Asymptote Labs

AARM (Autonomous Action Runtime Management) is an open specification for securing AI agent actions at the point of execution: it intercepts agent-initiated actions and evaluates them against context, intent, policy and behavior before they run, with tamper-evident audit records. Authored by Herman Errico while at Vanta and first published on arXiv in February 2026, it was donated to the Cloud Security Alliance in April 2026 and now operates as a vendor-neutral CSAI Foundation technical working group.

Astha.ai is a Palo Alto, California-based company founded in 2025 that provides runtime-aware security and compliance for AI agent infrastructure. It leads the SAFE Agentic Framework and initiated the open-source SAFE-MCP project to map, assess and mitigate attack paths in AI agents and Model Context Protocol (MCP) deployments, offering continuous assessment, scanning, identity and access control, and audit-ready compliance evidence mapped to NIST, the EU AI Act and SOC 2, alongside an AI Agentic Security (AIAS) Practitioner certification.

Builds a 'data layer' between enterprise security telemetry and downstream SIEMs, data lakes, and AI agents-collecting signals across vendors and normalizing, enriching, resolving identities and assets, and detecting coverage gaps to give security teams and AI agents a clean, consistent view of the environment.

Ossprey (Ossprey Security) is a London-based cybersecurity company (founded 2026) focused on open-source software supply chain security. It combines static analysis with AI behavioral analysis to detect malicious code hidden in otherwise-functional dependencies, spanning a scanning tool, a severity dashboard and an AI behavioral engine that understands code intent rather than matching known signatures.

BlueRock (BlueRock Security, formerly BedRock Systems), founded in 2017 and based in San Francisco, provides a runtime security and observability platform for AI agents, including an agentic runtime sandbox, guardrails and a trust context engine that let enterprise security, DevOps and development teams see and control autonomous agents and MCP implementations in production.

Socket, founded in 2020 in San Francisco, provides scanning tools to detect security vulnerabilities in open-source code.