QL Security vs Scytale

QL Security is a UK-based consultancy providing AI security, governance, compliance, assurance, and ISO/IEC 42001 implementation support for organisations managing AI risk. Services are delivered as an advisory engagement rather than a SaaS product.

Scytale is a compliance automation (GRC) platform that pairs its software with a dedicated in-house compliance expert for each customer. Meiran Galis founded it in 2021 and leads it as CEO. The operating company is Scytale AI, Inc. Its press releases are datelined New York, and it lists offices in New York, Tel Aviv, Prague, Lisbon, Johannesburg and Cape Town. Calcalist reported in 2025 that its R&D center is in Tel Aviv. Scytale says it supports 80+ security, privacy and AI frameworks, with controls cross-mapped between them; its public framework library names 37, including SOC 2, ISO 27001, ISO 42001, the EU AI Act, PCI DSS, GDPR, HIPAA, SOX IT general controls, NIST CSF 2.0, DORA and NIS2. The platform automates evidence collection, continuous control monitoring, user access reviews, policy management, vendor risk and audit preparation. Scytale also sells penetration testing by its own team (web, mobile, API, network and cloud), AI-drafted answers to security questionnaires that an expert reviews, and a Trust Center for sharing compliance documents with customers. SOX ITGC automation came from its June 2025 acquisition of AudITech. Scytale describes a set of six AI agents but names two: Scy, a conversational assistant that checks control status, drafts remediation and creates policies, and an AI Governance Agent that finds unregistered AI systems and adds them to an AI inventory. Its page also shows agents validating evidence, flagging control gaps, redlining policies after a regulatory change and flagging vendors above a risk threshold. In September 2026 it added AI third-party risk management: vendor discovery through SSO, profile enrichment, dynamic risk scoring and breach monitoring. In October 2026 it launched Scytale MCP, which gives AI assistants read-only access to a customer's compliance data. **AI compliance coverage** Scytale supports ISO/IEC 42001, reusing controls it shares with ISO 27001 to stand up an AI management system (AIMS), and added the EU AI Act as a framework in 2025. Its AI Governance product discovers AI tools and agents across identity providers, cloud accounts, code repositories and SaaS apps, classifies their risk and runs assessments against the EU AI Act, ISO 42001, the NIST AI RMF and AIUC-1. It connects to OpenAI, Anthropic, Google Vertex AI and AWS Bedrock. Scytale's pages don't say which EU AI Act obligations its templates cover. We found no claim that Scytale itself holds ISO 42001 certification. **Who it's for** Startups and mid-market companies that need SOC 2 or ISO 27001 and want to add ISO 42001 or EU AI Act readiness on the same platform, with expert help rather than purely self-serve software. Customers shown on its homepage include monday.com, Deel, Fiverr, Payoneer, Taboola and ICL. Its published customer stories (SundaySky, Sport Alliance) cover security compliance; we found none about ISO 42001 or AI governance.