Fortreum, a cybersecurity assessment firm backed by Gryphon Investors, has acquired Kovr.AI, a FedRAMP-authorised AI-native compliance platform. Financial terms were not disclosed. Kovr.AI serves organisations across highly regulated industries with its patented "build once, map anywhere" architecture, allowing evidence and controls to satisfy multiple compliance frameworks simultaneously, including FedRAMP, CMMC 2.0 and NIST CSF 2.0. The platform features Agent Artemis, an agentic AI operating within a Zero Data Retention environment. Kovr.AI already works with the US Air Force, Space Force and Accenture Federal Services. The acquisition combines Kovr's AI platform with Fortreum's independent assessment capabilities. Existing clients from both companies gain access to the combined offering immediately.

Fortreum acquires Kovr.AI to deliver AI done right in cybersecurity compliance - setting a new standard for audit quality, compliance readiness, and client trust. Acquisition Combines Fortreum's Practitioner Expertise with Kovr's FedRAMP-Authorized Agentic AI Platform - Serving the Full Compliance Lifecycle Across FedRAMP, CMMC 2.0, DOD SRG, NIST CSF 2.0, and GovRAMP LANSDOWNE, Va.-(BUSINESS WIRE)-Fortreum, a leading cybersecurity assessment and advisory firm backed by Gryphon Investors, a leading middle-market private investment firm, and trusted by blue-chip federal and commercial clients, today announced the acquisition of Kovr.AI, a FedRAMP-authorized, AI-native compliance platform purpose-built for organizations in highly regulated industries. Kovr.AI has recently announced strategic partnerships with agencies, companies, and investors in the U.S. defense and national security community, an indication that the world's most security-conscious enterprises trust its technology platform. Enterprise organizations are sending a clear message: they want AI-native innovation in compliance, without compromising security, integrity, or trust. Kovr.AI and Fortreum answer that call - combining the most advanced AI compliance platform in the market with the independent assessor trusted by blue-chip enterprises across federal and commercial sectors. Together, Fortreum and Kovr.AI serve organizations across the full compliance lifecycle - from readiness and evidence preparation through formal assessment and ongoing monitoring across FedRAMP, CMMC 2.0, DOD SRG, NIST CSF 2.0, and GovRAMP. Kovr's patented "build once, map anywhere" architecture means evidence and controls developed within the platform automatically satisfy equivalent requirements across multiple frameworks simultaneously, enabling organizations to advance through each standard in a single, coordinated effort. Fortreum's practitioner-led assessments then deliver the independent attestation that makes that posture credible and defensible to regulators, customers, and boards. Fortreum's role as the trusted independent assessor remains unchanged, and Kovr's platform is built to work alongside the MSPs, readiness consultants, and compliance tools organizations already rely on. Existing Kovr.AI customers gain direct access to Fortreum's CMMC C3PAO and FedRAMP assessment expertise; existing Fortreum clients gain Kovr's AI-powered compliance platform. For channel partners that bring clients to Fortreum, this combination creates a faster, more capable assessment experience that reflects the strength of the preparation work that preceded it. This is AI done right. At the intelligence layer of Kovr's platform is Agent Artemis - an agentic AI that gives practitioners a unified interface to the full scope of compliance data: cloud environments, security toolchains, evidence repositories, and documentation. All of this operates within a FedRAMP-authorized, Zero Data Retention environment. A built-in governance framework ensures every AI-generated input is auditable and subject to human validation before any finding reaches the client. Kovr.AI holds FedRAMP Moderate Authorization and has earned recognition from the national security community - validated by a strategic investment from a leading national security-focused investor and already deployed with the U.S. Air Force, Space Force, and organizations including Accenture Federal Services. This track record is a testament to Kovr's performance at the highest levels of federal rigor, and gives Fortreum's clients in the defense industrial base immediate access to a platform already trusted where the stakes are highest. Fortreum's assessments are always practitioner-led and practitioner-validated - every finding reviewed, signed off, and stood behind by a qualified member of the Fortreum team. As an independent assessor, Fortreum's commitment is to the integrity of its findings. The combined Fortreum + Kovr.AI solution is available now. Existing clients of both organizations are encouraged to contact their account team to explore the combined capabilities. New clients can schedule a consultation or request a demo at www.fortreum.com. "This acquisition is about doing AI right - making our assessments better, not just faster. Our clients choose Fortreum because our findings represent genuine, independent judgment. With Agent Artemis and a platform already validated by the national security community and deployed across leading federal organizations, we are bringing a level of rigor and capability that simply did not exist before in this market - paired with the human expertise that makes every finding credible. That is a combination that sets a new standard." - James Leach, CEO & Co-Founder, Fortreum "Kovr was built to serve organizations across the entire compliance journey - from building their security posture through the formal assessment that validates it. Joining Fortreum means our customers now have direct access to the most trusted independent assessor in the market, and Fortreum's clients gain the most capable AI compliance platform available. Together, we will deliver more thorough, more defensible assessments - and demonstrate what AI-enabled compliance, done with integrity, actually looks like." - Andrew Black, CEO & Co-Founder, Kovr.AI About Fortreum Fortreum is a trusted cybersecurity assessment and advisory firm delivering rigorous, high-quality outcomes for blue-chip clients across federal, defense, and commercial sectors. Backed by Gryphon Investors, Fortreum is a recognized C3PAO for CMMC and an authorized assessor for FedRAMP. Its experienced practitioners bring depth of evaluation, independence of judgment, and accountability to every engagement. For more information, visit www.fortreum.com. About Kovr.AI Kovr.AI is an AI-native cyber compliance platform built on NIST 800-53, NIST 800-171, and OSCAL standards. Its patented "build once, map anywhere" architecture enables evidence and controls to satisfy requirements across FedRAMP, CMMC 2.0, GovRAMP, DOD SRG, NIST CSF 2.0, and more - simultaneously. At its intelligence layer is Agent Artemis, an agentic AI that provides practitioners with a unified interface to their full compliance environment within a FedRAMP-authorized, Zero Data Retention environment. Deployed with the U.S. Air Force, U.S. Space Force, and organizations including Accenture Federal Services. Learn more at www.kovr.ai. About Gryphon Investors Gryphon Investors is a leading middle-market private investment firm focused on growing competitively-advantaged companies in the Business Services, Consumer, Healthcare, Industrial Growth, Software, and Technology Solutions & Services sectors. With more than $10 billion of assets under management, Gryphon prioritizes investments in which it can form strong partnerships with founders, owners, and management teams to accelerate the building of leading, high-quality companies and generate enduring value through its integrated deal and operations business model. Gryphon's highly-differentiated model integrates since 1999 its well-proven Operations Resources Group, which is led by full-time, Gryphon senior operating executives with general management, artificial intelligence, human capital acquisition and development, acquisition due diligence and integration planning, treasury, finance, and accounting expertise. Gryphon's three core investment strategies include its Flagship, Heritage, and Junior Capital strategies, each with dedicated funds of capital. The Flagship and Heritage strategies target equity investments of $50 million to $500 million per portfolio company. The Junior Capital strategy targets investments of $10 million to $25 million in junior securities of credit facilities, arranged by leading middle-market lenders, in both Gryphon-controlled companies, as well as in other private equity-backed companies operating in Gryphon's targeted investment sectors. Contacts. Media Contact Liz Ryder Director, Marketing - Fortreum [email protected] Fortreum. Release Versions Media Contact Liz Ryder Director, Marketing - Fortreum [email protected]

Gryphon Investors has completed a majority growth recapitalisation of Fortreum, a cybersecurity services firm specialising in audit, advisory and technical testing for regulated industries. Financial terms were not disclosed. Founded in 2020 and based in Lansdowne, Virginia, Fortreum helps enterprises meet complex cybersecurity requirements across federal and commercial compliance frameworks including FedRAMP, CMMC, ISO and PCI. The company is known for XRAMP, its continuous validation platform that streamlines regulatory auditing. Co-founders James Leach and Michael Carter will retain significant equity stakes. The investment will support expansion of Fortreum's offerings and accelerate development of its tech-enabled solutions, including AI-powered capabilities. This marks Gryphon's fifth platform investment in technology solutions and services, following partnerships with 3Cloud, Caylent, NewRocket and phData.