The AI Provenance Company
Know the agents and AI apps you adopt, the data they run on and how they change over time.
AI provenance
Software provenance
Products
Three products, three parts of the same picture: the agents and AI apps on offer, the open source inside what you ship, and the vulnerabilities that reach both.
Provenance for the agents you are about to adopt
Every agent carries a passport recording what its build actually discloses (model, framework, tools, data sources, hosting, residency and permission scope) and who said so.
Component intelligence, from an SBOM
Upload a bill of materials and every component resolves to its real source repository, enriched with maintenance, contributor, release, dependency and advisory signals, then assessed for where in the world it is actually maintained.
The MITRE chain, self-updating, in your cluster
D3FEND to ATT&CK to CAPEC to CWE to CVE, with the CISA KEV catalog, EPSS scores, the NVD CPE dictionary and both tiers of GitHub Security Advisories. It comes up empty, populates itself and stays current with no operator intervention.
Services
Engagements that stand up the pipelines, produce the assessments and run the registries, using the same evidence standard the products hold themselves to.
Build and deploy
Design and run the pipelines that turn a software estate into intelligence you can query: ingestion, resolution, enrichment and the store underneath it.
Build and deploy
Scanning built into your CI with the thresholds, gates and retained evidence that an auditor will accept, rather than a tool bolted on at the end.
Build and deploy
Curated, richly structured datasets your agents can reason over inside secure and offline environments, with no internet access required.
Build and deploy
Automated evaluation of AI assets across quality, consistency, reliability and dependability, run continuously rather than once at procurement.
Recurring deliverable
Evidence-backed assessments of the suppliers you depend on, delivered as citeable reports that separate what is verified from what is assessed.
Managed service
A vetted catalogue of the AI apps and agents approved for your organization, maintained as a living record rather than a spreadsheet.
Managed service
Continuous monitoring of an item in your registry, with regular updates on what changed in its build, its evidence or its risk, and what that means for you.
Managed service
Assessment and monitoring of your supply chain through continuous risk management, compliance readiness, risk monitoring of your supplier base, and policy support and consulting.
Start with the outcome, not the vendor. Explore agents mapped to the functions your organization actually performs.
Ranked using user feedback, provenance completeness and evidence risk signals.
Clumio
Clumio, a Commvault offering, is a cloud-native cyber resilience solution for AWS. Clumio enables fast recovery from ransomware, accidental deletions, and account-level disruptions, while helping customers meet compliance needs and streamline backup costs - all with radically simple operations. Try it for free.
Trend Micro
Trend Cloud One™ has reached End of Life and is now fully transitioned to TrendAI Vision One™ - delivering the latest, most advanced AI cybersecurity tools and capabilities for comprehensive protection. Learn how to update here: https://www.trendmicro.com/en_us/business/campaigns/platform-update.html
TSIA (Technology & Services Industry Association)
AI for technology services. Answers you can trust. Now in Microsoft Teams.
Draup
AI agents for Microsoft Copilot designed for modern sales teams
Legal Interact
Matter Manager is a comprehensive legal automation platform specifically designed for in-house legal
OptimusInformation
Certifi is an AI-powered app built for Microsoft Teams for azure certification preparation.
SettleTop traces the components behind an agent, from who built it to the models, frameworks, tools, data, dependencies and deployment environment. If evidence is unavailable, the registry says Unknown.
Who created the agent, who publishes it and whether vendor identity is verified.
Models, frameworks, skills, packages, tools, MCP servers and version lineage.
Data sources, APIs, permissions, external services and runtime dependencies.
Evidence status, provenance gaps, risk indicators and change history.
Filter by function, source, deployment, evidence tier, provenance, pricing and evidence risk. Compare them side by side, and share a result set by link. Where a source is silent, the value reads Unknown.
Corrections and disclosures
The registry records what a source states, and reads Unknown where it states nothing. If a record about your agent is wrong or incomplete, write to registry@settletop.com.
