T-NEX
Menu
DEEN
GRC provider register · Category 8 of 11 · Part 2 of 2

GRC software for third-party risk, N to Z:
22 providers with AI classification.

In short: Part 2 of 2 of the Third-party risk category: full entries for 22 of the 55 providers, alphabetically from N to Z, as of 18 October 2026. Of these, 21 document specific AI functions (95%). In Germany, Austria or Switzerland, two have a documented headquarters, one of them in Germany.

By and Published: As of: · Subpage of the GRC provider register Reviewed by Andreas Unruh and Christoph Gembruch, managing directors of T-NEX GmbH, on
Illustration: globe with networked GRC providers whose AI evidence flows into a checked provider register

Neither completeness nor a general suitability for banks is claimed. Providers are listed alphabetically. The order is not a performance rating.

All 682 GRC providers in the market overview · 379 European GRC providers · Third-party risk category page (55)

Publisher: T-NEX GmbH. Andreas Unruh and Christoph Gembruch are managing directors of T-NEX. This editorial market overview is based on vendor sources and specialist primary sources. It contains no ranking and is not based on a joint product test. The market overview covers 682 providers from GRC and adjacent specialist areas. Acquired brands and former product names are not counted separately. Methodology and sources

Context, figures, review questions and the regulatory framework are on the Third-party & supply chain risk category page.

Entries from N to Z: functions, AI classification and sources.

The assignment describes the offering considered, not all of the company's products. AI information names specific functions or limits of the public documentation. Scope of delivery, data storage and regional availability must be checked for each offering. Download provider overview as CSV (German), licensed under CC BY 4.0, credit “T-NEX GRC-Anbieterregister, t-nex.de”.

Is a provider missing or an entry out of date? Send us a note with a source via the contact form. Accepted changes are marked in the entry with the date they were checked.

Third-party & supply chain risk: N to Z

22 entries

Third-party & supply chain risk · N to Z · 22 providers
Provider / productDocumented focusAI functions and classification
Neotas · Product: Automated Due Diligence · Headquarters: United Kingdom [1] · Neotas Limited, Coppergate House, 10 Whites Row, London. · Neotas LimitedDocumented focus: Self-service software for customer and third-party checks drawing on sanctions, PEP data, media, registers and other public sources. Editable reports contain source references and audit trails.AI functions and classification: AI confirms the subject under investigation, cleans up mismatches and duplicates and condenses parallel research into a risk-flagged report. The platform allows the choice of the AI model used.[2] [1] · Specific AI functions documented
Consolidate due diligence research · Clean up mismatches · Create evidenced risk reports
AI evidence: [2] · Self-service reports and a free first report offered; in-depth analyst-led investigations are separate from this.
Source check: 2026-10-15
OPEN / RoboRobo · Product: RoboRobo Compliance Check · Headquarters: Japan [3] · Seller and operator オープン株式会社 (OPEN, Inc.), Tokyo, explicitly named in the statutory seller disclosure. · OPEN, Inc.; オープン株式会社; RoboRoboコンプライアンスチェックDocumented focus: Cloud software for compliance checks of business partners based on adverse media, register and supplementary database information. Manages check results, business decisions and exportable evidence.AI functions and classification: AI ranks articles found by level of attention required; generative AI summarises conspicuous articles and LLM analysis assesses their risk level for the subject-matter decision.[4] [5] [3] [6] · Specific AI functions documented
Prioritise adverse media · Summarise conspicuous articles · Assess article risks for partner checks
AI evidence: [4] [5] · Commercial cloud service with free trial. Additional databases and API connection are separate options; AI functions documented on current product pages.
Source check: 2026-10-15
Orbiq · Product: Vendor Assurance · Headquarters: Germany [7] · Orbiq GmbH, Hamburg, HRB 192841 according to the legal notice. · Orbiq GmbH; Orbiq Vendor AssuranceDocumented focus: Supplier assessment with questionnaires, evidence, assessment histories and ongoing monitoring for security and compliance teams.AI functions and classification: AI suggests control-related questions and evaluates answers based on supplier criticality. It flags contradictions and changes compared with earlier answers and creates reasoned assessment reports for approval.[8] [7] · Specific AI functions documented
Prepare supplier questionnaires · Detect contradictions in answers · Draft assessment reports
AI evidence: [8] · Product page offers a demo. Questionnaires, analysis and monitoring are described as modular; confirm the specific licence and subject-matter approvals.
Source check: 2026-10-15
Panorays · Product: Panorays Third-Party Cyber Risk Management · Headquarters: USA / Israel [9] · Current vendor information: headquarters in New York and Israel. The terms and conditions name Panorays Ltd. and affiliated companies; the specific contracting company may depend on the contract. Headquarters not derived from the choice of law alone. · Panorays Ltd.; Panorays TPCRMDocumented focus: Panorays combines supplier questionnaires, security evidence, external observations and business criticality in a single process for assessing third-party risks. Teams can classify suppliers, verify information, agree on measures and track changes. The platform supports collaboration with suppliers as well as the documentation of assessments for those responsible for security, compliance and procurement.AI functions and classification: Panorays describes NLP for checking supplier answers against documents, certifications and evidence. AI also suggests questionnaire answers from existing assessments and researched information; an ML model supports risk classification.[10] [11] [9] [12] · Specific AI functions documented
Check supplier answers against evidence · Suggest questionnaire answers · Classify supplier risks with AI support
AI evidence: [10] · Documented by the vendor; agree licence and configuration scope. No product test.
Source check: 2026-10-14
Prewave · Product: Supplier Risk Management / Action Platform · Headquarters: Austria [13] · The vendor explicitly names Vienna, Austria as headquarters; the legal notice had little content for technical reasons when currently retrieved, so the official company announcement is used as evidence.Documented focus: Combines the detection of supplier risks with measures and collaboration with suppliers. Supports the documentation of due diligence.AI functions and classification: Prewave describes specialised AI models for analysing and classifying external risk events. Events are matched against supplier locations and prioritised by severity and dependency; experts review the results.[14] [15] · Specific AI functions documented
Classification of risk events · Matching against supplier locations · Prioritisation of risk alerts
AI evidence: [15] · Documented by the vendor; no product test.
Source check: 2026-10-14
ProcessUnity TPRM PlatformDocumented focus: Third parties from request to offboarding with shared records, assessments and monitoring.AI functions and classification: Assessment Autofill creates draft answers for supplier questionnaires from existing risk and compliance documents. Evidence Evaluator supports the analysis of evidence for control reviews. Suppliers and analysts review the results in the respective assessment workflow.[16] [17] [18] · Specific AI functions documented
Draft answers for supplier questionnaires · AI-supported evidence analysis
AI evidence: [17] [18] · Documented by the vendor in TPRM Platform and Global Risk Exchange; suppliers review the drafts before submission. Licence scope not fully established; no product test.
Source check: 2026-10-14
Rescana · Product: Rescana Vendor Risk Management · Headquarters: Israel [19] · The privacy policy names Rescana Ltd., registration number 515442077, with an address in Tel Aviv, Israel. · Rescana Ltd.Documented focus: Rescana combines supplier identification, risk assessment, continuous monitoring and tracking of measures. The GRC relevance lies in particular in documented third-party reviews, control assessments and reports.AI functions and classification: The AI agents described collect supplier documents, analyse questionnaires and check information against external risk intelligence. Contract reviews identify missing security provisions; further agents coordinate requests for additional information and escalations.[20] [19] · Specific AI functions documented
Analyse supplier documents and questionnaires · Detect contractual security gaps · Support follow-up requests and risk reports
AI evidence: [20] · Demo access offered; the vendor describes enterprise deployments. Check AI results and automated follow-up steps against your own approval processes.
Source check: 2026-10-15
Resilinc · Product: Agentic AI Supply Chain Risk Platform · EventWatch and RiskShield are product names.Documented focus: Monitors risks relating to suppliers, sites and materials. Combines events and compliance risks with assessments and coordinated measures.AI functions and classification: Resilinc EventWatchAI detects supply chain disruptions from news and other event sources. NLP and generative AI classify and explain relevant events; the platform also describes AI-supported recommendations on possible countermeasures.[21] [22] [23] [24] · Specific AI functions documented
Identify events with supply chain risks · Summarise and classify event research · Suggest risk mitigation options
AI evidence: [23] [22] · Documented as an available provider offering in the Microsoft Marketplace; scope depends on the product and the integration. No product test.
Source check: 2026-10-14
Risk Ledger · Headquarters: United Kingdom [25] · Risk Ledger Ltd.; Companies House 10831970, registered office Adam House, 7–10 Adam Street, London. The provider policy names Risk Ledger Ltd. as the responsible company. Geography checked on 15.10.2026; hosting or ownership not derived from the registered office.Documented focus: Network for supplier assessments with a shared question framework, evidence, approvals and visibility of further supply chain tiers.AI functions and classification: Risk Ledger documents AI-generated supplier summaries from completed assessments. They consolidate the risk profile and compliance information and suggest next review steps.[26] [27] [25] [28] · Specific AI functions documented
Summarise supplier assessments · Suggest next steps in the supplier review
AI evidence: [27] · Documented in the vendor changelog since July 2026; activation via Customer Success or support. No product test.
Source check: 2026-10-14
S&P Global · Product: KY3P · IHS Markit KY3P; TruSightDocumented focus: Offers processes for the entire third-party life cycle. Supports control assessments, due diligence and the review of cyber risks and resilience.AI functions and classification: Agentic AI for due diligence has been announced for KY3P: it is intended to compile customer data, monitor profiles for material changes and trigger reviews. This does not yet evidence an available AI work step in KY3P.[29] [30]Announced or in development
Compile data for due diligence (announced) · Monitor profile changes and trigger reviews (announced)
AI evidence: [30] · AI KYC and due diligence, including KY3P connection, are explicitly on the roadmap. No documented available pilot; no product test.
Source check: 2026-10-14
SAFE Security · Product: SAFE One / TPRM AI Co-Worker · Headquarters: USA [31] · SAFE; Lucideus; RiskLens; BalbixDocumented focus: SAFE Security combines supplier review, risk assessment and tracking of measures with a platform for cyber risks. The TPRM area runs from onboarding a supplier via questionnaires and evidence to approval and ongoing monitoring. Findings are linked to business impacts and remediation measures; status and communication remain traceable in the review history.AI functions and classification: Documented agents analyse policies, audit reports and attestations, check questionnaire answers against standards and flag gaps. The TPRM AI Co-Worker also supports remediation with evidence and guidance on actions. Marketing claims of complete autonomy were not adopted as verified in practice.[32] [31] [33] [34] [35] [36] · Specific AI functions documented
Analysis of supplier evidence · Matching of questionnaire answers · Support for remediation measures
AI evidence: [32] · Documented by the vendor; not tested in practice.
Source check: 2026-10-14
Sayari · Product: Sayari Pilot / Mirato TPRM · Headquarters: USA [37] · The company's own job advertisement explicitly names Washington, D.C., as headquarters; the contact page confirms the US office and further international locations. · Sayari Labs; Sayari Labs Inc.; Mirato; Sayari Pilot; Mirato TPRMDocumented focus: Sayari combines corporate and ownership data with review workflows for third-party risks. Pilot supports screening, document analysis and ongoing supplier assessments. Mirato's TPRM technology, acquired in 2026, is managed within the same provider group.AI functions and classification: Pilot uses AI to extract information from complex documents and maps it to company-specific risk controls. The platform combines screening, evidence analysis and risk assessment with source references and escalation. More advanced functions of the Pilot Superagent have been announced separately as the next development stage.[38] [39] [40] [37] · Specific AI functions documented
Analyse supplier documents for risk information · Map evidence to your own control requirements · Support third-party assessments with a documented audit trail
AI evidence: [38] · Pilot is offered with specific functions and demo access. Pilot Superagent, autonomous investigation workflows and the Regulatory Co-Pilot are listed under “Coming Next” and are not counted as functions already available.
Source check: 2026-10-15
Schwarzthal Tech · Product: Wunderschild / Know Your Network · Headquarters: United Kingdom [41] · Schwarzthal Tech Ltd, Devonshire House, 582 Honeypot Lane, London. · Schwarzthal Tech Ltd; Wunderschild; Know Your Network; KYNDocumented focus: Software for network-based checks of customers, contacts and business partners. Connections, data sources and potential financial crime risks are brought together into a single picture.AI functions and classification: Machine learning supports network assessments, data linking and the aggregation of relationships. Entity resolution links information on persons and companies even where there are multiple name variants.[42] [43] [41] · Specific AI functions documented
Analyse business partner networks · Link personal and company data · Investigate hidden risk connections
AI evidence: [42] [43] · The provider documents software and a use case; commercial deployment and data scope are to be clarified on request.
Source check: 2026-10-15
Scrioo · Product: Supplier / Third-Party Intelligence · Headquarters: Luxembourg [44] · Scrioo S.à r.l., Grevenmacher, Luxembourg; company address in the vendor footer. · Scrioo S.à r.l.Documented focus: Software for due diligence and ongoing monitoring of suppliers and other business partners based on public and supplementary data sources.AI functions and classification: AI agents check and compare external signals and prepare their relevance for the assessment of business partners. The results support prioritised handling of risks.[45] [44] · Specific AI functions documented
Analyse business partner signals · Prioritise external risk indicators
AI evidence: [45] · Platform access, pricing and demo offerings available. Check data coverage, historical look-back and optional data sources in the contract.
Source check: 2026-10-15
SecurityPal · Product: Vendor Assess / Vinny · Headquarters: USA [46] · SecurityPal AI; Vendor Assess; VinnyDocumented focus: With Vendor Assess, SecurityPal supports the structured assessment of suppliers. Companies define the depth of review and risk criteria and receive reports with findings, ratings and recommended measures. A central repository keeps evidence and assessment results together. The software combines automated work steps with additional review by experts where the case in question requires it.AI functions and classification: The AI agent Vinny researches suppliers, collects and analyses security and compliance documents, maps findings to frameworks and creates TPRM reports. The product description supplements this workflow with risk-based human review; results were not verified in practice.[47] [46] · Specific AI functions documented
Supplier document analysis · Framework mapping · TPRM report drafts
AI evidence: [47] · Documented by the vendor as a combination of platform, AI agent and managed supplier review; certified analysts support in-depth reviews and provider communication. Not tested in practice.
Source check: 2026-10-14
SecurityScorecard TITAN AI · Product: TITAN AI; TITAN Assess; HyperComply · SecurityScorecard; TITAN AI; TITAN Assess; HyperComply; RespondAIDocumented focus: SecurityScorecard combines security ratings, supplier assessments and continuous monitoring of third-party risks. Evidence, questionnaires and measures support assessment and collaboration with suppliers. HyperComply has belonged to the provider group since the acquisition completed in September 2025 and is counted together here; the scope of integration remains product-dependent.AI functions and classification: SecurityScorecard TITAN AI describes AI for checking supplier statements against evidence, extracting SOC 2 content and prioritising third-party risks.[48] [49] [50] · Specific AI functions documented
Check supplier statements and questionnaire answers against evidence · Extract details from SOC 2 reports · Prioritise third-party risks and remediation steps
AI evidence: [48] · Documented by the vendor in the TITAN AI platform, in particular TITAN Assess; no product test.
Source check: 2026-10-14
ShieldByte Infosec · Product: ShieldRisk AI · Headquarters: India [51] · ShieldByte Infosec lists Mumbai, India, as headquarters. The ShieldRisk contact page names ShieldByte Infosec Pvt. Ltd. as provider; product and vendor are counted only once. · ShieldByte Infosec Pvt. Ltd.; Shieldbyte Infosec Private Limited; ShieldRisk; ShieldRisk AI; ShieldRisk TPRMDocumented focus: ShieldRisk supports third-party risk management with supplier onboarding, questionnaires, assessment dimensions, control mapping, evidence storage and reports. Data protection, business continuity and regulatory risks are part of the assessment scope presented.AI functions and classification: The product page describes AI models that update risk scores based on supplier answers, threat intelligence and reassessments. The vendor assigns this function to its ongoing third-party risk process.[52] [53] [51] · Specific AI functions documented
Assess supplier risks with AI support · Update risk scores based on new information · Prioritise third-party assessments
AI evidence: [52] · SaaS platform with demo and sign-up offering. Confirm available assessment models, data sources and configuration in the specific product access.
Source check: 2026-10-15
Supply Wisdom · Product: Continuous MonitoringDocumented focus: Monitors suppliers and locations for financial, operational, cyber, compliance and ESG risks. Supports the ongoing detection of changes.AI functions and classification: Supply Wisdom describes AI-supported analysis of public data on third-party and location risks. This produces context-based risk alerts and up-to-date information for assessing new and existing suppliers.[54] [55] [56] [57] · Specific AI functions documented
Analysis of public third-party risk signals · Context-based supplier and location alerts · Support for supplier assessments
AI evidence: [56] [57] · Documented by the vendor; no product test.
Source check: 2026-10-14
UpGuard Vendor Risk · To the detailed profile Documented focus: Assess and monitor third parties: security profiles, questionnaires, evidence, controls and measures in one workflow.AI functions and classification: Vendor Risk analyses security documents, maps findings to control requirements and creates risk-related draft reports. Source citations show the basis of the assessment; analysts can comment on or correct results.[58] [59] · Specific AI functions documented
Map document findings to controls · Draft risk reports · Trace assessments with source citations
AI evidence: [59] · Documented by the vendor for Vendor Risk; check scope of services and pricing in the specific offer. Human correction provided for; no product test.
Source check: 2026-10-14
Vendorica · Product: Vendorica / MCP Server · Headquarters: Lithuania [60] · Pillar labs, UAB, Vilnius, Lithuania, company code 308103902. · Pillar labs, UAB; VendoricaDocumented focus: DORA-oriented supplier and evidence management with documented connection of external AI assistants. AI processing takes place in the connected tool, not in a proprietary Vendorica language model documented here.AI functions and classification: The MCP server provides organisation-specific data on controls, supplier risks and evidence. Connected AI agents can use this for GRC queries, gap analyses and policy drafts; access is read-only and logged.[61] [60] · Specific AI functions documented
Query GRC evidence with external AI assistants · Prepare gap analyses with connected agents · Create policy drafts from GRC context
AI evidence: [61] · Current product documentation describes a shipped MCP server with OAuth and revocable tokens. An external AI tool and its contract are required; no evidence of autonomous AI supplier assessment by Vendorica itself.
Source check: 2026-10-15
WhisticDocumented focus: Supplier assessments, security evidence and monitoring; additionally internal control testing and a Trust Center for customer enquiries.AI functions and classification: Whistic uses AI to analyse supplier evidence and to create source-referenced findings. For this purpose, the Automation Orchestrator coordinates evidence collection, analysis and the management summary; the final risk assessment remains with the team.[62] [63] · Specific AI functions documented
Analyse supplier evidence against selected frameworks · Prepare findings with sources and confidence information · Create management summaries for approval
AI evidence: [62] [63] · Currently documented for the Assess workflow with four individually configurable agents. Further Orchestrator workflows are on the roadmap and are not counted as available; no product test.
Source check: 2026-10-14
Zenta · Product: Zenta AI / TPRM · Headquarters: Spain [64] · ADVISORY & TECH SL, CIF B01669225, address in Valencia. The legal notice still uses the name RISKALLAY. · ADVISORY & TECH SL; Riskallay; Zenta AIDocumented focus: Platform for third-party risks, due diligence, questionnaires and compliance controls. Assessments, evidence and decisions are handled in shared workflows.AI functions and classification: AI extracts findings from security reports and questionnaires, drafts answers from existing documents and recommends policies or tests for controls. Uncertain extractions are flagged; third-party approvals remain with subject-matter experts.[65] [64] · Specific AI functions documented
Analyse third-party evidence · Draft questionnaire answers · Suggest policies and tests for controls
AI evidence: [65] · Zenta AI is described on the current product page with demo and platform access. Agree the specific AI and module scope; no product test.
Source check: 2026-10-15

Sources.

The numbers in square brackets refer to this list. It is numbered consecutively for this page.

  1. Neotas: vendor source, headquarters evidence checked 15.10.2026
  2. Neotas: main source, AI evidence checked 15.10.2026
  3. OPEN / RoboRobo: vendor source, headquarters evidence checked 15.10.2026
  4. OPEN / RoboRobo: main source, AI evidence checked 15.10.2026
  5. OPEN / RoboRobo: vendor source, AI evidence checked 15.10.2026
  6. OPEN / RoboRobo: vendor source checked 15.10.2026
  7. Orbiq: vendor source, headquarters evidence checked 15.10.2026
  8. Orbiq: main source, AI evidence checked 15.10.2026
  9. Panorays: vendor source, headquarters evidence checked 14.10.2026
  10. Panorays: main source, AI evidence checked 14.10.2026
  11. Panorays: vendor source checked 14.10.2026
  12. Panorays: vendor source checked 14.10.2026
  13. Prewave: headquarters evidence checked 14.10.2026
  14. Prewave: main source checked 14.10.2026
  15. Prewave: vendor source, AI evidence checked 14.10.2026
  16. ProcessUnity: AI-Powered Third-Party Risk Management Platform ProcessUnity · vendor source, checked 14.10.2026
  17. ProcessUnity TPRM Platform: vendor source, AI evidence checked 14.10.2026
  18. ProcessUnity TPRM Platform: vendor source, AI evidence checked 14.10.2026
  19. Rescana: vendor source, headquarters evidence checked 15.10.2026
  20. Rescana: main source, AI evidence checked 15.10.2026
  21. Resilinc: main source checked 14.10.2026
  22. Resilinc: vendor source, AI evidence checked 14.10.2026
  23. Resilinc: vendor source, AI evidence checked 14.10.2026
  24. Resilinc: vendor source checked 14.10.2026
  25. Risk Ledger: register entry, headquarters evidence checked 14.10.2026
  26. Risk Ledger: how it works Risk Ledger · vendor source, checked 14.10.2026
  27. Risk Ledger: product changes 2026 Risk Ledger · vendor source, AI evidence, checked 14.10.2026
  28. Risk Ledger: vendor source checked 14.10.2026
  29. S&P Global: main source checked 14.10.2026
  30. S&P Global: vendor source, AI announcement checked 14.10.2026
  31. SAFE Security: vendor source, headquarters evidence checked 14.10.2026
  32. SAFE Security: main source, AI evidence checked 14.10.2026
  33. SAFE Security: vendor source checked 14.10.2026
  34. SAFE Security: vendor source checked 14.10.2026
  35. SAFE Security: vendor source checked 14.10.2026
  36. SAFE Security: vendor source checked 14.10.2026
  37. Sayari: vendor source, headquarters evidence checked 15.10.2026
  38. Sayari: main source, AI evidence checked 15.10.2026
  39. Sayari: vendor source checked 15.10.2026
  40. Sayari: vendor source checked 15.10.2026
  41. Schwarzthal Tech: vendor source, headquarters evidence checked 15.10.2026
  42. Schwarzthal Tech: main source, AI evidence checked 15.10.2026
  43. Schwarzthal Tech: vendor source, AI evidence checked 15.10.2026
  44. Scrioo: vendor source, headquarters evidence checked 15.10.2026
  45. Scrioo: main source, AI evidence checked 15.10.2026
  46. SecurityPal: vendor source, headquarters evidence checked 14.10.2026
  47. SecurityPal: main source, AI evidence checked 14.10.2026
  48. SecurityScorecard: TITAN AI Platform SecurityScorecard · vendor source, AI evidence, checked 14.10.2026
  49. SecurityScorecard: Third-Party Risk Platform SecurityScorecard · vendor source, checked 14.10.2026
  50. SecurityScorecard TITAN AI: vendor source checked 14.10.2026
  51. ShieldByte Infosec: vendor source, headquarters evidence checked 15.10.2026
  52. ShieldByte Infosec: main source, AI evidence checked 15.10.2026
  53. ShieldByte Infosec: vendor source checked 15.10.2026
  54. Supply Wisdom: main source checked 14.10.2026
  55. Supply Wisdom: vendor source checked 14.10.2026
  56. Supply Wisdom: vendor source, AI evidence checked 14.10.2026
  57. Supply Wisdom: vendor source, AI evidence checked 14.10.2026
  58. UpGuard: Vendor Risk UpGuard · vendor source, checked 14.10.2026
  59. UpGuard: AI in third-party risk management UpGuard · vendor source, AI evidence, checked 14.10.2026
  60. Vendorica: vendor source, headquarters evidence checked 15.10.2026
  61. Vendorica: main source, AI evidence checked 15.10.2026
  62. Whistic: platform and product limits Whistic · vendor source, AI evidence, checked 14.10.2026
  63. Whistic: Automation Orchestrator Whistic · vendor source, AI evidence, checked 14.10.2026
  64. Zenta: vendor source, headquarters evidence checked 15.10.2026
  65. Zenta: main source, AI evidence checked 15.10.2026
Back to top