Supplier and vendor security startups: shared supplier assessments, security ratings, and continuous third-party monitoring. Full GRC suites stay on grcplatforms.com.
4 companies · ordered by name · no paid placement · About this category
Boston, United States
Third-party cyber risk intelligence: rates and monitors vendors from outside-in data, flags which ones a new breach or vulnerability touches, and estimates the financial exposure.
Released an MCP server that exposes its third-party cyber risk platform to AI agent workflows, February 2026
New York, United States
Third-party cyber risk platform that combines external attack surface scans with supplier questionnaires, now with a module that prices supplier risk in dollars.
Launched Cyber Risk Quantification to put a dollar value on supplier cyber risk, August 2026
London, United Kingdom
Supplier security as a shared network: each supplier keeps one security profile that every connected customer can see, instead of answering questionnaires one by one.
Raised a GBP 24M Series B led by Axiom Equity, July 2026
Hobart, Australia
Cyber risk platform that started in vendor risk and now covers a company's own attack surface and workforce shadow AI use from one console.
Raised a $75M Series C led by Springcoast Partners, February 2026
Third-party risk is the supplier side of security: the breach that starts at a vendor, a SaaS provider, or a supplier of a supplier.
ISO 27001 (A.5.19 to A.5.22), NIS 2 and DORA all ask companies to manage it, so it belongs on a map of security companies and not only in a GRC suite.
This index maps every company whose primary product assesses, rates, or monitors supplier security. Full GRC platforms stay on grcplatforms.com.
Every entry carries a 2024 to 2026 proof-of-life signal recorded with a source link, and membership is taxonomy from the research pass.
The products here cluster into three shapes. Shared assessment networks let a supplier answer one security assessment and keep it current for every customer connected to it, then map dependencies several tiers deep.
Security ratings platforms score suppliers from external scans of their attack surface and alert when a rating moves or a new breach touches a vendor. Vendor risk workflows automate questionnaires, remediation requests, and loss estimates in money terms.
Several entries now add AI agents that read vendor documents or investigate rating changes.
Security and procurement teams who own supplier assurance, CISOs preparing for NIS 2 or DORA supplier requirements, and investors mapping the independent ratings and assessment field.
Listings are the full live catalog slice for this primary category, sorted alphabetically by name. This is not a scored quality ranking and there is no paid placement. Aevral is a disclosed house listing under the same rules (live, no pin). See /transparency.
4 companies. Catalog last reviewed 2026-08-23. Page copy reviewed 2026-10-19. Next review by 2026-11-19. Ordered by name. No paid placement.