Governance, risk and compliance

Third-party risk and security ratings

Assessment and monitoring of suppliers' security, including questionnaires and outside-in security ratings.

39 vendors · alphabetical

• AnecdotesAnecdotes sells an enterprise agentic GRC platform that combines core GRC applications, AI agents and data collected automatically from an organization's systems.Ownership not established
• ApptegaApptega sells an end-to-end security and compliance platform for assessments, risk management, third-party oversight and audit readiness.Ownership not established
• ArcherArcher sells a governance, risk and compliance platform that connects enterprise risk, compliance, audit, AI governance, ESG, third-party risk and resilience on shared data and one reporting layer.Ownership not established
• AttaxionAttaxion sells a platform that maps an organization's entire attack surface, identifies critical vulnerabilities and supports remediation with guided next steps and workflows.Ownership not established
• BitsightBitsight delivers a map of assets and vulnerabilities across an enterprise and its supply chain, prioritized by real-time threat intelligence.Ownership not established · primary category
• Black KiteBlack Kite sells an AI-native third-party cyber risk management platform.Ownership not established · primary category
• CoplaCopla is a cybersecurity compliance platform that automates evidence collection, policy management, audit cycles, and control monitoring across frameworks like DORA, NIS2, ISO 27001, SOC 2, and PCI DSS.Ownership not established
• CyberSaintCyberSaint sells CyberStrong, a platform that connects controls, assets, and vulnerabilities to live threat and business data.Ownership not established
• CynomiCynomi describes a Security Growth Platform as one that enables service providers to deliver, scale, and grow security services across their entire client base.Ownership not established
• DrataDrata sells software that helps customers earn and keep trust with continuous compliance, integrated internal and third-party risk, and real-time customer assurance.Ownership not established
• Fortified Health SecurityFortified Health Security is an information security managed services organization dedicated to healthcare.Ownership not established
• HiltHilt sells a platform that maps data movement across cloud and endpoint infrastructure.Ownership not established
• HyperproofHyperproof sells an AI-powered GRC platform that centralizes compliance, risk, and security workflows.Ownership not established
• iCOUNTERIn real time, iCOUNTER detects the active threats targeting a customer's vendors, suppliers, MSPs, SaaS providers, partners, and broader digital ecosystem.Ownership not established · primary category
• KovrrKovrr sells AI and cyber risk, security, and governance solutions to global organizations.Ownership not established
• LogicGateLogicGate sells AI agents and purpose-built applications for governance, risk and compliance.Ownership not established
• MetricStreamMetricStream sells a connected GRC system that automates risk and compliance work with AI assistants and agents.Ownership not established
• OneTrustOneTrust sells software that connects privacy, data, AI, and technology risk in one continuous system.Ownership not established
• OnspringOnspring is a flexible, cloud-based GRC platform that connects and monitors business-critical functions, processes and information.Ownership not established
• OptroOptro sells the GRC Intelligence Platform, which delivers real-time insights, autonomous testing and a connected view for enterprises.Owned by Hg since 2024
• OsanoOsano sells a privacy platform for cookie consent, data subject requests and privacy assessments across 95+ laws.Ownership not established
• PanoraysPanorays sells a platform that detects hidden 3rd to Nth parties, maps their relationships and monitors them for cyber threats.Ownership not established · primary category
• PrevalentPrevalent is third-party risk management software that the company markets as Mitratech Prevalent, a unified, AI-powered product for assessing, monitoring and remediating risk across the vendor and supplier lifecycle.Owned by Mitratech since 2024 · primary category
• Recorded FutureRecorded Future is a threat intelligence company that sells real-time intelligence and autonomous defense.Ownership not established
• RegScaleRegScale sells a Continuous Controls Monitoring platform that connects live cloud telemetry, security tools and CI/CD pipelines to federal and commercial compliance frameworks.Ownership not established
• RiskReconRiskRecon sells vendor security monitoring that is custom-tuned to match a customer's risk policy.Owned by Mastercard · primary category
• Safe SecuritySafe Security sells a single platform that unifies cyber risk management, continuous threat exposure management and third-party risk management.Ownership not established
• Scrut AutomationScrut Automation sells a platform that brings compliance, risk and reporting together for every entity, with role-based access.Ownership not established
• ScytaleScytale sells an AI GRC platform that combines automation, AI agents, continuous monitoring and dedicated GRC experts.Ownership not established
• SecureframeSecureframe sells Secureframe Comply for compliance automation, Secureframe Trust for a Trust Center, knowledge, and questionnaires, and Secureframe Defense for CMMC and defense-oriented secure environments.Ownership not established
• SecurityScorecardSecurityScorecard sells a platform for continuous vendor monitoring, automated assessments and risk intelligence.Ownership not established · primary category
• SOCRadarSOCRadar sells an Extended Threat Intelligence (XTI) platform that organizations use to identify, analyze and mitigate cyber threats.Ownership not established
• SprintoSprinto says compliance often lands on startups with no owner.Ownership not established
• Third Wave InnovationsThird Wave Innovations helps growing businesses understand cyber risk, reduce exposure, stay insurable, and recover when something goes wrong.Ownership not established
• ThoropassThoropass is a licensed auditor that delivers audits, supported by purpose built software.Ownership not established
• UpGuardUpGuard sells tools that move third-party risk monitoring from static snapshots to continuous oversight.Privately held · primary category
• VantaVanta offers automation, continuous monitoring and the Vanta Agent so that organizations get and stay compliant.Ownership not established
• VodafoneVodafone is a telco that sells mobile and internet services, along with financial services, TV, cloud, security, Internet of Things (IoT) and business communications.Ownership not established
• WhisticWhistic sells a platform that includes Assess, Vendor Monitoring, Compliance, and Trust Center, supported by the Trust Center Exchange, Whistic AI, and Automation Orchestrator.Ownership not established · primary category