Automation of compliance evidence, audits and regulatory obligations across frameworks such as SOC 2 and ISO 27001.
75 companies on usedby use at least one of the 3 tools in this category with a public customer. Vanta leads with 43 companies. Then come Drata (24) and Norm AI (8).Latest check Oct 7, 2026: 73 of 75 public lines checked. Counts are of companies on usedby, not of the whole market: we list a company when a public page shows its AI tools.
75
companies on usedby use a tool of this category
Companies with a public line for each tool. Job-post signals count and are drawn apart in the proof bar.
| # | Tool | Customers | Proof |
|---|---|---|---|
| 1 |  Vanta | 43 | |
| 2 |  Drata | 24 | |
| 3 |  Norm AI | 8 |
Vanta43 customersVanta is used by 43 companies on usedby, 28 confirmed by a case study, a named quote or a press release. Named customers include Github, Atlassian, and Snowflake. Who uses Vanta, Drata vs Vanta
Customer page: vanta.com. Latest check of 43 of 43 lines: Oct 7, 2026.
Drata24 customersDrata is used by 24 companies on usedby, 18 confirmed by a case study, a named quote or a press release. Named customers include OpenAI, T-Mobile, and Instacart. Who uses Drata, Drata vs Vanta
Customer page: drata.com. Latest check of 24 of 24 lines: Oct 7, 2026.
Norm AI8 customersNorm AI is used by 8 companies on usedby, 0 confirmed by a case study, a named quote or a press release. Named customers include Blackstone, Capital One, and Vanguard. Who uses Norm AI, Norm AI vs Vanta
Customer page: norm.ai. Latest check of 6 of 8 lines: Oct 4, 2026.
Companies first listed by a tool of this category in the last 90 days.
Side-by-side pages with the companies behind each tool.
Answers drawn from usedby data.
Vanta, used by 43 of the 75 companies on usedby in this category. Then come Drata (24) and Norm AI (8). Who uses Vanta.
Vanta: 43 companies on usedby, against 24 for Drata.
By the number of companies with a public line for each tool, read from dated captures of vendor customer pages, case studies, press releases and job posts. Job-post signals count in the totals and are shown apart. usedby lists a company when a public page shows it, so these counts describe the companies on usedby, not the whole market.