Fortreum acquires Kovr.AI to deliver AI done right in cybersecurity compliance - setting a new standard for audit quality, compliance readiness, and client trust. Acquisition Combines Fortreum's Practitioner Expertise with Kovr's FedRAMP-Authorized Agentic AI Platform - Serving the Full Compliance Lifecycle Across FedRAMP, CMMC 2.0, DOD SRG, NIST CSF 2.0, and GovRAMP LANSDOWNE, Va.-(BUSINESS WIRE)-Fortreum, a leading cybersecurity assessment and advisory firm backed by Gryphon Investors, a leading middle-market private investment firm, and trusted by blue-chip federal and commercial clients, today announced the acquisition of Kovr.AI, a FedRAMP-authorized, AI-native compliance platform purpose-built for organizations in highly regulated industries. Kovr.AI has recently announced strategic partnerships with agencies, companies, and investors in the U.S. defense and national security community, an indication that the world's most security-conscious enterprises trust its technology platform. Enterprise organizations are sending a clear message: they want AI-native innovation in compliance, without compromising security, integrity, or trust. Kovr.AI and Fortreum answer that call - combining the most advanced AI compliance platform in the market with the independent assessor trusted by blue-chip enterprises across federal and commercial sectors. Together, Fortreum and Kovr.AI serve organizations across the full compliance lifecycle - from readiness and evidence preparation through formal assessment and ongoing monitoring across FedRAMP, CMMC 2.0, DOD SRG, NIST CSF 2.0, and GovRAMP. Kovr's patented "build once, map anywhere" architecture means evidence and controls developed within the platform automatically satisfy equivalent requirements across multiple frameworks simultaneously, enabling organizations to advance through each standard in a single, coordinated effort. Fortreum's practitioner-led assessments then deliver the independent attestation that makes that posture credible and defensible to regulators, customers, and boards. Fortreum's role as the trusted independent assessor remains unchanged, and Kovr's platform is built to work alongside the MSPs, readiness consultants, and compliance tools organizations already rely on. Existing Kovr.AI customers gain direct access to Fortreum's CMMC C3PAO and FedRAMP assessment expertise; existing Fortreum clients gain Kovr's AI-powered compliance platform. For channel partners that bring clients to Fortreum, this combination creates a faster, more capable assessment experience that reflects the strength of the preparation work that preceded it. This is AI done right. At the intelligence layer of Kovr's platform is Agent Artemis - an agentic AI that gives practitioners a unified interface to the full scope of compliance data: cloud environments, security toolchains, evidence repositories, and documentation. All of this operates within a FedRAMP-authorized, Zero Data Retention environment. A built-in governance framework ensures every AI-generated input is auditable and subject to human validation before any finding reaches the client. Kovr.AI holds FedRAMP Moderate Authorization and has earned recognition from the national security community - validated by a strategic investment from a leading national security-focused investor and already deployed with the U.S. Air Force, Space Force, and organizations including Accenture Federal Services. This track record is a testament to Kovr's performance at the highest levels of federal rigor, and gives Fortreum's clients in the defense industrial base immediate access to a platform already trusted where the stakes are highest. Fortreum's assessments are always practitioner-led and practitioner-validated - every finding reviewed, signed off, and stood behind by a qualified member of the Fortreum team. As an independent assessor, Fortreum's commitment is to the integrity of its findings. The combined Fortreum + Kovr.AI solution is available now. Existing clients of both organizations are encouraged to contact their account team to explore the combined capabilities. New clients can schedule a consultation or request a demo at www.fortreum.com. "This acquisition is about doing AI right - making our assessments better, not just faster. Our clients choose Fortreum because our findings represent genuine, independent judgment. With Agent Artemis and a platform already validated by the national security community and deployed across leading federal organizations, we are bringing a level of rigor and capability that simply did not exist before in this market - paired with the human expertise that makes every finding credible. That is a combination that sets a new standard." - James Leach, CEO & Co-Founder, Fortreum "Kovr was built to serve organizations across the entire compliance journey - from building their security posture through the formal assessment that validates it. Joining Fortreum means our customers now have direct access to the most trusted independent assessor in the market, and Fortreum's clients gain the most capable AI compliance platform available. Together, we will deliver more thorough, more defensible assessments - and demonstrate what AI-enabled compliance, done with integrity, actually looks like." - Andrew Black, CEO & Co-Founder, Kovr.AI About Fortreum Fortreum is a trusted cybersecurity assessment and advisory firm delivering rigorous, high-quality outcomes for blue-chip clients across federal, defense, and commercial sectors. Backed by Gryphon Investors, Fortreum is a recognized C3PAO for CMMC and an authorized assessor for FedRAMP. Its experienced practitioners bring depth of evaluation, independence of judgment, and accountability to every engagement. For more information, visit www.fortreum.com. About Kovr.AI Kovr.AI is an AI-native cyber compliance platform built on NIST 800-53, NIST 800-171, and OSCAL standards. Its patented "build once, map anywhere" architecture enables evidence and controls to satisfy requirements across FedRAMP, CMMC 2.0, GovRAMP, DOD SRG, NIST CSF 2.0, and more - simultaneously. At its intelligence layer is Agent Artemis, an agentic AI that provides practitioners with a unified interface to their full compliance environment within a FedRAMP-authorized, Zero Data Retention environment. Deployed with the U.S. Air Force, U.S. Space Force, and organizations including Accenture Federal Services. Learn more at www.kovr.ai. About Gryphon Investors Gryphon Investors is a leading middle-market private investment firm focused on growing competitively-advantaged companies in the Business Services, Consumer, Healthcare, Industrial Growth, Software, and Technology Solutions & Services sectors. With more than $10 billion of assets under management, Gryphon prioritizes investments in which it can form strong partnerships with founders, owners, and management teams to accelerate the building of leading, high-quality companies and generate enduring value through its integrated deal and operations business model. Gryphon's highly-differentiated model integrates since 1999 its well-proven Operations Resources Group, which is led by full-time, Gryphon senior operating executives with general management, artificial intelligence, human capital acquisition and development, acquisition due diligence and integration planning, treasury, finance, and accounting expertise. Gryphon's three core investment strategies include its Flagship, Heritage, and Junior Capital strategies, each with dedicated funds of capital. The Flagship and Heritage strategies target equity investments of $50 million to $500 million per portfolio company. The Junior Capital strategy targets investments of $10 million to $25 million in junior securities of credit facilities, arranged by leading middle-market lenders, in both Gryphon-controlled companies, as well as in other private equity-backed companies operating in Gryphon's targeted investment sectors. Contacts. Media Contact Liz Ryder Director, Marketing - Fortreum [email protected] Fortreum. Release Versions Media Contact Liz Ryder Director, Marketing - Fortreum [email protected]

Gryphon Investors has completed a majority growth recapitalisation of Fortreum, a cybersecurity services firm specialising in audit, advisory and technical testing for regulated industries. Financial terms were not disclosed. Founded in 2020 and based in Lansdowne, Virginia, Fortreum helps enterprises meet complex cybersecurity requirements across federal and commercial compliance frameworks including FedRAMP, CMMC, ISO and PCI. The company is known for XRAMP, its continuous validation platform that streamlines regulatory auditing. Co-founders James Leach and Michael Carter will retain significant equity stakes. The investment will support expansion of Fortreum's offerings and accelerate development of its tech-enabled solutions, including AI-powered capabilities. This marks Gryphon's fifth platform investment in technology solutions and services, following partnerships with 3Cloud, Caylent, NewRocket and phData.

Gryphon backs Fortreum in cybersecurity growth deal. Founder-led firm retains significant ownership following recapitalization. Gryphon Investors has acquired Fortreum in partnership with the founders of the cybersecurity services firm. Fortreum provides cybersecurity services that help companies meet federal and commercial compliance standards. Its work spans regulatory audits, security advisory support, and technical testing, including penetration testing - where professionals simulate real-world cyberattacks on a company's systems, applications, or networks - and continuous monitoring in real time or near-real time to detect security threats and performance issues. A core service of the company is XRAMP, a software platform that supports ongoing compliance monitoring. Unlike traditional audits that happen at set intervals, XRAMP offers continuous validation, aiming to simplify how companies meet cybersecurity requirements. Customers of Fortreum include cloud service providers, federal contractors, and other companies operating in regulated industries that must demonstrate consistent cybersecurity readiness. Fortreum was founded in 2020 and is headquartered near Washington DC in Lansdowne, Virginia. Gryphon partnered with Fortreum's founders on this transaction with the management team retaining a significant equity stake. James Leach, co-founder and chief executive officer, and Michael Carter, co-founder and president, will continue to lead the business in partnership with Gryphon. "Fortreum perfectly matches with the core investment criteria of Gryphon's technology solutions and services group (TSSG)," said Gabe Stephenson, a deal partner at Gryphon and the co-head of TSSG, and Clint Kadolph, a principal in TSSG, in a released statement. "The company is in a high-growth market with exciting secular tailwinds, is clearly an emerging market leader, provides customers with a compelling value proposition that translates to attractive economics, and has a backable team that shares an ambitious view of the future with us. We have been actively evaluating the cybersecurity space for the last several years and believe that Fortreum sits in the most attractive segment of cybersecurity." "We see a compelling opportunity to help scale a next-generation cybersecurity platform," said Vikram Mahidhar, operating partner and TSSG co-head, and Pavan Arora, head of Gryphon's AI team, in a released statement. "Combining Fortreum's deep regulatory and technical expertise with Gryphon's AI and automation capabilities will significantly enhance the value XRAMP delivers to clients and accelerate the build-out of the industry's defining platform for modern compliance and continuous assurance." Gryphon is based in San Francisco and makes leveraged acquisitions and growth investments in middle-market companies. The firm invests from $50 million to $500 million of capital in companies with enterprise values ranging from $100 million to $600 million and EBITDA of up to $80 million. Sectors of interest include business services, consumer products and services, healthcare, industrial growth, and software. AGC Partners was the financial advisor to Fortreum, and J.P. Morgan was the financial advisor to Gryphon.