CISO Tribune

Vendor comparison · 2 companies

RegScale vs Thoropass

RegScale sells a Continuous Controls Monitoring platform that connects live cloud telemetry, security tools and CI/CD pipelines to federal and commercial compliance frameworks. Thoropass is a licensed auditor that delivers audits, supported by purpose built software. CISO Tribune files both under Compliance automation and Third-party risk and security ratings. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • RegScale
  • Thoropass
RegScale vs Thoropass: Products, Customers and Funding Compared
RegScaleRegScale sells a Continuous Controls Monitoring platform that connects live cloud telemetry, security tools and CI/CD pipelines to federal and commercial compliance frameworks.regscale.comThoropassThoropass is a licensed auditor that delivers audits, supported by purpose built software.thoropass.com
What it sells
  • RegScale Trust Center[2]A live, customer-facing security portal.
  • OSCAL Hub[2][6][14]An open-source platform for package review and submission.
  • Audit Lifecycle Platform[4][6][11][17][18]A centralized system that manages the audit process from readiness through final reporting.
  • First Pass[11]AI-powered evidence review that runs before evidence reaches the auditor.
  • Smart Sort[11][12][17]Analyzes incoming evidence and maps it to the appropriate audit requirement.
  • Thoropass MCP ServerLets customers use the Audit Lifecycle Platform from AI tools such as Claude or ChatGPT.
  • Thoropass Risk Register[5][16]Reviews and mitigates risk in the same platform used for readiness and audit.
  • Thoropass Trust Center[14]A public-facing portal that shows a customer's compliance posture.
Categories
Headquarters
Not stated on its pagesNew York, United States[3]
Founded
Not stated on its pages2019[2][3]
Ownership and funding
Not stated on its pagesNot stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • June 11, 2026RegScale announced it achieved ISO 27001 certification in under 30 days using its own continuous controls monitoring platform.[3]
  • May 14, 2026RegScale announced an oversubscribed Series B of more than $30 million, alongside growing Fortune 500 and federal adoption.[4]
  • December 16, 2025RegScale launched the OSCAL Hub, an open-source platform for OSCAL security compliance documents, and announced it is donating the source code to the OSCAL Foundation.[14]
  • July 9, 2026Thoropass launched an MCP server that lets customers connect their organizations' AI agents with its Audit Lifecycle Platform.[18]
  • January 29, 2026Thoropass launched Smart Sort AI, a feature in its Audit Lifecycle Platform that turns exports from any GRC tool into audit-ready evidence.[17]
G2 and Gartner Peer Insights
  • G2: listed, seen November 3, 2026[5]
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 4, 2026[10]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, RegScale sells mainly to organizations that need to show compliance with federal and commercial frameworks. RegScale describes Level 2 readiness for defense contractors. RegScale customers include a private equity firm, a major diversified healthcare company of retail pharmacies, health insurance and virtual care services, and a large American government services company. RegScale describes engineers who build via CI/CD, GitOps, and CLI tools alongside GRC officers who work in spreadsheets, and one healthcare deployment ran on-premises.From its own pages, Thoropass sells mainly to organizations pursuing audits and certifications such as SOC 2, ISO 27001, PCI DSS and HIPAA. Thoropass says it serves organizations getting started on a first framework and those looking to maintain a compliance program. Companies with multiple products or environments can organize evidence and controls in the platform. Its pages address healthcare organizations that need HIPAA compliance. Organizations with unique industry or internal frameworks can manage them directly in Thoropass.
Last verified
October 7, 2026November 2, 2026

Where they overlap

  • Compliance automation is the primary category of both RegScale and Thoropass; both are also filed under Third-party risk and security ratings.

Where they differ, field by field

  • RegScale is also filed under GRC and integrated risk platforms.
  • RegScale lists RegScale Trust Center and OSCAL Hub. Thoropass lists Audit Lifecycle Platform, First Pass, Smart Sort, Thoropass MCP Server, Thoropass Risk Register and 1 more.
  • Thoropass is headquartered in New York, United States.
  • Thoropass was founded in 2019.

How they differ

RegScale sells a Continuous Controls Monitoring platform that connects live cloud telemetry, security tools and CI/CD pipelines to federal and commercial compliance frameworks. Thoropass sells an Audit Lifecycle Platform that manages the audit process from readiness through final reporting. Thoropass is also a licensed auditor that delivers audits, supported by purpose built software.

Both companies offer a trust center with NDA gating: RegScale Trust Center is a live, customer-facing security portal, and the Thoropass Trust Center is a public-facing portal that shows a customer's compliance posture. RegScale also sells OSCAL Hub, an open-source platform for package review and submission. Thoropass also sells First Pass, which checks evidence before it reaches the auditor, and a Risk Register that can be set up in a 4×4 or 5×5 configuration. Thoropass is headquartered in New York, United States, and was founded in 2019. RegScale's customers include a private equity firm and a large American government services company, and one healthcare deployment ran on-premises. Thoropass names Cinchy and Elestio among its customer stories.

On May 14, 2026, RegScale announced an oversubscribed Series B of more than $30 million. On June 11, 2026, RegScale announced it achieved ISO 27001 certification in under 30 days using its own platform. On July 9, 2026, Thoropass launched an MCP server that lets customers connect their organizations' AI agents with its Audit Lifecycle Platform. On January 29, 2026, Thoropass launched Smart Sort AI in that platform.

What it sells: RegScale

What RegScale Trust Center does[2]
RegScale Trust Center offers automated NDA gating and self-service compliance artifacts. RegScale Trust Center is powered by live telemetry data.

What it sells: Thoropass

What Audit Lifecycle Platform does[4][6][11][17][18]
The Thoropass Audit Lifecycle Platform combines AI-powered workflow automation, evidence collection, control management and auditor collaboration in one place. The platform is designed to replace fragmented tools like spreadsheets and email chains.
What First Pass does[11]
First Pass checks evidence for common issues such as missing information, inconsistencies and timing problems before it reaches the auditor. It is meant to help teams reduce rework and improve audit readiness.
What Smart Sort does[11][12][17]
Smart Sort analyzes incoming evidence from external systems and maps it to the appropriate audit requirement. It is currently available for customers pursuing SOC 2 Type I or Type II audit cycles.
What Thoropass Risk Register does[5][16]
With the Thoropass Risk Register, customers review and mitigate risk in the same platform they use for compliance readiness and the audit process. The risk dashboard can be set up in a flexible 4×4 or 5×5 risk configuration. Risks are linked back to relevant controls.
What Thoropass Trust Center does[14]
The Thoropass Trust Center is available to all customers as a public-facing portal that shows a customer's compliance posture. Customers control visibility with NDA gating and access requests.

Questions about RegScale and Thoropass

What do RegScale and Thoropass sell?
RegScale sells RegScale Trust Center and OSCAL Hub. Thoropass sells Audit Lifecycle Platform, First Pass, Smart Sort, Thoropass MCP Server, Thoropass Risk Register and 1 more.
Are RegScale and Thoropass in the same category?
Yes. Compliance automation is the primary category of both on CISO Tribune.
Where are RegScale and Thoropass headquartered?
Thoropass is headquartered in New York, United States.
When were RegScale and Thoropass founded?
Thoropass was founded in 2019.
Who are RegScale and Thoropass sold to?
From its own pages, RegScale sells mainly to organizations that need to show compliance with federal and commercial frameworks. From its own pages, Thoropass sells mainly to organizations pursuing audits and certifications such as SOC 2, ISO 27001, PCI DSS and HIPAA.
What have RegScale and Thoropass announced recently?
June 11, 2026: RegScale announced it achieved ISO 27001 certification in under 30 days using its own continuous controls monitoring platform. July 9, 2026: Thoropass launched an MCP server that lets customers connect their organizations' AI agents with its Audit Lifecycle Platform.

About RegScale

RegScale sells a Continuous Controls Monitoring platform that connects live cloud telemetry, security tools and CI/CD pipelines to federal and commercial compliance frameworks. RegScale says its platform gives organizations the speed to see, understand, and react in real time.

RegScale says companies spend months compiling static artifacts while configuration drift and unpatched CVEs expose production systems between audits. RegScale says it connects to live security telemetry 24/7/365 and validates controls continuously against technical reality. RegScale says automated API ingestion pulls evidence continuously, so engineering never pauses development before or during an audit. RegScale stores security packages natively in NIST OSCAL code. RegScale says that when infrastructure changes in GitOps, its System Security Plan updates itself in real time. RegScale delivers Compliance as Code directly into a CI/CD pipeline via native CLI and GitHub Actions. RegScale says regulatory violations fail pull requests before code reaches production.[1]

RegScale says one platform unites continuous monitoring, tool orchestration, and customer-facing trust. RegScale describes its core Continuous Controls Monitoring operating system as housing the multi-framework crosswalk, RegML regulatory AI, a dynamic risk ledger and a native NIST OSCAL dynamic SSP engine. RegScale says continuous monitoring runs across 250+ frameworks, supported out of the box. RegScale describes an automated integration backbone that connects 100+ enterprise cloud environments, cybersecurity scanners, identity providers, and CI/CD pipelines. RegScale runs automated scheduled pulls from CrowdStrike, Tenable, Wiz, Qualys, and more. RegScale Trust Center is a live, customer-facing security portal with automated NDA gating and self-service compliance artifacts. Every RegScale deployment contains six deterministic software engines. RegScale says its universal crosswalk automatically maps real-time telemetry across 250+ frameworks.

For federal programs, RegScale says its compliance management system automates the generation of Plans of Action and Milestones, System Security Plans, Security Assessment Plans, and Security Assessment Reports, all according to OSCAL standards, besides one-click artifact generation for FedRAMP. RegScale says its security team used its own CCM platform to achieve FedRAMP High authorization 3-4x faster than average. RegScale validates Key Security Indicators as compliance as code, running deterministic checks against live infrastructure and returning pass/fail results in real time. OSCAL Hub is an open-source platform that simplifies how Authorizing Officials review packages and how organizations submit them. RegScale says it achieved ISO 27001:2022 in under 30 days using its own platform, and that it earned CMMC Level 2 with its own platform.[1][6]

RegScale addresses third-party risk management through its Continuous Controls Monitoring platform, enabling organizations to assess, monitor, and mitigate risks associated with vendors and partners. RegScale says organizations can automate collection of vendor and partner onboarding questionnaires and use AI to score vendor submissions. RegScale consolidates risk data from all third-party vendors into a single platform. RegScale provides automated risk scoring for third parties. RegScale enables continuous monitoring of third-party risks by integrating with external data feeds and systems. RegScale offers a questionnaire system, procurement system integrations, and assessment capabilities to flow down requirements to vendors. RegScale integrates with DevSecOps workflows, security tools, and GRC systems for managing third-party risks.[1][7]

A government R&D organization implemented RegScale and streamlined issue management and workflows across tens of thousands of systems within weeks. A private equity firm chose RegScale to improve the cybersecurity posture of its portfolio companies through automation and real-time oversight of security and risk. RegScale describes its continuous controls monitoring platform as including governance, risk management, and compliance alongside threat categories, delivered with multi-tenancy. A major diversified healthcare company of retail pharmacies, health insurance, and virtual care services was struggling with fragmented compliance operations. RegScale provided a centralized platform that unified the compliance operations of that healthcare company into a single pane of glass. The healthcare company gained the ability to map common controls across SOC 1, SOC 2, SOX, and HITRUST with RegScale. The platform's compliance and risk modules were deployed in a scalable on-premises configuration for one healthcare deployment.[1][8][10]

Tovuti consolidated its SOC 2 and FedRAMP System Security Plans into a single source of truth with RegScale. A large American government services company needed to maintain and share up-to-date control sets across its three core teams. RegScale provided a centralized platform with a customizable control library, controlled security plan sharing, and a Unified Compliance Framework (UCF) integration for control mapping.[11][12]

RegScale says it was built by risk and compliance veterans who got fed up with GRC busywork that is entirely manual, after the fact, and reactive. RegScale says its AI-powered system plugs into ITIL and DevSecOps workflows. Travis Howerton is Co-Founder and CEO of RegScale.[6][11][13]

RegScale on the record

Sources

RegScale full record

  1. [1]regscale.comRegScale · regscale.com · undated page, accessed October 7, 2026 · Tier A
  2. [2]RegScale | Continuous Controls Monitoring Platform for Cyber ResilienceRegScale · undated page, accessed October 31, 2026 · Tier A
  3. [3]RegScale Achieves ISO 27001 Certification in Under 30 Days Using Its Own Continuous Controls Monitoring PlatformBusiness Wire · published June 11, 2026 · Tier A
  4. [4]RegScale Emerges as Category Leader in AI-Driven Continuous Controls Monitoring, Tripling Revenue as CISOs Abandon Manual GRCBusiness Wire · published May 14, 2026 · Tier A
  5. [5]RegScale Reviews 2026: Details, Pricing, & Features | G2G2 · undated page, accessed October 31, 2026 · Tier C
  6. [6]Accelerate FedRAMP Certification & Compliance with RegScaleRegScale · undated page, accessed November 3, 2026 · Tier A
  7. [7]Faster, Easier Third-Party Risk Management with AI and AutomationRegScale · undated page, accessed November 3, 2026 · Tier A
  8. [8]R&D Org Scales Security and Compliance across 75,000 SystemsRegScale · undated page, accessed November 3, 2026 · Tier A
  9. [9]Private Equity Firm Automates Security and Risk ManagementRegScale · undated page, accessed November 3, 2026 · Tier A
  10. [10]Healthcare Company Centralizes Compliance & Eliminates Manual Tracking | RegScale Customer SuccessRegScale · undated page, accessed November 3, 2026 · Tier A
  11. [11]Tovuti LMS SOC 2 & FedRAMP Compliance Case Study | RegScaleRegScale · undated page, accessed November 3, 2026 · Tier A
  12. [12]Government Services Provider Centralizes Control Management | RegScale Customer SuccessRegScale · undated page, accessed November 3, 2026 · Tier A
  13. [13]RegScale About Us | Taking the Complexity Out of ComplianceRegScale · undated page, accessed November 3, 2026 · Tier A
  14. [14]RegScale Donates Open-Source OSCAL Hub to the OSCAL Foundation to Accelerate the Automation of Security Compliance Across Public and Private SectorsBusiness Wire · published December 16, 2025 · Tier A

Thoropass full record

  1. [1]Readiness and audit in one compliance automation platform - ThoropassThoropass · undated page, accessed September 27, 2026 · Tier A
  2. [2]Thoropass ceo sam li honored by goldman sachs for entrepreneurship excellenceThoropass · thoropass.com · published October 17, 2024 · Tier A
  3. [3]6001423004Thoropass · job-boards.greenhouse.io · undated page, accessed September 27, 2026 · Tier A
  4. [4]AI-powered, expert-led | ThoropassThoropass · undated page, accessed October 29, 2026 · Tier A
  5. [5]The only all-in-one solution for infosec compliance and audits - ThoropassThoropass · undated page, accessed October 29, 2026 · Tier A
  6. [6]Audit Lifecycle Platform | ThoropassThoropass · undated page, accessed October 29, 2026 · Tier A
  7. [7]Augment your experience with service partners - ThoropassThoropass · undated page, accessed October 29, 2026 · Tier A
  8. [8]Save time and money with AWS and Thoropass - ThoropassThoropass · undated page, accessed October 29, 2026 · Tier A
  9. [9]Integrations that streamline your compliance journey - ThoropassThoropass · undated page, accessed October 29, 2026 · Tier A
  10. [10]Thoropass Reviews 2026: Details, Pricing, & FeaturesG2 · undated page, accessed October 29, 2026 · Tier C
  11. [11]AI-Native IT Audits | Thoropass Audit Lifecycle PlatformThoropass · undated page, accessed November 4, 2026 · Tier A
  12. [12]Smart Sort AI: Automated Evidence Mapping | ThoropassThoropass · undated page, accessed November 4, 2026 · Tier A
  13. [13]Thoropass leading the charge on AI-powered technology - ThoropassThoropass · undated page, accessed November 4, 2026 · Tier A
  14. [14]Product Updates - ThoropassThoropass · undated page, accessed November 4, 2026 · Tier A
  15. [15]Thoropass vs. Traditional Audit Firms: A Smarter Way to Compliance | ThoropassThoropass · undated page, accessed November 4, 2026 · Tier A
  16. [16]Efficiently track, analyze, and mitigate risk in one, central platform - ThoropassThoropass · undated page, accessed November 4, 2026 · Tier A
  17. [17]Thoropass Launches Smart Sort AI to Turn Any GRC Export Into Audit-Ready EvidenceThoropass · published January 29, 2026 · Tier A
  18. [18]Thoropass Launches MCP Server to Further Streamline AI-native Audit CapabilitiesThoropass · published July 9, 2026 · Tier A

Spot a factual error? Request a correction.