Need to get familiar with the AI TRiSM market? Get our report

AI TRiSM is moving fast right now, and the biggest names in AI and data want a piece of it.

We've found a lot of interesting signals. OpenAI agreed to buy Promptfoo, used by major companies to test AI security, and integrate it into its agent platform. And Veeam paid $1.725B for Securiti AI to protect data used by AI systems. Security is becoming part of the AI stack itself.

In this section, we look at why AI security is being folded into bigger platforms, what that means for independent startups, and which parts of the market are still open.

Most companies can't say how many AI tools their staff use, let alone what data goes into them.

We compare six types of AI trust, risk and security tools, from governance platforms to guardrails and monitoring. We rank what security, compliance and engineering teams need most, like preventing data leaks and proving compliance.

This helps you see which problems already have a budget, and which ones still sit between teams with no one paying.

Per-user licenses for employee AI use, fees per application or per model, usage-based pricing on every prompt checked, platform subscriptions, open-source tools with paid enterprise versions: AI TRiSM companies sell in many ways.

We compare guardrails that check live AI traffic with governance platforms and open-source tools. Live checks add computing costs. Governance sales involve several teams and can take longer. Free tools still need a way to earn revenue.

You'll see which models hold up when a cloud provider or a model maker adds a similar feature for free.

A growth rate is only useful if you know what's behind it. Here, we explain what pushes the AI TRiSM market forward.

Some drivers are easy to spot: more AI agents at work, more company data flowing into models, and auditors starting to ask questions. Others add up over time. Every new agent needs its own permissions and checks. Each public AI incident makes boards ask harder questions. And when large customers ask their suppliers how they control AI, those suppliers need a way to show it.

Before building or investing, you should know what makes companies pay for AI risk tools, and who in the company signs for it.

HiddenLayer and Noma Security are among the startups people name first in AI security, but the AI TRiSM market is much wider.

Many smaller players solve one precise problem. Some only track which AI tools employees use and what they paste into them. Others test models for bias before a bank can use them, or check what an AI agent is allowed to do before it does it.

They are hard to spot because the same company can be filed under security, governance or data privacy, and its buyers sit in different teams. Many are also bought within a few years, so the map changes before most people have read it.

Below, you'll find the market grids and ecosystem maps we've built to show who covers which part of AI risk, and where the gaps still are.

Protect AI, Lakera, Robust Intelligence… some of the best AI security startups have already won the way this market often pays: a big security company bought them.

They solved specific security problems, from finding threats hidden in models to blocking prompt injection. Palo Alto Networks, Check Point and Cisco bought those capabilities and customer bases. An acquisition is a real result, but it doesn't prove every standalone model would have lasted.

We'll look at how these teams picked one sharp problem and won users fast, and what that teaches startups that want to stay independent.