Artificial intelligence is expanding employee capabilities beyond technical teams, creating significant security challenges for companies struggling to track access by humans and AI agents.

Jeremy Epling, chief product officer at Vanta Bioscience , described the shift in an interview, noting that AI allows employees to build software and automate tasks with minimal technical expertise. This democratization of building capabilities is fundamentally altering how organizations approach cybersecurity and compliance.

Rising Builder Roles

Vanta has observed a sharp increase in non-traditional technical roles among its more than 16,000 customers. Epling stated that builder roles, including go-to-market engineers and governance, risk and compliance (GRC) engineers, have increased by more than 300% year over year. This growth reflects businesses using AI to accelerate development and automate workflows.

However, this expansion creates new security gaps. Epling noted that security through obscurity is no longer viable because AI agents can find ways to access data or perform unexpected actions. Security teams now face the challenge of monitoring not just employees, but potentially thousands of autonomous systems operating on their behalf.

Shadow AI Concerns

The company identified "shadow AI" as an emerging risk, where employees sign up for AI services without established security vetting. In some cases, employees may feed company information into unvetted tools. This raises the prospect of organizations needing to monitor an expanding network of AI systems that can make decisions and act with increasing autonomy.

Epling warned that organizations could eventually have dramatically more agents than employees, creating a severe visibility problem for security teams. He predicted that the amount of automation will "fundamentally change everything" and create chaos that may overwhelm users.

Vanta’s AI Adoption

Vanta is also deploying AI to automate its own security and compliance work. Its Vanta agent can analyze security programs, assess vendors, answer questionnaires, and identify risks. The company has introduced integrations, APIs, an MCP server, and custom agents for customer workflows.

Daily users of Vanta’s agent have increased by more than 250% this year, while usage of its MCP server has grown 50-fold, according to Epling. This internal adoption mirrors the broader trend of companies granting AI systems greater authority to act on their behalf.

What the Numbers Show

The divergence between the 300% rise in customer builder roles and the 250% growth in Vanta’s own agent usage highlights a dual dynamic: customers are rapidly deploying AI for development while simultaneously relying on automated tools for governance. This suggests that as AI lowers the barrier to entry for building software, the demand for automated compliance monitoring scales proportionally to manage the resulting complexity.

Vanta and Carahsoft Technology Corp announced on July 09, 2026, that Vanta has achieved Federal Risk and Authorization Management Program (FedRAMP) Class C Certification through the 20x pathway for its Government Cloud offering. This certification enables federal agencies to leverage Vanta's automated trust management platform to enhance continuous compliance, streamline risk management, and increase visibility across security ecosystems. The authorization supports the Federal Government’s IT modernization and resiliency requirements.

Morgan Kaplan, Head of Public Sector at Vanta, stated that achieving FedRAMP 20x Class C Certification represents a significant milestone. The platform helps government vendors and agencies strengthen compliance and risk management across complex cybersecurity environments. It supports more than 35 frameworks, including CMMC, NIST 800-53, FedRAMP, and SOC 2, utilizing AI and automation to reduce manual effort and improve efficiency.

Carahsoft serves as Vanta’s Public Sector distributor, providing government agencies with streamlined access to Vanta’s agentic trust platform, solutions, services, and training. Brian O’Donnell, Vice President of Cybersecurity Solutions at Carahsoft, emphasized that the milestone underscores a shared commitment to advancing modern, scalable compliance approaches across the public sector.

Vanta’s solutions are available through various contract vehicles held by Carahsoft. These include SEWP V contracts NNG15SC03B and NNG15SC27B, NASPO ValuePoint Master Agreement #AR2472, TIPS Contract #220105, OMNIA Partners Contract #R240303, E&I Contract #EI00063~2021MA, and The Quilt Master Service Agreement Number MSA05012019-F.

Contract Vehicles