Commugen Launches AI Agents for Cyber GRC, Bringing Agentic Automation to Risk & Compliance Management

Native AI agents embedded in Commugen’s no-code platform review evidence, map controls, draft policies, turn findings into assigned tasks

LONDON, UNITED KINGDOM, October 27, 2026 /EINPresswire.com/ — Commugen, a no-code cyber GRC automation provider, today announced the launch of a portfolio of AI agents for cyber governance, risk and compliance (GRC). The agents cover six areas: third-party and supply chain risk, compliance and policy management, vulnerability and exposure management, risk management and quantification, internal audit, and contract management. They run inside the workflows organizations already manage in the Commugen platform and are available as add-ons.

The launch brings AI in GRC, the use of artificial intelligence (AI) to do the reading, matching and drafting in GRC programs, into day-to-day cyber GRC work. Much of that work runs on unstructured text: policies, audit evidence, vendor questionnaires, penetration test reports, contracts, risk descriptions, and regulatory updates. Traditional workflow tools can route documents and extract predefined information, while large language models (LLMs) can interpret more varied text and draft responses for a person to check.

The agents arrive as AI moves beyond security operations into GRC. Industry research shows that security operations teams already use AI agents widely for threat detection, while far fewer apply them to vulnerability management, the work where security findings become risk treatment and compliance tasks.
“AI in GRC is not about replacing the people who own risk decisions,” said a Commugen representative. “Our agents take the high-volume reading, matching and drafting off their desks. The practical change is less time collecting and comparing, and more time deciding.”

What AI Agents Actually Do in Cyber GRC

Commugen’s AI agents take on high-volume reading, matching and drafting work that cyber GRC teams would otherwise do by hand. They read evidence and questionnaires, compare them against control requirements, draft policies and risk write-ups, and turn findings into tasks with owners. Each agent follows the same pattern: it reads, checks or drafts, and returns a finding with an explanation that a person reviews and acts on.
Commugen defines an AI agent in GRC as software that pursues a defined goal, such as validating supplier evidence, by planning and completing the steps itself. That makes it different from the two approaches most GRC teams already know:
• Rule-based automation follows a predefined path, starts from a trigger or schedule, and produces a status change, ticket or reminder, such as a reminder when a control review is overdue.
• An AI assistant, often called a copilot, responds to a person’s prompt and produces a draft for that person, such as a risk description rewritten for the board.
• An AI agent chooses its next steps and tools based on what it finds, starts from a goal or event such as a new vendor upload, and produces a finding with a status, score, explanation or task list.
The three approaches stack rather than compete. In the Commugen platform, rule-based workflows still run approvals, reminders and escalations, and the AI agents fit into those workflows at the steps that used to need a person to read, compare and write. The agents focus on tasks with clear inputs, a known standard to check against, and an output a person can verify, and they support continuous compliance by reviewing new evidence as it arrives and flagging gaps against framework requirements such as ISO/IEC 27001:2022 and NIST CSF 2.0.

The New AI Agents, by GRC Area

Third-party and supply chain risk

• AI Evidence Analysis reviews supplier security questionnaires against the organization’s controls, flags expired certificates, inconsistent answers and missing evidence, and explains each risk score. Commugen reports that it reduces supplier evidence review time by up to 70%.
• AI Compliance Auditor verifies the supplier’s legal entity, checks evidence against predefined checkpoints, and recommends a status of accept, accept with conditions, request clarification or reject, with a numeric score and an audit summary.
• AI Cyber Threat Intelligence Assessment uses open-source intelligence (OSINT) to look for data leaks, ransomware mentions and known vulnerabilities linked to a supplier, and turns the results into a quantified risk score for procurement and security teams.
• AI Vendor Task Generator converts evidence-review recommendations into remediation tasks linked to the original questionnaire item, pending manager approval.

Compliance and policy management

• AI Policy Generator turns a security control into a distribution-ready internal policy aligned with the organization’s frameworks, with each policy traceable to its originating control.
• AI Controls-from-Policy Generator reads a policy or standard and produces a prioritized list of required controls, with a relevance score and explanation for each.
• AI Finding-to-Control Mapping links each finding to the controls expected to mitigate it, reveals controls that exist on paper but are not operating in practice, and recommends missing controls.

Vulnerability and exposure management

• AI PT Report Breakdown converts penetration test reports into structured findings with severity, affected assets, evidence and remediation steps, each linked back to the source report.
• AI Mitigation Advisor turns a vulnerability into a step-by-step mitigation plan, and AI Vulnerability Remediation produces a remediation brief for security leaders with business risk, technical fix and verification steps.
• AI Controls Generator analyzes an exposure and proposes up to 10 tailored security controls with implementation guidance and priorities.
• AI Finding Overlap Detection identifies duplicate or similar findings across assessments, so a recurring issue is remediated once at the root.
• AI Task Generator breaks a mitigation plan into assignable tasks with owners, priorities and status tracking.

Risk management and quantification

• AI Risk Quality Analyst reviews risk descriptions and business implications entered into the risk register, scores their quality, and gives feedback on what to add, including guidance for non-technical employees who report risks.
• AI Cyber Risk Quantification puts a dollar value on cyber risk. For each risk scenario, it estimates the annual rate of occurrence (ARO) and the single loss expectancy (SLE), producing a numeric financial exposure figure with the reasoning and cost breakdown behind it. Expressing cyber risk in monetary terms lets CISOs rank risks by potential financial impact, justify security investments against the losses they prevent, and report to boards and executives in the business language they use for every other decision, rather than in technical severity scores.
• AI GRC Assistant rewrites risk and compliance content for different audiences, from legal and operations to executives and the board.

Internal audit

• AI Audit Report Analyzer creates structured findings from an audit report, AI Audit Recommendations drafts tailored recommendations for each finding, and AI Similar Findings Finder uses semantic search to surface related findings already in the system.

Contract management

• AI Contract Management extracts key terms such as start dates, durations, renewal options and service levels, and AI Contract Requirement Extraction produces a table of the obligations an organization must meet, each linked to its location in the contract.

Built-In Human Oversight

Commugen designed the agents on the principle that AI agents in GRC need human oversight wherever an output becomes a decision, such as accepting a risk or approving a policy. An agent prepares the evidence, but a named owner reviews the output and signs off. Language models can state a wrong fact with full confidence, and in GRC one wrong “compliant” status can carry straight into an audit report or a board pack. Commugen recommends three checkpoints for every agent:
1. Require named human approval for consequential decisions and sensitive record changes, such as risk acceptance, regulator filings and customer attestations.
2. Define which actions each agent may take automatically, and spot-check those outputs on a schedule.
3. Log who approved each agent output, so auditors can trace every consequential decision to a person.
AI regulation points the same way. Article 14 of the EU AI Act, Regulation (EU) 2024/1689, requires human oversight of high-risk AI systems, commensurate with their risks, autonomy and context. The EU AI Act entered into force on August 1, 2024, and the AI Omnibus, in force since July 27, 2026, moved the rules for Annex III high-risk AI systems to December 2, 2027.
Commugen’s agents are designed to support these human oversight requirements: every consequential output routes to a named approver, and approvals are recorded for audit. Commugen itself holds ISO 9001, ISO/IEC 27001 and SOC 2 Type 2 certifications, independently audited across security, availability, confidentiality and privacy.

Security, Data Handling and AI Governance

Commugen states that customer data is never used for model training, that AI processing runs through secure APIs, and that the agents can be deployed on a customer’s own infrastructure. Each agent is given the narrowest access its task needs, and its inputs, outputs and approvals are logged for audit.
Commugen recommends that organizations govern the AI inside their GRC program the same way they govern any other risk: inventory every AI feature and agent, record each one in the risk register with an owner, a purpose and the data it touches, assess it against the NIST AI Risk Management Framework or ISO/IEC 42001:2023, and reassess when the model, the vendor or the use case changes. Because the agents run on a no-code platform, GRC teams can adjust the workflow around each agent when a framework or regulation changes, without depending on vendor services.

Availability

The AI agents are available now as add-ons to the Commugen cyber GRC platform, in both SaaS and on-premise deployments. Commugen advises organizations evaluating AI in GRC to test agents on their own evidence, frameworks and workflows rather than a demo script, starting with two or three tasks the team repeats every month, such as vendor evidence review or policy updates.
“Every AI output that becomes a decision needs a named owner and an audit trail,” the representative added. “We built these agents so organizations can scale AI in GRC as regulation matures, without retrofitting oversight later.”

About Commugen

Commugen is a no-code Cyber GRC automation platform that puts Cyber GRC on autopilot with automated workflows, powerful dashboards, and built-in AI, all in one flexible, easy-to-use platform. Founded in 1999, Commugen is used by more than 150 leading enterprises. Its solutions cover cyber risk management, multi-framework compliance (ISO 27001, SOC 2, GDPR, NIS2, DORA and more), third-party risk management, AI risk management, cyber risk quantification, and more. Commugen is ISO 9001, ISO 27001, and SOC 2 Type 2 certified, available as SaaS or on-premiseץ
cyber.commugen.com.

Adam Babayoff
Commugen
+44 20 4591 9206
Visit us on social media:
LinkedIn