Noma Security
AI security and governance platform to discover, test, and protect AI agents, models, MCP servers, and tools.
By Noma Security · HQ New York, US · 4.0/5 Value-Position score (estimate)
Positioning guardrails
Best for
- Enterprises rolling out LLMs, RAG applications, and AI agents that need discovery, policy enforcement, and runtime protection in one platform.
- CISOs and security teams facing shadow AI, prompt injection, or agent scope violations that endpoint and network controls cannot see.
- Regulated organizations that need audit-ready evidence and session-level context for AI governance and compliance reviews.
- Companies standardizing on Claude Enterprise, Claude Code, or MCP-based agents and needing governed visibility into that usage.
- Security teams that want policy defined once and enforced at existing control points (agent hooks, MCP/AI gateways, SDKs, APIs) instead of one gateway.
Ideal size: Enterprise (1,000+ employees) people · Security-mature enterprise with active AI/agent adoption and CISO-led governance
Not for
- Small teams or startups with little AI or agent adoption; value scales with the size of the AI estate.
- Buyers wanting a low-cost self-serve tool; Noma is sold as an enterprise platform through a demo.
- Teams expecting inline blocking of Claude Enterprise activity; the Compliance API connector is monitoring only by design.
- Organizations that want a single chokepoint gateway for all AI traffic rather than distributed enforcement.
Value metrics scorecard
Time-to-Value
2–4 weeks
~30 days to first production value
Total Cost of Ownership
On request
Enterprise, quote-based; no public pricing or self-serve plans published
Implementation Friction
3/5
Engineering + admin effort required
Value-Position score
out of 5 · model estimate
Full cost breakdown
Mandatory implementation fee
None
Seat tiers
Custom enterprise agreements; pricing not published
Add-on costs
- None
Company & support
Who is behind Noma Security, and how your team gets help once it is live.
Company
- Founded
- Not recorded
- Headquarters
- New York, US
How you get support
- PhoneNot listed
- EmailNot listed
- Live chatNot listed
- Support portal / ticketsNot listed
- Community forumNot listed
- Help centre / docsNot listed
- Dedicated account managerNot listed
- In person / on-siteNot listed
- Hours
- Not recorded
- Response time
- Typically within one business day (security questions)
No public support portal, support email, or phone line is documented; the site routes visitors to demo and chat forms, and the trust center states security questions are answered within one business day.
“Not listed” means the vendor’s public pages don’t mention that channel, not that it is unavailable. Ask about it during evaluation.
Market position
Where Noma Security sits against its closest alternatives. Pick any two of cost, speed, friction and buyer score, and up to 9 companies to compare.
Quadrant view
Typical annual cost × Time-to-value
The lines cross at the median of the solutions shown, so about half sit on each side of each line.
Companies on the chart 6 / 10
- Noma Security
- Living Security
- Fieldguide
- Bitdefender GravityZone
- Bretton
- Transcend
Add or change companies
Up to 10 companies including Noma Security. Listed closest first.
Stack fit signal
Compatibility with standard B2B ecosystems.
No official MCP server. Reachable only by building one against their API.
AI & MCP readiness
What Noma Security ships in AI, and what it asks of your ecosystem.
AI features shipped
Vendor pages describe AI-SPM asset discovery, policy-based control over which agents and data are approved, continuous AI red teaming (prompt injection, jailbreak, data leakage, goal drift), and AI detection and response over the full agent session chain. The privacy policy permits use of de-identified data to improve services, including through AI.
Your data & models
- Trains on your data
- Not recorded — ask the vendor
- Runs on
- Not recorded
- AI pricing
- Not recorded
In your ecosystem
- AI connection
- Custom build only
- Model key
- Not recorded
- AI usage audit
- Not recorded
Compliance attestations
* IAPP AIGP certifies individuals, not products. It means named staff hold the credential — not that the platform does.
Bottom line
Noma Security is an enterprise AI security and governance platform. It discovers agents, models, MCP servers and tools across cloud, code and SaaS environments (AI-SPM), enforces agent access policies at existing control points, continuously red-teams AI apps and agents, and detects threats such as prompt injection and data exfiltration in real time (AI-DR). Connectors include Claude Enterprise via its Compliance API. Sold as an enterprise platform via demo; no public pricing.
Frequently asked questions
What does Noma Security actually protect?
Noma covers the AI estate end to end: AI security posture management to find every agent, model, MCP server and tool; access control that defines which agents are approved and what data and actions they may touch; continuous AI red teaming against prompt injection, jailbreak, data leakage and goal drift; and AI detection and response that monitors prompts, tool calls, data access and actions across agent sessions.
How is Noma Security priced?
Noma does not publish pricing, seat tiers or add-on costs. The site drives buyers to a demo request, and the product is presented as an enterprise platform rather than a self-serve plan, so commercial terms are quoted. Budget for an enterprise agreement and confirm scope (number of AI assets, connectors, environments) during evaluation.
How does Noma work with the AI tools we already use, such as Claude Enterprise?
Noma connects to Claude Enterprise through Claude's Compliance API using a read-only compliance access key, then applies AI-DR detection profiles and raises findings with user, session and data context in the Noma Console. The vendor states this connector is monitoring only by design and does not block Claude Enterprise activity inline. Claude Code hooks and Claude Cowork add runtime coverage.
Do we need a single AI gateway to use Noma?
No. Noma's Open Enforcement decouples policy from infrastructure: governance is defined once and enforced at agent control points you already run, including agent hooks, MCP gateways, AI gateways, agent SDKs and direct APIs. That avoids rerouting all traffic through one gateway, though it means enforcement coverage depends on how many control points you instrument.
What compliance certifications does Noma hold?
Noma's trust center lists SOC 2 Type II (audited by EY), ISO 27001, ISO/IEC 42001 and HIPAA, with GDPR and CCPA also shown. The trust center exposes 104 security controls and 32 documents, most available on request, covering access control, data security, infrastructure, network security and audit logging. Confirm report availability and scope during vendor review.
How long does implementation take?
Noma does not publish a deployment timeline. For the Claude Enterprise connector the vendor says setup takes a few steps with no endpoint agents or proxies and that activity is ingested once a compliance key is pasted. Broader rollouts span discovery across cloud, code and SaaS environments plus policy definition, so plan weeks rather than days for full enterprise coverage.