CISO Tribune

Company record · security vendor

Thoropass

CISO Tribune company record: Thoropass, security vendor (Compliance automation)

Where Thoropass appears on the record (52)

Every page on CISO Tribune and its network that carries this company, 52 in all.

Compared with (50)

vs Anchore, vs Anecdotes, vs Apptega, vs Archer, vs Attaxion, vs Bitsight, vs Black Kite, vs Coalfire, vs ConnectSecure, vs Copla, vs CyberSaint, vs Cynomi, vs DefenseStorm, vs Drata, vs Forte Technologies, vs Fortified Health Security, vs HCLSoftware, vs Hilt, vs Hyperproof, vs ICF, vs iCOUNTER, vs Indurex, vs JupiterOne, vs Knox Systems, vs Kovrr, vs LogicGate, vs MetricStream, vs OneTrust, vs Onspring, vs Optro, vs Osano, vs Panorays, vs Prevalent, vs Recorded Future, vs RegScale, vs RiskRecon, vs Safe Security, vs Scrut Automation, vs Scytale, vs Secureframe, vs SecurityScorecard, vs SOCRadar, vs Sprinto, vs StratoKey, vs Third Wave Innovations, vs UnderDefense, vs UpGuard, vs Vanta, vs Vodafone, vs Whistic

In the vendor directory (2)

What the company sells

Thoropass is a licensed auditor that delivers audits, supported by purpose built software. Thoropass combines in-house auditors with the automation of evidence collection in a single process and place. Thoropass uses AI to map controls, identify gaps and organize evidence in real time.

The Thoropass Audit Lifecycle Platform is a centralized system that manages the entire audit process from readiness through final reporting. The platform combines AI-powered workflow automation, evidence collection, control management and auditor collaboration in one place. The platform is designed to replace fragmented tools like spreadsheets and email chains. The Audit Lifecycle Platform supports customers and auditors throughout the assessment process.

First Pass is Thoropass’ AI-powered evidence review capability, and it checks evidence for common issues such as missing information, inconsistencies and timing problems before it reaches the auditor. First Pass reviews submissions for completeness, consistency and timeliness. Smart Sort analyzes incoming evidence from external systems and maps it to the appropriate audit requirement. Customers upload files or folders into Thoropass, and Smart Sort analyzes each document and recommends it for the relevant evidence request. Smart Sort works with uploaded evidence without requiring a dedicated integration with the system it came from. Smart Sort is currently available for customers pursuing SOC 2 Type I or Type II audit cycles. The Thoropass MCP Server lets customers interact with the Thoropass Audit Lifecycle Platform from AI tools such as Claude or ChatGPT. Thoropass states that it does not believe AI should replace human auditing.

Thoropass is designed to support multi-framework audits such as SOC 2, ISO 27001, PCI, GDPR and HITRUST within a unified process. The platform maps overlapping controls across frameworks to reduce duplicate work. ISO/IEC 27701, NIS 2 Directive, ISO 9001, CMMC Level 2 and CIS Controls v8 are available in the Thoropass platform. Thoropass supports ISO 42001 in its OrO Way offering for multi-framework compliance. Organizations with unique industry or internal frameworks can manage them directly in Thoropass. Certified CPA and HITRUST auditors conduct SOC 2, ISO 27001, HITRUST or HIPAA audits directly within Thoropass.

With the Thoropass Risk Register, customers review and mitigate risk in the same platform they use for compliance readiness and the audit process. The risk dashboard can be stood up in a flexible 4×4 or 5×5 risk configuration. In the Thoropass Risk Register, risks are linked back to relevant controls so customers can review, assign and remediate without leaving the platform. Thoropass provides penetration testing within its platform, to test where an organization needs improvement. Thoropass is a PCI Approved Scanning Vendor (ASV). The Thoropass Trust Center is available to all customers as a public-facing portal that shows a customer's compliance posture.

Thoropass integrations, such as the one with AWS, are vetted and approved by auditors. High-quality data from integrations automatically satisfies evidence requests while powering transparent continuous compliance monitors. Customers connect business tools and apps to Thoropass through auditor-vetted native integrations. Thoropass integrates with a wide range of common business and infrastructure tools to automate evidence collection and reduce manual work. Customers can use consultation, representation and audit services through a vetted ecosystem of service partners.

Thoropass names customers among its stories. Thoropass’ compliance experts conducted gap, risk and readiness assessments for Cinchy and crafted a tailored task list to help it secure ISO 27001 and SOC 2 compliance. Elestio was looking to expand and move up-market in Europe, and Thoropass’s multi-framework approach helped it achieve additional certifications quickly. Sam Li is the CEO of Thoropass.[1][4][5][6][7][8][9][11][12][13][15][16]

Categories
Headquarters
New York, United States[3]
Founded
2019[2][3]
Ownership
Not established from our sources
CISO on record
Not yet on our record. Send a verified source
Website
thoropass.com

Products and services

Product names as the company writes them; what each does, in our words, from the company's own product pages. Never how well it does it.

  • Audit Lifecycle Platform[4][6][11][17][18]

    A centralized system that manages the audit process from readiness through final reporting.

    The Thoropass Audit Lifecycle Platform combines AI-powered workflow automation, evidence collection, control management and auditor collaboration in one place. The platform is designed to replace fragmented tools like spreadsheets and email chains.

  • First Pass[11]

    AI-powered evidence review that runs before evidence reaches the auditor.

    First Pass checks evidence for common issues such as missing information, inconsistencies and timing problems before it reaches the auditor. It is meant to help teams reduce rework and improve audit readiness.

  • Smart Sort[11][12][17]

    Analyzes incoming evidence and maps it to the appropriate audit requirement.

    Smart Sort analyzes incoming evidence from external systems and maps it to the appropriate audit requirement. It is currently available for customers pursuing SOC 2 Type I or Type II audit cycles.

  • Thoropass MCP Server

    Lets customers use the Audit Lifecycle Platform from AI tools such as Claude or ChatGPT.

  • Thoropass Risk Register[5][16]

    Reviews and mitigates risk in the same platform used for readiness and audit.

    With the Thoropass Risk Register, customers review and mitigate risk in the same platform they use for compliance readiness and the audit process. The risk dashboard can be set up in a flexible 4×4 or 5×5 risk configuration. Risks are linked back to relevant controls.

  • Thoropass Trust Center[14]

    A public-facing portal that shows a customer's compliance posture.

    The Thoropass Trust Center is available to all customers as a public-facing portal that shows a customer's compliance posture. Customers control visibility with NDA gating and access requests.

Competitors and alternatives

The other companies on our record filed under the same categories, category by category: first those that lead with that category and share more of Thoropass's categories, then alphabetical. A list from the record, never a ranking.

What review platforms show

The headline rating and review count each platform showed in public search results on the day we looked, with the link. We do not read or reproduce the reviews, and a rating is the platform's, not ours.

  • G2 · 4.7 out of 5[10]seen November 4, 2026

Recent news

Dated company events from the last twelve months, each in one sentence of ours with its source. Newest first.

  • July 9, 2026

    Thoropass launched an MCP server that lets customers connect their organizations' AI agents with its Audit Lifecycle Platform. Thoropass[18]

  • January 29, 2026

    Thoropass launched Smart Sort AI, a feature in its Audit Lifecycle Platform that turns exports from any GRC tool into audit-ready evidence. Thoropass[17]

References

Every fact above cites one of these by number. Tier A is the company itself, a regulator or a filing; tier B is trade or business press.

  1. [1]Readiness and audit in one compliance automation platform - ThoropassThoropass · undated page, accessed September 27, 2026 · Tier A: the company, a regulator or a filing
  2. [2]Thoropass ceo sam li honored by goldman sachs for entrepreneurship excellenceThoropass · thoropass.com · published October 17, 2024 · Tier A: the company, a regulator or a filing
  3. [3]6001423004Thoropass · job-boards.greenhouse.io · undated page, accessed September 27, 2026 · Tier A: the company, a regulator or a filing
  4. [4]AI-powered, expert-led | ThoropassThoropass · undated page, accessed October 29, 2026 · Tier A: the company, a regulator or a filing
  5. [5]The only all-in-one solution for infosec compliance and audits - ThoropassThoropass · undated page, accessed October 29, 2026 · Tier A: the company, a regulator or a filing
  6. [6]Audit Lifecycle Platform | ThoropassThoropass · undated page, accessed October 29, 2026 · Tier A: the company, a regulator or a filing
  7. [7]Augment your experience with service partners - ThoropassThoropass · undated page, accessed October 29, 2026 · Tier A: the company, a regulator or a filing
  8. [8]Save time and money with AWS and Thoropass - ThoropassThoropass · undated page, accessed October 29, 2026 · Tier A: the company, a regulator or a filing
  9. [9]Integrations that streamline your compliance journey - ThoropassThoropass · undated page, accessed October 29, 2026 · Tier A: the company, a regulator or a filing
  10. [10]Thoropass Reviews 2026: Details, Pricing, & FeaturesG2 · undated page, accessed October 29, 2026 · Tier C
  11. [11]AI-Native IT Audits | Thoropass Audit Lifecycle PlatformThoropass · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
  12. [12]Smart Sort AI: Automated Evidence Mapping | ThoropassThoropass · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
  13. [13]Thoropass leading the charge on AI-powered technology - ThoropassThoropass · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
  14. [14]Product Updates - ThoropassThoropass · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
  15. [15]Thoropass vs. Traditional Audit Firms: A Smarter Way to Compliance | ThoropassThoropass · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
  16. [16]Efficiently track, analyze, and mitigate risk in one, central platform - ThoropassThoropass · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
  17. [17]Thoropass Launches Smart Sort AI to Turn Any GRC Export Into Audit-Ready EvidenceThoropass · published January 29, 2026 · Tier A: the company, a regulator or a filing
  18. [18]Thoropass Launches MCP Server to Further Streamline AI-native Audit CapabilitiesThoropass · published July 9, 2026 · Tier A: the company, a regulator or a filing

Last verified November 2, 2026. Our code found the quoted passage behind each fact on its source page when the fact was recorded, and re-checks every record against its sources each month.

Recorded September 27, 2026, expanded November 4, 2026 from the references above.

Work for Thoropass? Suggest a correction to a fact on this page (with a source on your own domain), or claim this entry by publishing a small file on your domain.

Security leadership

CISO Tribune has not yet recorded who holds the top security seat at Thoropass. We add a seat only from a verified source; if you have one, send it to the desk.

Questions CISOs ask about Thoropass

What does Thoropass sell?
Thoropass sells Audit Lifecycle Platform, First Pass, Smart Sort, Thoropass MCP Server, Thoropass Risk Register and Thoropass Trust Center. Audit Lifecycle Platform: A centralized system that manages the audit process from readiness through final reporting. First Pass: AI-powered evidence review that runs before evidence reaches the auditor. Smart Sort: Analyzes incoming evidence and maps it to the appropriate audit requirement. Thoropass MCP Server: Lets customers use the Audit Lifecycle Platform from AI tools such as Claude or ChatGPT.
Who does Thoropass fit?
From its own pages, Thoropass sells mainly to organizations pursuing audits and certifications such as SOC 2, ISO 27001, PCI DSS and HIPAA. Thoropass says it serves organizations getting started on a first framework and those looking to maintain a compliance program. Companies with multiple products or environments can organize evidence and controls in the platform. Its pages address healthcare organizations that need HIPAA compliance. Organizations with unique industry or internal frameworks can manage them directly in Thoropass.
How does CISO Tribune file Thoropass?
CISO Tribune files Thoropass under Compliance automation, with Third-party risk and security ratings as a secondary category.
Where is Thoropass headquartered?
Thoropass is headquartered in New York, United States.
When was Thoropass founded?
Thoropass was founded in 2019.

Related guides