Cranium ONE AI Security and Governance Platform

Cranium is an AI security and governance company developed inside KPMG Studio, KPMG's startup incubator, with AI security experts from KPMG's Advisory practice. KPMG LLP announced the spin-out in April 2023 with founder and CEO Jonathan Dambrot, a former KPMG partner, and the company is backed by Titanium Ventures, KPMG and SYN Ventures. It helps regulated enterprises discover, observe, govern, secure and prove the safety of their AI models, agents and third-party AI vendors.

Cranium ONE runs this as a continuous AI Trust Loop. Discover builds an AI inventory and AI Bill of Materials and detects shadow AI. Observe inspects live agent sessions with over 100 risk signals and 250 intent classifications plus token and cost tracking. Govern defines and enforces policies mapped to NIST AI RMF, the EU AI Act and ISO 42001. Secure provides adversarial testing and red teaming, runtime threat defense and targeted remediation. Prove issues real-time Cranium AI Cards, Trust Hubs and audit-ready attestations for customers and regulators.

• Discover: automated AI inventory, AI Bill of Materials and shadow-AI detection.
• Observe: live agent sessions with over 100 risk signals, 250 intent classes and cost tracking.
• Govern: policy enforcement mapped to NIST AI RMF, EU AI Act and ISO 42001.
• Secure: adversarial testing, red teaming, runtime threat defense and remediation.
• Prove: real-time Cranium AI Cards, Trust Hubs and audit-ready attestation.
• Third-party AI: continuous verification of AI vendors in the supply chain.

Vietnamese banks can inventory all AI tools used by staff and vendors and enforce policies before audits. Telecom operators can red team customer-facing agents and monitor them at runtime. Multinational subsidiaries in Vietnam can publish AI Cards to show group-level compliance.

Security, risk and compliance teams share one inventory and one loop from discovery to attestation instead of separate tools. Shadow AI and third-party AI vendors become visible and continuously verified. Mapping to NIST AI RMF, the EU AI Act and ISO 42001 keeps compliance posture current. AI Cards and Trust Hubs give customers and regulators audit-ready evidence on demand.

EU AI Act enforcement and ISO 42001 adoption are pushing enterprises to keep a verifiable inventory of every model, agent and AI vendor. Banks, insurers and telecom operators in Southeast Asia face growing supervisory questions about third-party AI and need evidence that can be shared with regulators and partners.

Cranium emerged from KPMG Studio in 2023 with seed funding from KPMG and SYN Ventures, and investors now include Titanium Ventures. It states SOC 2 Type 2 and ISO 27001 certification and lists a 2025 Gartner Cool Vendor title, 2025 CRN Stellar Startups, 2026 Cybersecurity Excellence Awards Gold and 2026 Cyber Defense Magazine InfoSec Innovator.