Vanta Signs Definitive Deal to Acquire Pillar Security

By Grace Kim

Pillar Security announced on November 9, 2026, that Vanta had signed a definitive agreement to acquire the AI security company. The pending deal would place Pillar's agent-testing and runtime-protection technology inside Vanta's trust and compliance business.

Under the plan, Pillar's software would connect with Vanta's Trust Graph. According to Pillar's announcement, the integration would link AI governance policies to the systems they govern, while Vanta would add testing and enforcement telemetry to policies and ownership records already on its platform.

What is Pillar Security?

According to Pillar's announcement, Dor Sarig and Ziv Karliner founded the company in 2023 after concluding that AI would move beyond answering prompts to acting for organizations through data, tools and decisions.

Pillar says its software covers AI applications and agents throughout their lifecycle. It finds those systems, tests their defenses and stops actions outside authorized boundaries. Test designs and operating limits are based on each agent's business role, granted authority and risk owner.

Pillar's researchers analyze failure modes in AI systems, then use the results to develop new tests and safeguards. Pillar's announcement says the acquisition would place that capability inside Vanta's trust and compliance business.

In practical terms, Vanta would add tools that test and stop AI agents, not just catalog them.

What would Vanta gain from the deal?

Pillar's announcement says Vanta serves more than 20,000 companies. The announcement also says Vanta's platform links security and compliance policies and controls with their owners and organizational commitments.

For Vanta, the pending acquisition would add testing results and runtime-security events to those policy and ownership records. Test results would show where controls need reinforcement, while live security events would serve as proof that required safeguards were operating.

Pillar said its purpose is to reach more teams and connect its technology with the trust programs organizations already run. The practical result is that Pillar's controls would travel through those programs.

How would policy reach live agents?

According to Pillar's announcement, an organization's rules would shape how Pillar tests agents and constrains their live actions. The approach would extend Vanta's governance work from documenting and controlling agents to testing their behavior and enforcing boundaries while they operate.

Vanta's AI Governance product page describes an inventory spanning developer laptops, production code and vendor platforms. The system attaches each agent's models, prompts and data access to the Trust Graph.

The product page also says the software provides policy-based restrictions on agent access and behavior. It monitors activity beyond approved boundaries in real time and produces evidence for buyers, auditors or regulators through Vanta's Trust Center.

Pillar and Vanta said the aim is to “narrow the gap between a written AI policy and the technical controls applied to a running agent.” In practice, one control system would span policy, testing, live monitoring and audit evidence.

What does Pillar's SAIL framework cover?

Pillar reports that its Secure AI Lifecycle, or SAIL, framework has passed 50,000 downloads. The shared methodology maps 91 AI risks across seven phases and gives development, machine-learning operations, security and governance teams a common approach from initial development through live operation.

The seven phases are:

• Policy and asset discovery.
• Security-posture analysis.
• Adversarial testing.
• Deployment controls.
• Isolated execution.
• Monitoring.
• Retirement.

SAIL gives cross-functional teams a common sequence for managing AI risk.

What can Pillar's rules enforce?

Pillar's governance and compliance documentation describes a rule engine that can:

• Prevent deployments using unapproved models.
• Keep AI data in approved regions.
• Identify licensing conflicts.
• Limit who may deploy models or change policies.

Separate third-party AI controls described by Pillar evaluate external systems against internal requirements before those systems can reach company data or production environments.

For compliance, Pillar combines asset-discovery records, adversarial test results and runtime-guardrail telemetry into documentation for auditors. Governance findings and runtime logs are tied to regulatory requirements.

Pillar's announcement says this evidence trail explains the acquisition's rationale: activity used to enforce AI policies can also demonstrate compliance inside Vanta's trust programs. In practical terms, enforcement activity can serve as compliance evidence.

What remains after the signing?

Pillar's announcement identifies “a continuous evidence trail from written policy to live agent behavior” as the central deliverable of the pending deal. The integration remains future joint work.

The next test for Vanta, as Pillar framed the deal, is whether it can make that trail operational across the trust programs of the more than 20,000 companies it serves.