Control & trust
Which AI agent platforms document SOC 2, SSO, RBAC and audit controls?
Of 984 vendors, 482 document full security and identity coverage: role based access control (RBAC), single sign on (SSO), audit trails, encryption, least privilege tool access, a compliance posture such as SOC 2 or ISO 27001, and a stated data handling policy. Another 349 document partial coverage and 153 document none at all.
Every vendor in the index is assessed against the same 14 point taxonomy from public documentation, and no vendor pays for placement. Counts on this page were measured across all 984 public vendors on August 10, 2026.
How the 984 vendors split
No public evidence means the reviewed sources did not document the capability. On this index that is a statement about the evidence, not proof that the capability is absent. See methodology.
What counts as full coverage
Full coverage means the controls a security review asks for are published rather than promised: a named access model such as RBAC, identity integration such as SSO or SAML, an audit surface, and a compliance page a buyer can read without a call. Partial usually means encryption and a SOC 2 badge with nothing documented about who inside your organization can make an agent do what.
How to read these numbers
153 vendors document nothing here, the second largest evidence gap in the taxonomy, and the lane pattern explains most of it. The security and SOC lane leads at 70 percent because it sells to the people who write the questionnaire. GTM at 36 percent and browser at 35 percent trail, and both are lanes where individual teams often buy without a security review, so the documentation never gets written. Note the direction of causation before penalizing a small vendor: this axis measures published evidence, and a startup with real controls but no published SOC 2 report and no trust centre scores the same as one with neither.
Leading platform for security, identity & governance in each use case
Picked mechanically: the highest total coverage vendor in each lane that documents full evidence on this axis, one vendor per row. Scores are out of 14.
-
1. UiPath, for enterprise operations agents
13.5 / 14Full enterprise operations agents ranking · Compare the whole lane on all 14 axes
-
2. Automation Anywhere, for multi-agent platforms
13 / 14Full multi-agent platforms ranking · Compare the whole lane on all 14 axes
-
3. NICE CXone, for customer support agents
13 / 14Full customer support agents ranking · Compare the whole lane on all 14 axes
-
4. Salesforce, for GTM and revenue agents
13 / 14Full GTM and revenue agents ranking · Compare the whole lane on all 14 axes
-
5. Agno, for agent infrastructure platforms
12.5 / 14Full agent infrastructure platforms ranking · Compare the whole lane on all 14 axes
-
6. Appian, for agent builders
12.5 / 14Full agent builders ranking · Compare the whole lane on all 14 axes
-
7. CrowdStrike, for security and SOC agents
12.5 / 14Full security and SOC agents ranking · Compare the whole lane on all 14 axes
-
8. Emergence AI, for browser and computer-use agents
12.5 / 14Full browser and computer-use agents ranking · Compare the whole lane on all 14 axes
-
9. Factory, for coding agents
12.5 / 14Full coding agents ranking · Compare the whole lane on all 14 axes
-
10. Dataiku, for data analyst agents
12 / 14Full data analyst agents ranking · Compare the whole lane on all 14 axes
-
11. Kubiya, for SRE and DevOps agents
12 / 14Full SRE and DevOps agents ranking · Compare the whole lane on all 14 axes
-
12. Quiq, for voice agents
12 / 14Full voice agents ranking · Compare the whole lane on all 14 axes
-
13. Innovaccer, for healthcare agents
11.5 / 14Full healthcare agents ranking · Compare the whole lane on all 14 axes
Documented coverage by use case
Share of each lane documenting full coverage on this axis. Vendors that sit in two lanes count in both, the same rule the rankings and matrices use.
| Use case | Full coverage | Share |
|---|---|---|
| security and SOC agents | 64 of 92 | 70% |
| agent builders | 74 of 114 | 65% |
| customer support agents | 68 of 115 | 59% |
| multi-agent platforms | 33 of 57 | 58% |
| agent infrastructure platforms | 103 of 179 | 58% |
| SRE and DevOps agents | 21 of 36 | 58% |
| healthcare agents | 42 of 77 | 55% |
| coding agents | 35 of 68 | 51% |
| voice agents | 45 of 88 | 51% |
| enterprise operations agents | 141 of 319 | 44% |
| data analyst agents | 28 of 67 | 42% |
| GTM and revenue agents | 52 of 144 | 36% |
| browser and computer-use agents | 17 of 49 | 35% |
Recent verified changes from the vendors named above
Capability coverage is not a static picture. These are the most recent sourced change log entries for the platforms listed above, newest first, one per vendor. Scores on this page update as entries like these are verified.
-
Salesforce security / enterprise
High impactSalesforce announced that its Agentforce 360 platform has achieved Department of Defense Impact Level 5 (IL5) authorization. The platform is now embedded into Missionforce National Security to securely process highly sensitive workloads, including Controlled Unclassified Information and unclassified National Security Systems data.
August 5, 2026 · Verified · All Salesforce changes
-
UiPath security / enterprise
Medium impactOrganization Administrators can now use the Check access API to retrieve effective access permissions for users, groups, or external applications across the entire organization. The results include both organization-scoped and tenant-level assignments.
August 5, 2026 · Verified · All UiPath changes
-
NICE CXone security / enterprise
High impactNICE introduced NICE Witness, a new AI governance solution designed to create an impartial and cross-vendor record of AI activity and personnel actions. The solution captures data from the first call through dispatch and final review to ensure accountability in AI-assisted decisions.
August 3, 2026 · Verified · All NICE CXone changes
-
CrowdStrike security / enterprise
High impactCrowdStrike extended its Falcon AI Detection and Response (AIDR) module to provide active protection for AI agents built in Microsoft Copilot Studio and Anthropic's Claude Code. The update safeguards against threats originating from third-party AI tool usage.
July 30, 2026 · Partially Verified · All CrowdStrike changes
-
Automation Anywhere security / enterprise
High impactAutomation Anywhere announced that its agentic AI platform is now HIPAA compliant, supporting the processing of protected health information (PHI) across administrative healthcare workflows. The compliance framework enforces strict access controls, data encryption, and comprehensive audit logging. It also includes the provision of business associate agreements (BAAs) for covered entities.
July 29, 2026 · Verified · All Automation Anywhere changes
Full change log · updated weekly across the whole index
Questions buyers ask
Does a full score mean the vendor holds SOC 2?
Not by itself. Certification is one form of evidence among several, and this axis also weighs access control, identity integration and auditability. Always confirm the specific certification, its type and its date directly with the vendor.
What is the most common gap?
Agent level permissioning. Plenty of vendors document company level RBAC and SSO while saying nothing about constraining which tools an individual agent may call, which is the control that matters once agents act on their own.
How does this differ from the oversight axis?
Security governs who and what may act. Human oversight governs whether a person has to approve the action. A platform can score well on one and poorly on the other, and enterprise buyers usually need both.
The other 13 axes
No single axis decides a shortlist. Buyers who care about this one usually check human oversight & guardrails and observability & auditability next, or open the full taxonomy to see how the 14 axes fit together.