Noma Security vs Prediction Guard

Noma Security is a security and governance platform for AI agents and the wider AI lifecycle. It was founded in 2023 by Niv Braun (CEO) and Alon Tron (CTO), who met in the Israel Defense Forces' 8200 intelligence unit. Its contact page lists a single office, in New York, and its development center is in Tel Aviv. Noma has raised $132 million: a $7 million seed round led by Glilot Capital Partners and a $25 million Series A led by Ballistic Ventures, announced together when it came out of stealth (reported October 31, 2024), and a $100 million Series B led by Evolution Equity Partners in July 2025, with Ballistic and Glilot taking part. Databricks Ventures made an undisclosed investment in June 2025, alongside a partnership with Databricks. The platform has four products. AI-SPM finds agents, MCP servers, skills, models and tools across cloud platforms, SaaS platforms, code repositories and endpoints (through existing EDR or MDM tools), and flags misconfigurations such as excessive agency, unsandboxed agents and secrets in agent instructions. It also scans models from open registries such as Hugging Face for malicious artifacts, hidden instructions and known vulnerabilities, and assesses MCP servers for supply chain risk. Agent Access Control defines which agents are approved, what data they can reach and what actions they can take. AI-DR monitors agent sessions at runtime for prompt injection (including indirect injection through tool responses), data leakage, tool poisoning and scope violations; it can alert, block, mask data inline, steer the agent, require human approval or stop it with a kill switch. AI Red Teaming runs multi-turn attack campaigns against apps and agents, including in CI/CD pipelines, and feeds findings into runtime policies. Policies are enforced through agent hooks, AI and MCP gateways, agent SDKs and APIs. Noma covers SaaS agents built in Microsoft Copilot Studio and Salesforce Agentforce, and homegrown agents on Amazon Bedrock, Azure AI Foundry and Databricks or built with LangChain and CrewAI. Since February 2026 it has been available through the Extended plan of AWS Security Hub, covering Amazon Bedrock and SageMaker workloads. **AI compliance coverage** Noma says its AI-SPM and red-teaming findings map to the NIST AI RMF, the EU AI Act and ISO 42001, as well as the OWASP Top 10 for LLMs and MITRE ATLAS, and its red-teaming product offers these frameworks as compliance presets. A UiPath case study on its site says Noma's scanning supported UiPath's ISO/IEC 42001:2023 certification. We found no published control-by-control mappings. **Who it's for** Large enterprises with many AI agents across endpoints, SaaS and cloud that want one security layer from discovery to runtime. Noma says it is used by more than 10% of the Fortune 100, and testimonials on its site come from people at UiPath, Kantar, Best Buy, Nielsen and Endor Labs.

Prediction Guard sells a self-hosted "sovereign AI control plane" for regulated organizations. It sits between applications and the models, agents and MCP tools they call, and applies access, safety and policy controls to each request inside the customer's own infrastructure. The company was founded in 2023 in Lafayette, Indiana; CEO Daniel Whitenack is a co-founder. It raised a $3.7 million seed round led by Sovereign Capital in May 2025, and Noblis Ventures made a strategic investment of undisclosed size in July 2025. At the time of the seed round it had eight employees and said it had 18 customers in health care, defense, transportation and manufacturing. The platform registers each agent with an identity and role and limits it to the models and tools that role needs. Runtime controls include PII masking, prompt injection detection, toxicity filtering, input sanitization, MCP tool scoping and human-in-the-loop approval; requests that fail a policy are blocked and logged. It produces an exportable AI bill of materials (CycloneDX) of models, guardrails and MCP servers, runs model security scans and streams security events to SIEM tools such as Splunk, Datadog and Grafana. Applications call it through OpenAI- and Anthropic-compatible APIs. It deploys into a customer VPC on AWS, Azure or Google Cloud, on Kubernetes on premises, or air-gapped. Prediction Guard says its control overhead is under 200 ms per request. **AI compliance coverage** Prediction Guard says its policies align with the NIST AI RMF, NIST AI 600-1, the OWASP Top 10 for LLM and agentic applications, OMB M-26-04 and AIUC-1, with one-click baselines and an exportable "proof of alignment" for the NIST AI RMF. A company blog post (August 2026) adds the EU AI Act and ISO/IEC 42001. The same post labels its OWASP mapping "self-published" and not independently verified, and notes that the audit log records enforcement events rather than full replayable traces. We found no published control-by-control mapping. The homepage shows badges for a SOC 2 Type 2 report by Sensiba and HIPAA compliance; there is no public trust center. **Who it's for** Regulated enterprises and public sector bodies that want AI guardrails and agent controls to run inside their own network, including disconnected environments. It is sold to government through Carahsoft. Its homepage quotes executives at Noblis (also an investor), SimWerx and iBase-t.