Shield360 › Compare › AI governance tools
AI governance tools compared (2026)
Thirteen tools, seventeen questions, and a source for every answer. The tools do different jobs, so this page sorts them by the layer of governance each one works at, says where Shield360 fits and where it does not, and points to the tool that fits better when that is true.
Based on each vendor's public documentation as of October 2026. Features change, so check with the vendors.
01 · Layers
What each tool governs
“AI governance” is four jobs
sold under one name.
Most of the tools below are strong at one layer and present at one or two others. Knowing which layer your first problem sits in narrows a long list to two or three.
| Layer | The question it answers | What it produces |
|---|---|---|
| Inventory and registry | What AI do we run, who owns it, and what is it for? | A register of systems, models, agents and vendors, each with an owner |
| Risk and compliance workflow | Was each use assessed, approved and mapped to the rules we answer to? | Intake forms, assessments, approvals, framework mappings |
| Runtime and agent controls | What may a person or an agent send, call or change, and what is stopped? | Allow, warn, mask and block decisions, made before the action |
| Data governance | Which data trained or feeds a system, where it came from, and how it is classified | Lineage, a data catalog, classification labels |
Reporting after the fact, or enforcing before the action
A second line cuts across all four. Some tools describe what happened: they collect traces, questionnaires or logs and report on them. Others sit in the path of a request and can stop it before it reaches a model or a tool. Both are useful. They are not interchangeable: a report of the card number that reached a chatbot is evidence of a gap, not a control.
Shield360's position: governance built from what actually ran, rather than from what was declared, with enforcement in the path where it can be put there — the browser, an AI proxy, coding agents and an MCP gateway — and observation everywhere else.
02 · The matrix
Thirteen tools
Seventeen questions,
answered from each vendor's own pages.
“Not stated” is not “no”: it means we could not find it on the vendor's own pages, so ask them. The last four columns are the questions Shield360 was built around, so read them as our emphasis rather than a neutral list. Shield360's own row is marked Partial wherever that is the honest answer. Scroll the table sideways; the tool name stays in place.
| Tool | Main layer | Inventory / registry | Risk & compliance workflow | Runtime / agent controls | Data governance | EU AI Act | NIST AI RMF | ISO/IEC 42001 | Discovery | Testing | Monitoring | Audit trail | Deployment | Coding-agent governance | AI cost attribution | In-path sensitive-data protection | Stored-data minimization |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Shield360 | Runtime controls and evidence from observed AI use | ✓ Built from observed use: tools, models, vendors, keys, agents, MCP servers; owner, purpose, risk rating, decision | ✓ Risk register, AI requests and approvals, impact assessments, findings, internal audits, management reviews | ✓ Browser extension, AI proxy, coding-agent hooks, MCP gateway grants, sequence policies | ✓ Dataset registry for training, evaluation and RAG data: owner, provenance, license, classification, Art. 10 quality and bias examination, second-person approval; lineage of observed flows; classification catalog; data dictionary; dataset contents not inspected | ✓ The 33 Articles that place obligations on organizations that build or use AI, incl. serious-incident register (Art. 73), AI literacy (Art. 4), prohibited-practice screening (Art. 5), FRIA (Art. 27), Annex IV technical documentation; evidence, not legal advice | ✓ All 72 AI RMF 1.0 subcategories assessed: 44 from observed evidence, 28 by owner attestation; NIST does not certify | ✓ All 38 Annex A controls, Statement of Applicability, daily history; evidence, not certification | ✓ Shadow AI on endpoints; LLM workloads in a Kubernetes cluster | ✓ LLM-judge evaluations; agent test suites with templated, model-generated and multi-turn red-team attacks run on your own evaluation model, with cost and time caps; prompt-injection detection | ✓ Traces, alerts, SIEM export | ✓ Append-only audit log; CSV and JSON exports; signed evidence packages | Managed, or self-hosted with Docker Compose | ✓ Hooks in Claude Code, Cursor and Codex: warn or block | ✓ Seats and per-token use, per person and machine | ✓ Browser extension, AI proxy, coding agents: warn, mask or block | ✓ Prompts, responses and tool content not stored unless the organization opts in |
| Credo AI | Risk and compliance workflow, with policy packs | ✓ Including agents and third-party AI | ✓ Intake, approval gates | Partial Evaluates agent traces for violations, escalates to a person | Partial Lineage and model metadata in the agent registry | ✓ | ✓ | ✓ | ✓ Shadow AI discovery; cloud auto-discovery | ✓ Automated red-teaming, drift detection | ✓ | ✓ Evidence generation, audit trails | Self-hosted install documented, including air-gapped | Not stated | Not stated | Not stated | Not stated |
| IBM watsonx.governance | Lifecycle governance, evaluation and monitoring | ✓ Use cases; catalog of agents and tools | Partial Governance policies across models and workflows; intake not described | Partial Guardrail metrics the application acts on | Partial Tool lineage mapping | ✓ Listed on the product page | ✓ Listed on the product page | ✓ Listed on the product page | ✓ Unmanaged and unapproved AI use | ✓ Red teaming; quality and safety metrics | ✓ Drift and agent behavior | ✓ Traceability of decisions and model changes | Cloud and on-premises | Not stated | Not stated | Not stated PII is measured, blocking not stated | Not stated |
| Holistic AI | Discovery, testing and compliance, with runtime agents | ✓ Models, agents, datasets, endpoints | ✓ Intake, review, human approvals | ✓ Inline agents; kill switches | Partial Asset classification and dependency mapping | ✓ | ✓ | ✓ | ✓ Scans cloud, code and SaaS | ✓ Red teaming: jailbreak, toxicity, hallucination, bias | ✓ | ✓ Audit trails, version history | Not stated | Not stated | Partial Agent spend limits, not attribution | Not stated | Not stated |
| OneTrust AI Governance | Inventory, risk and policy workflow | ✓ Systems, models, agents, datasets, vendors | ✓ Intake, approval, attestation, sign-off | ✓ Block, allow, redact, escalate or route by policy | Not stated Data lineage is a separate OneTrust product | ✓ Template | ✓ Template | ✓ Template | ✓ Shadow AI | Not stated | ✓ | ✓ Evidence from assessments, approvals, enforcement | Platform model not stated; the AI Guard classifier runs on a OneTrust Light Worker Node | Not stated | Not stated | ✓ AI Guard SDK in the application: mask or block before the model | ✓ AI Guard sends summary metrics, not prompts |
| ServiceNow AI Control Tower | Enterprise AI inventory and workflow on the ServiceNow platform | ✓ Models, agents, MCP servers, datasets, prompts | ✓ Risk questions in the intake form; steward review | ✓ AI Gateway; inline guardrails in its agent SDK | Partial Datasets tracked as assets | ✓ Content pack | ✓ | Partial In legal review per the June 2026 release notes | ✓ Connectors to cloud and data platforms | ✓ Evaluation suite | ✓ Runtime observability of agents | Partial Stated in community articles | Part of the ServiceNow platform | Not stated | ✓ AI consumption cost and ROI | Partial Agent SDK scans tool calls for PII and credentials | Not stated |
| Microsoft Purview | Data security and compliance for AI apps and agents | ✓ AI apps and agents with recent activity | Partial Compliance Manager assessments; no AI use-case intake described | Partial DLP in Edge for Business; not agent policy | ✓ Classification and sensitivity labels | ✓ Assessment template | ✓ Assessment template | ✓ Assessment template | ✓ Generative AI sites; needs extension or onboarded devices | Not stated | ✓ | ✓ Audit log, activity explorer | Microsoft Purview portal | Not stated | Not stated | ✓ Edge for Business: block sensitive text to AI apps | Partial Retention policies delete; not masking before storage |
| Collibra AI Governance | AI system of record on a data catalog and lineage platform | ✓ Use cases, models, agents | ✓ Intake, assessment and approval workflow | Partial Guardian Agents can block in block mode | ✓ Catalog, lineage, classification-based masking | ✓ Assessment template | ✓ Assessment template | Not stated | Partial Ingests model metadata from ML platforms | Not stated | Partial Trust score per system, not runtime telemetry | ✓ Traceability of AI activities | Governs AWS, Azure, Google, Databricks, SAP, MLflow; hosting model not stated | Not stated | Not stated | Not stated | Partial Warehouse masking by role, not AI telemetry |
| MLflow Model Registry | Open-source model lifecycle registry; AI Gateway and evaluation alongside | ✓ Models, versions, aliases, tags | Partial Metadata and tags; no intake or approval workflow | Partial Guardrails in the MLflow AI Gateway, not the registry | Partial Model version linked to the run that produced it | Not stated | Not stated | Not stated | Not stated | ✓ LLM-judge scorers | ✓ Tracing, gateway usage | Partial Gateway request logs | Open source (Apache-2.0); managed on Databricks or AWS | Not stated | Partial Per endpoint, team or project, through the AI Gateway | Partial PII redaction in the AI Gateway | Not stated |
| NVIDIA NeMo Guardrails | Runtime guardrails for LLM applications | Not stated | Not stated | ✓ Input, retrieval, dialog, execution and output rails | Not stated | Not stated | Not stated | Not stated | Not stated | ✓ Evaluation tooling; vulnerability scanning reports | Partial Per-request tracing to your own backend | Not stated | Open source (Apache-2.0): library or OpenAI-compatible server | Not stated | Not stated | ✓ Masks sensitive data inside the application or guardrails server | Not stated |
| VDF AI | Runtime governance for agents on its own orchestration platform | ✓ Agents, networks and models it runs | Partial Approval gates for consequential actions | ✓ Policy evaluated on every request; tool grants | Partial Where prompts and outputs were processed and stored | ✓ | Not stated | ✓ | Not stated | Not stated | ✓ Latency, token and cost per call | ✓ Decision receipts; audit log of AI actions | On-premises, hybrid, air-gapped, sovereign cloud | Not stated | ✓ For traffic it runs | Not stated | Partial Content stays in your infrastructure |
| Langfuse | LLM observability, evaluation and prompt management | Not stated | Not stated | Not stated Its docs call hook tracing telemetry, not enforcement | Not stated | Not stated | Not stated | Not stated | Not stated | ✓ LLM-as-a-judge, datasets, experiments | ✓ Traces of LLM and non-LLM calls | Partial Audit logs on Enterprise plans | Open source (MIT core); self-hosted or Langfuse Cloud | Partial Traces Claude Code, Codex, Cursor and others; no enforcement | ✓ Per call; by developer, project or model | Not stated | ✓ Client-side masking before data is sent |
| Arize Phoenix | LLM tracing and evaluation | Not stated | Not stated | Not stated | Not stated | Not stated | Not stated | Not stated | Not stated | ✓ LLM and code evaluators, datasets, experiments | ✓ Tracing of model calls, retrieval and tools | Not stated | Source-available (Elastic License 2.0); self-hosted | Not stated | ✓ Rolled up by trace and project | Not stated | Partial Settings hide inputs and outputs in spans |
Read the cells as of October 2026. Based on each vendor's public documentation as of October 2026; features change — check with vendors. Product names are trademarks of their owners and are used here only to identify the products. Every source is listed below.
03 · By layer
What each is strongest at
Each tool, in a few sentences.
Risk and compliance platforms
Credo AI
A governance platform built around policy packs for the EU AI Act, NIST AI RMF and ISO/IEC 42001, with automated evidence generation. It adds a registry with shadow-AI discovery, AI-assisted intake and approval gates, and automated red-teaming and drift detection.
IBM watsonx.governance
Lifecycle governance of AI use cases joined to evaluation and monitoring of models and agents: drift, red teaming, and quality and safety metrics including PII and prompt injection. IBM states it runs across cloud and on-premises environments.
Holistic AI
Broad single-vendor coverage: shadow-AI discovery across cloud, code and SaaS, intake and approval workflows, agentic red teaming, and runtime agents that can step in inline. Its compliance assessments name the EU AI Act, NIST AI RMF and ISO 42001.
OneTrust AI Governance
Intake, approval, attestation and sign-off workflows with EU AI Act, NIST AI RMF and ISO 42001 templates, alongside discovery of AI systems. Its AI Guard SDK masks or blocks sensitive data inside an application, with classification on a OneTrust Light Worker Node that sends summary metrics rather than prompts.
ServiceNow AI Control Tower
Brings AI assets — models, agents, MCP servers, datasets and prompts — into the ServiceNow platform's inventory and workflow, with risk questions in the intake form. ServiceNow has added an AI Gateway with runtime controls, an evaluation suite, and cost and ROI tracking. Its June 2026 release notes say ISO 42001 content is in legal review.
Data and security governance
Microsoft Purview
Applies Microsoft's data classification, sensitivity labels, DLP and audit to AI apps and agents, and can block sensitive text sent to unmanaged AI apps in Edge for Business. Compliance Manager includes assessment templates for the EU AI Act, NIST AI RMF and ISO/IEC 42001.
Collibra AI Governance
A register of AI use cases, models and agents with intake, assessment and approval workflows, linked to Collibra's data catalog and lineage. It ships EU AI Act and NIST AI RMF assessment templates, and ingests model metadata from ML platforms.
Registries and open-source building blocks
MLflow Model Registry
Open-source (Apache-2.0) versioning and lineage for machine-learning models, each version linked to the run that produced it. Separate MLflow components add GenAI tracing, LLM-judge evaluation and an AI Gateway with guardrails and per-endpoint cost tracking; the matrix notes where a cell comes from the gateway rather than the registry.
Runtime guardrails and agent platforms
NVIDIA NeMo Guardrails
Programmable rails for LLM applications — input, retrieval, dialog, execution and output — including sensitive-data masking and tool-call checks. It is an Apache-2.0 library or an OpenAI-compatible server that a team builds into its own application.
VDF AI
Per-request policy, tool grants, approval gates and decision receipts for agents running on VDF's own orchestration platform, deployable on-premises, hybrid, air-gapped or in a sovereign cloud. Its controls apply to what it runs or registers.
Shield360
An AI inventory, risk register and framework control status built from observed use, with AI requests and approvals, and enforcement in the browser, an optional AI proxy, coding agents and an MCP gateway. The next section says where it fits and where it does not.
Observability (for reference)
Langfuse
Open-source (MIT core), self-hostable tracing for LLM applications, with token and cost tracking, evaluations, datasets and prompt management. It traces coding agents such as Claude Code through hooks, and its own documentation says to treat that as telemetry, not enforcement.
Arize Phoenix
OpenTelemetry and OpenInference tracing with auto-instrumentation, plus LLM evaluators, datasets, experiments and a prompt playground. It is self-hostable under the Elastic License 2.0.
04 · Where Shield360 fits
And where it does not
Governance from what ran,
enforced where it can be.
Shield360 starts from evidence. A collector on each computer, hooks inside coding agents, a browser extension, an AI proxy, an MCP gateway and the SDK report what AI was used, by whom, at what cost and with what data. The governance views are built on that record:
An inventory nobody has to fill in
Every AI tool, model, vendor, provider key, agent and MCP server seen in use, with the people and computers using it. Your team records the owner, purpose, risk rating and a decision — approved by exception, rejected, retired — which can carry conditions and an expiry. People can ask to use a new tool, and a reviewer approves or rejects the request on the same record.
A risk register that fills itself
Risks are raised hourly from what was observed — a rejected tool still in use, sensitive data sent after a warning, an unapproved model, prompt injection — and scored by likelihood and impact. Accepting a risk needs a rationale and an expiry.
Control status, not a questionnaire
The 33 EU AI Act Articles that place obligations on organizations, all 72 NIST AI RMF subcategories, the OWASP Top 10 for Agentic Applications and all 38 ISO/IEC 42001 Annex A controls, each with a Statement of Applicability entry, are shown as met, gap or no evidence from what was observed and what your people attest, and kept as a daily history. Subcategories and Articles that observation cannot show are attested only. Evidence leaves as a signed package an auditor can verify offline, with a PDF report. This is evidence for an auditor, not a certification.
One policy, enforced in four places
One organization-wide policy decides what the browser extension, the AI proxy and the coding-agent hooks do with each kind of sensitive data — off, warn, mask or block — and which AI tools may be used. The MCP gateway denies agents anything not granted to them.
Cost on a person
Spend with and without subscriptions, attributed to people, machines, projects, models and tools, so a seat that is barely used and a key nobody owns both show up.
Less kept
Prompts, responses and tool content are not stored unless an administrator turns that on, and an environment can only store less than its organization. Secrets are always scrubbed from what is stored.
What Shield360 does not do
- No vendor questionnaires or attestations. AI requests and impact assessments run inside Shield360; questionnaires sent to and from vendors do not.
- No look inside your datasets. The dataset registry records what your team declares about each dataset, including its quality and bias examination; Shield360 does not read the data. It covers the datasets people register, and data lineage covers only the paths Shield360 observes. The data dictionary covers the tables agents query through the gateway.
- No model registry for models you train.
- No exhaustive red-teaming. Every attack starts from a test in your own suites, and generated and multi-turn attacks are only as strong as the evaluation model you configure, which also judges them. A target that passes resisted those attacks, not every attack. Prompt-injection detection is heuristic.
- No certification. Mapping evidence to a framework control is not a determination that an obligation is met.
- No TLS interception. AI use that does not pass through the extension, the AI proxy, a coding-agent hook or the gateway is still observed and attributed, but not blocked. The extension covers managed Chrome and Edge.
- Coding-agent hooks warn or block; they cannot mask, and they do not yet enforce the approved-model list.
- No per-person enforcement: a per-person setting narrows what is collected, not what is enforced.
05 · Where to start
If your first problem is…
Start with the problem
you already have.
| If your first problem is… | Start with | Then add |
|---|---|---|
| Unknown or shadow AI on people's computers | Shield360: the collector finds AI tools, sites, apps and direct provider traffic per person | Shield360's AI requests to approve or reject what it finds, or the GRC platform you already run |
| Coding agents with access to code and secrets | Shield360: hooks in Claude Code, Cursor and Codex warn about or block sensitive data, secret files and risky sequences | Langfuse or Arize Phoenix if engineers also want detailed traces of their own applications |
| AI spend nobody can attribute | Shield360: seats and per-token spend per person and machine, and keys with no owner | Your FinOps tooling for cloud-side model hosting costs |
| Sensitive data in AI prompts | Shield360 for the browser, an AI proxy and coding agents; Microsoft Purview where the environment is Microsoft 365 and Edge | OneTrust AI Guard or NeMo Guardrails inside applications you build |
| Agents and MCP servers acting on your systems | Shield360's MCP gateway: per-agent tokens, deny-by-default grants, sequence policies | NeMo Guardrails for rails inside the agent itself |
| Model lineage and the data behind a model | Collibra, or MLflow Model Registry for teams already on MLflow | Shield360's dataset registry for the datasets behind each AI system, and Shield360 for what the deployed model is then used for |
| Labels and DLP across a Microsoft-only environment | Microsoft Purview | Shield360 for coding agents and AI spend outside Microsoft |
| Red-teaming models and agents before release | Holistic AI, or IBM watsonx.governance | Shield360 agent tests with templated, generated and multi-turn red-team passes as regression suites in CI |
| GRC questionnaires, intake and attestations | OneTrust or ServiceNow AI Control Tower, or Credo AI | Shield360's signed evidence packages to back the answers |
| Agents you run on-premises or air-gapped, under one orchestrator | VDF AI | — |
06 · How to evaluate
Work back from the evidence
Work back from the evidence
you will be asked for.
Name the evidence first
List what a regulator, an auditor or your board will ask you to show — an inventory with owners, a risk register, control status for a named framework, an audit log, proof that sensitive data was stopped — and evaluate each tool against that list rather than its feature page.
Ask for an exported evidence pack
In a trial, ask each vendor to export the evidence for one framework from your own environment. A file built from your data says more than a demo built from theirs.
Separate “reports” from “stops”
For each risk you care about, ask where the tool sits: does it see the request before it reaches the model or tool, or read about it afterwards? Ask what happens when the control cannot reach its policy.
Ask what is stored
A governance tool that keeps every prompt becomes a store of the data it was bought to protect. Ask what is kept by default, who can change it, and whether that change is itself recorded.
Check the “Not stated” cells
Every gap in the matrix is a question for the vendor, including ours.
07 · Sources
Verified October 2026
Sources.
Verified October 2026. Each competitor cell comes from the vendor's own pages below, fetched on 1 October 2026; nothing is taken from third-party round-ups. ServiceNow's AI Control Tower product page refused our request, so its cells come from ServiceNow's press releases and from release notes posted by ServiceNow staff on its community site. Shield360's cells come from its product documentation and source code, checked against the version in production on 15 October 2026.
Shield360
Credo AI
IBM watsonx.governance
Holistic AI
OneTrust AI Governance
ServiceNow AI Control Tower
Microsoft Purview
Collibra AI Governance
MLflow
NVIDIA NeMo Guardrails
Langfuse
Based on each vendor's public documentation as of October 2026; features change — check with vendors. If a cell about your product is wrong, tell us through the contact link below and we will correct it.
See which layer you are missing.
The assessment asks eighteen questions across six areas and scores them in your browser. It takes five minutes, needs no sign-up, and your answers stay in your browser.