Executive Summary
Every platform here sends questionnaires and watches vendors between assessments. They differ in where they started: the assessment workflow, an outside-in security rating, or a broader risk or workflow platform.
Third-party risk management (TPRM) software keeps an inventory of the vendors, suppliers and service providers you depend on, assesses each one in proportion to the risk it brings, and monitors it between assessments. Products differ on three points: how assessments are collected and checked, what the product watches between assessments, and who does the work.
Mitratech states that in October 2024 it acquired Prevalent, which it describes as AI-enabled third-party risk management. Mitratech states that Prevalent is purpose-built for TPRM, not a module within a broader GRC solution.
Two products often compared with it start from outside the vendor. Panorays states that it evaluates risk across four areas: AI-powered questionnaires on vendor controls and compliance, external attack surface assessments, inherent risk based on each vendor's business and technology profile, and the customer's own risk policies. UpGuard describes its offering as a holistic TPCRM platform that delivers continuous vendor insights, 360-degree assessments, and efficient AI-powered workflows. Section 3 sets the three side by side, in the vendors' own words.
This guide covers what US bank regulators and the EU's DORA expect of a third-party risk program, what to test in a proof of concept, five approaches to buying, the eight platforms in the table that represent them, and published prices. Program design, the SIG and CAIQ questionnaires and program metrics are covered in the article Third-Party Information Security Risk Management.
What Do Regulators Expect of a Third-Party Risk Program?
In the US, the banking agencies set the reference model. The Federal Reserve, FDIC and OCC state that the joint guidance replaces each agency's existing general guidance on the topic and is directed to all banking organizations they supervise. The Federal Reserve, FDIC and OCC guidance states that effective third-party risk management generally follows a continuous life cycle for third-party relationships. The Federal Reserve, FDIC and OCC guidance divides its Third-Party Relationship Life Cycle section into planning; due diligence and third-party selection; contract negotiation; ongoing monitoring; and termination.
The Federal Reserve, FDIC and OCC state that a banking organization's use of third parties does not diminish its responsibility to meet these requirements to the same extent as if its activities were performed by the banking organization in-house. The Federal Reserve, FDIC and OCC guidance states that a banking organization analyzes the risks associated with each third-party relationship and adjusts its risk management practices, commensurate with its size, complexity, and risk profile and with the nature of its third-party relationships. In practice, the depth of each assessment follows a risk tier set when the vendor is first taken on.
The Federal Reserve, FDIC and OCC guidance states that maintaining a complete inventory of third-party relationships and periodically conducting risk assessments for each one supports a banking organization's determination of whether risks have changed over time. The Federal Reserve, FDIC and OCC record that various commenters emphasized the importance of managing risks posed by subcontractors, including those with access to sensitive, nonpublic information and those within extended chains of subcontractors. Ask each vendor how its product records fourth parties, and whether it learns about them from the vendor's answers, from an outside scan, or both.
In the EU, financial entities answer to DORA. EIOPA states that the Digital Operational Resilience Act (DORA) is an EU regulation to strengthen the digital resilience of financial entities, and that it entered into application on 17 Jan 2025. EIOPA states that DORA applies to 20 different types of financial entities and ICT third-party service providers.
Outside banking, supply chain guidance comes from NIST. NIST states that the publication provides guidance to organizations on identifying, assessing, and mitigating cybersecurity risks throughout the supply chain, and integrates cybersecurity supply chain risk management (C-SCRM) into risk management activities. NIST has published a fillable version of the SCRM Assessment Scoping Questionnaire (Table 26).
How Do Assessment-Led and Scan-Led Platforms Compare?
An assessment-led product starts from the questionnaire and the evidence behind it. Mitratech describes Prevalent as an AI-powered third-party risk management (TPRM) solution that helps organizations assess, monitor, and remediate risks across the vendor and supplier lifecycle, from onboarding to offboarding. Mitratech states that with Prevalent's AI FastTrack Assessment, organizations can upload up to 15 prior completed vendor assessments in any format, and the solution automatically populates a new questionnaire. Mitratech states that with Prevalent it provides access to a vendor intelligence network with pre-built vendor risk profiles and continuous monitoring data, and that customers also have access to expert-managed services to help build, optimize, and scale their TPRM programs.
A scan-led product starts from what it can see of the vendor from outside, and checks answers against it. Panorays states that it validates questionnaire responses by comparing them with vendors' external documents and cyber posture assessments. Panorays states that within hours it tests the security posture of hundreds of assets across third parties' external attack surfaces, highlighting gaps and suggesting remediation steps.
UpGuard states that it offers a library of questionnaires, including ISO, NIST, SIG, DORA, HIPAA and CPS230, and a builder for custom questionnaires. UpGuard states that its daily scans and curated threat feeds surface exposures, misconfigurations, CVEs, and security incidents as they appear. UpGuard states that customers can partner with an UpGuard analyst, a designated analyst allocated to their security team to manage vendor assessments.
These are the vendors' own descriptions, not test results. To compare them, give each finalist the same twenty vendors, including some you have already assessed, and compare what each product finds, what it asks each vendor, and how long each assessment takes.
| If you need | Look at | Why |
|---|---|---|
| Assessments across cyber, financial, sanctions and reputational risk | A purpose-built TPRM application with broad monitoring sources | One risk record per vendor across risk types |
| A view of vendors that will not answer questionnaires | A product that scans each vendor's attack surface from outside | A first reading of risk before any vendor replies |
| Questionnaire answers checked against evidence | Products that compare answers with outside scans and uploaded documents | Fewer answers accepted at face value |
| Assessments done without adding staff | Vendors that sell analyst or managed assessment services | Outside analysts collect documents and chase vendors |
What Should You Test in a TPRM Platform?
Start with the questionnaire library. The Cloud Security Alliance states that the STAR Level 1: Security Questionnaire (CAIQ v4.1) provides a set of Yes/No questions a cloud consumer and cloud auditor may wish to ask of a cloud provider to ascertain their compliance to the Cloud Controls Matrix (CCM). Ask which standard questionnaires come built in, whether you can weight questions, and whether a vendor can answer once and share the answer with many customers.
Then test evidence review. ProcessUnity states that Evidence Evaluator analyzes vendor documentation, maps evidence to controls, and directs analysts to the exact page and section where support is found. Bitsight states that its Vendor Risk Management accelerates onboarding with AI-automated assessments mapped to SIG Lite, NIST CSF 2.0, HECVAT, CIS, TISAX, CMMC and more. Upload three SOC 2 reports and a completed questionnaire for a vendor you know well, and check which controls the product marks as met or failed, and whether it cites the page it relied on.
Test outside-in monitoring on vendors you know. Bitsight states that it is committed to the "Principles for Fair and Accurate Security Ratings." Ask which signals feed each rating, how often the product rescans, and how a vendor disputes a finding.
Check fourth-party discovery. Ask how the product finds your vendors' own suppliers: from questionnaire answers, from outside scans of the technology a vendor uses, or both. Ask how it tells you which of your vendors are exposed when one of those suppliers is breached.
Finally, test the workflow from intake to offboarding. Panorays states that it generates remediation tasks automatically from questionnaire responses and external assessments, assigns priorities and deadlines, and tracks progress in one consolidated view. Check the integrations with the procurement, contract and GRC systems you already run.
| Capability | What it does | Buyer translation |
|---|---|---|
| Inventory and intake | Records each vendor, its owner and the service it provides | Do we know every third party we depend on? |
| Inherent risk tiering | Scores each vendor by data access, criticality and spend before any assessment | Which vendors need a full assessment, and which a light one? |
| Questionnaires | Sends standard or custom questionnaires and tracks responses | Can vendors answer in the formats they already use? |
| Evidence review | Maps SOC 2 reports, certifications and policies to controls | Are answers checked, or taken on trust? |
| Outside-in monitoring | Scans each vendor's internet-facing assets and watches for breaches | Will we hear about a vendor incident before the vendor tells us? |
| Fourth-party discovery | Finds the suppliers your vendors depend on | Which of our vendors share one cloud or software supplier? |
| Remediation | Turns findings into tasks with owners and deadlines | Do gaps get closed, or only recorded? |
| Reporting | Summarizes portfolio risk for executives, auditors and regulators | Can we show oversight on request? |
Vendors in Third-Party Risk Management (TPRM)
Representative vendors include Bitsight, OneTrust, Panorays, Prevalent / Mitratech, ProcessUnity, SecurityScorecard, ServiceNow TPRM (Third-party Risk Management) and UpGuard. The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors
The approaches below follow where each product started: an assessment workflow, a broader risk or workflow platform, or an outside-in security rating. Three of the five approaches hold two platforms each.
A purpose-built TPRM application runs the vendor lifecycle as its only job. ProcessUnity states that instead of adding point tools onto a fragmented process, it unifies the entire third-party risk lifecycle on one platform. ProcessUnity states that the Global Risk Exchange is powered by 18,000+ control attestations, 370,000+ vendor profiles, predictive analytics, and firmographic and technographic data. ProcessUnity describes ProcessUnity Risk Index as a risk rating that combines internally informed control data with externally observed risk signal. ProcessUnity states that ProcessUnity and its investors acquired CyberGRX, whose existing shareholders retained a minority stake. Mitratech states that Vendor Threat Monitor, Prevalent's continuous monitoring engine, draws on more than 30,000 adverse media and news sources, over 1.8 million politically exposed person profiles, and more than 1,000 enforcement and sanctions lists, covering financial health, cyber security, ESG, regulatory actions, and reputational signals.
A module of a privacy and GRC suite shares records and workflows with the rest of the suite. OneTrust states that its Third-Party Risk Management product manages and automates the end-to-end third-party lifecycle, including onboarding, assessment, risk treatment, reporting, monitoring, and offboarding. OneTrust states that its Third-Party Risk Exchange gives access to cybersecurity risk ratings from SecurityScorecard, RiskRecon, and HackNotice. OneTrust states that customers can screen, assess, and monitor third parties for ethics and compliance risks with access to databases from Dow Jones.
A module of an enterprise workflow platform runs third-party risk beside the platform's other workflows. ServiceNow states that Third-party Risk Management centralizes vendor risk in one system, automates assessments, monitors vendor changes, and routes remediation tasks to the right teams. ServiceNow lists due diligence among the use cases for Third-party Risk Management, automating due diligence across the full vendor lifecycle. ServiceNow states that the ServiceNow AI Platform unites AI agents, data, and workflows on one enterprise-grade platform.
A security ratings company scores vendors from outside and has added TPRM workflow. Bitsight states that it created the security ratings category in 2011, replacing self-reported controls and point-in-time assessments with an objective, continuous view of cyber risk. Bitsight states that it monitors 40M+ companies and has a network of 75K+ vendor profiles. Bitsight states that Bitsight Continuous Monitoring delivers daily insight into vendors and their vendors, including automatic fourth-party discovery that maps vendors' technology stack. SecurityScorecard states that other vendors pair a data source with a separate workflow platform, while TITAN AI owns the data and runs the workflow natively. SecurityScorecard states that its TITAN Watch package includes scorecards for monitored organizations, custom questionnaire management, and automated identification of third and fourth parties.
An attack surface scan combined with questionnaires puts both in one product, sold mainly to security teams. UpGuard states that its checks feed a proprietary rating algorithm that produces a security rating out of 950 for an organization's internet-facing web properties. Panorays states that Panorays AI uncovers hidden third-, fourth-, and nth-party relationships, giving a single, consolidated view of risk.
Threat intelligence is also sold for third-party risk. Recorded Future states that it was founded in 2009 and acquired by Mastercard in 2024. Recorded Future states that Recorded Future Third-Party Risk monitors a vendor portfolio continuously and surfaces ransomware extortion mentions, breach disclosures, credential leaks, and exposed infrastructure as they happen. Recorded Future states that its third-party risk product feeds vendor scores, alerts, and supporting evidence into TPRM and GRC platforms for intake, assessment, and reassessment workflows.
| Vendor | Approach | Where it fits |
|---|---|---|
| Panorays | Attack surface scan with questionnaires | Risk DNA from questionnaires, attack surface tests and business impact; Nth-party discovery |
| UpGuard | Attack surface scan with questionnaires | Rating out of 950; questionnaire library; analyst services; published price |
| OneTrust | Module of a privacy and GRC suite | Lifecycle workflows; risk ratings from SecurityScorecard, RiskRecon and HackNotice; Dow Jones screening |
| ServiceNow TPRM (Third-party Risk Management) | Module of an enterprise workflow platform | Vendor risk, assessments and remediation on the ServiceNow AI Platform |
| Prevalent / Mitratech | Purpose-built TPRM application | Assessments plus monitoring of cyber, financial, sanctions and reputational sources; expert-managed services |
| ProcessUnity | Purpose-built TPRM application | Global Risk Exchange data and Risk Index; AI agents with cited evidence |
| Bitsight | Security ratings with TPRM workflow | Security ratings since 2011; fourth-party discovery; 75K+ vendor profiles |
| SecurityScorecard | Security ratings with TPRM workflow | TITAN AI with Watch, Assess and Secure packages; free scorecard access |
Eight platforms across five approaches; three approaches hold two platforms each. The approaches were set before any platform was chosen, and the eight rows are the platforms the previous edition of this guide evaluated. A place in this table cannot be bought. Recorded Future, named above, and other third-party risk vendors can make their own case in the Spotlight below.
How Is TPRM Software Priced?
Most TPRM products are priced by the number of vendors monitored or assessed, with modules, users and services on top. Count your vendors by risk tier before you ask for quotes, and ask how a vendor that leaves the program mid-term is counted.
Published list prices are rare. UpGuard lists its Standard plan at $1,750 a month, billed annually, to monitor 50 vendors, with additional vendors at $79 a month.
Free access and usage meters. SecurityScorecard states that there is no limit to the number of users that can access an organization's free scorecard. SecurityScorecard states that the primary factor in the price of its products is usage, measured by the number of organizations a customer would like to monitor and manage within the platform.
Quotes by scope. Panorays states that its pricing is based on the customer's security risk strategy and the types of assessments required. Where a vendor in the table publishes no price, the price is a quote. All prices are US list prices as published when this guide was checked in November 2026.
| Meter | You are charged for | Grows with | Where it goes wrong |
|---|---|---|---|
| Monitored vendors | Each vendor watched by outside scans or ratings | Vendor count | Subsidiaries and domains counted as separate vendors |
| Assessed vendors | Each vendor taken through a questionnaire and evidence review | Vendors in the higher risk tiers | Reassessments counted as new assessments |
| Modules | Monitoring, contract, ESG or due diligence add-ons | Risk types in scope | Screening data sold separately from the workflow |
| Services | Analysts who run assessments for you | Assessments outsourced | Hourly or per-assessment fees that outgrow the license |
How long does implementation take for Third-Party Risk Management (TPRM)?
Most of the work is building the vendor inventory and agreeing the risk tiers. Agree both with procurement, security and the business owners before the first questionnaire goes out.
Load every vendor from accounts payable, procurement and contract records. Record an owner and the service each vendor provides, and remove duplicates.
Score inherent risk from data access, system access, criticality and spend. Set the assessment depth and the review frequency for each tier.
Start with the critical tier. Collect existing SOC 2 reports and completed questionnaires before sending new ones, and track remediation with owners and dates.
Turn on outside monitoring for every tier. Add the moderate tier to assessments, connect procurement intake so new vendors enter the program before contract, and report to the board each quarter.
What should you ask vendors about Third-Party Risk Management (TPRM)?
Ask each vendor to answer in writing and to demonstrate on vendors from your own portfolio.
-
Does your program assess vendors on financial, sanctions or ethics risk as well as cyber risk?Yes Shortlist purpose-built TPRM applications and GRC suite modules with those data sources.No Include security ratings and attack surface products, and test their questionnaire workflow.
-
Do you already run a GRC or workflow platform with a third-party module?Yes Test that module against one standalone product before buying a second system.No Weight integrations with procurement and contract systems.
-
Can your team run every assessment in-house?Yes Weight automation of evidence review and questionnaire scoring.No Price managed assessment services alongside the software.