Giving an AI agent access to customer records is easier than making sure it stays within its permissions.
Vanta announced on Nov. 9 that it signed a definitive agreement to acquire AI security startup Pillar Security. The planned acquisition would connect AI agent testing, monitoring and runtime protection with Vanta’s governance platform.
For managed service providers (MSPs) and compliance partners, the integration could support services that help customers identify their AI systems, test their safeguards and monitor agent activity.
Founded in 2023 by Ziv Karliner and Dor Sarig, Pillar Security develops tools for discovering, testing and protecting AI applications and agents throughout their lifecycle. Vanta says the integration will connect policies governing AI use with technical controls that test and restrict agent behavior.
An agent might have permission to access customer records or internal business applications but still behave unexpectedly. Pillar’s platform helps organizations identify vulnerabilities, test agents against potential attacks and prevent unauthorized activity during operation. Vanta plans to connect these capabilities to its Trust Graph, which links business policies, security controls, risk ownership and compliance evidence.
The planned acquisition builds on Vanta’s AI governance offering, introduced in July 2026, as partners explore building AI governance services. The company says demand for its early-access program has pushed its waiting list to six times the available capacity. Vanta has also grown to more than 20,000 customers, up from 16,000 in the first quarter of 2026.
What Vanta plans to introduce in 2027
According to Vanta’s integration roadmap, the company plans to introduce Pillar’s capabilities in stages throughout 2027. Vanta says AI Governance will become a paid offering in January 2027.
| Expected release | Capability | What it does |
| January 2027 | AI inventory | Maps AI applications, models, agents and Model Context Protocol (MCP) servers |
| January 2027 | Runtime monitoring and detection | Detects suspicious behavior and security violations |
| Spring 2027 | AI red-teaming | Tests agents against adversarial attacks |
| Summer 2027 | Runtime enforcement | Blocks unauthorized actions in real time |
The combination is designed to create a continuous security process. Companies can identify their AI systems, test their weaknesses, monitor their behavior and enforce restrictions without treating governance as a separate paperwork exercise.
Why MSPs and channel partners should pay attention
The planned acquisition could give MSPs, security consultants and compliance partners another reason to expand their AI security offerings.
In a July 2025 survey of 3,500 IT and business leaders conducted by Sapio Research for Vanta, 65% said their use of agentic AI was outpacing their understanding of it. Forty-eight percent reported having a framework for granting or limiting AI autonomy.
That gap creates room for channel partners to offer services around AI asset discovery, risk assessments, adversarial testing and ongoing security monitoring. Partners already managing clients’ compliance and security programs could also use AI governance as an entry point for additional engagements.
However, the opportunity will depend on how accessible Vanta makes the integrated capabilities to partners. Pricing, partner packaging, deployment requirements and the level of automation available will influence whether smaller MSPs can deliver these services profitably.
What partners should check before building a service
For partners already managing compliance and security programs, the potential value is connecting a customer’s AI policies with evidence of how its agents behave. Visibility into what agents access could help partners identify risks, investigate incidents and explain where controls need strengthening.
The rollout schedule also matters when defining a service. Vanta plans to introduce inventory and monitoring before runtime enforcement, so partners should distinguish between identifying risky activity and automatically blocking it.
Before quoting an engagement, partners should ask:
- Coverage: Which AI applications, agent frameworks and deployment environments will the tools support?
- Customer management: How will partners manage access, policies and reporting across multiple customers?
- Response responsibilities: Who investigates alerts, approves exceptions and handles an agent blocked during a business process?
- Commercial terms: How will licensing, partner access and support costs affect service pricing?
- Evidence: Can customers export records showing which policies, tests and interventions applied to an agent?
Partners can begin by helping customers inventory AI systems, identify accountable owners and document permitted actions. Those steps provide a foundation for evaluating the integrated tools as they arrive, while keeping customer commitments aligned with capabilities that are actually available.
Read more: Explore how AI security concerns are creating new opportunities for MSPs to connect governance work with broader customer security and business needs.