What they do

Phana Velocity is an AI-powered continuous compliance platform built on a simple premise: compliance should be detected, managed, and verified in real time rather than assessed periodically. With 230+ live integration sources spanning cloud infrastructure, SaaS tools, and browser automation, evidence is collected continuously, with no screenshots and no manual gathering.

The platform maps one evidence set to 78+ global frameworks, pre-built or custom. Coverage includes ISO 27001, SOC 2, PCI DSS 4.0, HIPAA, DORA, GDPR, and MAS TRM, alongside India's DPDP Act, the RBI Cyber Security Framework, and the SEBI Cyber Security and Cyber Resilience Framework.

Phana proves compliance rather than simply tracking it. It issues cryptographic proof of compliance that auditors can verify offline, without logging into the platform. A multi-agent AI assessment engine provides confidence-scored findings with rationale, and a Generation Agent drafts policies, SOPs, and infrastructure-as-code templates (Terraform and CloudFormation).

Why SFPL advises Phana

Legacy compliance tools are static databases fed by manual data entry, assessed periodically, and priced through opaque seat-based contracts. Phana replaces that model with continuous, agentic compliance and transparent per-100-control pricing, so teams stop repeating the same evidence work for every framework.

For service provider organizations, Phana Velocity supports a scalable, high-margin Managed GRC practice without the linear headcount growth older tools require. Its Vendor Risk Management module extends compliance-as-a-service to third-party and supply chain risk, an increasingly mandated capability under DORA, NIS2, and India's DPDP framework. SFPL advises Phana on enterprise go-to-market strategy and positioning.

Key capabilities

• 78+ frameworks from one evidence set, including India's DPDP, RBI and SEBI mandates
• 230+ live integrations with evidence collected continuously, 24/7
• Cryptographic proof of compliance, verifiable offline by auditors
• AI-generated policies, procedures, IaC and architecture documents mapped to controls
• Vendor Risk Management: risk scoring, questionnaires, vendor portals and evidence export
• Private per-tenant LLM instances, customer-managed keys and geo-tenancy for data residency

What they do

BAAR-ID is a converged identity platform. It brings directory services, identity governance and administration (IGA), single sign-on, multi-factor and password-less authentication, privileged access management (PAM), and non-human and AI-agent identity governance onto one data model, one policy engine, and one console. That removes the five or more point products most enterprises integrate to achieve the same coverage.

BAAR-ID is recognized as a Product Leader in the KuppingerCole Identity Governance and Administration Leadership Compass 2026, and is listed as a Representative Full-Suite Vendor in the Gartner Market Guide for Identity Governance and Administration, August 2026, alongside SailPoint, Saviynt, Okta and Microsoft Entra. With 15+ enterprise customers and customer tenures of three to five years, the platform is production-proven.

Its AI-powered, risk-based approach to Segregation of Duties and its deep connector catalogue accelerate and de-risk IGA deployments. Authentication and directory services extend natively across Windows, macOS and Linux, and service accounts, bots and AI agents are governed under the same lifecycle, policy and review regime as human users.

Why SFPL advises BAAR

A typical enterprise identity function runs a directory from one vendor, governance from a second, SSO and MFA from a third, PAM from a fourth, and controls testing from a fifth, each with its own licence, renewal cycle and integration overhead. BAAR-ID consolidates them, lowering total cost of ownership while strengthening security, because every layer shares context and responds in real time when a user joins, moves or leaves.

BAAR complements existing Microsoft investments rather than replacing them. For service providers, it opens tool-rationalization and cost-reduction conversations across identity modernization, M&A integration, managed identity services, compliance programs and sovereign identity initiatives, and the dual analyst recognition reduces procurement friction.

Capabilities at a glance

• Directory, IGA, SSO, MFA, password-less and PAM in one platform
• AI-powered, risk-based Segregation of Duties analysis
• Native authentication and directory services for Windows, macOS and Linux
• Governance of service accounts, bots and AI agents alongside human users
• Third-party and contractor access, and post-acquisition identity integration
• Deep connector catalogue for legacy, on-premises and cloud applications

What they do

Block Armour's award-winning software-defined perimeter (SDP) architecture, powered by blockchain-based digital identity, enforces Zero Trust as a single control plane across remote users, on-premises systems and multi-cloud workloads. It is more than a VPN alternative: it is access control for the whole distributed enterprise, aligned with the NIST Zero Trust Framework.

Its core capability is device binding, which cryptographically ties user identity to a verified, registered and compliant endpoint using blockchain-based digital signatures. That disrupts pass-the-hash, pass-the-ticket, credential dumping and lateral movement over SMB, RDP and WMI: stolen credentials are unusable from any other device. Continuous posture checks confirm OS patch level, EDR status, firewall, disk encryption and configuration throughout the session, not only at login.

Protected applications and servers are invisible to unauthorized users, shrinking the attack surface before reconnaissance starts. The platform deploys on-premises or in the cloud as a software-only overlay, with no internet dependency when run on-premises.

Why SFPL advises Block Armour

As AI compresses the time from vulnerability disclosure to exploitation to hours, exposed services and flat networks become immediate liabilities. Block Armour removes that exposure by verifying every user, device and service through hardware-attested identity before any connection is permitted, and it works alongside existing IAM, Active Directory, MFA, SIEM and EDR or XDR investments.

For service providers, it supports enterprise-wide Zero Trust programs rather than one-off VPN swaps, with a strong differentiator in ransomware readiness and incident response. In India, it is architecturally aligned with the DPDP Act, the latest RBI cybersecurity advisory and CERT-In's emphasis on Zero Trust and continuous verification, a strong entry point for BFSI, government and infrastructure clients.

Capabilities at a glance

• Device binding with blockchain-based digital signatures
• Continuous device posture checks throughout each session
• Invisible applications and servers for unauthorized users
• One Zero Trust fabric for remote, on-premises and cloud access
• Software-only overlay, on-premises or cloud, with no hardware rip-and-replace
• Immutable audit trails supporting DPDP, RBI and CERT-In requirements

What they do

NtangledState has defined a new category: Cryptographic Trust Convergence. Certificate lifecycle, machine identity, cryptographic posture and post-quantum migration were previously four separate problems handled by four separate tools. NtangledState brings them together as one required trust state that is continuously proven.

Its flagship product, PKISecOPS, automates certificate issuance, renewal, revocation and policy enforcement across the enterprise, moving organizations through a discover, assess, govern, automate, secure and validate workflow with risk-aware automation that checks context, dependencies and deployment readiness before changing a certificate. A unique Proof of Serving capability gives real-time, verifiable evidence of what each service is presenting cryptographically, available to auditors in minutes through an append-only record.

A second live product, Aeon, provides External Digital Trust Posture Management, assessing the cryptographic posture of externally visible infrastructure before an attacker does. AETHER, security testing and intelligence for AI, agentic systems and web applications, is coming soon.

Why SFPL advises NtangledState

Three shifts make this category urgent. Public TLS certificate validity falls to a 47-day maximum from March 2029 under CA/Browser Forum ballot SC-081v3, about eight renewals per certificate per year. RSA and ECC are deprecated from 2030 and disallowed by 2035 under NIST guidance (NIST IR 8547), with EU and UK roadmaps aligned. And DORA, NIS2 and PCI DSS 4.0 increasingly require organizations to prove what protects each service on demand.

For service providers, PKI is one of the most overlooked layers of enterprise infrastructure and one of the most consequential when it fails. NtangledState's platform, with two products live and two in development, supports a durable managed-services practice from today's certificate operations through to post-quantum migration, an increasingly board-level topic.

Capabilities at a glance

• Certificate lifecycle automation: issue, renew, install and prove, continuously
• Risk-aware automation with context, dependency and readiness checks
• Proof of Serving: auditor-grade evidence in minutes from an append-only record
• Post-quantum migration through hybrid cryptography, service by service, to a date you set
• Aeon: external digital trust posture management
• Machine identity governance as AI and IoT workloads grow