Folio 1The register · 32 products · revision 2026-11-08

Third-party risk management software: the register

Every TPRM and vendor risk management product we could source: who owns it, how it assesses vendors, what it integrates with, what it costs, and how it secures itself. Each fact links to the vendor’s own page and carries the date it was checked.

In brief

The register holds 32 products in five approaches: assessment workflow, security ratings, GRC-suite modules, compliance platforms and AI-first tools. Only 3 publish a price on their own site; most quote on request. Choose the approach first, by the evidence you collect and the number of third parties you manage, then compare what each vendor publishes.

Assessment workflow 7
Security ratings 7
GRC suite module 9
Compliance platform 4
AI-first assessment 5

Assessment workflow

Built around the vendor inventory and the assessment: questionnaires, evidence, findings and remediation through each stage of the relationship.

Security ratings

Scores a company from the outside, from what can be seen on the internet, without asking it anything. Used to triage and to watch vendors between assessments.

GRC suite module

The third-party module of a wider governance, risk and compliance suite. Strongest where the rest of the suite is already in use.

Compliance platform

A compliance-automation platform (SOC 2, ISO 27001 readiness) with a vendor-risk module added. Lighter, and usually cheaper to start.

AI-first assessment

Built on AI reading the evidence (SOC 2 reports, policies, questionnaire answers) and drafting the assessment, with a person reviewing.

All 32 products

Grouped by approach. Within each group, ordered by how many of five things the vendor publishes (methodology), then by name. The number is a reference, not a rank. Select a name for the full entry and its sources.

Third-party risk management software in this register
No.	Product	Owner	Questionnaires	Integrations	Price	Free / trial	Own SOC 2 / ISO
Assessment workflow · 7 products
01	VenminderElizabethtown, KY	Ncontracts, backed by Hg	SIG Core, SIG Lite, CAIQ	Listed	Marketplace list price	—	SOC 2
02	Censinet RiskOpsBoston, MA	Independent, venture-backed	NIST CSF	Listed	On request	—	SOC 2
03	CertaSaratoga, CA	Independent, venture-backed	—	130+	On request	—	SOC 2 · ISO 27001
04	PrevalentAustin, TX	Mitratech	SIG, CAIQ, ISO 27001, NIST CSF	—	On request	—	ISO 27001
05	Risk LedgerLondon, United Kingdom	Independent, venture-backed	ISO 27001, NIST CSF	Listed	On request	Free for suppliers	ISO 27001
06	ProcessUnityConcord, MA	Private equity: Marlin Equity Partners	—	Listed	On request	Free for suppliers	SOC 2 · ISO 27001
07	AravoSan Francisco, CA	Aravo Solutions, Inc.	—	Listed	On request	—	—
Security ratings · 7 products
08	SecurityScorecardNew York, NY	Privately held, venture-backed	SIG, CAIQ	Listed	Marketplace list price	Free trial	SOC 2
09	UpGuardHobart, Tasmania, Australia (US headquarters: Mountain View, California)	Privately held, venture-backed	SIG, DORA, HIPAA	Listed	Published	14-day free trial	SOC 2
10	PanoraysNew York, NY	Privately held, venture-backed	SIG, CAIQ, NIST CSF, ISO 27001	Listed	On request	Free plan	SOC 2 · ISO 27001
11	BitsightBoston, MA, United States	Privately held	SIG Lite, NIST CSF, ISO 27001, HECVAT	Listed	On request	Free report only	SOC 2 · ISO 27001
12	Black KiteBoston, MA	Privately held, venture-backed	SIG	Listed	On request	Proof of concept	SOC 2 · ISO 27001
13	RiskReconSalt Lake City, UT	Mastercard	Rating A–F letter grade translated…	Listed	On request	30-day free trial	—
14	InterosArlington, VA	Independent, venture-backed	—	Listed	Marketplace list price	—	—
GRC suite module · 9 products
15	LogicGate Risk CloudChicago, IL	Independent, growth-equity backed	SIG, CAIQ	267+	On request	—	SOC 2 · ISO 27001
16	OneTrustAtlanta, GA, USA	Independent, privately held and venture-backed	SIG Core, SIG Lite	500+	On request	—	SOC 2 · ISO 27001
17	Supplier ShieldMorges, Switzerland	Abilene Group SA, Morges, Switzerland	ISO 27001, SOC 2, NIST CSF, NIST SP 800-53	Listed	Published	—	ISO 27001
18	CentraleyesTel Aviv, Israel per the vendor's AI Info page; site footer lists 'Headquarters' addresses in Hoboken, NJ and New York, NY	Independent	—	Listed	Marketplace list price	—	SOC 2
19	MetricStreamSan Jose, CA, USA	Independent, investor-backed: MetricStream lists…	—	—	On request	—	SOC 2 · ISO 27001
20	Optro (AuditBoard)Los Angeles, CA, USA	Private equity: Hg	—	Listed	On request	—	SOC 2 · ISO 27001
21	RiskonnectAtlanta, GA, USA	Private equity: TA Associates	—	Listed	On request	—	SOC 2
22	ArcherOverland Park, KS, USA	Private equity: Cinven	—	—	On request	—	—
23	ServiceNowSanta Clara, CA, USA	Public company	—	—	On request	—	—
Compliance platform · 4 products
24	SecureframeSan Francisco, CA (newsroom dateline; HQ not explicitly named)	Independent, venture-backed	—	300+	Published	—	SOC 2 · ISO 27001
25	VantaSan Francisco, CA (place of business stated in Vanta's MSA; HQ not explicitly named)	Independent, venture-backed	—	400+	Marketplace list price	—	SOC 2 · ISO 27001
26	Cynomi	Independent, venture-backed	—	—	On request	—	SOC 2 · ISO 27001
27	DrataSan Francisco, CA	Independent, venture-backed	—	Listed	On request	—	SOC 2 · ISO 27001
AI-first assessment · 5 products
28	VISO TRUSTSan Francisco, CA	Protecht Group	SIG, SOC 2, ISO 27001, NIST CSF	100+	Marketplace list price	—	SOC 2
29	VendictNew York, NY	Independent, venture-backed	—	6+	On request	14-day free trial	SOC 2
30	WhisticWest Jordan, Utah	Independent, venture-backed	SIG, CAIQ	Listed	Marketplace list price	Free for suppliers	SOC 2 · ISO 27001
31	SAFE TPRMPalo Alto, CA	Independent, venture-backed	—	Listed	Marketplace list price	—	SOC 2 · ISO 27001
32	ZaniaPalo Alto, California	Independent, venture-backed	SOC 2, ISO 27001, PCI DSS	Listed	On request	—	SOC 2

32 products · 494 source URLs · checked November 8, 2026. A dash means the vendor’s public pages don’t say. Something wrong? Send a correction.

What vendors publish

How many of the 32 products publish each of the five things the order is based on. Most of the category sells on a demo.

A price11A free plan or trial for buyers5Its own SOC 2 or ISO 2700127An integration count7Named questionnaires or a rating scale16

Assessment workflow: 7 entries

Built around the vendor inventory and the assessment: questionnaires, evidence, findings and remediation through each stage of the relationship.

No. 01Assessment workflow

Venminder

Venminder (Software Platform, Vendiligence™ Control Assessments, Ven-monitor™) · Ncontracts (sold under the Venminder brand)

Vendor management software for the vendor lifecycle, combined with expert-performed control assessments (SOC, financial, cybersecurity, contracts) and a monitoring dashboard aggregating third-party risk data providers, aimed at financial organizations.

Owner: Ncontracts (acquired Venminder, 2024), backed by Hg
HQ: Elizabethtown, KY
Questionnaires: SIG Core, SIG Lite, CAIQ · Unlimited Questionnaire Library; Questionnaire Templates (RFP, SIG Core, SIG Lite, InfoSec, Pandemic etc.)
Integrations: API and SSO integration options; pre-built integrations with RSA Archer Third-Party Risk Governance, SecurityScorecard, and ArgosRisk AR Intelligence
Outside-in: Via partners: Ongoing Cybersecurity Monitoring lists SecurityScorecard and BitSight ratings; Ven-monitor combines integrated providers' business health, cybersecurity, privacy, ESG, adverse media and know-your-vendor data.
AI: Venminder says it uses AI to extract vendor contract metadata and speed its Vendiligence assessments, and does not use customer data to train shared models (June 2024).
Price: AWS Marketplace: Venminder Third-Party Risk Enterprise Platform (seller: Venminder): Dimension "Venminder TPR Enterprise" - "Includes all Enterprise modules (no customization)" - 12-month contract Cost/12 months $125,000.00; 24-month contract Cost/24 months $120,000.00 ("save up to 52%"); 36-month contract Cost/36 months $115,000.00 ("save up to 69%"). (marketplace list price)
Free / trial: None stated
Own assurance: SOC 2 Type II badge on the Ncontracts Trust Center (report titled "Ncontracts, LLC - SOC 2 Type 2 Report"); Venminder-specific scope not stated publicly

NoteNcontracts, owner since Sept 2024, also sells a second TPRM product, Nvendor. Venminder's own information page says both offer the same control assessments and services, but Nvendor connects to Ncontracts' wider risk suite while "Venminder runs stand-alone only." Source.

Checked 2026-11-0821 sources: aws.amazon.com, aws.amazon.com, aws.amazon.com …

No. 02Assessment workflowAI-first assessment

Censinet RiskOps

Censinet RiskOps™ – Third-Party Risk · Censinet, Inc.

Healthcare-specific platform for assessing vendors and their products with curated healthcare question sets, a shared assessment network, AI-assisted review and a remediation risk register.

Owner: Independent, venture-backed (investors include HLM Venture Partners, Cedars-Sinai and MemorialCare Innovation Fund)
HQ: Boston, MA
Questionnaires: NIST CSF · "Censinet question sets are curated specifically for healthcare by a dedicated curation team"; NIST CSF 2.0, CPG, HICP and NIST AI RMF support announced as enterprise assessments on the same platform.
Integrations: Censinet Workflow Connector for ServiceNow (in the ServiceNow Store); "modern APIs for rapid integration with existing IT, GRC, and procurement systems"
Outside-in: No outside-in security rating stated. Monitoring is described as "Potential Incident Alerts: Breach and ransomware notifications focused on your inventory".
AI: The Censinet Risk Assessor Agent reviews questionnaire responses and documentation, identifies potential findings and drafts reports and corrective action plans; vendor claims up to 66% time reduction.
Price: Not published: on request
Free / trial: None stated
Own assurance: SOC 2 Type 2 examination for the Censinet RiskOps platform, conducted by A-LIGN (announced February 18, 2026)

Checked 2026-11-0814 sources: aws.amazon.com, censinet.com, censinet.com …

No. 03Assessment workflowAI-first assessment

Certa

Certa Third Party OS – TPRM Orchestration · Opinr, Inc. dba Certa

No-code platform that orchestrates third-party intake, onboarding, screening, due diligence, monitoring and offboarding across risk domains, with AI agents that pre-fill forms, assess risk and adjudicate screening hits.

Owner: Independent, venture-backed (Series B led by Fin Capital and Vertex Ventures SEAI, 2023)
HQ: Saratoga, CA
Questionnaires: None named
Integrations: 130+ native integrations across screening, company data, e-sign and enterprise systems; Certa Connect no-code open API and RPA framework
Outside-in: Continuous monitoring is offered ("Always-on risk signals, not point-in-time snapshots"); no outside-in security-ratings provider is named on Certa's site.
AI: Certa AI agents: Vibe Configuration (policy-to-workflow in natural language), Risk, Pre-Fill, Adjudicate, Contracts and Validation agents, plus the Certa Concierge in-app assistant.
Price: Not published: on request
Free / trial: None stated
Own assurance: SOC 2 Type 2 (also SOC 1 Type 2) · ISO/IEC 27001

Checked 2026-11-0815 sources: aws.amazon.com, marketplace.microsoft.com, trust.certa.ai …

No. 04Assessment workflowGRC suite module

Prevalent

Mitratech Prevalent · Mitratech

Questionnaire-based TPRM platform covering vendor intake to offboarding, with an 800+ template library, AI-assisted assessment completion, continuous risk monitoring and optional managed services.

Owner: Mitratech (acquired Prevalent, 2024)
HQ: Austin, TX
Questionnaires: SIG, CAIQ, ISO 27001, NIST CSF, NIST SP 800-53, NIST 800-171 / CMMC, PCI DSS · library of 800+ assessment templates
Outside-in: Own monitoring, no ratings partner named: Vendor Threat Monitor / Mitratech Vendor Risk Monitoring tracks cyber threats (Internet and dark web), operational, financial, reputational and sanctions data, with high/medium/low-risk scoring.
AI: ARIES AI digital assistant; AI FastTrack Assessment populates a new questionnaire from up to 15 prior assessments and generates 200+ recommended answers; AI false-positive filtering and LLM event summaries in monitoring.
Price: AWS Marketplace: Prevalent TPRM Platform (seller: Prevalent, Inc.), 12-month contract: Dimension "Third-Party Marketplace" - "Access to the Third-Party Marketplace" - Cost/12 months $349.00. This prices only the supplier-side Third-Party Marketplace (self-assessment sharing), not the buyer TPRM platform. (on request)
Free / trial: None stated
Own assurance: ISO/IEC 27001

NotePrevalent was acquired by Mitratech (announced Oct 2, 2024); prevalent.net now redirects to mitratech.com and the product is sold as Mitratech Prevalent. The AWS Marketplace listing is still under seller Prevalent, Inc. Source.

Checked 2026-11-0812 sources: aws.amazon.com, aws.amazon.com, marketplace.microsoft.com …

No. 05Assessment workflow

Risk Ledger

Risk Ledger platform (Active Supply Chain Security) · Risk Ledger Ltd

Network platform where each supplier completes one standardised security assessment shared with every connected client, plus nth-party network mapping and emerging-threat tracking.

Owner: Independent, venture-backed (£24 million Series B led by Axiom Equity with Mercia Ventures, July 2026) · founded 2018
HQ: London, United Kingdom
Questionnaires: ISO 27001, NIST CSF · One standardised Supplier Assessment Framework that "covers ISO27002, the NIST Cybersecurity Framework, the NCSC Cyber Assessment Framework & Cyber Essentials"; reviewed every 6 months; add-on domains include Financial Risk, ESG and UK Government Data and Personnel Security.
Integrations: "Open API" included as standard; "Advanced Reporting and Integrations" also available; supplier ISO certificate data pulled from the International Accreditation Forum (IAF).
Outside-in: Own External Monitoring (Beta): scans suppliers' public assets, including port scanning, and shows findings with critical/high/medium/low severity indicators; listed as included as standard. No score scale is stated.
AI: "Summarise profile" gives an AI-generated supplier summary; Auto Suggest uses an AI model (Claude Haiku 4.5) to help suppliers complete assessments.
Price: Not published: on request
Free / trial: Free for suppliers: "Free For every supplier. No subscription required." Free tools: Supply Chain Risk Exposure Assessment, Supplier Criticality Matrix, Supplier Coverage Check, Public Sector Cyber Compliance Check. (for the suppliers being assessed, not for buyers)
Own assurance: ISO/IEC 27001

Checked 2026-11-0811 sources: aws.amazon.com, marketplace.microsoft.com, riskledger.com …

No. 06Assessment workflowAI-first assessmentSecurity ratings

ProcessUnity

ProcessUnity TPRM Platform (with the ProcessUnity Global Risk Exchange) · ProcessUnity, Inc.

Configurable TPRM workflow platform paired with the Global Risk Exchange library of attested vendor assessments, plus AI agents, evidence review and a controls-based 100-point Risk Index.

Owner: Private equity: Marlin Equity Partners (majority-control investment, 2021; Long Ridge Equity Partners retained a significant minority stake) · founded 2003
HQ: Concord, MA
Questionnaires: None named · 250+ supported frameworks, regulations and standards; 1,000+ cybersecurity and enterprise controls in our library
Integrations: Pre-built two-way connectors for ERP, P2P, AP, GRC, ERM, CRM, HCM and ITSM; risk data from 40+ providers (e.g., Bitsight, Black Kite, Dun & Bradstreet, RiskRecon, SecurityScorecard, Shared Assessments); Connect-Anything API framework
Outside-in: Own score: ProcessUnity Risk Index rates vendors on a 100-point scale, combining vendor-attested control data with outside-in threat and vulnerability intelligence; integrations also listed for Bitsight, Black Kite, RiskRecon and SecurityScorecard.
AI: ProcessUnity AI Agents for TPRM (Sept 2026), Evidence Evaluator (maps vendor documents to controls), Assessment Autofill and, for third parties, DDQ AutoAssist; ISO/IEC 42001:2023 certified AI management system (Oct 2026).
Price: Not published: on request
Free / trial: For third parties only: "Any organization can join the ProcessUnity Global Risk Exchange as a third party at no cost"; "DDQ AutoAssist is free for every third party on the Exchange, with no per-questionnaire charge." (for the suppliers being assessed, not for buyers)
Own assurance: SOC 2 Type 2, renewed annually; the Global Risk Exchange was to be included in audit scope from Q3 2025 · ISO/IEC 27001

NoteThe CyberGRX brand is retired: after the July 2023 combination, its exchange is sold as the ProcessUnity Global Risk Exchange ("formerly CyberGRX"). Source.

Checked 2026-11-0825 sources: aws.amazon.com, info.processunity.com, marketplace.microsoft.com …

No. 07Assessment workflowAI-first assessment

Aravo

Aravo for Third-Party Risk Management (Intelligence First™ Platform) · Aravo Solutions, Inc.

Configurable third-party management platform covering intake, onboarding, due diligence, monitoring, contracts, performance and offboarding, with risk-domain applications (ABAC, DORA, privacy, ESG) and embedded AI agents.

Owner: Aravo Solutions, Inc.; founder Tim Albinson is Chairman; no change of ownership announced in its press releases through Oct 2026 (investors not named on its site) · founded 2000
HQ: San Francisco, CA
Questionnaires: None named
Integrations: Integration framework using web-services APIs (XML/JSON, SOAP/REST); content partners include Refinitiv World-Check One, LexisNexis, Dow Jones, BitSight, SecurityScorecard, RapidRatings and Dun & Bradstreet
Outside-in: Via integrations: "cyber-risk and security ratings from BitSight and SecurityScorecard" through its connector framework; no own rating stated.
AI: Aravo AI (April 2026): workflow agents (Survey, Remediation, Decision), interactive agents in AI Canvas, and a no-code AI Studio where teams can choose which LLMs power their agents.
Price: Not published: on request
Free / trial: None stated
Own assurance: Not stated publicly

Checked 2026-11-0815 sources: aravo.com, aravo.com, aravo.com …

Security ratings: 7 entries

Scores a company from the outside, from what can be seen on the internet, without asking it anything. Used to triage and to watch vendors between assessments.

No. 08Security ratingsAssessment workflow

SecurityScorecard

TITAN AI platform (TITAN Watch, TITAN Assess, TITAN Secure; TITAN MAX managed services)

Grades organizations' external security A–F, monitors vendors continuously, and adds questionnaire automation, threat intelligence and remediation workflows in its TITAN AI platform.

Owner: Privately held, venture-backed (backers named by the company include Evolution Equity Partners, Silver Lake Partners, Sequoia Capital, Google Ventures and Riverwood Capital) · founded 2014
HQ: New York, NY
Questionnaires: SIG, CAIQ · "Import an existing questionnaire or start from SIG or CAIQ Lite"; pre-built and auto-imported templates in TITAN Assess
Integrations: "Pre-built workflow integrations", "API for custom integrations" and "MCP server integration" (MCP not in TITAN Watch), per pricing comparison table
Rating scale: A–F letter grade mapped to a numeric score from 100 to 0 (A = 90–100; F = 60 or lower)
Price: AWS Marketplace: "SecurityScorecard" listing, 12-month contract (Cost/12 months): SSC Free — "REQUEST QUOTE" — $0.00; SSC Pro — "REQUEST QUOTE" — $0.00; SSC Business — "For vendor management of 5 domains, reporting unlocked" — $13,500.00; SSC Enterprise — "Larger vendor management of 75 domains + onboarding experience" — $155,375.00 (marketplace list price)
Free / trial: "Free forever accounts" include "Scorecard for your own domain", "Questionnaire response", "Pre-built dashboards Basic report creation"; free trial: "Get immediate access to 5 scorecards of your choosing"; after a trial "the account will revert to a free version"
Own assurance: SOC 2 Type II

Checked 2026-11-0825 sources: aws.amazon.com, aws.amazon.com, aws.amazon.com …

No. 09Security ratingsAssessment workflow

UpGuard

UpGuard Vendor Risk · UpGuard, Inc.

Monitors vendors with daily external scans and a 0–950 security rating, and runs questionnaires, AI document reviews, risk assessments and remediation workflows.

Owner: Privately held, venture-backed (2026 Series C led by Springcoast Partners; existing investors August Capital, Square Peg Capital, Pelion Venture Partners) · founded 2012
HQ: Hobart, Tasmania, Australia (US headquarters: Mountain View, California)
Questionnaires: SIG, DORA, HIPAA · "library of best-practice questionnaires – including ISO, NIST, SIG, DORA, HIPAA, CPS230 and more"; assessment templates include NIST CSF 2.0, NIST SP 800-53 and ISO 27001:2022
Integrations: Native Jira Cloud, Slack and ServiceNow (UpGuard CyberRisk app) integrations; "over 4,000+ apps using Zapier"; API and webhooks. ("100+ Native Integrations" is listed for the separate Risk Automations product.)
Rating scale: 0–950 with A–F letter grade (A 801–950, B 601–800, C 401–600, D 201–400, F 0–200)
Price: Vendor Risk — Standard: $1,750 /mo, billed annually ("Monitor 50 Vendors"; "Additional Vendors for $79/month"); Professional: Contact sales ("Monitor 150 Vendors"); Corporate: Contact sales ("Monitor 500 Vendors"); Enterprise: Contact sales (Unlimited vendor monitoring slots); Enterprise+: Contact sales ("Monitor Unlimited Vendors"). "Pricing last updated: October 2026" (published)
Free / trial: "a free 14-day trial" (pricing page); Trust Exchange "Free: $0/mo" plan for sharing your own security posture
Own assurance: SOC 2, Type II compliant (annual attestation)

Checked 2026-11-0820 sources: aws.amazon.com, console.cloud.google.com, help.upguard.com …

No. 10Security ratingsAssessment workflow

Panorays

Panorays Third-Party Cyber Risk Management

Gives third parties a 0–100 external Cyber Posture Rating, combines it with questionnaire answers and business context, and manages assessment, monitoring and remediation of supplier cyber risk.

Owner: Privately held, venture-backed (2021 Series B led by Greenfield Partners, with Aleph and Oak HC/FT)
HQ: New York, NY
Questionnaires: SIG, CAIQ, NIST CSF, ISO 27001, DORA, PCI DSS · "Built-in SIG and CAIQ Questionnaires"; "pre-built templates based on these frameworks" (NIST CSF, ISO/IEC 27001, CIS Controls, SIG, CAIQ); "pre-built DORA-specific questionnaires"; PCI vendors get "a security inquiry that will ask about each of the 12 PCI controls"
Integrations: Integrations page lists connectors including Archer, AuditBoard, Diligent, Drata, Coupa, DocuSign, Asana and Freshworks; no count stated
Rating scale: Cyber Posture Rating from 0–100 (aggregated from hundreds of individual Tests, each rated 0–100)
Price: Not published: on request
Free / trial: "Create Your Free Account": "Send up to 5 pre-built questionnaires and view the cyber posture of 5 third-parties."
Own assurance: SOC 2 Type II · ISO/IEC 27001

Checked 2026-11-0819 sources: aws.amazon.com, marketplace.microsoft.com, marketplace.microsoft.com …

No. 11Security ratingsAssessment workflow

Bitsight

Bitsight Third-Party Risk Management (Continuous Monitoring, Vendor Risk Management, Vulnerability Detection & Response) · Bitsight (BitSight Technologies, Inc.)

Rates vendors' external security posture daily on a 250–900 scale and adds vendor intake, questionnaire assessments, SOC 2 summarization and zero-day exposure outreach.

Owner: Privately held; Moody's made a $250 million strategic investment in 2021 · founded 2011
HQ: Boston, MA, United States
Questionnaires: SIG Lite, NIST CSF, ISO 27001, HECVAT, NIST 800-171 / CMMC · "AI-automated assessments mapped to: SIG Lite, NIST CSF 2.0, ISO 270001, HECVAT, CIS, JAMA/JAPIA, MVSP, TISAX, CMMC and more"; network of "over 75,000 vendor profiles"
Integrations: "integrates with leading GRC platforms including ServiceNow Vendor Risk Management, Archer, OneTrust, ProcessUnity, and Aravo"; "a robust API for custom integrations"
Rating scale: 250–900 (Bitsight states the upper and lower edges are reserved and the current effective range is 300–820; the security-ratings page describes 300–820); categories Advanced 740–900, Intermediate 640–730, Basic 250–630; each risk vector gets an A–F letter grade
Price: AWS Marketplace: Listing is for Bitsight for Security Performance Management (not the TPRM product): 12-month contract, dimension "SPM Enterprise Combined" "per license (includes 20 benchmarking subscriptions)" $138,550.00 Cost/12 months; custom pricing offers available on request (on request)
Free / trial: Free Cyber Risk Report ("Security Ratings Snapshot"): "Get a snapshot of your organization's cybersecurity program, including your Bitsight Security Rating and a benchmark of how you compare to industry peers." (not a free plan or trial for assessing vendors)
Own assurance: SOC 2 Type 2 · ISO/IEC 27001: Not held: Bitsight states "BitSight does not, but Amazon AWS, our hosting provider does."

Checked 2026-11-0819 sources: aws.amazon.com, aws.amazon.com, help.bitsighttech.com …

No. 12Security ratingsAssessment workflow

Black Kite

Black Kite third-party cyber risk management (TPCRM) platform (Black Kite Monitor, Black Kite Assess, Black Kite Extend)

Rates third parties' external cyber posture from open-source intelligence, estimates ransomware likelihood and financial impact, and runs AI-assisted vendor assessments against compliance frameworks.

Owner: Privately held, venture-backed (2021 Series B led by Volition Capital, with Moore Strategic Ventures, Glasswing Ventures and Data Point Capital) · founded 2016
HQ: Boston, MA
Questionnaires: SIG · "built in integration with Shared Assessments SIG questionnaire"; compliance module standards include "NIST 800-53, ISO27001,GDPR, CIS CSC-20, NIST 800-17"; AI mapping to NIST, ISO 27001, SOC 2, HIPAA, PCI DSS and custom frameworks
Integrations: "open API and extensive ecosystem of native integrations" including ServiceNow TPRM, ServiceNow ITSM, Ncontracts, Aravo and Onspring; MCP Server
Rating scale: A–F letter grade "based on a 100-point scale"; separate Ransomware Susceptibility Index on a 0–1 scale
Price: Not published: on request
Free / trial: "Black Kite offers free trials in the form of a proof of concept."; "FREE RSI™ RATING" (Ransomware Susceptibility Index) (not a free plan or trial for assessing vendors)
Own assurance: SOC 2 (listed in its trust center; SOC 2 and SOC 3 reports available) · ISO/IEC 27001

Checked 2026-11-0817 sources: aws.amazon.com, blackkite.com, blackkite.com …

No. 13Security ratingsAssessment workflow

RiskRecon

RiskRecon Cyber Ratings (with RiskRecon Assessments Powered by Whistic) · RiskRecon, a Mastercard company

Scans third parties' internet-facing systems, rates their cybersecurity hygiene A–F weighted by each system's value, and produces prioritized action plans to share with vendors.

Owner: Mastercard (NYSE: MA); acquisition agreement announced December 2019, expected to close in Q1 2020 · founded 2015
HQ: Salt Lake City, UT
Questionnaires: None named
Integrations: APIs offered to Technology Alliance Partners to add RiskRecon ratings data to their platforms (Global Cybersecurity Alliance Program); no count stated
Rating scale: A–F letter grade translated from a 0–10 numeric rating (10 best); population average 7.5 ("a low B")
Price: Not published: on request
Free / trial: "Get a free 30-day trial of the RiskRecon portal and see the ratings of up to 50 vendors." (includes "A RiskRecon report of your own organization")
Own assurance: Not stated publicly

Checked 2026-11-0814 sources: aws.amazon.com, blog.riskrecon.com, blog.riskrecon.com …

No. 14Security ratingsAI-first assessment

Interos

interos.ai Resilience platform – Third-Party Risk Management · Interos Inc. (interos.ai)

Maps multi-tier supplier networks from a B2B relationship knowledge graph and scores suppliers on cyber, financial, ESG, geopolitical, catastrophic and restrictions risk, with continuous alerts.

Owner: Independent, venture-backed (TechCrunch, Oct 2024: $40 million strategic growth round from funds managed by Blue Owl Capital; nearly $290 million raised to date)
HQ: Arlington, VA
Questionnaires: None named
Integrations: Interos risk intelligence integrated into SAP Ariba Supplier Risk; iQ matches ERP identifiers to the knowledge graph for ERP workflows.
Price: AWS Marketplace: 12-month contract: Resilience Platform ("Access to the Resilient Platform") $100,000.00 Cost/12 months (marketplace list price)
Free / trial: None stated
Own assurance: Not stated publicly

Checked 2026-11-0812 sources: aws.amazon.com, marketplace.microsoft.com, techcrunch.com …

GRC suite module: 9 entries

The third-party module of a wider governance, risk and compliance suite. Strongest where the rest of the suite is already in use.

No. 15GRC suite moduleAssessment workflowAI-first assessment

LogicGate Risk Cloud

Risk Cloud® Third-Party Risk Management Agentic Application · LogicGate, Inc.

TPRM application inside the Risk Cloud GRC platform: vendor intake, SIG/NIST/CAIQ questionnaires, external assessment portal, dashboards, and agents that triage intake and run first-pass assessments.

Owner: Independent, growth-equity backed ($113M Series C led by PSG, 2021) · founded 2015
HQ: Chicago, IL
Questionnaires: SIG, CAIQ · Pre-built SIG, NIST, and CAIQ questionnaires
Integrations: "dozens of purpose-built integrations" (About page); the integrations directory lists 267 (native integrations, Risk Cloud Connectors, Evidence Sources), plus an MCP server, open REST API and SFTP connector
Outside-in: Via integrations with intelligence providers such as Black Kite, SecurityScorecard and Vital4; no own rating stated.
AI: TPRM Agentic Application with a Third-Party Intake Agent, Third-Party Assessment Agent and TPRM Insights Agent; third parties can autofill questionnaires in a single click.
Price: Not published: on request
Free / trial: None stated
Own assurance: SOC 2 Type II (2026 SOC 2 Type 2 report announced May 30, 2026) · ISO/IEC 27001

Checked 2026-11-0814 sources: aws.amazon.com, marketplace.microsoft.com, trust.logicgate.com …

No. 16GRC suite moduleAssessment workflowAI-first assessment

OneTrust

OneTrust Third-Party Risk Management (sold as Third-Party Risk Management Base or within the Third-Party Management Suite)

Manages the third-party lifecycle (intake, tiering, assessments, risk treatment, monitoring, offboarding) inside OneTrust's governance platform, with partner cyber ratings and Dow Jones screening add-ons.

Owner: Independent, privately held and venture-backed (investors named by OneTrust include Insight Partners, Coatue, TCV, Sands Capital, Franklin Templeton and Generation Investment Management) · founded 2016
HQ: Atlanta, GA, USA
Questionnaires: SIG Core, SIG Lite · "Choose from more than 50 built-in control frameworks or import your own" (product page); same-day support for the 2022 SIG Core and SIG Lite was announced in 2022 under the former Vendorpedia brand
Integrations: 500+ pre-built plug-ins (platform-wide, About Us page); product page: "Choose from dozens of integrations"
Outside-in: Partner data, not its own: "Screen and monitor cyber risk ratings and breach activity from RiskRecon, SecurityScorecard, and HackNotice"; the Third-Party Risk Exchange also links SupplyWisdom and ISS Corporate Solutions data
AI: OneTrust says AI document scanning reduces assessment time by up to 65% and AI agents can handle intake, screening and risk tiering.
Price: Not published: on request
Free / trial: None stated
Own assurance: SOC 2 Type II · ISO/IEC 27001

Checked 2026-11-0819 sources: marketplace.microsoft.com, marketplace.microsoft.com, onetrust.com …

No. 17GRC suite moduleAssessment workflow

Supplier Shield

Supplier Shield TPRM module of Acuna GRC · Acuna SA (operating as Supplier Shield)

Third-party risk module inside the Acuna GRC platform covering vendor inventory, risk tiering, adaptive questionnaires, evidence library, findings and reports, with DORA and NIS2 mappings.

Owner: Abilene Group SA, Morges, Switzerland (its ISO 27001 certificate scope covers Acuna and Supplier Shield; acunagrc.com is '© 2026 Abilene Group SA') · founded 2019
HQ: Morges, Switzerland
Questionnaires: ISO 27001, SOC 2, NIST CSF, NIST SP 800-53, PCI DSS, NIST 800-171 / CMMC · "Adaptive questionnaires built by compliance experts so vendors answer once and frameworks reuse responses"; "50+ frameworks supported"
Integrations: Failed controls become Jira/ServiceNow tickets; supplier import via "Manual / CSV / API"; pricing matrix lists "APIs (Zapier)" as an add-on and SSO "Google, Microsoft"
Outside-in: Homepage describes the module as "OSINT · A-F grades · live monitoring"; the pricing matrix lists "Cybersec supplier monitoring overview" as "Soon" in all three tiers. Breach Scanner ("D&B credit · darknet exposure") is a separate Acuna module.
AI: Aiko, an AI agent inside Acuna GRC, proposes vendor risk tiers, drafts evidence-renewal requests, auto-maps new obligations and drafts board summaries.
Price: Supplier Shield TPRM starts from CHF 4'290 / yr (Starter). The core of Acuna GRC, the AI-native GRC platform, starts from CHF 6'390 / yr; additional modules are priced separately. Tiers: Starter CHF 4'290 / yr (Up to 1 member); Professional: Contact sales (Up to 5 team members); Enterprise: Custom quote (Up to 10 team members). (published)
Free / trial: None stated
Own assurance: ISO/IEC 27001

NoteProduct packaging changed in 2026: "Supplier Shield is now a module of the Acuna GRC platform... Existing contracts are honored to renewal; renewal moves to Acuna pricing." (vendor pricing FAQ). Source.

Checked 2026-11-0812 sources: acunagrc.com, aws.amazon.com, cdn.prod.website-files.com …

No. 18GRC suite moduleAssessment workflow

Centraleyes

3rd Party Risk Management

Runs vendor onboarding, questionnaires, risk scoring, external exposure monitoring and remediation tracking inside the same GRC platform used for internal risk and compliance.

Owner: Independent; no parent company or investors named on the vendor site (entities: Centraleyes Ltd. and Centraleyes, Inc.) · founded 2018
HQ: Tel Aviv, Israel per the vendor's AI Info page; site footer lists 'Headquarters' addresses in Hoboken, NJ and New York, NY
Questionnaires: None named · 70+ Pre-loaded industry frameworks and standards
Integrations: Integrates with cloud platforms, ticketing systems, vulnerability scanners, and collaboration tools; API and webhook support
Outside-in: Combines vendor questionnaires with continuous external intelligence: 'Exposed assets, vulnerabilities, breach indicators, leaked credentials, and configuration findings are tied to each vendor profile'; the source of this intelligence is not named and no score scale is published.
AI: Lists 'AI-powered planning, orchestration, and remediation' as a vendor risk management feature, running on the same 'AI-powered platform' as its internal risk program.
Price: AWS Marketplace: Listing 'Centraleyes GRC' (sold by Centraleyes GRC), 36-month contract: 'Centraleyes GRC Basic' (up to 2 frameworks and 2 named users) $120,000.00; 'Centraleyes GRC Enterprise' (up to 5 frameworks and 4 named users) $180,000.00; 'Centraleyes GRC MSSP' (up to 5 frameworks, 4 named users, up to 3 managed client workspaces) $225,000.00, Cost/36 months. Whole-platform tiers; no separate TPRM dimension. (marketplace list price)
Free / trial: None stated
Own assurance: SOC 2 certified (as stated)

Checked 2026-11-0812 sources: aws.amazon.com, marketplace.microsoft.com, centraleyes.com …

No. 19GRC suite moduleAssessment workflowAI-first assessment

MetricStream

MetricStream Third-Party Risk Management · MetricStream, Inc.

Third-party module of MetricStream's GRC platform covering inventory, risk-based onboarding, multi-domain due diligence questionnaires, contract obligations, continuous monitoring with external data, and issue remediation.

Owner: Independent, investor-backed: MetricStream lists BlueTorch Capital, Goldman Sachs, Clearlake Capital, Sageview Capital, CM Growth, Kaiser Ventures and EDBI among its investors
HQ: San Jose, CA, USA
Questionnaires: None named · Proportionate questionnaires across cyber, privacy, financial, compliance, resilience, operational, sanctions, corruption and reputational risk; questionnaires and scoring are configurable
Outside-in: Combines internal scoring with external content "such as BitSight's cybersecurity ratings"; the sister IT Vendor Risk Management product integrates Dow Jones, Dun & Bradstreet, BitSight and SecurityScorecard
AI: Third-Party Risk Agents recommend tiers and tailor assessments, AI Survey Autofill drafts responses from evidence, and AI scans SOC 2 and SOC 3 reports for anomalies.
Price: AWS Marketplace: 'MetricStream ConnectedGRC' (Sold by: MetricStream Inc.), 36-month contract: 'CyberGRC - Prime' (IT Risk Assessments, Reporting, Scoring and Centralized Management) $180,000.00; 'ESGRC - Prime' $180,000.00; 'CyberGRC Workshop' $1.00. No Third-Party Risk Management dimension is listed, so the TPRM product has no public price. (on request)
Free / trial: None stated
Own assurance: SOC 2 Type II · ISO/IEC 27001

Checked 2026-11-0811 sources: aws.amazon.com, metricstream.com, metricstream.com …

No. 20GRC suite moduleAssessment workflowAI-first assessment

Optro (AuditBoard)

Optro TPRM (Agentic TPRM) · Optro, Inc. (formerly AuditBoard)

Optro's TPRM module uses AI agents to tier vendors against your policy, pull SOC 2 and ISO reports from public trust centers, and pre-fill questionnaires for analyst review.

Owner: Private equity: Hg (agreed to acquire AuditBoard in May 2024 in a deal valued at over $3 billion) · founded 2014
HQ: Los Angeles, CA, USA
Questionnaires: None named · "We also offer a library of OOTB questionnaire templates based on some of the most commonly asked about high-risk areas"; scoring and questionnaires customizable by vendor type
Integrations: 200+ out-of-the-box integrations including security ratings providers, plus REST API (company AI-info page); the TPRM page FAQ says "150+ OOTB integrations"
Outside-in: Integrates with third-party security ratings services: "TPRM also integrates with leading security ratings services to deliver real-time cyber ratings for vendors"; providers not named on the page
AI: AI agents tier vendors from an uploaded policy, collect SOC 2/ISO reports from public trust centers and pre-fill questionnaires; Optro says every agent action is logged, auditable and reversible.
Price: Not published: on request
Free / trial: None stated
Own assurance: SOC 2 Type II (2026 report covering September 1, 2025 to August 31, 2026) · ISO/IEC 27001

NoteRebranded: AuditBoard became Optro on March 9, 2026 (auditboard.com now redirects to optro.ai); owned by private equity firm Hg since the 2024 acquisition. Source.

Checked 2026-11-0817 sources: aws.amazon.com, hgcapital.com, hgcapital.com …

No. 21GRC suite moduleAssessment workflow

Riskonnect

Riskonnect Third-Party Risk Management · Riskonnect, Inc.

Riskonnect module that stores vendor and supplier records, runs onboarding and scheduled reassessment questionnaires through a portal, tracks certificates and contracts, and scores each third party.

Owner: Private equity: TA Associates (majority owner, invested 2021); Thoma Bravo, the prior majority owner, said in 2021 it would keep a significant stake · founded 2007
HQ: Atlanta, GA, USA
Questionnaires: None named · Customized questionnaires for onboarding and reassessment; forms can be customized for different supplier categories
Integrations: "We also offer APIs ... to easily import and export data and out-of-the-box integrations with specialized partners"
Outside-in: Links to "your preferred risk intelligence provider through API integrations"; lists third-party risk intelligence feeds and attack surface monitoring, providers not named
AI: Riskonnect's Intelligent Risk Framework adds Salesforce Agentforce 360 agent actions across risk areas including third-party risk (announced February 3, 2026).
Price: Not published: on request
Free / trial: None stated
Own assurance: SOC 2 Type 2

Checked 2026-11-0813 sources: riskonnect.com, riskonnect.com, riskonnect.com …

No. 22GRC suite moduleAssessment workflow

Archer

Archer Third-Party Governance · Archer (Archer Technologies LLC)

Keeps each vendor relationship on one record in the Archer GRC platform, covering intake, inherent-risk tiering, questionnaires via a vendor portal, residual risk scoring, metric monitoring and offboarding.

Owner: Private equity: Cinven (acquired from RSA Security, 2023) · founded 2000
HQ: Overland Park, KS, USA
Questionnaires: None named · Editable questions and scoring; "Teams with a question bank usually port it over"; prescriptive framework covers profiles, engagements, inherent risk, due diligence and monitoring out of the box
Outside-in: Lists "Security risk monitoring: Outside-in security ratings between reviews"; the ratings provider is not named on the product page
AI: Archer Evolv lets permitted users query the third-party record, grounds answers in the customer's own records and requires a person to approve before the record changes.
Price: Not published: on request
Free / trial: None stated
Own assurance: Not stated publicly

NoteFormerly RSA Archer: carved out of RSA Security and acquired by private equity firm Cinven (announced April 2023). Source.

Checked 2026-11-0818 sources: aws.amazon.com, archerirm.com, archerirm.com …

No. 23GRC suite moduleAssessment workflowAI-first assessment

ServiceNow

Third-party Risk Management (formerly Vendor Risk Management), part of ServiceNow Integrated Risk Management · ServiceNow, Inc.

ServiceNow IRM application that keeps a third-party portfolio, tiers engagements, runs risk assessments through a vendor portal, tracks issues and rolls results into enterprise risk and controls.

Owner: Public company (NYSE: NOW)
HQ: Santa Clara, CA, USA
Questionnaires: None named · Tiering assessments and inherent risk questionnaires (IRQs); 'automated inherent risk questionnaires' were added in the Vancouver release
Outside-in: Store key features list "Security score integration"; partner-built TPRM integrations on the ServiceNow Store include Bitsight, SecurityScorecard, Black Kite, Panorays, Recorded Future and Interos
AI: Third-party Risk Management Advanced and Prime add generative AI to summarize third-party risk issues and identify potential issues during assessment review.
Price: AWS Marketplace: Reseller listing, not sold by ServiceNow: 'PROD20917 Bynet ServiceNow Third Party Risk Management' (Sold by: BYNET, delivered as an AMI), 12-month contract, dimension 'transactions', Cost/12 months $480.00; listing note: 'Product pricing is subject to a minimum of all Bynet ServiceNow products ordered in total, of $120,000.' (on request)
Free / trial: None stated
Own assurance: Not stated publicly

NoteProduct renamed from Vendor Risk Management to Third-party Risk Management (app version 17.x); older documentation and analyst reports use the VRM name. Source.

Checked 2026-11-087 sources: aws.amazon.com, newsroom.servicenow.com, newsroom.servicenow.com …

Compliance platform: 4 entries

A compliance-automation platform (SOC 2, ISO 27001 readiness) with a vendor-risk module added. Lighter, and usually cheaper to start.

No. 24Compliance platformAssessment workflow

Secureframe

Third-Party Risk Management (a feature of Secureframe Comply; formerly Vendor Risk Management)

Keeps vendor profiles, risk assessments and documents in one place, flags unlisted apps found via SSO, schedules risk-based reviews, and uses AI to pull answers from vendor SOC 2 reports.

Owner: Independent, venture-backed (investors listed include Kleiner Perkins, Gradient Ventures, Accomplice Ventures, Base10 Partners) · founded 2020
HQ: San Francisco, CA (newsroom dateline; HQ not explicitly named)
Questionnaires: None named · Send 'custom or template-based questionnaires' from the platform; pricing page lists a 'Security Review Template'.
Integrations: 300+ integrations (platform-wide; the About page says 150+)
Outside-in: No outside-in vendor ratings stated; the TPRM page's 'continuously monitor' refers to detecting unlisted apps accessed via SSO and recurring reviews based on risk level.
AI: Comply AI for TPRM extracts answers to security review questions from vendor documents such as SOC 2 reports and policies and populates suggested answers for review.
Price: Fundamentals: "Starting at $7,500/year". Complete (adds "Advanced Third-Party Risk Management"): "Get a quote". (published)
Free / trial: None stated
Own assurance: SOC 2 Type 2 · ISO/IEC 27001

Checked 2026-11-0818 sources: aws.amazon.com, secureframe.com, secureframe.com …

No. 25Compliance platformAssessment workflowAI-first assessment

Vanta

Third Party Risk Management (TPRM)

Keeps a vendor inventory, scores inherent risk, collects vendor evidence and questionnaires, and uses an AI agent to review SOC 2 reports and draft findings and remediation plans.

Owner: Independent, venture-backed (backers named include Sequoia Capital, Craft Ventures, Y Combinator, J.P. Morgan and Goldman Sachs) · founded 2018
HQ: San Francisco, CA (place of business stated in Vanta's MSA; HQ not explicitly named)
Questionnaires: None named · Build a questionnaire from scratch, start from a template created by Vanta's Security team, or import a questionnaire from a spreadsheet; assessment types include security, privacy, AI, finance, legal and custom.
Integrations: Automatically pull data from 400+ tools (platform-wide)
Outside-in: No outside-in score; continuous vendor monitoring for vulnerabilities, breaches, misconfigurations, leaked credentials and subprocessors comes from Vanta's own technology (acquired Riskey, July 2025). Listed as an add-on; June 2026 update says Continuous Vendor Monitoring is 'Available in preview as a part of the Advanced Third-Party Risk Management'.
AI: TPRM Agent discovers vendors, retrieves evidence from vendor trust centers, extracts risks from SOC 2 reports and DPAs, pre-fills assessment questionnaires and flags answers for human review.
Price: AWS Marketplace: Listing 'Vanta' (sold by Vanta), 12-month contract: dimension 'Third Party Risk Management (TPRM)', description 'Up to 50 vendors managed per year', $13,600.00 Cost/12 months. Platform packages are separate dimensions (e.g. 'Essentials Package', 'Starting cost for 1-20 employees', $14,000.00). Custom pricing via private offer. (marketplace list price)
Free / trial: None stated
Own assurance: SOC 2 Type II attestation · ISO/IEC 27001

Checked 2026-11-0819 sources: aws.amazon.com, help.vanta.com, help.vanta.com …

No. 26Compliance platformAssessment workflowGRC suite module

Cynomi

Third-Party Risk Management (TPRM) module of the Cynomi platform

Lets MSPs and MSSPs send vendor questionnaires, score and report vendor risk for each client, reuse shared vendor assessments across clients, and feed results into the client's risk score.

Owner: Independent, venture-backed ($37M Series B co-led by Insight Partners and Entrée Capital, 2025) · founded 2021
Questionnaires: None named · Third-party risk management template library; March 2026 added 'SaaS & Software Vendor Security Assessment', 'Sensitive Data & Privacy Assessment' and 'Cardholder Assessment'.
Outside-in: No outside-in vendor ratings stated; the TPRM page describes 'questionnaire distribution, risk scoring, and ongoing monitoring'.
AI: 'CISO Intelligence' weights vendor assessment risks by the vendor's criticality to the client's business operations and regulatory obligations.
Price: Not published: on request
Free / trial: None stated
Own assurance: SOC 2 Type II · ISO/IEC 27001

Checked 2026-11-0812 sources: aws.amazon.com, cynomi.com, cynomi.com …

No. 27Compliance platformAssessment workflowAI-first assessment

Drata

Third-Party Risk Management (with Agentic TPRM Assessment)

Keeps a vendor inventory and uses an AI agent to collect vendor security evidence, evaluate it against your own written standards, and record inherent and residual risk decisions.

Owner: Independent, venture-backed · founded 2020
HQ: San Francisco, CA
Questionnaires: None named · Questionnaires are built in Drata as reusable templates; questions can be imported from a CSV file (up to 500 questions per file).
Integrations: Integrates with 'hundreds of tools' (platform-wide); Vendor Source Sync pulls vendors from procurement, CLM and other systems and writes decisions back
Outside-in: No outside-in security rating stated; ongoing monitoring is described as 'recurring reviews, tailored follow-up questionnaires, and automated reassessment cadences'.
AI: An agent evaluates each third party against customer-written natural-language standards, pulls documents from vendor Trust Centers, flags gaps, drafts follow-up questions and explains decisions; Drata MCP exposes vendor-risk data to AI assistants.
Price: AWS Marketplace: Listing 'Drata Security & Compliance Automation Platform' (sold by Drata), 12-month contract: only dimension is 'Foundation Package for 1-50 FTE Companies', 'List price for 1-50 FTE Company', $15,000.00 Cost/12 months. No Third-Party Risk Management dimension is listed; custom pricing by private offer. (on request)
Free / trial: None stated
Own assurance: SOC 2 Type 2 · ISO/IEC 27001

Checked 2026-11-0813 sources: aws.amazon.com, drata.com, drata.com …

AI-first assessment: 5 entries

Built on AI reading the evidence (SOC 2 reports, policies, questionnaire answers) and drafting the assessment, with a person reviewing.

No. 28AI-first assessmentAssessment workflow

VISO TRUST

VISO TRUST AI-Powered TPRM platform · VISO TRUST (a Protecht brand)

Uses AI to request and read vendor security artifacts such as SOC 2 reports, score inherent and residual risk with rationale, and monitor breach news across third and nth parties.

Owner: Protecht Group (acquired VISO TRUST, April 2026); Protecht received a US$280 million investment from PSG Equity a year earlier · founded 2020
HQ: San Francisco, CA
Questionnaires: SIG, SOC 2, ISO 27001, NIST CSF, PCI DSS · Evidence-first rather than questionnaire-first; integrated the 2024 Shared Assessments SIG (Dec 2023) and "can automatically complete SIG questionnaires using existing security program artifacts and evidence".
Integrations: "Connect VISO TRUST with 100+ tools you already use"; popular integrations listed include Jira, Coupa, ServiceNow, Archer, Slack, Okta, Google Workspace, Microsoft, Salesforce, Workday, Vertice, Netskope.
Outside-in: No proprietary security rating; Instant Assessments analyse OSINT, vendor artifacts "and optional security rating inputs". Breach/News Monitoring covers "100+ curated sources, including breach disclosures, news feeds, trust-center updates, and SEC filings".
AI: Agentic AI requests vendor artifacts, maps evidence to frameworks and produces explainable inherent and residual risk scores "in under a minute per vendor".
Price: AWS Marketplace: 12-month contract: Vendor Relationships ("Unique business relationships that are assessed, monitored, and managed.") $1,000.00 Cost/12 months per unit; also offered: "24-month contract - save up to 10%", "36-month contract - save up to 20%" (marketplace list price)
Free / trial: None stated
Own assurance: "VISO TRUST has recently achieved our AICPA SOC 2, Type 2 compliance" (SOC 2 Type 2 and SOC 3 announced October 2022)

NoteAcquired by Australia-based GRC vendor Protecht Group in April 2026; site now reads "A Protecht Brand" and Protecht plans to integrate VISO TRUST's AI with its own GRC platform. Source.

Checked 2026-11-0816 sources: aws.amazon.com, marketplace.microsoft.com, visotrust.com …

No. 29AI-first assessmentAssessment workflow

Vendict

Vendict Third-Party Risk Management (TPRM) platform and Managed TPRM

AI agents analyse vendor security and privacy documents, pre-fill vendor questionnaires and monitor third-party risk; in the managed option, Vendict's GRC experts validate findings and run assessments.

Owner: Independent, venture-backed ($10 million Series A led by Moneta VC and JAL Ventures, August 2025) · founded 2020
HQ: New York, NY
Questionnaires: None named
Integrations: Trust center lists "Available Integrations (6)": Slack, Microsoft Teams, SSO (SAML, OpenID), Google Drive, Sharepoint, Confluence.
Outside-in: No rating scale stated; Managed TPRM tiers include "External Risk Exposure Monitoring" (Limited / Expanded / Full Coverage) and "Trust Center & Evidence Continuous Monitoring".
AI: AI agents chase vendors for documents and answers, locate controls in vendor documentation, analyse them against the customer's standards and surface risks for expert validation.
Price: Not published: on request
Free / trial: "Sign up for a free 14-day trial"; April 2026 limited-time offer of "a complimentary vendor risk assessment for one third-party organization".
Own assurance: "Vendict has been continuously attested to SOC2 Type 2 by 'Big-4' firms since 2022, in the Service Criteria of Security, Availability and Confidentiality."

Checked 2026-11-0814 sources: aws.amazon.com, aws.amazon.com, marketplace.microsoft.com …

No. 30AI-first assessmentAssessment workflowCompliance platform

Whistic

Whistic Assess (with Vendor Monitoring and Trust Center on the Whistic Agentic Risk Operations Platform)

Has AI read vendors' existing security evidence such as SOC 2 reports, map it to your controls with cited findings, and route results to reviewers who record the decision.

Owner: Independent, venture-backed (investors listed include Emergence Capital, ForgePoint Capital, JMI Equity and Battery) · founded 2015
HQ: West Jordan, Utah
Questionnaires: SIG, CAIQ · Whistic Core 'comes standard with 50+ standard questionnaires and frameworks'; custom-questionnaire builder and premium frameworks are add-ons.
Integrations: Salesforce, Slack, Jira, BitSight, and DocuSign, plus an API
Outside-in: Partner ratings from RiskRecon (Mastercard): 'continuous monitoring by RiskRecon on more than 60,000 companies' and a combined 'RiskRecon Assessments Powered by Whistic' offering; BitSight integration. Own Vendor Monitoring scans public, dark web and SEC sources every 30 minutes for breaches.
AI: AI reads vendor evidence and answers your controls with confidence scores and source citations; Automation Orchestrator runs four agents (Initiator, Collector, Analyst, Reporter) from trigger to executive summary, and people make the final decision.
Price: AWS Marketplace: Listing 'Whistic - Agentic Risk Operations Platform (AI-First TPRM)' (sold by Whistic), 12-month contract, Cost/12 months: 'Whistic Core AI' (25 vendor assessments, 25 AI Assessment Copilot uses, 25 Vendor Insights, 5 Smart Responses, 1 Trust Center; unlimited vendors and users) $15,500.00; 'Whistic Assess AI: Standard' (75 vendor assessments) $31,750.00; 'Whistic Assess AI: Professional' (150) $43,250.00; 'Whistic Assess AI: Premium' (250) $54,750.00; 'Whistic Assess AI: Enterprise' (500) $76,000.00; 'Vendor Monitoring - Standard' $5,500.00; 'Vendor Monitoring - Professional' $8,250.00. A 24-month contract option is also listed. (marketplace list price)
Free / trial: 'Create a Free Profile' link on whistic.com (terms not described); Cloud Security Alliance members were offered 'a 3-month free Whistic trial' (Jan 2025) (for the suppliers being assessed, not for buyers)
Own assurance: SOC 2 Type II · ISO/IEC 27001

Checked 2026-11-0815 sources: aws.amazon.com, marketplace.microsoft.com, whistic.com …

No. 31AI-first assessmentAssessment workflowSecurity ratings

SAFE TPRM

SAFE TPRM AI Co-Worker · SAFE (Safe Security)

AI agents run vendor intake, inherent-risk tiering, evidence review, vendor follow-ups, remediation, continuous monitoring and offboarding, with third-party risk expressed in financial terms.

Owner: Independent, venture-backed (raised over $170 million; $70 million Series C led by Avataar Ventures, July 2025) · founded 2012
HQ: Palo Alto, CA
Questionnaires: None named
Integrations: Platform-wide (SAFE One): "SAFE integrates with 150+ of the world's leading cybersecurity tools and products"; the same page also says "over 100+ out-of-the-box integrations".
Outside-in: Own outside-in scanning ("Detect External Exposures") combined with questionnaires, contracts, SaaS posture and inside-out telemetry "into one defensible score"; third-party exposure is quantified in dollars via FAIR-based cyber risk quantification.
AI: "100+ AI agents" (e.g. Document Analyzer, Inline Review, Vendor Interaction, Threat Intel, Contract Analysis, Fourth-Party Discovery agents) work across five TPRM phases.
Price: AWS Marketplace: 12-month contract: SAFE TPRM Basic ("SAFE TPRM Basic, up to 25 users") $20,000.00 Cost/12 months; Overage cost $1.00/unit; custom pricing via "Request private offer" (marketplace list price)
Free / trial: None stated
Own assurance: SOC 2 Type 2 (security page also lists SOC 3) · ISO/IEC 27001

NoteSAFE and SecurityScorecard announced on 17 October 2025 that they had "resolved their recent legal dispute" (vendor press release). Source.

Checked 2026-11-0816 sources: aws.amazon.com, marketplace.microsoft.com, safe.security …

No. 32AI-first assessmentAssessment workflowCompliance platform

Zania

Zania Autonomous Third-Party Risk Management (AI agents) · Zania Inc.

AI agents tier vendors, collect and check evidence against trust centers, breach data and public records, chase vendor follow-ups and produce evidence-cited findings for human review.

Owner: Independent, venture-backed ($18M Series A led by NEA, September 2025) · founded 2023
HQ: Palo Alto, California
Questionnaires: SOC 2, ISO 27001, PCI DSS · Pricing page lists supported frameworks "including SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS, and ISO 42001" across the platform.
Integrations: Implementation includes "connecting to your existing GRC, procurement, ticketing, and identity systems".
Outside-in: No security rating stated; agents validate evidence against "trust centers, breaches, and public records" and monitoring triggers reassessments when vendor posture changes.
AI: AI agents classify vendors by data access and criticality, collect and validate evidence, send follow-ups and produce findings mapped to the customer's controls.
Price: Not published: on request
Free / trial: None stated
Own assurance: SOC 2 Type II examination

Checked 2026-11-089 sources: aws.amazon.com, marketplace.microsoft.com, zania.ai …

Chain of title: who owns whom

The category is consolidating. Every acquisition, merger and rename recorded in the register, newest first, each linked to its announcement.

2026-05SecurityScorecard: Acquired Driftnet (internet scanning and threat intelligence) source
2026-05Optro (AuditBoard): Acquired Midship (AI-native SOX testing) source
2026-04VISO TRUST: Acquired by Protecht Group source
2026-03Optro (AuditBoard): Renamed from AuditBoard to Optro (March 9, 2026) source
2025-11SAFE TPRM: Acquired Balbix (CTEM) source
2025-10Optro (AuditBoard): Acquired FairNow (AI governance) source
2025-09SecurityScorecard: Acquired HyperComply (AI security questionnaire automation) source
2025-07Vanta: Acquired Riskey (third- and fourth-party risk monitoring), integrated into Vendor Risk Management source
2025-02Drata: Agreed to acquire SafeBase (Trust Center software) source
2024-12Bitsight: Completed acquisition of Cybersixgill source
2024-11Bitsight: Signed definitive agreement to acquire Cybersixgill (cyber threat intelligence) in a $115M deal source
2024-10Prevalent: Acquired by Mitratech (from Insight Partners), announced alongside Preparis on Oct 2, 2024 source
2024-09Venminder: Acquired by Ncontracts; Hg bought out prior Ncontracts (Gryphon Investors) and Venminder shareholders source
2024-06Riskonnect: Acquired Camms (GRC software) source
2024-05Optro (AuditBoard): Agreed to be acquired by Hg in a transaction valued at over $3 billion source
2024-03Archer: Acquired Flisk, entering the RMIS market source
2024-02Archer: Acquired Compliance.ai (AI regulatory change management) source
2024-01Riskonnect: Acquired Ventiv Technology; TA Associates continues as majority owner source
2023-07ProcessUnity: Acquired CyberGRX (Marlin-backed combination; CyberGRX shareholders kept a minority stake) source
2023-04Archer: Cinven agreed to acquire Archer from RSA Security (a Clearlake Capital and Symphony Technology Group portfolio company); terms not disclosed source
2023-02Archer: Acquired Atlas (policy management) source
2022-08Bitsight: Announced intent to acquire ThirdPartyTrust (vendor assessment and onboarding platform) source
2022-02SecurityScorecard: Acquired LIFARS (digital forensics and incident response) source
2021-11Riskonnect: TA Associates announced a growth investment; Thoma Bravo planned to keep a significant equity stake source
2021-09ProcessUnity: Majority-control growth investment from Marlin Equity Partners; Long Ridge retained a significant minority stake source
2021-09Bitsight: Moody's to invest $250 million in Bitsight; Bitsight to acquire VisibleRisk (Moody's/Team8 joint venture) source
2021-05OneTrust: Agreed to acquire Shared Assessments (publisher of the SIG questionnaire), which was to remain a vendor-neutral organization source
2019-12RiskRecon: Mastercard announced an agreement to acquire RiskRecon (terms not disclosed; close expected Q1 2020) source
2018-09ProcessUnity: Majority growth capital investment from Long Ridge Equity Partners source
2017-06Riskonnect: Thoma Bravo agreed to acquire Riskonnect; founders kept a significant minority stake source

Analyst reports, as the vendors tell it

Every “best TPRM software” list we found is written by a vendor. Analyst reports are the other common shortcut. These are the current ones, and the vendors in this register that say they are a Leader in each, in their own words. We have not read the reports, which are paid.

Vendors that state they are Leaders in current analyst reports
Report	Vendors in the register that say they are a Leader
Gartner Magic Quadrant for Third-Party Risk Management Tools (2026, the first)	Certa (statement), Aravo (statement), OneTrust (statement), Optro (AuditBoard) (statement)
The Forrester Wave: Third-Party Risk Management Platforms, Q1 2026	ProcessUnity (statement), LogicGate Risk Cloud (statement), Archer (statement)
The Forrester Wave: Cybersecurity Risk Ratings Platforms, Q2 2026	Panorays (statement), Bitsight (statement)
IDC MarketScape: Worldwide Third-Party Risk Management 2026 (doc US53007725)	UpGuard (statement), SAFE TPRM (statement)

Other vendors are also named in these reports; only those in this register are listed. A Leader placement is the analyst’s judgment for its own criteria, not a measure of fit for your program.

How to choose

Start from the evidence you collect
If your program runs on questionnaires and SOC 2 reports, look at assessment-workflow products first. If you need to watch hundreds of vendors you will never send a questionnaire to, security ratings are the cheaper first layer. Most large programs run both.
Count your third parties, then tier them
Pricing is usually per vendor monitored or per assessment. A program with 2,000 suppliers and 60 critical ones buys differently from one with 80 suppliers, all of them reviewed every year.
Name the rules you answer to
Banks answer to the interagency guidance (OCC, Fed, FDIC); EU financial firms to DORA and its register of information; healthcare to HIPAA business associate rules. Ask each vendor to show the report or register the rule asks for, not just a logo.
Check what is already in the building
If you run ServiceNow, Archer, OneTrust or a compliance platform such as Vanta or Drata, its vendor-risk module may be enough. Suite modules win on shared data, specialists on depth.
Read the AI claims closely
Several vendors now say AI reads SOC 2 reports and fills in assessments. Ask what a person still reviews, and whether the model is trained on your vendors’ documents.
Check who will own the product next year
12 products in this register changed hands, or bought a rival, since 2023. Ask about the roadmap and contract terms if a deal is recent.

Questions

What is third-party risk management software?

Software that keeps an inventory of an organisation’s suppliers and service providers, sorts them by how much risk they carry, collects evidence about them (security questionnaires, SOC 2 reports, certificates, outside-in ratings), records findings and fixes, and produces the reports regulators and auditors ask for. Vendor risk management (VRM) software is the same category under another name.

What is the best third-party risk management software?

There is no single answer, and this register doesn’t pick one: every “best TPRM software” list we found is published by a vendor that ranks itself first. Choose by approach first (assessment workflow, security ratings, a GRC-suite module, a compliance platform, or an AI-first tool), then compare what the remaining vendors publish. The register orders products within each approach by how much they publish; it is not a quality ranking.

How much does TPRM software cost?

Most vendors don’t say. In this register 3 of 32 publish a price on their own site and 8 more show a list price on a cloud marketplace; the rest quote on request. The pricing page lists every published figure exactly as written.

What is the difference between TPRM and VRM?

In software, almost none: both names cover the same products, and vendors use them interchangeably. In a program, “third party” is wider: it includes partners, distributors, affiliates and other relationships where nothing is bought, while “vendor” usually means a supplier you pay.

Do I need security ratings as well as questionnaires?

They answer different questions. A questionnaire tells you what a vendor says it does; a rating tells you what can be seen of its internet-facing systems from outside, without asking. Ratings are used to triage large vendor lists and to watch vendors between assessments. See the security ratings page for each vendor’s published scale.

Which TPRM tools include the SIG and CAIQ questionnaires?

In this register 11 products say their library includes the Shared Assessments SIG, and 6 name the Cloud Security Alliance CAIQ. The questionnaires page compares the two and maps their domains.

Want a shortlist instead of a register?

Tell us your size, your rules and what you need checked. We reply by email with the products that fit, from this register. We only pass your details to a vendor if you ask us to.

Get a shortlist

Sources for this page

Each vendor’s own product, pricing, trust-center and press pages — Every fact in the register: 494 source URLs, linked from each entry below.
Acquisition and rename announcements, as linked in the chain of title — Each ownership change; every line links its own announcement.
Board of Governors of the Federal Reserve System, FDIC, OCC: Interagency Guidance on Third-Party Relationships: Risk Management (2023) — The rule US banks answer to, in “How to choose”.
Regulation (EU) 2022/2554 (DORA) — The register of information EU financial entities must keep.

Each product’s own sources are linked from its entry in the register. How products are chosen and ordered, and how to correct an entry: methodology.

Cite this page

Third-Party Risk Management Software. “Third-party risk management software, compared on what vendors publish.” Updated November 8, 2026. https://thirdpartyriskmanagementsoftware.com/