Thoropass vs Vanta

Thoropass, which started as Laika, combines a compliance platform with its own auditors, so one company can prepare a customer for an audit and then perform it. It was founded in 2019 and is based in New York, with Sam Li as CEO and co-founder. It has raised about $98 million, most recently a $50 million Series C led by Fin Capital in November 2022. Audits run through Laika Compliance, LLC, a licensed CPA firm doing business as Thoropass Assurance, and in September 2026 a subsidiary, Thoropass Certification LLC, was accredited to perform ISO/IEC 27001:2022 certification audits. We found no acquisition or merger; its September 2026 announcement still names Thoropass, Inc. as the parent. Thoropass says it covers more than 30 frameworks, including SOC 1, SOC 2, ISO 27001, HITRUST, PCI DSS, HIPAA and CMMC, and also sells penetration testing, including tests of AI tools. Its AI features include First Pass AI, which pre-screens evidence before an auditor reviews it, and generative AI for due diligence questionnaires. **AI compliance coverage** Thoropass supports ISO/IEC 42001 readiness with policies, control sets and guided AI system impact assessment workflows, and says its ISO-qualified auditors are kept separate from implementation support. It doesn't list the EU AI Act or the NIST AI RMF. **Who it's for** Companies that want readiness and the audit itself from one vendor. Named customers include Nord Security, AcuityMD, PhysicsX and Access Group.

Vanta is a compliance automation and trust management platform founded in 2018 and based in San Francisco. It says 16,000 companies use it and that it passed $300 million in annual recurring revenue in April 2026. It has raised $504 million since 2021; its latest round was a $150 million Series D led by Wellington Management in July 2025 at a $4.15 billion valuation, and Fortune reported no newer round as of April 2026. The platform connects to more than 400 tools to collect audit evidence, run continuous control tests, manage policies, risks and access reviews, and publish a Trust Center. Vanta says its AI answers more than 80% of security questionnaire questions. In November 2025 it launched an agent-based Agentic Trust Platform for evidence, questionnaires, vendor oversight and risk, and its agent can be used inside Claude and Cursor through an MCP server. It bought Riskey, a third- and fourth-party risk monitoring company, in July 2025. More than 100 audit firms work in the platform. **AI compliance coverage** Vanta has dedicated products for ISO/IEC 42001, the NIST AI RMF (launched in preview in January 2024 with 60 pre-built requirements and 10 risk scenarios) and the EU AI Act (announced in October 2024). The ISO 42001 product includes policy and document templates, mapped controls, automated tests, AI risk scenarios and access to accredited ISO 42001 auditors who review evidence in the platform. The EU AI Act product classifies AI systems by role and risk level, inventories AI use, and provides templates, AI-drafted policies, impact assessments and post-market monitoring records. **Who it's for** Startups through enterprises that need SOC 2, ISO 27001 or HIPAA and want AI frameworks on the same platform. It manages governance evidence; it does not test models.