What they do

Phana Velocity is an agentic AI-powered compliance platform built to help organizations achieve and maintain regulatory readiness across multiple industries and geographies. Using intelligent AI agents, it automates the most time-consuming parts of compliance work: documentation, evidence collection, policy generation, and audit preparation.

Phana supports 78 or more compliance frameworks through a single unified platform, covering healthcare, financial services, data protection, and cybersecurity regulations worldwide. Its Generation Studio automatically produces policies and procedures tailored to each selected framework, and its Document Checklist manages the full document lifecycle from creation to final audit submission.

NVIDIA Inception Program Member

Why SFPL advises Phana

Traditional compliance programs depend heavily on manual effort, specialist teams, and expensive consulting engagements. Phana replaces that model with autonomous AI that manages compliance activities continuously, monitors regulatory changes in real time, and keeps organizations ahead of evolving requirements without scaling headcount.

For organizations operating across multiple geographies or regulatory environments, Phana eliminates the need for separate tools and processes for each framework. SFPL advises Phana on enterprise go-to-market strategy and positioning as the platform scales globally.

Key capabilities

• Agentic AI automation for compliance workflows
• 78+ frameworks managed from a single platform
• Automated policy and procedure generation via Generation Studio
• Full document lifecycle management and audit readiness tracking
• Continuous monitoring across evolving regulatory landscapes
• Available on AWS Marketplace

What they do

BAAR Technologies delivers an AI-powered Identity Governance and Administration platform that automates the full identity lifecycle: onboarding, transfers, access reviews, Segregation of Duties monitoring, and offboarding. Its deep connector catalog integrates with legacy, on-premises, and cloud applications, making it well suited for complex, heterogeneous enterprise environments.

Beyond IGA, BAAR provides enterprise-grade Single Sign-On, Multi-Factor Authentication, Directory Services for Windows, Linux, and Mac environments, and IT control assurance capabilities. Rather than displacing existing Microsoft investments, BAAR extends identity management, authentication, governance, and endpoint access controls to contractors, partners, acquired organizations, cloud workloads, and hybrid environments.

BAAR-IGA is recognized as a Leader in the 2024 KuppingerCole Leadership Compass for Identity Governance and Administration.

Why SFPL advises BAAR

BAAR's risk-based approach to Segregation of Duties and its breadth of connectors significantly accelerate IGA deployments compared to legacy alternatives. Its ability to consolidate governance, authentication, directory services, and compliance into a single platform addresses a persistent challenge for enterprise IT and security teams that are stretched thin.

For service provider organizations, BAAR creates meaningful opportunities across identity modernization, post-acquisition integration, managed identity services, and compliance programs. It enables higher-margin engagements with faster time to market and measurably better client outcomes.

Capabilities at a glance

• AI-powered Identity Governance and Administration
• Segregation of Duties monitoring across applications
• SSO, MFA, and Passwordless Access including legacy apps
• Directory Services for Windows, Linux, and Mac
• Automated user access reviews and access revocation
• Non-human and AI identity governance readiness

What they do

Block Armour delivers an award-winning Software Defined Perimeter architecture that enforces Zero Trust as a single control plane across remote users, on-premises systems, and multi-cloud workloads. Recognized as a Market Outperformer in the GigaOm Radar Report for Zero Trust Network Access, the platform goes well beyond a VPN replacement to provide holistic access control across the entire distributed enterprise.

The platform uses blockchain-based digital identity, not just IP addresses, to authenticate and authorize every user, device, and service before any connection is allowed. All communication is secured with 4096-bit RSA encryption. Policy is enforced at the device itself, meaning trust travels with the endpoint across remote, on-premises, and cloud environments. Infrastructure is cloaked from discovery and every resource is micro-segmented, shrinking the exploitable attack surface and containing blast radius.

Why SFPL advises Block Armour

As AI compresses the time from vulnerability disclosure to exploitation to mere hours, exposed services and flat networks become immediate liabilities. Block Armour removes that exposure through hardware-attested identity and continuous posture checking before any connection is permitted. This architecture is purpose-built for the hybrid enterprise, where users, data, and workloads are distributed across on-premises, SaaS, and multi-cloud environments.

For service provider organizations, Block Armour enables enterprise-wide Zero Trust transformation programs rather than one-off VPN replacements. It opens higher-value advisory and managed service conversations, supports data sovereignty requirements for clients, and creates new revenue streams beyond traditional network security.

Capabilities at a glance

• Software Defined Perimeter with blockchain-backed digital identity
• Zero Trust enforcement across remote, on-premises, and multi-cloud
• Infrastructure cloaking and micro-segmentation
• Continuous device posture checking
• Available on Microsoft Azure Marketplace and Oracle Cloud Marketplace
• Aligned with NIST Zero Trust Architecture framework

What they do

NtangledState is building the trust layer for a machine-driven world, one where applications talk to APIs, workloads talk to AI agents, devices connect to critical infrastructure, and robotics and space-connected systems extend digital infrastructure beyond the traditional enterprise perimeter.

Its first product, PKISecOPS, is an AI-powered PKI management and digital trust security platform that helps infrastructure and security teams manage the full certificate lifecycle, automate trusted deployments, and secure complex PKI environments before failures become critical outages, compliance violations, or security incidents. PKISecOPS moves organizations through a structured discover, assess, govern, automate, secure, and validate workflow, applying risk-aware automation that checks context, dependencies, and deployment readiness before executing certificate changes, rather than the blind automation offered by conventional certificate tools.

Its roadmap extends toward advanced security controls, post-quantum cryptography readiness, operational intelligence, and a natural-language Conversational PKI interface, positioning early adopters ahead of the shift to quantum-ready and agent-scale trust infrastructure.

Why SFPL advises NtangledState

PKI and certificate management is one of the most overlooked layers of enterprise infrastructure, and one of the most consequential when it fails. A single unmanaged certificate can halt critical business operations. NtangledState gives service providers a wedge into a rarely addressed but high-stakes conversation: certificate visibility, renewal governance, and audit readiness for regulated and infrastructure-heavy clients.

As clients scale AI workloads, IoT, and machine identities, the volume and criticality of certificates they must govern grows faster than most internal teams can manage manually, creating a durable, recurring managed-services opportunity. Service providers can position PKISecOPS within broader Zero Trust, cybersecurity resilience, and post-quantum readiness programs, an increasingly board-level topic, establishing an early and differentiated position in crypto-agility and machine identity governance ahead of the wider market.

Capabilities at a glance

• AI-powered PKI management and full certificate lifecycle automation
• Risk-aware automation with context, dependency, and deployment readiness checks
• Certificate visibility, expiry tracking, and renewal governance
• Governance, ownership, approvals, and audit controls across CA operations
• Post-quantum cryptography readiness roadmap
• Natural-language Conversational PKI interface (roadmap)