From the first plain-language description to a signed, expiring attestation, with drift monitoring and auditor-ready evidence the whole way.
Everything Vettly does
GRC rigour, applied to agents, at build speed.
Nine capabilities, one record per agent. From the first plain-language description to a signed, expiring attestation, with drift monitoring and auditor-ready evidence the whole way.
Registry of record
Every agent in the organisation, one stable identity each.
Per-tenant IDs (VT-0001…) with owner, team, business unit, criticality, lifecycle and tags
Five ways in: guided plain-language intake, technical spec wizard, declare-only, CSV/JSON import, API
Discovered agents land as unclaimed; owners claim them from the record
Versioned specifications hashed on every submission; the approved hash is the drift baseline
Status in one glance: draft, submitted, in review, changes requested, approved, conditional, rejected, expired, retired
Assessment engine
About sixty deterministic rules over everything an agent is made of, in under two seconds.
Model and provider: which model, who operates it, where it runs, and whether the agreements the data requires are in place (BAA for PHI, DPA, no-training, retention)
Optional Claude-assisted read of the prompt itself (claude-opus-5-5), with structured, reviewable findings
Blast radius
A live map of what an agent can reach, and the shortest path to exfiltration.
Principals → agent → knowledge, tools and MCP servers → systems of record, drawn as a graph
Metrics: systems reachable, write-capable paths, records in reach, highest classification, audience, trust-boundary crossings
The exfiltration triad flagged explicitly: private data + untrusted input + an outbound channel
Write paths highlighted so reviewers see what can change the world, not just what can be read
FAIR risk quantification
A dollar figure, not a colour.
Threat-event frequency × vulnerability × loss magnitude over 10 000 seeded Monte Carlo runs
Expected annual loss, P50 / P90 / P95 / P99 and the probability of at least one loss event
Loss composition: breach, response, regulatory, fraud and disruption
Residual exposure after the recommended fixes, ranked by loss reduction per unit of effort
Portfolio roll-up against the tenant's stated risk appetite
Review and blessing
The workflow a security team already runs, with the evidence attached.
Review queue with assignment, discussion threads and change requests back to the owner
Ten-point checklist pre-filled from the assessment: instructions, knowledge, tools, MCP, access, deployment, blast radius, quant, framework, ownership
Approve, approve with conditions, or reject, with separation of duties: reviewers recommend, owners and admins bless
Conditions tracked to completion with due dates; reopen, retire, recertify
Attestations
A certificate that means something because it expires.
Numbered certificates (VT-ATT-2026-00001) bound to the exact configuration hash that was reviewed
Validity period per tenant, 30-day recertification warnings, automatic expiry
Revoked when a new version is submitted or when critical drift is detected (optional)
Exportable as a PDF certificate and verifiable through the API
Discovery and drift
Find the agents nobody told you about, then notice when the blessed ones change.
Thirteen platform connectors with honest fidelity labels, plus a push endpoint for everything else
Scheduled syncs register unknown agents as unclaimed and snapshot known ones
Field-level diff against the approved baseline: instructions (line diff), tools, approval gates, knowledge, MCP servers, audience, exposure
Severity from low to critical; a shadow score shows what the live configuration would get
Acknowledge the drift, or adopt the live configuration as a new version and send it back through review
Documentation and evidence
Auditor-ready without a single screenshot.
An Agent Profile per agent in PDF, Markdown or JSON: identity, specification, findings, blast radius, quant, decisions, conditions, attestation, drift history
The whole registry as CSV, with scores, tiers, expected annual loss, attestations and drift status
Every finding mapped to OWASP LLM and Agentic Top 10, NIST AI RMF, MITRE ATLAS, ISO/IEC 42001, EU AI Act, SOC 2, GDPR, HIPAA and PCI DSS
Tenant audit log of every submission, checklist tick, decision, sync, membership change and sign-in
API, CI gates and notifications
Vettly where the work already happens.
An API for every step, with keys scoped to what each integration needs and usage metered per tenant
Fail a pipeline on tier, score or the exfiltration triad with one call
In-app inbox, email, Slack, Teams and signed webhooks for every lifecycle event
Push live configurations from any job; platform-native formats are normalised automatically
Every finding carries an identifier, evidence from the specification, a recommendation, an effort estimate, the share of vulnerability it removes, and the frameworks it maps to. The same input always produces the same score, so a pipeline can gate on it.
Instructions
Secrets in prompts, permissive directives, no boundary for untrusted content, no scope or refusal rules, removed confirmations, privileged identity claims, internal hostnames, no confidentiality rule.
Knowledge
Restricted or regulated data (PII, PHI, PCI) behind weak authentication or public exposure, untrusted sources feeding the prompt, write access to corpora, oversized record counts.
Tools
Write, delete, execute, financial and identity actions without human approval, irreversible actions, overly broad targets, communication tools that reach outside the organisation.
MCP servers
Community or unverified servers, unpinned versions, no integrity check, unauthenticated or plaintext transports, write-capable servers, secrets stored on the server.
Access and identity
Public or external audiences, privileged principals, anyone able to edit instructions, authentication weaker than the data warrants.
Deployment controls
Missing audit logging, injection detection, output filtering or rate limits; full autonomy on sensitive actions; scheduled and event triggers nobody watches.
Platform, model and provider
Which model, which provider operates it, where inference runs, and whether the contracts match the data: PHI without a business associate agreement, cardholder data at a third-party model, personal data without a processing agreement or a no-training commitment, unknown residency, unpinned model versions.
Blast radius
The exfiltration triad, trust-boundary crossings, write paths into systems of record, records in reach beyond the agent's purpose.
0–100 risk score and tier
Weighted by severity with diminishing returns, so one critical finding matters more than ten lows, and the tier (low, medium, high, critical) drives the verdict.
Category scores
Where the exposure concentrates: instructions, knowledge, tools, MCP, access, deployment, platform, blast radius. Reviewers know where to spend their hour.
Recommendations with a price
Each fix is ranked by how much expected annual loss it removes per unit of effort, so the top of the list is the best next hour of engineering.
Review, blessing and attestations
A decision you can defend a year later.
Every review leaves a record: who was assigned, what the checklist said, what was discussed, what changed, who decided and why. Approvals are bound to the configuration hash that was reviewed, so when the agent changes, the blessing is visibly out of date.
Ten-point checklist· Pre-filled from the assessment; each item passes, fails or is marked not applicable with a note.
Separation of duties· Reviewers verify and recommend; a different person blesses. Enforced per tenant.
Conditions· Approve now with obligations, due dates and resolution tracking; waive with a reason.
Lifecycle· Expiry, 30-day warnings, recertification, retirement, reopening on drift, revocation on a new version.
Attestationvalid
VT-ATT-2026-00017
Expense Audit Assistant · VT-0017 · approved with conditions
Score at approval
41 · medium
Configuration hash
sha256 · 9f3c…e21a
Valid until
2027-10-09
Open conditions
1 of 2
Approved by
Head of Security Governance
Frameworks
OWASP · NIST · ISO 42001
Exportable as a PDF certificate; verifiable by number through the API; revoked automatically when the configuration changes.
Ship agents your CISO can sign.
Tell us about your organisation and the platforms your agents run on. We provision your workspace and you are reviewing your first agent the same day.