Governance, risk and compliance

Third-party risk and security ratings

Assessment and monitoring of suppliers' security, including questionnaires and outside-in security ratings.

20 vendors · alphabetical, never ranked

• AnecdotesAnecdotes sells an enterprise GRC platform that pairs AI agents with a company's live systems data for governance, risk and compliance work, plus a third-party risk management tool that automates vendor discovery, evidence gathering and reassessment.Ownership not established
• Black KiteBlack Kite, previously named NormShield, sells a third-party cyber risk management platform covering vendor monitoring, AI-powered assessments, cyber event response, financial risk quantification and supply chain risk mapping.Ownership not established · primary category
• DrataDrata sells a compliance automation platform that collects evidence and monitors controls continuously so companies can prepare for and pass security audits, plus a Trust Center for sharing security posture with customers and a third-party risk management tool for assessing vendors.Ownership not established
• HyperproofHyperproof sells a GRC platform with modules for compliance management, risk management, audit management and third-party risk management, plus a FedRAMP-certified version called Hyperproof Gov.Ownership not established
• iCOUNTERiCOUNTER sells CTOS, a platform that detects active threats targeting an organization's vendors, suppliers and other third parties, prioritizing them at the point of intelligence collection.Ownership not established · primary category
• LogicGateLogicGate sells Risk Cloud, a configurable governance, risk and compliance platform used to automate and centralize enterprise risk, third-party risk, cyber risk and compliance programs.Ownership not established
• MetricStreamMetricStream sells a governance, risk and compliance platform with modules for enterprise risk, regulatory compliance, audit, cyber risk, third-party risk and operational resilience.Ownership not established
• OneTrustOneTrust sells a governance platform covering privacy automation, consent and preference management, AI governance, data use policy enforcement, technology risk and compliance tracking, and third-party risk management.Ownership not established
• OptroAuditBoard, the audit, risk and compliance software company, renamed itself Optro in March 2026.Owned by Hg since 2024
• OsanoOsano sells a data privacy management platform covering cookie consent, subject rights request handling, website compliance monitoring, data mapping and vendor privacy risk scoring.Ownership not established
• PanoraysPanorays sells a third-party cyber risk management platform that automatically assesses vendors by combining cyber posture ratings, business impact data and questionnaire responses into a single risk rating, and continuously monitors the external attack surface of an organization's vendors.Ownership not established · primary category
• PrevalentPrevalent sells third-party risk management software that combines AI-powered vendor risk assessments with continuous monitoring and remediation management across onboarding, ongoing oversight and offboarding.Owned by Mitratech since 2024 · primary category
• RiskReconRiskRecon sells a platform that continuously monitors vendors' web presence to produce cybersecurity risk ratings and uses AI-powered questionnaires to speed up third-party risk assessments.Owned by Mastercard · primary category
• Safe SecuritySafe Security sells a cyber risk platform built around two sets of AI agents: a CTEM AI Co-Worker that runs continuous threat exposure management, and a TPRM AI Co-Worker that runs third-party risk management.Ownership not established
• SecureframeSecureframe sells Secureframe Comply, software that automates evidence collection and continuous control monitoring so companies can get and stay compliant with standards such as SOC 2, ISO 27001, HIPAA, PCI DSS and GDPR, and that includes vendor risk management.Ownership not established
• SecurityScorecardSecurityScorecard sells third-party risk management, security ratings, security-questionnaire automation and threat intelligence products for monitoring vendor and supply-chain cyber risk.Ownership not established · primary category
• SprintoSprinto sells a platform that scopes and automates compliance work for standards such as SOC 2, ISO 27001 and HIPAA, monitors controls continuously, and automates vendor risk assessments and AI-tool discovery.Ownership not established
• ThoropassThoropass sells a compliance automation suite that handles policy creation, control monitoring and evidence collection, paired with in-house audit services, penetration testing and a risk register.Ownership not established
• UpGuardUpGuard sells a cyber risk posture management platform covering vendor risk, attack surface monitoring, workforce human risk, trust-page questionnaire automation and risk automations.Privately held · primary category
• WhisticWhistic sells a platform that uses AI agents to analyze vendor evidence and answer security controls, monitor vendor risk changes, run control tests, and publish approved security documentation through a hosted Trust Center.Ownership not established · primary category

No vendor pays to be listed or to change what we write. Descriptions are ours, drawn from each company's own site and filings. Corrections: /corrections.