NewCore vs Aembit
In short: NewCore scores 9.10 and Aembit scores 6.55 in the register. NewCore leads on 4 of the seven areas, Aembit leads on 2, and they tie on 1. NewCore documents 13 of the 24 controls in full and Aembit documents 5. The matrix below shows each one with its source.
How do the area scores differ?
| Area | Weight | NewCore | Aembit | Difference |
|---|---|---|---|---|
| A1 Inventory and discovery | 15 | 8 | 5 | +3 |
| A2 Ownership and accountability | 20 | 10 | 6 | +4 |
| A3 Policy authoring and enforcement | 20 | 10 | 8 | +2 |
| A4 Human approval and escalation | 15 | 10 | 2 | +8 |
| A5 Audit evidence | 15 | 9 | 9 | 0 |
| A6 Lifecycle and revocation | 10 | 8 | 9 | -1 |
| A7 Buying clarity | 5 | 5 | 9 | -4 |
| Weighted total | 100 | 9.10 | 6.55 | 2.55 |
Which controls does each one document?
| Control | NewCore | Aembit |
|---|---|---|
| GOV-01 Agent inventory | documented | partly documented |
| GOV-02 Named accountable owner | documented | partly documented |
| GOV-03 Documented purpose | not found in public material | not found in public material |
| GOV-04 Least privilege at creation | partly documented | not found in public material |
| GOV-05 Short-lived credentials | documented | documented |
| GOV-06 Per-action policy | documented | documented |
| GOV-07 Human approval for high-risk actions | documented | not found in public material |
| GOV-08 No self-approval | documented | not found in public material |
| GOV-09 Policy testing before go-live | documented | not found in public material |
| GOV-10 Tool allow-listing and hiding | documented | documented |
| GOV-11 Revocation and kill switch | documented | documented |
| GOV-12 Decommission at task end | partly documented | not found in public material |
| GOV-13 Per-action audit log tied to a person | documented | partly documented |
| GOV-14 SIEM export | not found in public material | documented |
| GOV-15 Periodic access review | not found in public material | not found in public material |
| GOV-16 Shadow agent detection | documented | not found in public material |
| GOV-17 MCP server registry | documented | not found in public material |
| GOV-18 Delegation bounded by the person's permissions | documented | partly documented |
| GOV-19 Agent incident response | partly documented | not found in public material |
| GOV-20 Change management for agent permissions | not found in public material | not found in public material |
| GOV-21 Third-party agent onboarding | not found in public material | not found in public material |
| GOV-22 Data access boundaries | not found in public material | not found in public material |
| GOV-23 Evidence retention | not found in public material | not found in public material |
| GOV-24 Board reporting | not found in public material | not found in public material |
Sources for every mark are on the NewCore and Aembit profiles.
Should you pick NewCore or Aembit?
Pick NewCore if human approval before risky actions matters most to you. NewCore scores 10 on approval against 2 for Aembit. Risky calls go to a named approver who confirms with device biometrics, and an agent can never approve its own action.
Pick Aembit if published pricing matters most to you. Aembit scores 9 on buying clarity against 5 for NewCore. It publishes a free tier and a price of $20 per agent per month.
Frequently asked questions
- 5.1 Which is better for AI agent governance, NewCore or Aembit?
- NewCore scores higher in the register, 9.10 against 6.55. The better choice depends on your need: pick Aembit if published pricing matters most to you.
- 5.2 Do NewCore and Aembit document human approval?
- NewCore scores 10 on approval and Aembit scores 2. Risky calls go to a named approver who confirms with device biometrics, and an agent can never approve its own action. A human approval step was not found.
- 5.3 Do NewCore and Aembit work alongside an identity provider?
- NewCore: Yes. NewCore states that your current identity platform keeps handling employee sign-in, and its first deployment path is "Start alongside your identity platform". It names SAML, OIDC and MCP. Aembit: Yes. Aembit states that it does not replace the workforce identity provider.
Reviewed by The Register desk