Fortreum, a Virginia cybersecurity assessment and advisory firm backed by the private investment firm Gryphon Investors, acquired Kovr.AI, a Reston, Virginia startup that sells an AI-based compliance platform to organisations in regulated industries. Fortreum announced the deal on April 13, 2026. Financial terms were not disclosed.
Kovr.AI's software holds a FedRAMP Moderate authorization, the US government security standard for cloud services. It helps companies collect evidence and map security controls to several government frameworks at once, including FedRAMP, CMMC 2.0, the Defense Department's Security Requirements Guide, NIST CSF 2.0 and GovRAMP.
Fortreum will offer Kovr's platform to its clients next to its own assessment services, and Kovr's existing customers will gain direct access to Fortreum's assessors. Fortreum said its role as an independent assessor would not change.
What Kovr.AI built
Kovr.AI was co-founded by chief executive Andrew Black and chief technology officer Sri Iyer, an Army veteran. The company said the founders are former executives of AWS, Gartner and PwC. It came out of stealth in May 2025.
Its platform is built on NIST 800-53, NIST 800-171 and OSCAL, a machine-readable format for security documentation. It connects to developer and security tools such as GitHub, Splunk and Snyk, monitors controls and vulnerabilities in real time, generates system security plans from collected evidence, and includes an AI chat assistant for asking about compliance status and gaps. Kovr calls its patented approach 'build once, map anywhere': a piece of evidence or a control is recorded once and then applied to equivalent requirements in each framework.
Kovr says its software has been deployed with the US Air Force, the US Space Force and Accenture Federal Services. At launch it named the companies Obviant, Pellonium and ConductorAI as users.
“Joining Fortreum means our customers now have direct access to the most trusted independent assessor in the market.”
Why Fortreum is buying
Fortreum, based in Lansdowne, Virginia, carries out FedRAMP assessments and CMMC assessments as an accredited third-party assessment organisation (C3PAO). These audits are required of many companies that sell to US government customers. When Kovr launched, Brandon Farwell of Xfund said it can take companies up to 1,000 hours to do the preparation work that the platform aims to do in about 15 minutes.
By owning Kovr, Fortreum gains a product that sits earlier in that process, when a company is getting ready to be assessed. Fortreum said the platform is designed to work alongside managed service providers, readiness consultants and other compliance tools, and that channel partners who bring clients to Fortreum should see a faster assessment experience.
Fortreum chief executive and co-founder James Leach said the aim was to make the firm's assessments better, not just faster. He also referred to a capability called Agent Artemis alongside the platform, which the announcement did not describe further.
The founders and the funding
Kovr.AI raised $3.6 million in seed funding in May 2025. The round was co-led by IronGate and Xfund, with Hack Factory, OODA Ventures and McLean Capital taking part. The company said at the time it would use the money to expand its go-to-market, AI engineering and product teams.
Fortreum's announcement also said Kovr had received a strategic investment from a national security-focused investor, which it did not name. The size of that investment was not disclosed, and Kovr's headcount was not reported. At its launch, Kovr named an advisory board that included Bryan Ware, the first presidentially appointed director of cybersecurity at the Cybersecurity and Infrastructure Security Agency (CISA), and national security and cyber risk strategist Matt Devost.
Assessors move into compliance software
When Kovr raised its seed round, chief technology officer Sri Iyer said FedRAMP and the Defense Department's SWFT programme were moving towards automation and AI. IronGate's Andrew Magliochetti pointed to what he described as a typical two-year, $2 million barrier to getting into government deployments.
The deal puts an audit firm and a readiness tool under one owner. Fortreum said it would keep its assessments independent, while giving clients of both companies access to each other's services.
