies and property records already in its platform. Pillar’s stated purpose is to reach more teams and connect its technology to the trusted programs organizations already run. Integration remains a future joint effort, which makes the path of continuous evidence from written policy to the behavior of flesh-and-blood agents the central outcome of the pending agreement.