PromptArmor is an AI security company that helps organisations assess and monitor the risk created when their vendors add AI to their products. It is built for third-party risk, security, privacy and legal teams that have to approve vendors whose software now includes models, AI features and AI subprocessors.
The platform finds where each vendor uses AI, scores that use against a set of AI risk vectors and keeps watching the vendor base for changes. Its mission is “to protect organizations from the unique threats posed by AI systems”.
At A Glance
| Vendor | PromptArmor |
|---|---|
| Category | AI vendor risk assessment and monitoring (third-party risk management) |
| Deployment | Hosted platform with open API, native connectors and SSO |
| Customers | HubSpot, GE HealthCare, Prosus Naspers |
| Certifications | SOC 2 Type II |
| Market classification | AI Model Security; also AI Safety & Guardrails |
What PromptArmor Does
Vendors across the supply chain are adding AI, often quietly, and each change can bring cyber, privacy and legal exposure: a model provider receiving customer data, a new feature switched on by default, or a vendor starting to train on its customers’ content. Standard vendor questionnaires were not written for this, and risk teams struggle to keep up.
PromptArmor’s approach is to treat vendor AI as something to find, score and keep watching, rather than a questionnaire answered once at onboarding. Risk teams get evidence about each vendor’s actual AI use, mapped to frameworks they already report against, and are told when that use changes.
Products
AI Vendor Risk (TPRM)
Third-party risk teams get a vendor report with AI-specific risk scores across 26 risk vectors in the cyber, privacy and legal domains. The vectors map to NIST AI RMF, the OWASP Top 10 for LLMs and MITRE ATLAS, so findings line up with frameworks the team already reports against. Reports can be run across the whole vendor portfolio rather than one vendor at a time.
Assessment By Team
Different reviewers care about different parts of a vendor’s AI, and the assessment splits accordingly:
| InfoSec | Indirect prompt injection risk across vendor AI assets, including injection that could lead to data exfiltration |
|---|---|
| Data privacy | Training-on-data defaults, AI subprocessor data flows and shadow IT |
| Legal | Training data opt-out policies, data retention obligations and AI subprocessor disclosures |
Continuous Monitoring
Daily scans cover the vendor ecosystem and catch changes such as a vendor adding AI for the first time, enabling new AI features by default or beginning to train on customer data. Real-time alerts flag expanded data access and changes of model provider across the portfolio.
How It Works
Customers add vendor names and URLs to the hosted platform. The platform discovers each vendor’s AI, enriches the record, tags the risks and scores them, then feeds the daily scans that drive alerts back to the risk team.
| Component | What it does |
|---|---|
| Access | An open API with real-time access and native connectors bring results into other tools, and sign-in uses SSO. |
| Data handling | Vendor assessment data is kept only as long as needed to deliver the service, encrypted at rest and in transit, and isolated between customer environments. |
Integrations
| Area | Integrations |
|---|---|
| GRC and TPRM | ServiceNow, ProcessUnity, Archer |
| Security platforms | Zscaler, Netskope |
Company Background
| Founded | By a team of security researchers and AI experts |
|---|---|
| Headquarters | San Francisco, United States |
| Research | The PromptArmor Threat Intel Team publishes vulnerability disclosures and guidance on AI security risks |
Note: This overview is compiled from PromptArmor’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.