AI Governance & Security Vendor Wiki

8 min read

Geordie AI

Primary category: agent-runtime-security. Also listed in ai-spm.

One-liner — A London agent-security startup that finds every AI agent in the enterprise (coding agents on laptops, Copilot Studio and Bedrock agents, SaaS agents), maps what each one can reach, flags the risky ones, and — through its Beam module — steers or blocks agent actions at runtime from inside the agent rather than from a network gateway.

What it does

Four modules, per the vendor (2026-10-23):

  • Discovery and posture. Inventories agents across code, cloud, endpoints and SaaS and maps each one’s configuration: permissions, tool and MCP connections, knowledge sources, system prompts, models and sub-tools, “updated continuously as they change.” Named coverage includes coding agents (Claude Code, Codex, Cursor, GitHub Copilot, Zed), agent platforms (Copilot Studio, Amazon Bedrock, AWS DevOps Agent, n8n, LangChain, Dust, Gemini) and Salesforce.
  • Behavior and risk intelligence. “A continuous, auditable record of every prompt, plan, response, and tool invocation,” behavioral baselining and anomaly detection, with findings mapped to OWASP, NIST, ISO 42001, the EU AI Act and AIUC-1.
  • Cost intelligence. Ties agent spend to the work it produced and flags waste.
  • Beam (remediation / runtime steering). Released March 2026. Hooks into the agent itself — lifecycle hooks, plugins and MCP — and runs in four modes: Monitor (record only), Guide (inject context and an approved alternative path), Confirm (pause for a human) and Enforce (binding hooks so prohibited actions do not run). The vendor calls this “context engineering” and pitches it as “deterministic controls without gateway latency.”

Where it sits in the stack

Primary agent-runtime-security: Beam acts inside the agent loop on plans and tool calls, which is the definition of that slot. The discovery/posture half is squarely ai-spm — inventory and risk scoring of the agent estate — hence the cross-list. This is the same posture-plus-runtime shape as zenity.

In lethal-trifecta terms, Geordie works mostly on the sensitive-data and egress legs. Discovery shows which agents hold data access and outbound tools at the same time, which is the dangerous combination. Beam can then stop or redirect the specific tool call that would complete the chain. It does less on the untrusted-input leg. It is not primarily a prompt-injection classifier sitting in front of the model. It works on what the agent does next, not on what text arrives.

Survey placement notes (2026-10 CTO survey): respondents wrote Geordie in under AI Runtime Security / AI Firewall and under LLM Observability & Eval.

  • The AI Runtime Security placement is an understandable neighbor, but not a match. Geordie is not an inline prompt/response firewall, and the vendor explicitly positions Beam against gateway-style inspection. It is not cross-listed to ai-runtime-security.
  • The LLM Observability placement is largely a respondent misplacement. Geordie does record prompts, plans and tool calls, and it does track cost. But that record exists for security audit and anomaly detection. It is not a developer tracing/evaluation platform like langfuse or langsmith: there are no eval suites or prompt versioning. The agent-activity record is a real feature, so the confusion is reasonable, but it does not justify a cross-list.

Positioning & differentiators

  • vs zenity — the closest shape (posture + runtime for agents). Zenity came up through Microsoft low-code and copilot security and is deep on Copilot Studio and Power Platform. Geordie’s public coverage list leads with developer coding agents (Claude Code, Cursor, Codex) as well as low-code platforms, and its runtime control lives in agent hooks rather than platform APIs.
  • vs noma-security — Noma came up via AI/ML pipeline posture and is far better funded. Geordie is the earlier-stage, agent-only bet.
  • vs gateway-style runtime players (prisma-airs, straiker, lasso-security) — those mostly inspect traffic in the request path. Geordie’s Beam enforces at the agent itself, which avoids adding latency. The tradeoff is that coverage depends on which agent runtimes Geordie has hooks for.
  • vs agent-identity players (token-security) — Token starts from the non-human-identity and credential side. Geordie starts from the agent’s configuration and behavior. They are complementary more than competing.

market_position: ai-native-disruptor in both categories: a 2025-founded startup with a strong external signal (RSAC 2026 Innovation Sandbox winner, Gartner Cool Vendor 2026 per the vendor) but ~37 staff and ~30 customer environments as of 2026-05.

Who should choose them / anti-fit

Good fit: a firm whose engineers and quants already run coding agents (Claude Code, Cursor, Codex) and whose business users are building Copilot Studio or Bedrock agents, where the security team first needs an inventory of those agents, and then a way to put “confirm before you push to prod / email externally / touch the PM book” checkpoints on specific agent actions without re-architecting traffic.

Anti-fit: shops with little or no agent footprint; firms that need on-prem or in-tenant deployment (none documented); buyers who want a single inline AI firewall for chatbot prompt traffic (that is ai-runtime-security); procurement teams that will not approve an 18-month-old vendor for a production control.

Known weaknesses / gotchas

  • Very young. Founded early 2025, ~37 employees (Fortune, 2026-05). The reference base is thin, especially in regulated finance.
  • Growth figures are vendor claims. “1,300% ARR growth” (first five months of 2026) and “50x ARR growth” (H1 2026) appear in vendor-sourced coverage with no base disclosed. Ignore them for diligence.
  • Valuation reports disagree. ~$180M post-money (Fortune, corrected, from Companies House) vs $155M (another outlet). Soft discrepancy, recorded 2026-10-23. It is not material to a buyer.
  • Hook-based enforcement is only as good as the hook coverage. An agent runtime without a Beam integration gets discovery and monitoring, not enforcement. Ask for the enforcement matrix by platform.
  • Acquisition risk is high. Agent-security startups are being bought quickly (Palo Alto/Protect AI, Check Point/Lakera, SentinelOne/Prompt Security). A well-signaled 2025 startup is an obvious target, so get change-of-control terms.

Deployment & data handling

SaaS (the login link resolves to an EU-region instance, which suggests regional hosting; no self-hosted option documented). Discovery uses API connectors to agent platforms plus endpoint/code-level collection for coding agents. Prompt, plan, response and tool-call records leave the tenancy to build the audit trail, so treat Geordie as a processor of sensitive prompt content. Retention, region choice, and training-use terms are unverified. Beam runs in-process via hooks, so enforcement does not add a network hop.

Integrations & partnerships

Named coverage (vendor list): Claude Code, Codex, Cursor, GitHub Copilot, Zed, Copilot Studio, Amazon Bedrock, AWS DevOps Agent, n8n, LangChain, Dust, Gemini, Salesforce, and MCP connections. NVIDIA Inception member. SIEM/SOAR export targets and IdP integrations are not documented publicly. mcp_support is left unverified: Geordie discovers MCP connections and Beam can operate through MCP, but it is not an MCP gateway in the mcp-gateway sense.

Compliance & FS traction

Vendor-stated SOC 2 Type II, SOC 3, ISO 27001 and GDPR. Not independently verified. Ask for the reports. Named customers lean toward financial data and fintech: AlphaSense (per Fortune, “tens of thousands of agents”), Fitch Group, OakNorth and Allica Bank (UK banks) appear among vendor logos, alongside EOG Resources, Synthesia, The Telegraph and Owkin. fs_traction: claimed. These are logos, not case studies, and none is a hedge fund or asset manager.

Commercial

Not public. No pricing page found as of 2026-10-23.

Competitors / alternatives

zenity · noma-security · straiker · operant-ai · lasso-security · prisma-airs · token-security

Open questions

  • Deployment detail: region choices, single-tenant option, data retention, sub-processors, training-use terms.
  • Per-platform enforcement matrix: which agent runtimes Beam can actually Enforce on versus only monitor.
  • SIEM/SOAR and IdP integrations.
  • Pricing model (per agent, per seat, platform).
  • Independent confirmation of SOC 2 / ISO 27001 reports.
  • FS references beyond logos; any asset-manager deployments.
  • RSAC’s own release (rsaconference.com, 2026-isb-winner) and Balderton’s release returned HTTP 403 on fetch. The win is corroborated by Geordie’s release plus RSAC/Dark Reading search results, and the round by three independent outlets.

Sources

History

  • [2026-10-23] Page created and researched in one pass from 2026-10 CTO-survey write-ins (2 respondents in production; written in under LLM Observability and AI Runtime Security / AI Firewall). Verified RSAC 2026 Innovation Sandbox win (2026-03-23) and $30M Balderton-led Series A (2026-05-28). Primary set to agent-runtime-security (Beam acts in the agent loop), cross-listed ai-spm (discovery/posture). Did not cross-list ai-runtime-security (not an inline AI firewall) or llm-observability (security audit trail, not a dev tracing/eval platform — judged a respondent misplacement).

Graph View

Backlinks