Wheelhouse Advisors published VC Sonar for Assurance and Compliance, 2026 Inaugural Edition on November 6. The report explores the top emerging providers leading the way on agentic GRC and TRM along the path to Autonomous IRM: eighteen companies, all outside the IRM50, that came through Wheelhouse's public-evidence screen because that evidence shows an agent of theirs performing, or released to perform, assurance or compliance work. Some of those agents execute the work today for named customers; others assist a person or execute without named-customer evidence yet, and each profile says which. Each one carries the VC Sonar Emerging Provider designation, an evaluated inclusion with no tiers, and each has a profile in the report that tells its customers what the agent does, where it sits on the five layers of Autonomous IRM, how long the capability has been in market and what to verify before trusting it with scope.
The eighteen cover all eight Governance, Risk and Compliance and Technology Risk Management solution areas, and the map that places them is the first VC Sonar map for those two segments. It is a visibility tool, not a ranking. Inclusion says that public evidence shows relevance to autonomous execution in assurance and compliance work, and a provider's position says where that work happens, nothing about product quality or commercial standing.
Figure 1: VC Sonar for Assurance and Compliance, November 2026. Rings are the five layers of Autonomous IRM, from Strategic Oversight outside to Verification and Audit at the center; the dot beside each provider shows how long the mapped capability has been in market; the arrow marks the one cross-segment provider. Placements are not rankings. Logos are the trademarks of their respective owners.
The 2026 Roster by Solution Area
In Regulatory Compliance, Norm Ai turns regulations and internal policies into executable checks and reviews marketing and communications content line by line, with each comment tied to a rule and a compliance officer making the final call. SmartSuite's AI Field Agents classify items, extract values from evidence and draft outputs inside the compliance, SOX and audit workflows its customers configure. Sprinto's Fix-it agent executes approved remediation plans for the security controls behind SOC 2 and ISO 27001 attestations, which carries it across the map to Cybersecurity as the edition's one cross-segment provider.
In Ethics and Conduct, Arctera scores every captured communication against more than 1,400 patterns, by Arctera's count, and explains each flag, with ChatGPT and Copilot prompts brought into the supervised record. Shield's Alert Closure Agent closes surveillance alerts where no risk is established and writes its reasoning into the alert, with every closure reopenable.
In Internal Audit, DataSnipper's Excel Agents run matching, reconciliation and population tests inside the workpaper, log every action by default and can wait for approval before writing. Fieldguide's Field Agents select samples, run procedures and document results for assurance providers, with exceptions routed to a professional for review.
In Policies and Procedures, Anecdotes' Policy Guardian reads written policies, maps collected evidence to the statements that can be tested and tests them continuously. Collibra sets policy over data and AI use before agents run, through a human-approved registry and rules pushed into Databricks and Snowflake. Credo AI holds the registry of AI use cases, the policy packs mapped to them and the approval gates in between.
In Cybersecurity, Reco maps agents, human identities, applications, permissions and data into one graph across more than 280 integrations and routes what it finds into guided remediation. In IT Risk, Monitaur logs model and agent decisions against defined safe operating ranges and maps the evidence to a controls library, and Rapid7's Cyber GRC turns the security platform's own telemetry into continuous control evidence across SOC 2, ISO 27001, HITRUST and CMMC.
In Digital and OT Risk, AIUC writes the AIUC-1 standard, runs adversarial tests against other companies' agents and certifies them. Wayfound's AI Agent Supervisor reads the transcripts of agents built on other platforms and grades every session against published guidelines. Zenity allows or blocks an agent action in the execution path on Copilot Studio and Microsoft Foundry, or shuts the agent down. In Disaster Recovery, Cutover orchestrates recovery tests and failovers through runbooks with an immutable log of every task, owner and timing, and Rubrik's Agent Rewind links each agent action to its prompt, plan and tool and restores what the agent changed.
Reading the Map
The map reads as concentric rings and radial segments. The rings are the five layers of Autonomous IRM, from Strategic Oversight on the outside to Verification and Audit at the center, and a provider sits in the ring where its mapped capability does its work. The marker encodes how long that capability has been in market, in three bands. Ten of the eighteen capabilities are under a year old; two have passed three years.
Thirteen of the eighteen sit in the two inner rings. Nine are in Verification and Audit, four in Remediation and Response. Two sit in Threat Intelligence and Validation, one in Business Orchestration, and two in Strategic Oversight, where they set policy before agents run. The agentic work that has reached public evidence is the examination of artifacts and the actioning of non-compliance. Not one provider's agent informs a management decision or engages a business owner on a goal. As John A. Wheeler puts it in the report, "The emerging market has built examiners for autonomous work. It has not built the record that lets anyone trust them, and until it does, independence must be designed before agents are scaled."
The outer rings are thin because of what they need. Strategic Oversight and Business Orchestration work on goals and processes, which live in the system of record that an emerging provider does not own. Its agent arrives with the policy, the control and the asset it touches, enough to examine an artifact or correct a control, not enough to tell a manager what the result means for a goal. The report calls this the GRC Integration Trap reappearing at the agentic frontier.
What Buyers Should Use It For
Each profile is a verification brief rather than a vendor evaluation. It states what the public evidence shows, whether an agent performs the work in a generally available product with named customers or whether the capability is released but assists a person or executes without that evidence, and it labels every figure that came from the provider and could not be corroborated as vendor-reported. Then it lists the items to verify before a pilot, written as questions to put to the provider.
The question the report asks of every provider is the one most buyers have not yet asked. When an agent acts, does its own log preserve what it was permitted to do, who changed that permission during the run, who approved the action and under what authority, and where the work went at a handoff? The report calls this the authority record and treats it as a control. Most providers can show what their agent did. Two, Sprinto and DataSnipper, can show the approval the agent waited for. None can show, in a shipping product, that a change to the agent's permissions during a run was recorded. One, Cutover, records handoffs, and only between people.
The buyer guidance turns that into a demonstration any team can run. In the first scenario the agent starts under approved conditions, its authorization changes mid-run, and the provider shows the change recorded, the restriction enforced and the activity reconstructable from the log. In the second, one process is split across two agents, or an agent and a person, and authority and evidence stay traceable across the handoff. A dashboard of agent activity proves neither. Fifteen of the eighteen providers are doer-side, meaning the agent produces evidence inside the function that owns the record, so the report also asks the buyer to decide who re-performs the agent's work, from which source, and whether they can do it outside the platform, before the agent is granted scope.
What the Providers Should Use It For
For the eighteen, the report is a statement of where their agent stands on the path to Autonomous IRM and what the next edition will look for. Every profile names the evidence that would move its provider forward: a named customer running the executing capability in production, an outcome that attaches to the agent rather than to the platform around it, and an exported run log that shows permission state, changes, approvals and handoffs. The two most complete partial answers on the authority record today, Credo AI's Agent Governor and Zenity's enforcement log, are in preview or behind a customer login, which is a shorter distance to close than most.
The map also leaves a space the report calls the opportunity gap. It is the center the rings serve, where an agent's work on any platform is read against the goal, the process, the assets and the policy of the business and judged against the risk the company agreed to take. Wheelhouse Advisors describes that place as the management plane, as distinct from the control planes the large workflow platforms have built to govern the agents they run, and none of the eighteen occupies it yet. A provider that integrates across several systems of record and control planes, carries the goal, process and owner with the work, and verifies the agents inside those systems from outside them would be building it. That is the direction the series will watch.
Where to Find It
VC Sonar for Assurance and Compliance, 2026 Inaugural Edition runs to 70 pages. It includes the map and its reading guide, the authority record table, a profile for each of the eighteen providers, buyer guidance with a minimum authority record specification and dividend measures, a roadmap from Extended toward Autonomous maturity in assurance and compliance, and the methodology behind the placements. It is the inaugural edition for GRC and TRM. Its companion, VC Sonar for Performance and Resilience, carries ERM and ORM and returns in a 2027 edition in January.
The report is available at wheelhouseadvisors.com/irm-navigator-research.
