Third-party risk management has become a legal obligation for hundreds of thousands of European organisations, and the software market that serves it has become genuinely difficult to read: 68 credible platforms, prices from zero to more than a million dollars a year, three different analyst taxonomies, a consolidation wave that renames a vendor every quarter, and marketing language engineered to make a questionnaire tool and a scanning engine sound identical.
This report maps that market end to end. SocialActive researched 70 companies (68 ranked platforms plus two adjacent monitoring tools), using only public sources: vendor websites and pricing pages, marketplace listings, analyst publications and reprints, press releases, funding databases and regulatory texts. Every material claim in this report carries a source, a label (public price, estimate, vendor-claimed, not found), or both. Where sources conflicted, the conflict is stated rather than smoothed over. Where we could not verify something, the report says NOT FOUND rather than guessing, and in one case the unverifiability of a vendor is itself the finding.
Transparency and method
This research was prepared by SocialActive, a research and marketing agency. The evaluation criteria (Part 5) and the ranking lens and weighting (Part 2.1) are stated in full so that any reader can form their own shortlist from the same evidence. Every pricing figure comes from public pages (vendor pricing pages, StartComply’s included), public marketplace listings, or third-party estimate services, each labelled as such. Sources are linked inline where each claim is made, one link per website; where a website supports more than one claim, the additional documents are listed in Appendix B. StartComply is evaluated under the same criteria and in the same profile format as the other 67 platforms. Corrections are welcome: any vendor that believes a fact in this report is wrong is invited to send the primary source, and the report will be updated with a change note (Appendix E).
Executive summary: ten findings
For readers who want the conclusion first: there is no single best TPRM software, and any answer that skips the sizing question is selling something. For enterprises with dedicated risk teams, the strongest platforms in this research are OneTrust and ProcessUnity, consistent with the 2026 Gartner and Forrester evaluations, with SecurityScorecard or Bitsight as the ratings layer on top. For small and mid-market European organisations buying against NIS2, DORA, ISO 27001 or GDPR deadlines, the strongest value pick is StartComply, with Venvera, Copla, Cyberday and Secfix as the closest alternatives. The ten findings below, and everything after them, exist so you can check that answer rather than take it on trust.
TPRM is now regulated demand, with dates. DORA has applied to EU financial entities since 17 January 2025 with a mandatory ICT third-party register; NIS2’s supply-chain security duty is in force in 22 of 27 member states as of May 2026, with four laggards referred to the EU Court of Justice in July 2026. The obligation has a long fuse: GDPR’s Article 28 made processor oversight a legal duty in 2018, and the EBA’s outsourcing guidelines required financial institutions to keep an outsourcing register from 2019, the direct ancestor of DORA’s register of information. The market this created is estimated at roughly USD 9 billion in 2025, growing 14 to 16 percent annually. (Part 4.)
“TPRM software” is not one market. It is six: EU-native compliance platforms, US compliance automation, pure-play TPRM and exchanges, security-ratings engines, enterprise GRC suites, and supply-chain risk platforms. Their price ranges barely overlap, and most bad purchases in this market are cross-family mistakes. (Part 1.)
2026 is the year the analysts arrived. Gartner published its first TPRM Magic Quadrant on 6 April 2026 (Leaders: Diligent, OneTrust, Optro, Aravo, Certa); Forrester’s Q1 2026 Wave named ProcessUnity, LogicGate and Archer as Leaders. Both evaluations exclude the ratings vendors and the entire affordable EU segment, so a small European buyer cannot outsource their shortlist to either. (Parts 4.4, 3.2.)
Only 17 of 68 platforms publish a real price for the platform itself. Opacity remains the market norm, and quote-only pricing correlates with steep, hard-to-budget renewals and per-module surprise costs. The public-price minority spans EUR 0 to USD 125,000 per year. (Parts 5.9, 3.1.)
The price spread for the same nominal need is two orders of magnitude. A 120-employee EU manufacturer needing NIS2 plus ISO 27001 with vendor oversight faces documented three-year totals from roughly EUR 20,000 to 31,500 on published EU pricing (Copla, Cyberday, Venvera, StartComply) to USD 60,000 to 150,000+ on the US platforms and enterprise suites (estimates); TPRM tooling alone spans EUR 4,500 to USD 375,000 over three years on published prices. (Part 3.4.)
External vendor scanning is the sharpest have/have-not line. A handful of ratings vendors operate real engines (SecurityScorecard, Bitsight, UpGuard, Panorays, joined by smaller Black Kite and FortifyData); most compliance platforms have none; StartComply is the only platform found bundling active scanning of each vendor’s domain into an SMB-priced TPRM subscription, with the necessary caveat that a bundled scanner is not a 12-million-company ratings universe. (Parts 5.6 and 2.)
Sovereignty answers changed under buyers’ feet. The consolidation wave (Prevalent to Mitratech, Venminder to Ncontracts, 3rdRisk to Diligent, HyperComply to SecurityScorecard, SafeBase to Drata, AuditBoard renamed Optro) moved several platforms into US ownership; 16 platforms in this report remain EU-owned and EU-hosted. Drata still published no EU data residency at research time; Secureframe’s UK hosting is not EU residency. (Parts 4.5, 5.13, 3.3, 6.2.)
The strongest value pick for the EU-SMB reference buyer, stated with its lens: for an EU organisation of 20 to 1,000 employees, regulator-driven, managing 10 to 150 vendors, StartComply comes out of the comparison as the strongest value pick (full ranked table in Part 2), driven by the field’s lowest-priced structured TPRM module (EUR 1,500 per year including vendor scanning; framework packages EUR 4,500 each), native NIS2/DORA mechanics, EU-only hosting under EU ownership, seven-language localisation and the bundled scanner. Buyers who prioritise a large integration ecosystem, a vendor exchange or SOC 2 coverage should start from the platforms behind it: Venvera, Copla and Cyberday follow, each beating StartComply on at least one criterion (DORA register export, pricing menu transparency, national-transposition breadth respectively). (Part 2.)
Above roughly 1,000 employees, the answer changes, and this report says so plainly: OneTrust and ProcessUnity are the strongest TPRM programmes for enterprises, Vanta is the strongest trust-management ecosystem, and a SecurityScorecard or Bitsight feed belongs on top. StartComply is not built for that buyer. (Parts 1.7, 2.)
The market’s weakest habit is unverifiable claims, and it is not confined to small vendors: we flag a vendor whose operating company cannot be independently verified at all (Vendorica), a Gartner recommendation claimed without naming a report (CyberArrow), scale figures that disagree between a vendor’s own pages (Aravo), and efficacy percentages nobody audits. The report’s method sections (Parts 5.2, 5.11, 5.18) exist because of exactly this.
How to read this report
Part 1 segments the field into six families and two buyer types, so you can find your lane before reading any ranking. Part 2 is the heart of the report: the ranking lens, the full 1-to-68 table, and profiles of all 68 platforms, family by family, each with inline sources. Part 3 consolidates the numbers: who publishes prices, the 2026 analyst placements, sovereignty at a glance, and three worked cost scenarios. Part 4 sets the regulatory and market context with dated sources. Part 5 defines the 20 evaluation criteria and how vendors obscure each. Part 6 carries the remaining reference tables (leadership, rebrands and ownership moves). Part 7 gives situation-based shortlists and the ten questions that expose any vendor. Part 8 answers the questions buyers actually search for. The appendices carry the full registry, additional source listings, adjacent tools, and a glossary.
A reader with ten minutes should read the executive summary above, the ranked table in Part 2.2, and the shortlist for their situation in Part 7.1. A reader about to sign a contract should also read Part 5 in full; it is the part that saves money.
Part 1. The Market, Segmented Honestly: Six Vendor Families and Two Very Different Buyers
Comparing all TPRM vendors on one axis produces nonsense. A EUR 1,500-per-year compliance platform and a EUR 500,000 enterprise GRC programme are not competing products; they are answers to different questions. Before ranking anything, this report sorts the 68 platforms into six families, because the family a vendor belongs to predicts its price, its depth, its buyer and its blind spots better than any feature list.
The ranked field by family (Part 1): 19 EU-native compliance platforms, 9 US or global compliance automation platforms, 10 pure-play TPRM platforms and exchanges, 7 security-ratings engines, 17 enterprise GRC suites, 6 supply-chain and financial risk platforms.
1.1 Family A: EU-native compliance platforms with built-in TPRM (19 platforms)
StartComply, Venvera, Copla (formerly CyberUpgrade), Cyberday, DataGuard, Secfix, Orbiq, 3rdRisk (now Diligent-owned, a borderline member), Securapilot, Scytale, SECJUR, CyberArrow, Formalize, Enactia, Priority eQualSuite, eramba, QuoIntelligence, Vendorica, Neotas.
These platforms were built in Europe, for European regulation, and treat third-party risk as one pillar of a compliance programme rather than a standalone discipline. Typical pricing runs from free tiers to roughly EUR 15,000 per year. Typical deployment is measured in hours to weeks. The buyers are SMB and mid-market organisations, usually 20 to 1,000 employees, facing NIS2, DORA, ISO 27001 or GDPR obligations with small or non-existent security teams.
Their common strength is regulatory nativeness and sovereignty: EU ownership, EU hosting, and product mechanics that match what a European regulator asks for. Their common weaknesses are shallow integration ecosystems, thin analyst coverage, and, with one exception (StartComply, with the caveats noted in its profile), the absence of any external technical monitoring of vendors.
1.2 Family B: US and global compliance automation platforms (9 platforms)
Vanta, Drata, Secureframe, Sprinto, Scrut Automation, Thoropass, Compyl, Optro (formerly AuditBoard), Continuum GRC.
Born from the SOC 2 audit-automation wave, these platforms dominate the global compliance-automation conversation. Vanta (16,000+ customers, roughly USD 300 million ARR by its April 2026 statements) and Drata (a USD 2 billion valuation) are the reference brands. Vendor risk is a module, frequently a paid add-on, built around questionnaires and AI document review rather than technical monitoring. European regulations are supported as mapped frameworks, and EU data residency ranges from opt-in (Vanta, Frankfurt) to absent from public documentation (Drata at the time of research) to UK-based (Secureframe, which is not EU residency).
Typical realistic pricing for mid-market deployments runs USD 10,000 to 80,000 per year with add-ons, based on publicly reported estimates. The right buyer is a company that sells to US enterprises and needs SOC 2 first, EU regulation second. For that buyer, this family is genuinely excellent, and this report says so in the individual profiles.
1.3 Family C: Pure-play TPRM platforms and vendor exchanges (10 platforms)
OneTrust Third-Party Management, ProcessUnity (with the CyberGRX Global Risk Exchange), Prevalent (now Mitratech), Risk Ledger, Venminder (now Ncontracts), Whistic, Aravo, Certa, apexanalytix, TemplarShield.
This is the deep end of the discipline: full vendor lifecycles, workflow engines, exchanges of pre-assessed vendors, managed assessment services. The April 2026 Gartner Magic Quadrant for TPRM Tools and the Forrester Wave largely evaluate this family. Pricing is quote-only and starts, in publicly reported figures, around USD 25,000 per year (ProcessUnity’s stated entry tier) and climbs well into six figures. Implementations are professional-services projects.
The right buyer manages hundreds to thousands of third parties with a dedicated risk team. The mismatch case is equally clear: the entry tiers of this family bundle capacity (3rdRisk’s entry tier, for instance, includes 500 third parties) that a 150-person company will never use but will pay for.
1.4 Family D: Security ratings and external telemetry platforms (7 platforms)
SecurityScorecard, Bitsight, UpGuard, Panorays, Black Kite, RiskRecon (Mastercard), FortifyData.
These companies operate internet-scale scanning engines and sell the resulting ratings. SecurityScorecard rates 12 million+ organisations; Bitsight, backed by Moody’s, pioneered the category; UpGuard pairs ratings with an unusually transparent public price (from USD 1,750 per month); Panorays combines scanning with questionnaire workflows. Ratings are objective, fast and vendor-cooperation-free, which questionnaires are not. They are also a monitoring layer rather than a compliance programme: a rating produces awareness, while an auditor asks for registers, assessments, contracts and incident records.
The right buyer either has an existing compliance stack and adds telemetry, or is an enterprise for whom the rating IS the use case (cyber insurance, M&A screening, portfolio oversight). For SMB compliance buyers, this family is usually a complement, not an alternative, with UpGuard as the notable crossover case that this report treats as a genuine competitor in the value segment.
1.5 Family E: Enterprise GRC and IRM suites with TPRM modules (17 platforms)
ServiceNow, Archer, MetricStream, IBM OpenPages, LogicGate, LogicManager, GAN Integrity, SAI360, Riskonnect, Resolver (Kroll), Mitratech Alyne, 6clicks, Centraleyes, Hyperproof, Onspring, NAVEX One, Wolters Kluwer OneSumX.
The suites run enterprise risk as a whole: operational risk, audit, policy, resilience, ethics, and, as one application among many, third-party risk. Publicly reported pricing for full deployments spans USD 75,000 to over USD 1 million per year (MetricStream), with implementation projects to match. Several members (6clicks, Centraleyes, Hyperproof, Onspring, LogicGate) are lighter, more modern mid-market alternatives to the legacy giants, and their profiles note it.
The right buyer is an enterprise consolidating many risk functions onto one platform, for whom TPRM is one workflow inside a larger governance architecture. Nobody in this family competes for a EUR 5,000 budget, and their sales teams would agree.
1.6 Family F: Supply-chain, procurement and financial third-party risk (6 platforms)
Interos, RapidRatings, Exiger, SAP Ariba Supplier Risk, Coupa Supplier Risk, D&B Risk Analytics.
This family looks at third parties through a different lens: physical supply chains, supplier financial health, sanctions and ESG exposure, procurement workflows. Interos maps multi-tier supplier networks with AI; RapidRatings rates supplier financial health; SAP Ariba and Coupa embed risk into procurement suites their customers already run. Cyber questionnaires exist here but are not the centre of gravity.
The right buyer is a manufacturer, retailer or global enterprise whose third-party risk is measured in factories and shipping lanes as much as in SaaS vendors. For an ICT-centric NIS2 or DORA programme, this family solves a neighbouring problem.
1.7 The two buyers this market actually contains
Across 68 platforms, one distinction explains most of the price variance, most of the feature variance and most of the buyer regret this market generates: whether the product was built for an organisation with a dedicated risk function or without one.
The first buyer, call it the enterprise buyer, has more than roughly 1,000 employees, a staffed risk or security team, hundreds or thousands of third parties, procurement and legal review of every contract, and a multi-year platform consolidation agenda. This buyer should be reading Families C, D and E, will pay five to seven figures annually, and will get value for it. If that is you, the shortlist from this research is OneTrust or ProcessUnity for the TPRM programme itself, a ratings feed from SecurityScorecard or Bitsight on top, and Vanta if the primary driver is a trust-management programme with vendor risk attached. StartComply is not the right platform for that buyer, and this report does not pretend otherwise.
The second buyer, the one most of the European market consists of, has between roughly 20 and 1,000 employees, no dedicated TPRM headcount, a regulator-driven deadline (NIS2, DORA, ISO 27001 renewal, a customer audit), somewhere between 10 and 150 vendors that matter, and a budget that a single enterprise licence would exhaust for a decade. For this buyer the decisive criteria are total cost, deployment speed, native EU regulatory mechanics, language fit and whether vendor oversight is included rather than sold separately. This is the buyer for whom this report’s primary ranking (Part 2) is calculated, and the segment where StartComply, Venvera, Copla, Cyberday, Secfix, DataGuard and Orbiq compete directly.
Both buyers are real. Most reports serve one while pretending to serve both. This one separates them explicitly, ranks the field for the second buyer, and provides the enterprise shortlist above for the first, with the underlying evidence in each profile so either reader can check our arithmetic.
Part 2. The Ranked Field: 68 TPRM Platforms Through a Stated Lens
2.1 How the ranking works, and how to disagree with it
No single ordering of 68 platforms is true for every buyer, so this report does what most rankings do not: it states the lens and the weighting openly, so a reader whose priorities differ can adjust their own shortlist from the same evidence.
The lens is the report’s reference buyer, defined in Part 1.7: a European organisation of roughly 20 to 1,000 employees, facing NIS2, DORA, ISO 27001 or GDPR obligations, managing 10 to 150 vendors, without a dedicated risk team, and spending its own money. Enterprises above that range should read the enterprise shortlist in Part 1.7 and the family C, D and E profiles, where different platforms win.
Nine criteria, drawn from Part 5, drive the ordering, in descending weight: total cost and value at SMB scale; TPRM lifecycle depth; EU regulatory nativeness; bundled external vendor scanning; EU sovereignty (ownership plus hosting); localisation; deployment speed; integrations and ecosystem; and the support and services model. Each platform is assessed per criterion strictly from the evidence in its profile and the sources linked there. Ties break on regulatory nativeness; where two platforms otherwise tie and one is unaffordable to the lens buyer, the buyable platform ranks first.
Three consequences of the lens deserve emphasis. First, the ordering is a value assessment for the stated buyer, not a maturity ranking; a buyer who weights ecosystem breadth and enterprise workflow above cost will correctly shortlist Vanta, UpGuard or OneTrust first, and the enterprise shortlist in Part 1.7 exists for exactly that reason. Second, enterprise platforms rank respectably despite prices the lens buyer cannot pay, because depth is depth: OneTrust sits seventh on the strength of the best TPRM workflow in the report. Third, ranks 26 to 68 are ordered by the same rubric applied to thinner public data; treat neighbouring positions there as approximate and read the profiles.
2.2 The full field, ranks 1 to 68
Family codes: A = EU-native compliance platform; B = US/global compliance automation; C = pure-play TPRM/exchange; D = security ratings; E = enterprise GRC/IRM suite; F = supply-chain/procurement/financial.
How the 68 platforms deliver outside-in technical assessment of vendors: roughly 43 have none, roughly 14 integrate partner feeds, 11 operate something native, and exactly one bundles it into an SMB-priced TPRM subscription. Classificatiofn per the profiles and Part 5.6.
All 68 platforms from this table are profiled below, grouped by family (Sections 2A to 2F). Each profile carries the platform’s rank from this table, which is why the numbering inside each family section is not consecutive; no profile is missing. Every profile states the evidence behind the rank, then closes with the platform’s strengths and its trade-offs against the report’s criteria and reference buyer.
Part 2, Section A. Family A Profiles: EU-Native Compliance Platforms With Built-In TPRM
Each profile carries the platform’s overall rank from Part 2.2 (numbering within this and the following sections is therefore non-consecutive), what the evidence shows, and its strengths and trade-offs against the report’s criteria. Prices are public list prices where stated; everything else is labelled estimate or vendor-claimed. Sources are linked inline at first mention, one link per website; additional documents appear in Appendix B.
Documented live interface languages among the platforms an SMB can actually afford. StartComply’s seven (vendor-stated) lead the segment; enterprise-tier localisation (OneTrust, SAP, Coupa supplier portals) exceeds it at enterprise prices. Data: Parts 5.17 and 2.
1. StartComply (Greece)
StartComply was founded in 2025 by TicTac, an Athens cybersecurity firm running MSSP, incident-response and forensics work since 1999, and comes out of this comparison as the strongest value pick for the report’s reference buyer. It automates NIS2, DORA, ISO 27001:2022 and GDPR natively, and is the only platform of the 68 with productised IMO maritime cyber coverage. TPRM is built into the base product across the full lifecycle (registry, tiering, questionnaires, DORA Article 30 contract tracking, fourth-party visibility, offboarding), and the base price includes active external vulnerability scanning of the customer’s own domain and of each vendor’s domain, a bundling we found nowhere else in its price class; its pricing page lists the module as “TPRM and External Vulnerability Assessment”, covering the questionnaire workflows and external vulnerability assessments on vendor and own domains. Its published pricing is modular: the TPRM and external vulnerability assessment module costs EUR 1,500 per year, and framework and policy packages (NIS2, ISO 27001:2022, DORA) cost EUR 4,500 per year each, with no per-seat fees, no implementation fees and optional ten-user add-on packs; optional vCISO and advisory services from the TicTac team are quoted separately and never mandatory. Seven live EU-language interfaces are stated (English, Greek, Bulgarian, Romanian, Polish, Czech, German), the widest live coverage in its segment, with further languages announced. Hosting is EU-only under Greek ownership, and its customer claim of 100+ European organisations is vendor-stated, not independently verified.
The trade-offs are recorded here exactly as for every other platform: no analyst coverage yet, no public integration catalogue or API documentation, no vendor exchange, and no SOC 2 framework coverage. StartComply leads this comparison on value, EU nativeness and sovereignty; organisations that need a large integration ecosystem, an assessment exchange or US framework breadth will find stronger fits among the platforms below.
2. Venvera (Bulgaria/Netherlands)
Venvera publishes its prices, which already places it in a small minority of this market: EUR 359 per month for four frameworks (DORA, NIS2, GDPR, Cyber Essentials) and EUR 799 per month for six (adding ISO 27001 and the EU AI Act), flat per organisation, with a 14-day free trial. Its DORA tooling is the reference implementation in the SMB segment: all ESA register-of-information tables with xBRL-CSV export, Article 30 contract tracking, concentration alerts and n-th-tier mapping. The legal entity behind the brand is Atlant Security EOOD of Sofia, Bulgaria, with Amsterdam operating as a marketing office; the founder’s background is in offensive security consultancy. The platform states SOC 2 Type II status and offers its UI in English, German, Spanish and Bulgarian. It is worth noting that no funding or headcount figures could be independently verified, and its traction claim of 800+ regulated entities is vendor-stated; buyers should request references.
Strengths: the segment’s reference DORA register tooling (native xBRL-CSV export), published month-to-month pricing, and a self-serve free trial. Trade-offs: no external vendor scanning found, multi-framework totals of EUR 4,300 to 9,600 per year at the upper end of the segment’s published prices, four UI languages, unverified traction claims, and no maritime coverage.
3. Copla, formerly CyberUpgrade (Lithuania)
Copla, the Vilnius company that rebranded from CyberUpgrade in 2025 and closed a EUR 6 million Series A led by Iron Wolf Capital around February 2026, prices compliance the way SMBs budget it: per framework, per year, in public. ISO 27001 at roughly EUR 2,999 (promotional; normally near EUR 4,000), NIS2 and SOC 2 near EUR 3,500, DORA near EUR 4,500, plus a Copla Registry product for the DORA register of information from roughly EUR 500 per year, and tiered fractional-CISO services from EUR 6,000 per year. Vendor risk is a use case within the compliance platform, centred on the DORA register; scanning ingests the customer’s own cloud scanner outputs rather than examining vendors externally, and full vendor-lifecycle depth (fourth-party mapping, offboarding workflows) was not evidenced.
Strengths: a fully published per-framework pricing menu, bundled human CISO services at published prices, disclosed venture funding, and a free DORA self-assessment tool. Trade-offs: vendor risk is register-centric rather than a full lifecycle, there is no external scanning of vendors, multi-framework scopes add up quickly at per-framework prices, and the platform is English-first with no maritime coverage.
4. Cyberday (Finland)
Cyberday, built by Agendium Ltd of Tampere (founded 2013), is the segment’s breadth champion for NIS2 localisation: its framework library lists national transpositions for 23 countries (24 variants), by a distance the widest national coverage we found, alongside CRA, CER and ISO 27001. It operates inside Microsoft Teams, publishes full headcount-based pricing (EUR 250 per month under 20 employees to EUR 1,990 per month at 1,000 to 2,999, annual billing), offers a genuine 14-day self-serve trial, and has held its own ISO 27001 certification since 2021, longer than most rivals in this family. The company is bootstrapped and claims 600+ customer organisations and 50,000+ users (vendor-claimed). Its third-party module is the trade-off: supplier oversight is questionnaire and self-assessment based, with no external scanning, no fourth-party mapping, no DORA Article 30 contract mechanics and no register-of-information generator.
Strengths: the field’s widest national NIS2 transposition coverage (23 countries), a genuine self-serve trial, Microsoft Teams-native operation, its own long-held ISO 27001 certification, and thirteen years of operating history. Trade-offs: the third-party module is questionnaire-only (no scanning, no Article 30 tracking, no fourth-party visibility), DORA depth is thinner than its NIS2 breadth, headcount-banded pricing rises quickly (EUR 8,160 per year at 120 employees), and vendor-linked incident clocks are absent.
6. Secfix (Germany)
Secfix is the best-funded direct EU SMB rival in this report: an oversubscribed USD 12 million Series A closed in late February 2026 (Alstin Capital, Bayern Kapital, neosfer), bringing total funding to roughly USD 17 million. Founded 2021 in Berlin, now Munich-led, it automates ISO 27001, TISAX, NIS2, GDPR, SOC 2 and the EU AI Act with an expert-assisted model, hosts on European infrastructure in Frankfurt, and is ISO 27001 certified itself. Its UI covers English, German, Spanish and Portuguese. Vendor management is a supporting module rather than a discipline: questionnaire and access-review based, with no external vendor scanning, no DORA register mechanics and no fourth-party mapping evidenced. Pricing is quote-based; third-party reports place ISO programmes between roughly EUR 5,000 and 30,000 (estimates).
Strengths: DACH brand and funding momentum, TISAX coverage, SOC 2 and EU AI Act framework breadth, and German-market depth with certified German hosting. Trade-offs: vendor management is a supporting module rather than a lifecycle, there is no external vendor scanning and no DORA register or Article 30 mechanics, pricing is quote-only, and language coverage stops short of CEE and the Balkans.
10. Scytale (Israel/global)
Scytale, founded in 2021, acquired SOX-automation firm AudITech in June 2025 for a reported USD 15 million and pushes hard into Europe from offices in Berlin, Lisbon and Prague. Its framework library spans 80+ frameworks including NIS2, DORA, ISO 27001 and GDPR, and its own certifications include SOC 2, ISO 27001 and ISO 42001. Pricing is quote-only on its site but public on AWS Marketplace: platform from USD 7,500 per year, additional frameworks USD 2,100 each, questionnaire-automation services USD 12,000 per year. Vendor risk management is an included module (inventory, automated assessments); we found no external vendor scanning, no fourth-party visibility and no EU data-residency commitment.
Strengths: framework breadth (80+ including SOC 2 and HIPAA), AI questionnaire services, and a public marketplace price floor. Trade-offs: no EU data residency found under Israeli ownership, no vendor scanning or DORA register mechanics, a thin TPRM lifecycle, English-first languages, and per-framework add-ons that raise multi-framework totals.
11. Formalize (Denmark)
Formalize, the Aarhus company that grew out of Whistleblower Software and rebranded in March 2024, raised a EUR 30 million Series B in October 2025 (Acton Capital and BlackFin Tech co-leading, roughly EUR 50 million total), and now sells a connected compliance platform whose modules include third-party management with an ICT-provider registry, contract and deadline tracking aligned to DORA and NIS2, and GDPR tooling. It hosts all data on AWS Frankfurt, holds its own ISO 27001 certificate (Intertek, November 2024), and claims 8,000+ customers and 12+ platform languages (vendor-claimed). The compliance platform itself is quote-only with a 14-day trial. Supplier questionnaire depth, a DORA register-of-information generator and any external scanning were not evidenced.
Strengths: funding and scale (EUR 50 million raised, 160+ staff), claimed language breadth, its own certified ISO status with a named auditor, and whistleblowing and ethics tooling rare in this family. Trade-offs: third-party depth is thin (no questionnaire automation evidenced, no register generator, no fourth-party visibility), there is no vendor scanning, platform pricing is unpublished, and incident-clock mechanics were not found.
15. DataGuard (Germany)
DataGuard is the DACH incumbent of this family: Munich-based since 2018, roughly EUR 80 million raised (Morgan Stanley Expansion Capital led its 2022 round), and 4,000+ customers claimed across 50+ countries. It pairs software with bundled consultancy (external DPO and ISO services), which many small teams value and which also lengthens engagements. Its platform covers GDPR and ISO 27001 deeply, NIS2 as a supported framework, and the EU AI Act; DORA, by contrast, exists as content rather than as a product module, with no register-of-information tooling found, a gap confirmed in this research. Vendor management is privacy-lens questionnaires without external scanning or fourth-party mapping. Pricing is quote-only; third-party listings from roughly EUR 175 per month exist but conflate different products and should be treated as unverified.
Strengths: DACH brand and customer base, funding, bundled consultancy depth, privacy tooling maturity, and EU AI Act coverage. Trade-offs: DORA exists as content rather than product mechanics, the vendor module is privacy-lens questionnaires without scanning, pricing is quote-only, deployment is consultant-paced, and CEE/SE-Europe languages are missing.
17. 3rdRisk, now a Diligent brand (Netherlands/US)
3rdRisk spent five years as the argument that Europe could produce its own pure-play TPRM platform: Amsterdam-built, NIS2 and DORA content packs, enterprise references including ING and KPMG, and a “built, developed and managed in the Netherlands” identity. On 14 January 2026 Diligent, the New York GRC group, acquired it (the announcement is linked in Part 4.5), and the identity changed in one press release. Under Diligent, whose Diligent One platform was named a Leader in the first Gartner Magic Quadrant for TPRM Tools in April 2026, 3rdRisk gains resources and an AI roadmap; what it loses is the sovereignty argument, since ownership now sits under US jurisdiction. Its commercial shape was already enterprise-leaning: quote-only tiers whose entry bundle includes 500 third parties, with DORA register and NIS2 packs reported as paid add-ons. Its cited NPS of 71 is a vendor claim.
Strengths: dedicated TPRM workflow depth, enterprise references (ING, KPMG), the analyst halo of Diligent’s 2026 Leader placement, and parent-company resources. Trade-offs: EU ownership ended in January 2026, the 500-vendor entry bundle prices out small buyers, there is no bundled scanning, pricing is quote-only, and localisation is thin.
19. eramba (UK/open source)
eramba is the budget outlier of this field: an open-source GRC platform maintained since 2007, bootstrapped on principle, with a free self-hosted Community edition and an Enterprise edition publicly priced from EUR 2,500 per year self-hosted (roughly EUR 5,000 hosted), flat, with unlimited users. Its third-party capability is a vendor register plus an online-assessments portal, supported by a public template library that includes an approximately 250-requirement NIS2 package and DORA content under Creative Commons. In 2026 it moved to Docker-only installation and shipped an MCP connector for querying the platform through an LLM. There is no external scanning, no register-of-information generator, and administration is the customer’s job; for teams with the skills, the economics are unmatched, and for teams without them, the total cost quietly becomes staff time.
Strengths: the field’s lowest price floor (a free Community edition), self-hosting and absolute data control, unlimited users for a flat fee, and open, inspectable content. Trade-offs: administration is entirely the customer’s job, there is no vendor scanning, DORA and NIS2 are template packs rather than clocks and registers, support is community-paced, and audit-facing polish is limited.
20. Orbiq (Germany)
Orbiq of Hamburg markets itself in language very close to the top of this family while its substance sits at the other end of the maturity range, and both halves belong in the record. Founded around 2025 by Emre Salmanoglu with a team of one to ten people and no disclosed funding, it markets an EU-sovereign trust centre with NIS2, DORA and ISO 27001 mappings and “vendor assurance”, at radically transparent prices: a free forever tier, EUR 85 per month for Team, EUR 190 per month for Business. All data is EU-hosted by default. The maturity gap is equally documented: its own ISO 27001 certification was, by its own statement, still in progress at the time of research, there are no named customers, and its vendor assurance is a document-exchange and attestation layer rather than a TPRM lifecycle; its external scanning is of its own product, not of a customer’s vendors.
Strengths: a real free tier, self-serve onboarding in minutes, and polished trust-centre presentation (click-to-sign NDA flows). Trade-offs: substance is early-stage across the board: no TPRM lifecycle, no vendor scanning, no incident clocks or register mechanics, its own ISO certification still in progress, a one-to-ten-person team, and minimal language coverage.
21. Securapilot (Sweden)
Securapilot, built by the Swedish consultancy Verit AB (founded 2014 by Kim Borg) and launched around 2025, is a Nordic surprise on the transparency criterion: full public list pricing in SEK (from 2,900 SEK per month for small companies, roughly EUR 3,100 per year, to 14,900 SEK per month for large ones, with separate municipal and agency tiers), all modules included. Its vendor-management module is more complete than its obscurity suggests: SIG-Lite, CAIQ, NIS2 and DORA questionnaire templates, an external vendor self-assessment portal, AI document analysis and 0-to-100 vendor scoring. It is native to Swedish regulation (the Cybersecurity Act in force January 2026) with site languages across six European tongues. What it lacks is public footprint and reach: no published customer counts, no verifiable own certification (the site claims ISO 27001 readiness rather than certification), and no external scanning.
Strengths: Nordic localisation and Swedish national-law fit, municipal-sector packaging, and questionnaire template breadth (SIG-Lite and CAIQ named). Trade-offs: no vendor scanning, no DORA register mechanics, no verifiable customers or certification yet, no incident clocks, and no southern or eastern EU languages.
51. SECJUR (Germany)
SECJUR of Hamburg (founded 2018, roughly USD 5.7 million raised, most recently from Look AI Ventures in November 2024) sells a Digital Compliance Office spanning ISO 27001, TISAX, GDPR, NIS2 and DORA, with vendor management and contract modules and hosting stated as Germany-based. Pricing is quote-only, and the third-party figures in circulation contradict each other badly enough that we decline to repeat any of them as an estimate. Supply-chain auditing is claimed; questionnaire depth, fourth-party visibility, register generation and any scanning were not evidenced.
Strengths: TISAX coverage, German-market legal heritage (founder is a lawyer), and DACH-local market presence. Trade-offs: vendor-management depth is unevidenced, there is no scanning, pricing is quote-only with contradictory third-party figures, languages stop at German and English, register and clock mechanics were not found, and the research window surfaced no dated 2025-2026 news.
61. CyberArrow (UAE)
CyberArrow, the Dubai firm that rebranded from EBDAA (founded 2014) in December 2021, automates GRC across 100+ frameworks with a TPRM capability of vendor inventory, pre-defined questionnaires and maturity scoring, and markets NIS2 implementation “in 3 weeks” alongside DORA automation claims. It is bootstrapped, roughly 24 people (estimate), with offices listed across Europe and testimonial logos including Emirates, Bupa and American Express (vendor-claimed). Two findings temper the picture: no public or estimated pricing exists at all, and a 2025 vendor blog claims a Gartner recommendation without naming any report, a claim we could not verify and flag accordingly. No EU data-residency statement or external scanning was found.
Strengths: framework count breadth, MENA-region presence and government relationships, and enterprise testimonial logos. Trade-offs: no EU residency statement, TPRM stops at questionnaires, no pricing signal of any kind, an unverifiable Gartner claim, thin EU languages, and no native regulatory mechanics.
62. QuoIntelligence (Germany)
QuoIntelligence of Frankfurt (founded February 2020 as a QuoScient spin-off) is not a compliance platform and does not pretend to be one; it earns its place in this report as the EU-sovereign monitoring layer several TPRM programmes bolt on. Its Mercury platform combines threat intelligence, digital risk protection, supply-chain monitoring and native external attack-surface management, produced, in its words, by European technology stored on German soil, with its own ISO 27001 certification (vendor-claimed). In October 2025 it launched KARLA, an AI threat-analyst agent, and in April 2026 closed a EUR 7.3 million Series A led by Elevator Ventures (coverage listed in Appendix B). There are no questionnaires, no registers and no compliance workflows here; pricing is undisclosed.
Strengths: threat-intelligence depth, native EASM sophistication, and analyst-grade intelligence reporting. Trade-offs: it is not a compliance platform: no frameworks, registers, questionnaires, clocks or audit evidence, and no published pricing. The accurate framing is monitoring complement, not compliance platform.
63. Neotas (UK)
Neotas of London applies open-source intelligence to enhanced due diligence: deep screening of suppliers, counterparties and executives across public records, adverse media and the open web, increasingly packaged for TPRM and DORA register-of-information contexts. Its analyst validation is unusual for its size (Chartis FCC50 2026 Market Disruptor and a placement in Chartis’s TPRM RiskTech Quadrant 2026) while the rest of its public footprint is thin: roughly USD 1.5 million disclosed funding against approximately 139 employees (estimates), and no published pricing, customer counts or EU-residency statement. It screens third parties; it does not run compliance programmes.
Strengths: human-and-OSINT due-diligence depth (integrity, fraud, reputation screening) that software questionnaires cannot reach, and financial-crime analyst recognition. Trade-offs: no compliance workflow or regulatory mechanics, no monitoring automation, unpublished pricing and traction, and unclear EU hosting. A complement for high-risk vendor onboarding rather than a platform substitute.
66. Enactia (Cyprus)
Enactia of Nicosia is the region’s privacy-led GRC entrant: a vendor and third-party management module (inventory, customisable questionnaires, a vendor evidence portal with AI-assisted flagging, automated High/Medium/Low tiering, contract and certification tracking) inside a suite whose core strength is GDPR tooling, extended by NIS2 control catalogues mapped to Article 21 and Middle East regulatory content. The company states ISO 27001 and SOC 2 badges, claims 40+ customers including Eurobank, Hermes Airports and Grant Thornton, and lists roughly 12 to 15 staff; its founding year is itself uncertain (2018 in funding databases against “4+ years” on its own site), its licensing page shows tiers without figures, and its wider independent footprint is minimal. No scanning, fourth-party visibility or DORA register generation was found.
Strengths: privacy-office depth (DPIA, DSR, transfer impact assessments) and Middle East regulatory coverage. Trade-offs: TPRM does not extend beyond questionnaires, there is no vendor scanning, NIS2/DORA product depth is thin, prices are unpublished, scale is unverifiable, and language coverage is undocumented.
67. Priority eQualSuite (Greece)
PRIORITY, the Athens quality-and-compliance consultancy founded in 1995 (115+ staff, EUR 11.5 million 2025 revenue, 1,300+ client companies, vendor-claimed; Capital.gr coverage), markets eQualSuite as the first Greek GRC software: six modules covering ISO management, business continuity, DPO work, risk, compliance and audit. Our research found no dedicated TPRM or vendor-risk module in the suite; supplier assessment appears in PRIORITY’s DORA consulting descriptions rather than in product documentation, and no pricing or product-native NIS2/DORA coverage could be located. As a consulting partner with software attached, PRIORITY is a significant Greek institution; as a TPRM platform, eQualSuite does not currently compete, and we say so plainly rather than rank it on capabilities it has not published.
Strengths: consulting bench depth in Greece (thirty years, 4,000+ projects) and business-continuity/quality-management breadth. Trade-offs: no TPRM module could be found, product-native regulatory mechanics and pricing are unpublished, and there is no independent product record; it competes as a consultancy, not a platform.
68. Vendorica (Lithuania)
Vendorica illustrates why this report verifies companies and not only products. Its website describes a DORA-native TPRM platform that reads, on paper, remarkably close to this report’s evaluation rubric: vendor register, SIG and CAIQ questionnaires, contract clause checklists, fourth-party concentration risk, an auto-generated ESA-ready register of information, BitSight and SecurityScorecard rating integrations, and public pricing (a free 10-vendor tier and a Professional tier at EUR 399 per month, apparently raised from EUR 299 during the research window). What we could not find is the company: no founders, no team page, no LinkedIn presence, no press coverage, no registration details beyond a Vilnius governing-law clause, and a SOC 2 Type II claim with no attestation evidence. Every fact about Vendorica comes from vendorica.com. Buyers should treat it accordingly until independent verification exists, and we rank it at the bottom of the field on exactly that basis, not on its feature list.
Strengths: on-paper DORA register generation claims, published pricing, and stated integrations of external ratings feeds. Trade-offs: the operating company itself could not be verified: no founders, no ownership transparency, no independent sources of any kind. All claims are vendor-published, which is the finding.
Part 2, Section B. Family B Profiles: US and Global Compliance Automation Platforms
The compliance-automation family dominates the global compliance conversation. For an EU regulatory buyer its members share a pattern: superb ecosystems and market presence, mapped rather than native EU mechanics, vendor risk as a module or add-on, and data-residency answers that require reading carefully. Each profile documents both halves.
8. Vanta (US)
Vanta is the category’s reference brand: roughly USD 300 million in annual recurring revenue and 16,000+ customers by its April 2026 statements, a USD 4.15 billion valuation from its July 2025 Series D, 400+ integrations, and in May 2026 a Leader placement in Forrester’s first GRC Platforms Wave. Its 2025-2026 agentic AI push is real product, not decoration: autonomous policy drafting, questionnaire automation, and a TPRM agent that reviews vendor evidence and auto-scores risk, with an agent unifying internal and third-party risk launched June 2026. For the EU buyer, the fine print matters: vendor risk management is sold standalone or as an add-on rather than bundled, NIS2 and DORA exist as product pages built on mapped controls rather than register-and-clock mechanics, EU hosting is a Frankfurt opt-in under a US parent, UI languages are limited to English, German, French and Spanish, and pricing is quote-only with a Vendr-reported median around USD 20,000, before add-ons and renewal escalation. Vanta is the right default for a company selling into US enterprises; this report’s lens simply weighs it for a different buyer.
Strengths: analyst coverage, customer count and funding scale, integration ecosystem, agentic AI maturity, framework breadth including SOC 2 and HIPAA, auditor familiarity, and brand gravity in procurement. Trade-offs: EU regulations are mapped rather than native, EU hosting is a Frankfurt opt-in under US jurisdiction, vendor risk is sold as an add-on with no scanning, realistic totals run well into five figures, and CEE languages and maritime coverage are absent.
12. Sprinto (US/India)
Sprinto is the value engine of this family: founded 2020, USD 31.8 million raised (Accel led its 2024 Series B), and 3,000+ customers claimed. Its Autonomous TPRM module discovers vendors from the customer’s environment, tiers and scores them with AI, and alerts on vendor incidents (vendor-claimed, within 48 hours). Notably for this family, its trust page confirms AWS Frankfurt as a primary hosting region, the only verifiable EU-residency statement among the US-cohort value players. NIS2 is a mapped landing page (70+ controls against Article 21) and DORA is covered through cross-mapped SCF controls; there is no register generator, no incident clocks, no fourth-party visibility evidenced and no external scanning. Pricing is quote-only; Vendr’s reported median is USD 15,000 with estimates from roughly USD 6,000.
Strengths: AI agent tooling (its no-code AI Playground shipped November 2025), SOC 2-centred framework breadth, integrations, and self-serve-like evaluation speed. Trade-offs: EU coverage is mapped without registers or clocks, there is no vendor scanning, ownership is US with Indian operations, pricing is quote-only, and EU-language coverage is minimal.
14. Scrut Automation (US/India)
Scrut carries the unusual distinction of an accredited ISO/IEC 42001 certification for its own AI management system, achieved in early 2025 before most rivals mentioned the standard. Founded 2021, roughly USD 20.6 million raised, it ships a vendor risk module with automated discovery through SSO and cloud integrations, AI-generated tiered questionnaires, AI document analysis, and continuous threat-intelligence monitoring of vendor breach signals; the company claims 20,000+ vendors assessed (vendor-claimed). It appeared in Forrester’s GRC Landscape Q4 2025 and as a Gartner Hype Cycle sample vendor. DORA and NIS2 are pre-loaded, cross-mapped frameworks rather than native mechanics; EU data residency was not found; pricing is quote-only with estimates starting around USD 15,000.
Strengths: its own certified AI governance, AI agent breadth (Scrut Teammates, April 2025), framework count (60+), and integration-driven vendor discovery. Trade-offs: no registers, clocks or national transpositions, threat-feed monitoring rather than true vendor scanning, no EU residency found, quote-only pricing, and minimal EU languages.
25. Drata (US)
Drata, valued at USD 2 billion since 2022 with roughly USD 328 million raised, made the family’s boldest TPRM-adjacent move by acquiring SafeBase, the enterprise trust-centre network, for a reported USD 250 million in February 2025 (the announcement is linked in Part 4.5), and followed with an AI agent for vendor risk reviews in August 2025. Its footprint is elite: 300+ integrations, 7,000+ customers, and SafeBase trust centres serving names like OpenAI. The EU picture is the family’s weakest: no publicly verifiable EU data residency existed at the time of research (a February 2026 executive quote about EU hosting plans is a plan, not a region), UI languages are English, Spanish, French and German, NIS2 and DORA are mappings, vendor risk and trust centre are premium modules, and pricing is quote-only (estimates from roughly USD 7,500 entry to USD 100,000+ programmes).
Strengths: trust-centre network (SafeBase is the category leader), brand strength, integrations, AI questionnaire automation, and framework breadth. Trade-offs: no published EU data residency at research time, mapped rather than native EU coverage, vendor risk and trust centre sold as premium modules with no scanning, quote-only pricing, and four UI languages.
26. Secureframe (US)
Secureframe, founded 2020 in San Francisco with roughly USD 79 million raised (Kleiner Perkins led its Series B), offers one of the family’s better included vendor-risk capabilities at its Complete tier, alongside Comply AI questionnaire extraction and shadow-vendor detection. In March 2026 it launched Secureframe Defense for the US defence industrial base, a signal of where its roadmap energy goes. Its hosting choices are US or UK (AWS London); after Brexit, neither is EU data residency, a distinction that matters to NIS2-regulated buyers and that its marketing does not volunteer. NIS2 and DORA are mapped frameworks; there is no register generator and no external scanning; pricing is quote-only, with widely reported entry estimates around USD 7,500 and per-framework stacking.
Strengths: framework breadth (39+ including CMMC), AI questionnaire tooling, US federal depth, and integrations. Trade-offs: hosting is US or UK only (neither is EU residency), EU regulations are mapped, there is no scanning and no DORA register mechanics, and per-framework stacking raises totals.
28. Thoropass (US)
Thoropass, the former Laika (founded 2019, roughly USD 98 million raised), sells the family’s most distinctive bundle: compliance software and the audit itself from one vendor, through its AICPA-accredited CPA arm rebranded Thoropass Assurance in December 2025, with PCI QSA and HITRUST assessor accreditations attached. Its AWS Marketplace listing makes it semi-transparent on price (documented here): platform from USD 8,700 per year plus SOC 2 audit from USD 5,800, against a Vendr-reported median around USD 30,700 for real contracts. Vendor risk is a supporting feature (assessments, monitoring, questionnaire automation) rather than a discipline; NIS2 and DORA pages do not exist on its site, EU residency was not found, and its July 2026 MCP server launch signals an AI-integration direction. The software-plus-auditor model raises an independence question some buyers weigh; others value the single throat to choke.
Strengths: bundled accredited audits from one contract (rare in this field), US framework depth (SOC 2, HITRUST, PCI), and marketplace price visibility. Trade-offs: no NIS2 or DORA pages were found at all, no EU residency, vendor risk is a supporting feature, there is no scanning, and the platform is English-first.
34. Optro, formerly AuditBoard (US)
Optro is the family’s enterprise pole: the platform founded as SOXHUB in 2014, renamed AuditBoard in 2017, acquired by Hg for more than USD 3 billion in May 2024, and renamed Optro on 9 March 2026, a sequence that also illustrates this report’s brand-sprawl criterion. Its credentials are heavyweight: 2,000+ enterprise customers including a majority of the Fortune 500 (vendor-claimed), a Leader placement in the 2025 Gartner Magic Quadrant for GRC Tools, and, under its new name, a Leader placement in the first TPRM Magic Quadrant of April 2026, positioned furthest right on completeness of vision. Its TPRM module (launched 2022) covers intake, questionnaires with AI answer drafting, scoring and remediation; external ratings arrive via a Bitsight integration gated to the TPRM Professional tier; fourth-party visibility and DORA registers were not found. Pricing is quote-based, with third-party estimates of USD 40,000 to 150,000 per year. EU presence is growing (London HQ, Germany entry May 2025) while an EU data-residency statement was not found.
Strengths: analyst standing (double MQ Leader), enterprise scale and installed base, audit-suite integration, AI assessment drafting, and partner ecosystem. Trade-offs: contracts estimated at USD 40,000 to 150,000 put it out of SMB reach, EU regulatory mechanics are thin, external ratings arrive via a gated partner feed, no EU residency statement was found, and localisation is limited.
35. Compyl (US)
Compyl of New York (founded 2020 by former CISOs Stas Bojoukha and Simon Shaddock) closed a USD 12 million Series A in June 2025 and positions itself between the compliance-automation tools and the enterprise suites. Its February 2026 release added Vendor Insights, continuous third-party monitoring that pulls public signals (credit ratings, breaches, security posture, certifications) into scheduled vendor risk profiles, the closest thing to a native vendor-intelligence layer in this family’s mid-market, alongside a full vendor lifecycle tied to contracts, assets and controls and 125+ integrations (vendor-claimed). Seventy-plus frameworks include NIS2, DORA and ISO 27001 as mapped content; EU residency, fourth-party visibility, register generation and the company’s own certifications were not found; pricing is quote-only (estimates from roughly USD 6,000).
Strengths: public-signal vendor intelligence spanning credit and operational data, US mid-market GRC workflow, and integration count. Trade-offs: EU mechanics and residency were not found, its signals are aggregated rather than active technical scans, the public footprint is small, and pricing is quote-only.
64. Continuum GRC (US)
Continuum GRC of Scottsdale, founder-led since 2015 alongside sister assessment firm Lazarus Alliance, is the family’s US-federal specialist: the vendor-claimed first pure GRC assessment SaaS with FedRAMP Authorization (held since December 2021, five consecutive years marked in March 2026), with 100+ pre-mapped frameworks, third-party risk assessment modules with response reuse across vendors, and a 2025-2026 AI push (A.ITAM and AITAMBot, marketed as an AI auditor). Its NIS2 and DORA coverage is mapped-framework level; the platform runs on AWS and AWS GovCloud in the US with no EU residency found; there is no external scanning; and pricing works through modular cost calculators with a 14-day trial but no public figures. For FedRAMP, CMMC and NIST-centric programmes it is a serious specialist; for the EU buyer of this report’s lens it is an ocean away in every sense.
Strengths: US federal accreditation depth (FedRAMP, StateRAMP), framework count, and audit-machine automation for NIST-family regimes. Trade-offs: EU relevance is minimal across residency, mechanics and languages, there is no vendor scanning, pricing hides behind calculators, and its footprint is US federal.
Part 2, Section C. Family C Profiles: Pure-Play TPRM Platforms and Vendor Exchanges
This family is the discipline’s deep end, and four of its members hold 2026 analyst Leader placements. It is also, almost uniformly, enterprise-priced and quote-only. The profiles credit the depth and state the entry barriers.
7. OneTrust (US)
OneTrust is the most complete third-party management product in this report and a Leader in the first Gartner Magic Quadrant for TPRM Tools (April 2026). Founded 2016 in Atlanta, roughly USD 920 million raised at a peak USD 5.1 billion valuation, around 14,000 customers across its trust-intelligence platform (vendor-claimed), and since February 2026 led by CEO John Heyman, succeeding founder Kabir Barday. Its Third-Party Management line spans risk management, due diligence and a Third-Party Risk Exchange with thousands of pre-assessed vendor profiles; external cyber signals arrive through integrated ratings feeds (SecurityScorecard, RiskRecon and others) rather than a native engine. Localisation is broad, reflecting its privacy heritage. The costs are equally documented: quote-only pricing whose module floor sits near USD 10,000 to 11,500 (Vendr median) while realistic enterprise deployments run USD 50,000 to 300,000+ per year (estimates), implementations are consultant-led projects measured in months, and EU hosting options do not remove US-parent jurisdiction. Enterprises consolidating trust, privacy and third-party programmes will justify it; a 200-person NIS2 entity will not.
Strengths: TPRM workflow depth (the strongest in this report), the exchange network, analyst standing, localisation breadth, and enterprise references. Trade-offs: realistic deployments run USD 50,000 to 300,000+ with consultant-led implementations, ownership is US, external signals are partner feeds rather than a native engine, and its clock-and-register depth arrives at enterprise prices only.
13. ProcessUnity (US)
ProcessUnity is the pure-play benchmark: founded 2003 in Concord, Massachusetts, merged with CyberGRX in July 2023 to attach the Global Risk Exchange (roughly 370,000 participating organisations and 18,000+ attested assessments, vendor-claimed) to the market’s deepest TPRM workflow engine, and named a Leader in the Forrester Wave for TPRM Platforms, Q1 2026, with top scores in current offering and strategy. Its Evidence Evaluator (May 2025) runs a proprietary cybersecurity LLM over supplier evidence. External ratings integrate from Bitsight, SecurityScorecard and RiskRecon rather than a native engine. The commercial floor is public: the emerging-enterprises tier starts around USD 25,000 per year, real deployments commonly run to USD 150,000 (estimates), implementations are professional-services projects with a steep administrator learning curve. NIS2 depth is thin relative to its DORA automation, and EU-only residency guarantees were not found.
Strengths: assessment factory scale, exchange economics, Forrester standing, DORA register automation at enterprise grade, AI evidence review, and financial-services references. Trade-offs: the published USD 25,000 floor and services-led implementations exclude small buyers, EU ownership and residency guarantees are absent, there is no native scanning, and localisation is thin.
22. Prevalent, a Mitratech company (US)
Prevalent, founded 2004 and acquired by Mitratech on 2 October 2024 (the announcement is linked in Part 4.5), remains one of the longest-standing dedicated TPRM platforms: 800+ questionnaire templates, a Vendor Intelligence Network, and managed services that will run assessments for the customer. Under Mitratech it now sits inside a March 2026 “Global GRC Platform” consolidation alongside the Alyne product, with continuity questions that any recently acquired platform carries. Continuous monitoring draws on partner threat and breach feeds rather than a native scanning engine. Pricing is quote-only at reported USD 50,000 to 250,000+ per year with a commonly required services engagement (estimates); EU residency can be arranged for enterprises but is not the default; DORA and NIS2 are mapped content.
Strengths: template library scale, managed assessment services, enterprise process maturity, and two decades of operating track record. Trade-offs: reported USD 50,000 to 250,000+ pricing with required services engagements, post-acquisition continuity questions, no default EU residency, mapped EU content, and partner feeds rather than native scanning.
27. Risk Ledger (UK)
Risk Ledger built the category’s most distinctive network model: suppliers join free, maintain one shared security profile, and buyers (banks, insurers, utilities, government) connect to it, giving the network visibility down to n-th-party layers. Founded 2018 in London by Haydn Brooks and Daniel Saul, GBP 9.8 million raised (GBP 6.25 million Series A led by Mercia in November 2023), the network passed 16,000 organisations with customers including Allica Bank, Anglian Water and Great Western Railway. It is deliberately assessment-based: the company argues external scanning cannot see internal controls, so it offers none, overlaying threat intelligence instead. For this report’s lens the boundaries are factual: UK-centred network coverage, English-only, buyer pricing quote-based, no DORA register tooling, and an ICP of enterprise and critical-national-infrastructure buyers rather than continental SMBs.
Strengths: network effects and n-th-party visibility, free-supplier economics, UK critical-infrastructure depth, and community-driven assessment reuse. Trade-offs: no registers or clocks, no technical scanning by design, English-only coverage centred on the UK, UK rather than EU sovereignty, and quote-based buyer pricing.
31. Aravo (US)
Aravo, founded 2000 in San Francisco by Tim Albinson and led since 2011 by CEO Michael Saracini, was named a Leader in the first Gartner Magic Quadrant for TPRM Tools in April 2026, capping a quarter-century of Global-2000 third-party lifecycle work. Its Intelligence First platform covers intake to offboarding including subcontractor tracking, with a DORA compliance application (vendor-claimed) and connectors streaming SecurityScorecard, Bitsight, RapidRatings and Dun & Bradstreet data; in April 2026 it shipped Aravo AI workflow agents. Its public profile is lopsided in an instructive way: analyst Leader status alongside scale claims whose own numbers disagree between the About page and press boilerplate, an inconsistency we flag per criterion 5.18. Pricing is custom enterprise; credible third-party benchmarks were not found; NIS2 coverage and EU residency were not found.
Strengths: enterprise lifecycle depth at Global-2000 scale, Gartner Leader standing, data-connector ecosystem, and twenty-six years of operating history. Trade-offs: no published pricing or credible benchmarks, no EU residency evidence, no NIS2 coverage found, undocumented localisation, and public scale claims that disagree with each other.
32. Certa (US)
Certa reached the Leaders quadrant of Gartner’s first TPRM Magic Quadrant in its first appearance, a striking result for a company founded 2016 (some profiles say 2019) by Jag Lamba. Its no-code, AI-first third-party operating system orchestrates the full lifecycle across cyber, compliance, financial, ESG and geopolitical domains, with sub-tier supply-chain visibility, 100+ data-source integrations, sanctions and UBO screening, and named enterprise outcomes at Uber and Box (vendor-published case studies). It holds SOC 2 Type II and ISO 27001 for itself, claims 50+ platform languages, and raised a USD 35 million Series B in 2023. What it does not show: any DORA or NIS2 coverage (none found on its site), EU data-residency statements, or public pricing.
Strengths: no-code workflow orchestration breadth, multi-domain risk coverage (ESG, forced labour, trade), Gartner Leader standing, integration count, and claimed language breadth. Trade-offs: no DORA or NIS2 coverage was found at all, no EU residency statements, no public pricing, no native scanning, and few European reference points.
33. Whistic (US)
Whistic, founded 2015 in Utah, pioneered the trust-network model: a Trust Catalog of nearly 15,000 company profiles (vendor-claimed), AI assessments across 50+ frameworks, and, since March 2026, native vendor breach monitoring, an unusual in-house capability in this family (external ratings still arrive via Bitsight and RiskRecon integrations). Its own certifications include ISO 27001, ISO 42001 and SOC 2. The corporate story wobbled in the research window: long-time CEO Nick Sorensen departed in 2025 with founder Juan Rodriguez returning as CEO, and third-party trackers estimate headcount fell by roughly a third year-on-year to around 87 (estimates). Pricing is quote-only with a Vendr-reported average near USD 20,600 (range roughly USD 12,700 to 43,600). DORA and NIS2 support is marketing-content level; EU residency was not found.
Strengths: trust-network reach, AI assessment maturity and its accuracy tooling, native breach monitoring, and its own certification stack including ISO 42001. Trade-offs: EU support is marketing-content level, pricing averages USD 20,600 (Vendr), no EU residency was found, and the research window recorded a CEO change and an estimated one-third headcount reduction.
43. Venminder, an Ncontracts company (US)
Venminder is the US financial-institution specialist of this family: unlimited-user TPRM tooling plus a human due-diligence factory (”Vendiligence” assessments, vendor-claimed at 30,000+ risk-rated assessments annually) serving banks and credit unions, acquired by Ncontracts in September 2024 through an Hg-led buyout (linked in Part 4.5) that put the combined business past 5,000 FI customers (vendor-claimed). Its continuous monitoring (Venmonitor) aggregates partner intelligence including SecurityScorecard rather than a native scanner. It is among the few in the family with a hard public price point: its AWS Marketplace listing shows the Enterprise platform at USD 125,000 for a twelve-month contract (Appendix B). Its EU story is blog-level guidance on DORA and NIS2 with no product mechanics, no EU residency found, and a North-American centre of gravity; its own founding year is reported inconsistently (2001 against roughly 2012 to 2015), which we note rather than resolve.
Strengths: outsourced human assessment capacity, US banking-regulation depth, operating track record, and parent-company breadth in FI compliance. Trade-offs: its EU story is blog-level with no product mechanics or residency, the published Enterprise tier is USD 125,000 per year, monitoring is partner-fed, and its centre of gravity is North American.
55. apexanalytix (US)
apexanalytix of Greensboro has protected supplier payments since 1988 and became a 2026 Gartner Leader, in the Supplier Risk Management Solutions Magic Quadrant rather than the TPRM Tools one, a distinction that maps exactly to what it is: supplier master data, onboarding portals (apexportal), overpayment and fraud prevention across USD 10 trillion+ of claimed annual spend, recovery audits, and, since acquiring Darkbeam in 2023, native supplier cyber monitoring. KKR took a majority stake in July 2022. Its European Centre of Excellence markets NIS2 and CSRD gap-closing across supplier bases (vendor-claimed), and a commissioned Forrester TEI study models a composite 20,000-supplier enterprise paying roughly USD 200,000 per year (estimate). This is procurement-side risk for global enterprises; a 100-vendor NIS2 programme is not its shape.
Strengths: supplier financial and fraud controls, native cyber monitoring at supplier-portfolio scale, global supplier data assets, and enterprise procurement integration. Trade-offs: no compliance-programme mechanics (registers, clocks, audit evidence), enterprise-composite pricing near USD 200,000 per year, US ownership, and procurement rather than audit-facing NIS2/DORA workflow.
65. Templar Shield (US)
Templar Shield of San Diego, founded 2013 by Nicholas Friedman, appears in TPRM vendor lists but is a professional-services and reseller firm, not a platform vendor, and this report classifies it accordingly. It implements and operates TPRM programmes on ServiceNow Vendor Risk Management as an Elite ServiceNow partner, resells Black Kite ratings (a value-added reseller since 2021, with a ServiceNow Store integration app), and in January 2026 signed a global delivery partnership with CDW. It claims 300+ global clients and 100+ Fortune 1000 engagements (vendor-claimed) with roughly 58 employees (estimate); it publishes no pricing and states no security certifications of its own. Organisations already committed to ServiceNow may find it a capable delivery partner; organisations comparing software platforms should read this entry as a category clarification.
Strengths: ServiceNow implementation expertise and enterprise services delivery capacity. Trade-offs: it is not a product: there is no platform, pricing, or product record to compare, which is the finding.
Part 2, Section D. Family D Profiles: Security Ratings and External Telemetry Platforms
The ratings family operates the scanning engines the rest of the market licenses or lacks. Note the structural fact from Part 4.4: Gartner’s first TPRM Magic Quadrant did not evaluate this family at all, treating ratings as a separate discipline. For most buyers in this report’s lens, these platforms complement a compliance programme rather than replace one; the profiles state where each blurs that line.
5. UpGuard (US/Australia)
UpGuard is the crossover platform of the ratings family: a genuine security-ratings engine with public pricing, which makes it the one ratings vendor an SMB can actually budget for. Vendor Risk starts at USD 1,750 per month billed annually for 50 monitored vendors (USD 21,000 per year), with a freemium tier monitoring a handful of vendors at no cost. Its momentum is verifiable: a USD 75 million Series C closed February 2026 (Part 4.5) on top of roughly USD 121 million in total funding. The trade-offs for an EU compliance buyer are equally factual: NIS2 and DORA exist as questionnaire mappings rather than native mechanics, there is no register-of-information generator, EU data residency is a paid arrangement rather than the default, the platform is English-first, and fourth-party monitoring is gated to the Corporate tier.
Strengths: ratings depth and telemetry (a dedicated engine with historical trending), market footprint, self-serve evaluation, integrations, and brand recognition. Trade-offs: NIS2 and DORA are questionnaire mappings without mechanics, the entry tier is USD 21,000 per year, ownership is US with EU residency as a paid arrangement, the platform is English-first, and it is a monitoring layer rather than the compliance programme an auditor asks for.
9. SecurityScorecard (US)
SecurityScorecard operates the largest rated universe in this report: more than 12 million organisations continuously scored across ten risk-factor groups, founded 2013 by Aleksandr Yampolskiy and Sam Kassoumeh, roughly USD 292 million raised at a 2021 unicorn valuation. It is also the ratings vendor that has leaned hardest into EU regulation, with productised DORA and NIS2 packaging, and the most acquisitive: HyperComply (September 2025) added AI questionnaire automation and Driftnet (May 2026) added internet-scanning depth, while its MAX offering turns the platform into a managed supply-chain detection and response service. The boundaries: what it productises for DORA and NIS2 is the monitoring slice, not registers, clocks or evidence workflows; pricing is quote-only at reported USD 15,000 to 35,000 entry and well beyond for enterprise portfolios (estimates); no EU-only residency guarantee was found; and the platform is English-first.
Strengths: telemetry scale and history, threat-intelligence depth, AI questionnaire automation via HyperComply, managed-service option, analyst and market presence, and integrations. Trade-offs: no registers, clocks or audit-evidence workflows, reported entry pricing of USD 15,000 to 35,000, no EU-only residency guarantee, and an English-first platform.
16. Panorays (US/Israel)
Panorays pairs a native scanning engine with automated questionnaires, the combination this report’s lens rewards most, executed at enterprise depth and enterprise price. Founded 2016, roughly USD 62 to 67 million raised, it pairs a native external attack-surface engine (continuous ratings of vendors) with automated questionnaires and business-context weighting (Risk DNA), and in November 2025 became the first TPCRM platform certified to ISO/IEC 42001 for AI governance; in Q2 2026 Forrester named it a Leader in its Cybersecurity Risk Ratings Wave. It is security-led rather than regulation-led: no DORA register generator or NIS2 incident clocks were evidenced, EU data residency is not published, and pricing is quote-based with third-party estimates around USD 30,000 entry (Vendr-derived, estimate).
Strengths: scanning and ratings depth (a true continuous engine with history), AI governance certification, analyst recognition, questionnaire automation maturity, and enterprise references. Trade-offs: no register or clock mechanics, estimated entry around USD 30,000, a US parent with unpublished EU residency, and English-first operation.
18. Bitsight (US)
Bitsight invented the security-ratings category in 2011 and remains its institutional heavyweight: Moody’s is its largest shareholder after a USD 250 million investment in 2021 valuing the company at roughly USD 2.4 billion (a minority stake, not an acquisition), total funding exceeds USD 465 million, and its December 2024 acquisition of Cybersixgill (roughly USD 115 million) added dark-web threat intelligence. Current public materials cite around 40 million companies monitored and roughly 68,000 to 75,000 vendor profiles in active use, with about 3,500 customers and USD 200 million+ ARR reported in April 2025. It sells ratings, quantification and fourth-party analytics, not compliance programmes: no registers, no clocks, mapped-level EU regulatory content, quote-only pricing at reported USD 20,000 to 200,000+ (estimates), and no default EU-only residency.
Strengths: ratings authority and financial-market credibility, telemetry scale and history, cyber risk quantification, fourth-party analytics, and enterprise installed base. Trade-offs: no compliance mechanics of any kind, reported pricing of USD 20,000 to 200,000+, no default EU-only residency, and English-first operation. For most readers it is a data layer to add later, not a compliance programme.
40. Black Kite (US)
Black Kite, founded 2016 as NormShield and rebranded in January 2021, differentiates on translating vendor cyber risk into money and probability: FAIR-based financial impact estimates, a Ransomware Susceptibility Index, and since August 2025 an Adversary Susceptibility Index mapping vendors to specific threat actors, all built on native OSINT scanning. Its Vendor Compliance module auto-maps assessment evidence to ISO 27001, GDPR, DORA and NIS2 simultaneously, an unusually direct EU hook for this family. The company claims 3,000+ customers and a 70 percent five-year growth rate (vendor-claimed, November 2025) and holds SOC 2 Type II and ISO 27001:2022 itself. Forrester placed it as a Strong Performer in its ratings Wave. Pricing is quote-only; Vendr reports a median near USD 29,000 (estimate). EU residency was not found.
Strengths: risk quantification (FAIR dollar modelling), threat-actor intelligence, native scanning depth, and enterprise installed base. Trade-offs: its compliance mapping enriches assessments but does not run registers, clocks or evidence, the Vendr-reported median is near USD 29,000, EU residency was not found, and the platform is English-first.
41. RiskRecon, a Mastercard company (US)
RiskRecon, incorporated 2015 in Utah and acquired by Mastercard in a deal announced December 2019, delivers objective external ratings with independently certified asset-attribution accuracy (vendor-claimed at 99.1 percent) and vendor-specific remediation plans. Inside Mastercard’s cybersecurity portfolio (alongside Recorded Future, acquired December 2024), its 2025-2026 story is partner-led: assessments powered by Whistic (March 2025), healthcare TPRM through CORL (August 2025), and a Cloudflare partnership (February 2026). Founder Kelly White now carries a Founder and Advisor title, and no standalone CEO is listed; the team page is headed by a Mastercard executive. DORA and NIS2 support is blog-level, EU residency was not found, and pricing is quote-only with a free 30-day trial for up to 50 vendors.
Strengths: ratings accuracy methodology, Mastercard-grade data governance and distribution, and free-trial telemetry for small portfolios. Trade-offs: no compliance mechanics, blog-level EU regulatory depth, a partner-led roadmap with no standalone CEO, and quote-only pricing.
60. FortifyData (US)
FortifyData of Acworth, Georgia (founded around 2015 by former CISO Victor Gamra, roughly USD 7 million raised) consolidates six modules, attack-surface management, TPRM, cyber GRC, vulnerability management, ratings and enterprise risk, into one platform whose distinguishing idea is validation: vendor questionnaire answers are cross-checked against live scan data, and a January 2026 AI Auditor reviews compliance documents. Its GRC module maps to ISO 27001, DORA, NIS2 and GDPR alongside US frameworks, and it completed its own SOC 2 Type II in January 2025. The visibility gap is the finding: no analyst placements, a team estimated around 20 people, and quote-only pricing with a Vendr-reported median near USD 21,000 (estimate). Named customers include Nike and UNICEF (vendor-claimed at its 2022 funding).
Strengths: scan-validated questionnaires, consolidated exposure management for the customer’s own estate, and US framework breadth. Trade-offs: EU mechanics and residency were not found, the public footprint remains minimal despite a decade of operation, localisation is thin, and the Vendr-reported median sits near USD 21,000.
Part 2, Section E. Family E Profiles: Enterprise GRC and IRM Suites With TPRM Modules
The suites run enterprise risk as a whole, and third-party risk as one application among many. Ten of the seventeen platforms below were evaluated in the 2026 analyst cycle (Gartner’s TPRM Magic Quadrant or Forrester’s TPRM Wave), and none of them competes at SMB prices. A consistent technical pattern runs through the family: no native external scanning anywhere; every cyber-telemetry capability arrives through partner feeds.
23. 6clicks (Australia)
6clicks of Melbourne (founded 2019 by Anthony Stevens, Louis Strauss and Andrew Robinson, roughly USD 25.9 million raised plus a USD 20 million investment programme announced February 2026) is the family’s sovereignty specialist: on 11 June 2026 it launched a Sovereign GRC infrastructure line spanning hyperscaler, local cloud, self-hosted and an air-gapped certified appliance, aimed at governments and MSSPs running its Hub and Spoke multi-entity architecture with the Hailey AI engine. DORA is genuinely productised; NIS2 exists as mapped content without national transpositions; TPRM is an included assessment-based module with no external scanning. Pricing is officially custom; the USD 4,800 and 18,000 to 19,000 tier figures in circulation appear only in third-party listings and are treated here as estimates.
Strengths: sovereign and air-gapped deployment options, multi-entity MSSP architecture, framework library breadth, and all-inclusive licensing at enterprise scale. Trade-offs: English-first localisation, no NIS2 national mechanics or incident clocks, no vendor scanning, custom pricing, and little CEE/SE-Europe presence.
24. Centraleyes (US/Israel)
Centraleyes (legally CyGov Ltd, founded 2016, roughly USD 2.8 million disclosed funding, a team of about 21) packs the deepest third-party module of the small cyber-GRC platforms: a metered vendor-risk module beside the first-party risk module, automated questionnaires, threat-intelligence enrichment of vendor profiles built on feeds and scanner integrations rather than a native engine, and unusual extras such as a Greek NIS2 self-assessment tool aligned to the national portal and an AI governance module mapping NIST AI RMF and ISO 42001. Hosting spans Israel, the US and the EU per its privacy policy; EU-only residency is not offered. Its public footprint is thin for a nine-year-old company, pricing is quote-only with unverified third-party ranges of USD 10,000 to 100,000, and NIS2/DORA remain mappings.
Strengths: breadth of risk-framework content, FAIR-style quantification options, threat-intel enrichment of vendor records, and single-day deployment claims at mid-market depth. Trade-offs: hosting spans Israel, the US and the EU with no EU-only option, its intelligence is feed-based rather than active scanning, pricing is quote-only with wide unverified ranges, and clocks and registers are absent.
29. LogicGate (US)
LogicGate‘s Risk Cloud earned the family’s strongest 2026 analyst season: a Leader in the Forrester Wave for TPRM Platforms Q1 2026, a Leader in the Forrester GRC Wave Q2 2026, and a vendor-announced Leader placement in Gartner’s GRC Tools Magic Quadrant. Founded 2015 in Chicago (roughly USD 156 million raised, PSG-led Series C), it sells TPRM as a flagship no-code application with SIG, CAIQ and NIST questionnaire packs, AI autofill at no extra cost, and agentic intake and assessment workflows in early access. External ratings arrive from SecurityScorecard, Black Kite and Vital4 integrations. A DORA Compliance Suite is genuinely productised; NIS2 is mapped guidance; data hosting offers a choice among four unnamed data centres; UI languages were not found. Pricing is quote-only; Vendr reports a median near USD 52,600 (estimate). Founder Matt Kunkel handed the CEO role to Diego Panama effective July 2026.
Strengths: analyst standing (triple Leader placements), no-code workflow flexibility, questionnaire-standard breadth, AI agent maturity, and enterprise references. Trade-offs: a Vendr-reported median near USD 52,600, US hosting in unnamed data centres, partner-fed ratings rather than scanning, mapped NIS2 guidance, and undocumented UI languages.
30. Hyperproof (US)
Hyperproof of Seattle (founded 2018 by Craig Unger, USD 66.5 million raised) bought its way into TPRM by acquiring Expent.ai in October 2025 (linked in Part 4.5) and shipped the result on 28 April 2026: an AI-native, evidence-based vendor module whose RiskAI reads SOC 2 reports, certificates and pen tests for gaps, backed by a vendor catalogue, tier-based reassessment and native scanning of public sources for breach and legal signals (vendor-claimed; no ratings-style engine). NIS2 and DORA sit among 160+ supported frameworks as templates, and, rare in this family, EU data residency is documented (Azure data centres in the United States and Europe). It holds its own SOC 2 while its ISO 27001 is not stated; pricing is quote-only with a Vendr median near USD 39,900 (estimate). One third-party tracker reported a 20 percent workforce reduction in December 2025, which remains company-unconfirmed and is noted as exactly that.
Strengths: AI document-analysis depth on vendor evidence, framework count, and public-signal breach monitoring. Trade-offs: NIS2 and DORA are templates without clocks or registers, monitoring is public-signal rather than active domain scanning, the Vendr median sits near USD 39,900, and the TPRM module was weeks old at research time.
36. ServiceNow TPRM (US)
ServiceNow’s Third-Party Risk Management, the renamed Vendor Risk Management application, is the strongest argument in this family for buying TPRM where the workflows already live: vendor inventory, assessments, scoring and remediation run natively on the Now Platform beside ITSM, security operations and GRC, with Bitsight and SecurityScorecard integrations supplying external ratings (score drops can auto-trigger assessments). The company’s scale is its own category: USD 13.28 billion revenue in FY2025, EU data-centre pairs in Amsterdam-Dublin and Dusseldorf-Frankfurt, ISO 27001 since 2012. The boundaries matter equally: it was not among the 15 vendors in Gartner’s TPRM Magic Quadrant, NIS2 and DORA are partner-configured mappings rather than products, and pricing is quote-only with third-party estimates of USD 30,000 to 100,000 per year for TPRM alone and far more for full GRC deployments.
Strengths: enterprise workflow integration (the deepest in this report), platform scale and stability, EU data-centre infrastructure, and partner ecosystem. Trade-offs: TPRM cannot be bought without the platform estate, NIS2 and DORA are partner-configured mappings, estimates run USD 30,000 to 100,000 for TPRM alone, and deployment is a platform project.
37. Archer (US)
Archer, the platform that carried the RSA name for a decade and has been owned by European private-equity firm Cinven since July 2023, was named a Leader in the Forrester Wave for TPRM Platforms Q1 2026 and claims a history of 24 Leader placements across risk-management evaluations (vendor-claimed). Its Third Party Governance solution is genuinely deep: a third-party catalogue that includes contracts and responsible owners, engagement-level residual risk across eight categories including fourth-party risk, a vendor-facing portal (Archer Engage), and SecurityScorecard integration for external ratings. Its 2025 Evolv line adds AI-native SaaS with DORA and EU AI Act forward-modelling (vendor-claimed). The trade-offs are enterprise-classic: quote-only pricing (estimates from roughly USD 14,000 for minimal scopes to USD 300,000+), no published EU-residency specifics for Archer SaaS, and genuine implementation weight.
Strengths: workflow and catalogue depth, fourth-party risk modelling, Forrester Leader standing, enterprise references across 1,200+ clients (vendor-claimed), and configurability. Trade-offs: estimates reach USD 300,000+ with heavyweight implementations, EU residency specifics are unpublished, external ratings are partner-fed, and NIS2 mechanics are thin.
38. Onspring (US)
Onspring of Overland Park (founded 2010 by Chris Pantaenius, founder-led with no outside institutional ownership found) is the family’s quiet overachiever on ease of use. Its no-code TPRM solution covers the full lifecycle including documented n-th-party tracking, an uncommon feature at this tier, with vendors answering surveys through an email link without logins; external monitoring arrives through unnamed partner integrations. It was among the 15 vendors evaluated in Gartner’s TPRM Magic Quadrant (placement not public). The EU picture is the thinnest in the family: no NIS2 or DORA content was found at all, no EU residency statement, and quote-only pricing (third-party estimates roughly USD 20,000 to 78,000).
Strengths: no-code flexibility, n-th-party documentation, and US federal options (a FedRAMP-authorised GovCloud edition). Trade-offs: no NIS2 or DORA content was found at all, no EU residency statement, no scanning, quote-only pricing, and English-first operation.
39. MetricStream (US)
MetricStream, the San Jose ConnectedGRC veteran founded 1999 (roughly USD 351 million raised, estimate), rebranded around an AI-first strategy in May 2025 under new CEO Marc Levine and closed the research window with a distinction none of its rivals matched: Chartis Research ranked it first in Enterprise GRC and a Category Leader in all seven categories including third-party risk (30 June 2026; release listed in Appendix B). Its TPRM line is complete to the point of including a dedicated fourth-party risk product, with continuous monitoring fed by Bitsight, SecurityScorecard, Dow Jones and D&B integrations. DORA is addressed through a resilience solution positioning and NIS2 through common-controls content, both mapped rather than register-native; EU hosting specifics were not found, and pricing estimates run USD 75,000 to 1 million+ per year.
Strengths: enterprise GRC breadth, dedicated fourth-party product, Chartis standing, data-partner ecosystem, and regulated-industry depth. Trade-offs: estimates run USD 75,000 to 1 million+ per year, EU hosting specifics were not found, EU regulations are mapped, monitoring is partner-fed, and deployments are heavyweight.
42. IBM OpenPages (US)
IBM OpenPages, the GRC platform IBM acquired in 2010 and now infuses with watsonx, is one of only two enterprise suites here with published pricing: the Essentials SaaS edition from USD 3,300 per month (one solution, ten users) and Standard from USD 6,050 per month, with the TPRM module reported as an add-on around USD 48,000 per year (estimate). It was named a Leader in the October 2025 Gartner Magic Quadrant for GRC Tools, and in November 2025 answered the sovereignty question with OpenPages as a Service from IBM Cloud Germany, keeping data under EU jurisdiction. Its TPRM module manages third-party hierarchies, assessments and workflow, with continuous monitoring via SecurityScorecard, RiskRecon, RapidRatings and Supply Wisdom connectors; watsonx can watch vendor news and filings (vendor-claimed). It was not among the TPRM Magic Quadrant’s 15 vendors, and NIS2 and DORA packaged modules were not found.
Strengths: enterprise AI governance integration (watsonx), GRC MQ Leader standing, published enterprise pricing, German-cloud EU residency, and IBM-scale stability. Trade-offs: the USD 3,300-per-month floor prices out small buyers, TPRM is an extra-cost module (reported ~USD 48,000 per year, estimate), NIS2/DORA modules were not found, monitoring is partner-fed, and deployment is enterprise-paced.
44. NAVEX One (US)
NAVEX, formed in 2012 from a four-company merger and majority-acquired in October 2025 by a Goldman Sachs Alternatives-led consortium with Blackstone as a significant minority investor, runs ethics and compliance for a claimed 13,000 organisations including roughly three-quarters of the Fortune 100. Its NAVEX One platform treats third-party risk as one pillar: RiskRate screening and monitoring feeds (sanctions, watchlists, adverse media), IRM assessments from the 2019 Lockpath acquisition, and lifecycle workflow from onboarding to renewal. Language reach is real but specific to intake: telephone interpretation in 150+ languages and web intake in 75+ (vendor-claimed; not necessarily the admin UI). It achieved its own ISO 27001 in December 2025, hosts in North American and EU data centres, and was evaluated in both 2026 TPRM analyst reports without a public placement. NIS2 is a mapped solution page, DORA is content, and cyber ratings are absent. Pricing is quote-based (third-party estimates from roughly USD 500 to 10,000+ per month across suites).
Strengths: ethics and whistleblowing infrastructure, screening-feed breadth, enterprise installed base, and intake language coverage. Trade-offs: cyber TPRM substance is thin (no scanning, no ratings partners found), NIS2 is a mapped page and DORA is content, pricing is quote-based, and admin-UI localisation is undocumented.
45. Riskonnect (US)
Riskonnect of Kennesaw (founded 2007, TA Associates-backed) has spent a decade absorbing the risk-software shelf: Marsh ClearSight (2018), Ventiv (January 2024), Camms (June 2024), plus business-continuity and project-risk lines, and in February 2026 launched an Intelligent Risk Framework of AI agents built on Salesforce Agentforce 360 spanning its portfolio including third-party risk. Its TPRM module covers onboarding portals, tiered questionnaires, scheduled reassessment, a genuine contract register and alerting; external ratings partners are referenced but unnamed; fourth-party capability was not found. It claims 2,700+ customers and 1,500+ staff (vendor-claimed). DORA and NIS2 are content hubs rather than products, and no register-of-information capability was found; EU residency rests on unstated Salesforce infrastructure choices; one product line (Active Risk Manager) carries a public UK G-Cloud price document, a rare transparency point. Estimates run from roughly USD 35,000 into the high six figures with implementation.
Strengths: integrated-risk breadth (insurable risk to ERM), contract-register maturity, AI agent investment, and enterprise scale. Trade-offs: DORA and NIS2 are content hubs without a register capability, EU residency rests on unstated infrastructure choices, ratings partners are unnamed, and estimates run from USD 35,000 into six figures.
46. SAI360 (US)
SAI360, the Chicago GRC-and-EHS platform whose lineage runs from Standards Australia through BPEA EQT to Symphony Technology Group (owner since January 2023), sells TPRM inside its Risk Management Professional and Enterprise bundles: standardised questionnaires (SIG, NIST CSF, CAIQ, CIS, VSA), tier-scaled assessments, a real contract register with adverse-term flagging, and monitoring fed by SecurityScorecard, LSEG World-Check and Argos Risk. Its unusual angle is integrated compliance training: vendors themselves can be assigned learning modules. May 2026 brought GRC Elevate 6.0 with embedded AI, and December 2025 the acquisition of regulatory-intelligence firm Plural Policy. A dedicated DORA page maps six modules to the regulation’s pillars (no register generator found); a NIS2 product page was not found; EU hosting regions are unstated despite Dutch, German and Lithuanian offices. It was MQ-evaluated without public placement; pricing is quote-only.
Strengths: GRC-plus-EHS breadth, vendor compliance training, questionnaire-standard coverage, and screening-partner depth. Trade-offs: no NIS2 product page was found, no register generator, EU hosting regions are unstated despite EU offices, monitoring is partner-fed, and pricing is quote-only.
47. Resolver, a Kroll business (Canada)
Resolver of Toronto (founded 2000, acquired by Kroll in March 2022, led since May 2024 by President Kam Rawal) approaches third-party risk from corporate-security and risk-intelligence roots, amplified by the ex-Crisp online-threat capability folded in during 2024. Its TPRM module offers SIG and SIG Lite questionnaires, a vendor portal, a contract register and reassessment workflows; no ratings partners are named and no scanning exists. It answers the residency question better than most of the family: AWS hosting with customer choice of region including Europe. DORA and NIS2 are handled through educational content and Kroll advisory rather than product mechanics. Its 2026 recognition came from QKS Group’s SPARK Matrix (GRC Leader) rather than Gartner or Forrester; third-party listings put a starting price around USD 10,000 per year (estimate); its own SOC 2 or ISO certificates were not found on public pages.
Strengths: corporate-security and threat-intelligence context, Kroll services depth, region-choice hosting, and incident-response adjacency at enterprise scale. Trade-offs: DORA and NIS2 are advisory content rather than product mechanics, there is no scanning and no named ratings partner, its own certifications are not published, and third-party listings start around USD 10,000.
48. Mitratech Alyne (Germany/US)
Alyne, founded 2015 in Munich and acquired by Mitratech in September 2021, is the German-engineered GRC layer of a portfolio that also contains Prevalent (profiled separately above), and Mitratech’s March 2026 Global GRC Platform launch consolidated both under an agentic AI layer (ARIES) with Alyne co-founder Manuel Reil as the division’s CTO and Chief AI Officer. Alyne brings 1,500+ control and assessment templates, risk quantification via a simulation engine, vendor-claimed third-, fourth- and n-th-party risk monitoring, DORA-mapped library content and a NIS2 landing page claiming article-aligned controls; Black Kite and SecurityScorecard integrations are reported by independent product analysis. The same analysis states plainly that Alyne’s strength lies in ERM and ISMS while Mitratech’s specialised TPRM offering is Prevalent, and this report profiles them separately for exactly that reason. Alyne holds its own ISO 27001 since 2017 (vendor-claimed); UI languages include German, English, French, Spanish and Chinese; pricing is quote-based with third-party listings starting near EUR 25,000 (estimate).
Strengths: control-library scale, risk quantification, German-language enterprise heritage, and the resources of the Mitratech portfolio. Trade-offs: TPRM depth within Alyne itself is limited (its own group points TPRM buyers to Prevalent), listings start near EUR 25,000, monitoring is partner-fed, and register and clock mechanics are absent.
49. LogicManager (US)
LogicManager of Boston, founded 2005 and still run by founder Steven Minsky without outside institutional ownership, made both 2026 analyst rosters (among the 15 in Gartner’s TPRM Magic Quadrant and the 12 in Forrester’s TPRM Wave) without a public placement in either, a distinctive profile for a bootstrapped firm whose last major press release dates to 2021. Its Third Party Risk solution covers inventory and tiering, domain-based due diligence, contractual risk controls that check SLA, indemnification and audit-rights clauses against risk tier, and breach-escalation workflows, with external monitoring via an Integration Hub that includes Bitsight and RiskRecon. Hosting runs on Oracle Cloud with a customer choice of USA, EU, Middle East or APAC regions. NIS2 and DORA content was not found; ISO 27001 and GDPR are mapped libraries; unlimited internal and external users are included in its published Job-to-be-Done pricing model, though no figures are public (third-party tier estimates roughly USD 10,000 / 30,000 / 150,000).
Strengths: contractual-controls sophistication, ERM integration depth, unlimited-user licensing, and two decades of bootstrapped stability. Trade-offs: no NIS2 or DORA content was found, monitoring is partner-fed, the pricing model is published without figures, the last major press release dates to 2021, and localisation is undocumented.
50. GAN Integrity (US/Denmark)
GAN Integrity began in Copenhagen in 2004 as Global Advice Network and now runs an ethics-and-compliance Integrity Platform from New York, London and Copenhagen, backed by Aquiline and, since 2023, an Apax impact-fund growth investment. Its third-party pillar is integrity-led: risk-based due-diligence questionnaires, AI screening across watchlists, PEPs and adverse media (Integrity Essential, 2024), LLM-generated enhanced due-diligence reports in minutes (Integrity Enrich, April 2025, extended October 2025 to network risk intelligence over hidden ownership), and continuous monitoring, with data from Moody’s, Sayari and Control Risks; no cyber-ratings partner or scanning exists, and no NIS2 or DORA content was found. Its own product page states a Challenger placement in the 2026 TPRM Magic Quadrant (vendor-stated; Gartner’s grid is not public). Pricing is quote-only with no credible estimates, its own certifications are attributed to its data centres rather than stated for the company, and CEO Helen Rosen leads following Nick Manolis.
Strengths: anti-bribery and integrity due-diligence depth few cyber-led platforms attempt, AI-generated EDD reports, and multinational ethics-programme workflow. Trade-offs: cyber TPRM substance is absent, no NIS2 or DORA content was found, there is no scanning, pricing is quote-only without estimates, and EU residency is unclear.
52. Wolters Kluwer OneSumX and TeamMate+ (Netherlands)
Wolters Kluwer, the Alphen aan den Rijn information group whose history reaches back to 1836 (EUR 6.1 billion 2025 revenue, roughly 21,100 employees, CEO Stacey Caywood since February 2026), presents this report’s most instructive gap between analyst standing and discoverable product. Chartis named its Financial and Corporate Compliance division a Category Leader in Third-Party Risk Management Solutions in August 2025, yet our research found no standalone OneSumX TPRM product: vendor-risk capability surfaces as vendor-management workflow inside TeamMate+ GRC (linking vendors to assessments and controls), while OneSumX itself concentrates on finance, risk and regulatory reporting for financial institutions, where its regulatory-content depth is genuinely formidable. No questionnaire exchange, continuous external monitoring, fourth-party mapping, ratings partners, DORA or NIS2 TPRM modules, or pricing signals were found. Buyers who see the Chartis badge should ask precisely which product it attaches to, which is criterion 5.2 in one sentence.
Strengths: regulatory-reporting content for banks (COREP, FINREP, Basel), corporate scale and stability, and financial-services analyst recognition. Trade-offs: no standalone TPRM product could be discovered, none of the lifecycle mechanics this report scores were found, and no pricing signals exist.
Part 2, Section F. Family F Profiles: Supply-Chain, Procurement and Financial Third-Party Risk
This family measures third-party risk in factories, finances and shipping lanes as much as in software. Gartner evaluates it in a separate Magic Quadrant (Supplier Risk Management Solutions) from the assurance-tool MQ, and this report keeps the same boundary: these are complements or neighbours to an ICT compliance programme, not substitutes for one.
53. Exiger (US)
Exiger is the reigning leader of the supplier-risk discipline: a Leader in the inaugural 2025 Gartner Magic Quadrant for Supplier Risk Management Solutions and again in 2026, positioned highest in execution and furthest in vision, with the US federal government as its anchor market (550+ customers claimed, including 60+ government and defence organisations). Founded 2013 to run the HSBC monitorship, majority-owned by Carlyle and Insight Partners since December 2023 (a reported USD 1.2 billion valuation, estimate), it assembled its 1Exiger platform partly by acquisition (Ion Channel, Versed AI, aDolus, XSB in 2023-2024), giving it multi-tier and even part-level supply-chain mapping plus native software-bill-of-materials security. It holds FedRAMP, SOC 2 Type II and ISO 27001 itself. DORA and NIS2 are thought-leadership content, not modules; EU residency was not found; pricing is quote-only with no credible public estimates.
Strengths: n-th-tier and component-level supply-chain illumination, due-diligence automation (DDIQ), software supply-chain security, government-grade accreditation, and analyst leadership in its own discipline. Trade-offs: no EU compliance mechanics (registers, clocks, evidence), no public pricing or credible estimates, thin EU-language coverage, and limited relevance to a 100-vendor ICT programme.
54. interos.ai (US)
Interos maps supply chains the way search engines map the web: an AI knowledge graph the company states covers 230 million+ entities and 11 billion+ buyer-supplier relationships down to the n-th tier, scored across six risk factors including a cyber model rebuilt in 2025 for real-time breach penalties. Founded 2005 by Jennifer Bisceglie, Arlington’s first unicorn after its 2021 USD 100 million Series C, it counts the US Department of Defense, NASA and Mastercard among named customers, and its AWS Marketplace listing shows a USD 100,000 twelve-month contract as a public anchor (Appendix B). Its 2025-2026 chapter is sober: USD 40 million (April 2025) and USD 20 million (January 2026, coverage) follow-on rounds with a stated aim of reaching breakeven by end-2026, and a Challenger placement in Gartner’s supplier-risk MQ whose write-up noted an English-only UI and a mostly North American base. There are no questionnaires, registers or compliance workflows; DORA and NIS2 exist as blog content.
Strengths: n-th-tier visibility at planetary scale, multi-factor risk telemetry (geopolitical, catastrophic, restrictions), and government-grade supply-chain analytics. Trade-offs: nothing a compliance programme requires (no questionnaires, registers or workflows), an English-only UI with no EU residency, and a USD 100,000 public price anchor.
56. SAP Ariba Supplier Risk (Germany)
SAP Ariba Supplier Risk embeds risk into the procurement flow itself: risk-exposure scores follow each supplier through onboarding, sourcing, contracting and purchase-to-pay across the SAP Business Network, informed by roughly 200 risk indicators and data partners including Dun & Bradstreet and EcoVadis (vendor-claimed). As a product of SAP SE of Walldorf, it carries the family’s strongest EU posture: EU data-centre choices (Frankfurt, Amsterdam, Paris and others), GDPR programmes, ISO 27001 and SOC attestations, and roughly 26 supplier-portal languages. SAP was a Leader in the 2025 and 2026 Source-to-Pay Magic Quadrants, though Ariba Supplier Risk was not among the vendors in Gartner’s dedicated supplier-risk MQ. Cyber posture arrives via third-party data and questionnaires rather than native scanning; NIS2 and DORA modules were not found; pricing is modular and unpublished (a commonly bundled lifecycle module is estimated around USD 25,000 per year for mid-size scopes).
Strengths: procurement-process integration, EU corporate heritage and data-centre breadth, supplier-portal language coverage, and enterprise network scale. Trade-offs: no registers or clocks, little use without an SAP procurement estate, enterprise cost and complexity, and procurement-paced deployment.
57. Coupa Supplier Risk (US)
Coupa folds third-party risk into total spend management: the TPRM engine it acquired with Hiperos in December 2018 digitises InfoSec, anti-bribery and GDPR questionnaires at the engagement level, continuous cyber signals arrive from a BitSight partnership, and AI can automatically hold high-risk suppliers inside procurement flows. Thoma Bravo took Coupa private for USD 8 billion in February 2023; CEO Leagh Turner arrived in November 2023; the 2025-2026 releases centre on agentic AI (Coupa Navi) and the Cirtuo acquisition. Its own certifications include ISO 27001:2022, ISO 27701 and SOC 1/2, with regional EU hosting options and a supplier portal supporting roughly 26 languages including Greek and Czech. NIS2 and DORA content was not found at all; supplier-risk depth beyond direct suppliers is limited; pricing is unpublished with Vendr estimates from roughly USD 50,000 to well past USD 500,000 for enterprise scopes.
Strengths: procurement-native risk enforcement (holds and approvals inside spend flows), community spend data at USD trillions scale, supplier-portal language breadth, and enterprise integration. Trade-offs: no NIS2 or DORA content was found, no compliance mechanics, Vendr estimates from USD 50,000 upward, and enterprise deployment weight.
58. RapidRatings (US)
RapidRatings rates the risk dimension almost everyone else ignores: supplier financial health. Its FHR rating, built on a framework developed in 1991 by economist Patrick Caragata and commercialised in the US from 2007, analyses private-company financial statements collected directly from suppliers through the FHR Exchange, now supplemented by RiskPulse (launched January 2026, powered by Creditsafe) monitoring 400 million+ entities daily (vendor-claimed). Clients include Verizon, Nokia and Unilever (vendor logos); AWS Marketplace lists public contract tiers at USD 70,000 and USD 110,000 per twelve months (Appendix B); the company is ISO 27001 and SOC 2 Type II certified itself; a new CEO, Charlie Minutella, arrived June 2025. There is no cyber capability of any kind, no NIS2 content, and DORA relevance is content-level.
Strengths: supplier financial-health analytics that cyber-led platforms barely touch, private-company financial data collection at scale, and Fortune-scale references. Trade-offs: no cyber or compliance capability of any kind (no scanning, no questionnaires beyond financials, no registers), no EU mechanics or localisation, and a public floor of USD 70,000 per year.
59. D&B Risk Analytics (US)
Dun & Bradstreet has scored businesses since 1841, and D&B Risk Analytics packages that data estate (550 million+ entities, vendor-claimed) into supplier and compliance intelligence: sanctions, PEP and adverse-media screening, beneficial-ownership mapping, predictive financial scores, continuous portfolio monitoring, and, notably for this report, cyber ratings powered by SecurityScorecard rather than any native engine. Clearlake Capital completed a USD 7.7 billion take-private in August 2025, installing ex-Moody’s Analytics president Stephen Tulenko as CEO in September 2025; in June 2026 the product gained agentic AI and an MCP server integrating with Anthropic’s Claude (vendor-claimed at 70 to 90 percent processing-time reductions). It carries a rare public price: the UK Government G-Cloud listing shows GBP 8,152 per licence per year with a 30-day trial. ISO 27001 covers its UK and European operations; NIS2 product coverage was not found; DORA is addressed by a position paper about D&B’s own posture.
Strengths: financial, sanctions and ownership data depth spanning two centuries of records, screening scale, and procurement-desk familiarity. Trade-offs: no ICT compliance mechanics, cyber ratings are resold from a partner rather than native, NIS2/DORA product coverage was not found, and it deploys as a data service rather than a compliance platform.
Part 3. The Numbers: Prices, Analysts, Sovereignty and Cost Scenarios
The numbers behind the profiles, consolidated: who publishes prices and what they are, where the 2026 analyst evaluations landed, who is EU-owned and EU-hosted, and what three realistic buying scenarios cost over three years. Every figure repeats a claim documented in the profiles; labels distinguish public list prices, marketplace listings, third-party estimates and vendor claims. Data as of July 2026.
3.1 Who publishes prices, and what they are
Platforms with genuinely public pricing (vendor page or public marketplace listing):
Everyone else in the field quotes only after a sales process. The most load-bearing third-party estimates used in this report (all labelled estimates in the profiles): Vanta median ~USD 20,000 (Vendr); Sprinto median ~USD 15,000 (Vendr); Whistic average ~USD 20,600 (Vendr); Black Kite median ~USD 29,160 (Vendr); FortifyData median ~USD 21,375 (Vendr); Thoropass median ~USD 30,700 (Vendr); Panorays entry ~USD 30,000 (Vendr-derived); Drata entry ~USD 7,500 to 15,000; Secureframe entry ~USD 7,500; OneTrust module floor ~USD 10,000 to 11,500 (Vendr median) with realistic deployments USD 50,000 to 300,000+; Prevalent USD 50,000 to 250,000+; Optro USD 40,000 to 150,000; MetricStream USD 75,000 to 1,000,000+; Coupa USD 50,000 to 2,000,000+.
Only 17 of the 68 ranked platforms publish an entry price anywhere public (vendor page, AWS Marketplace or UK G-Cloud); this chart shows all of them on a log scale, from Orbiq’s EUR 85 per month to Venminder’s USD 125,000 per year. The two-orders-of-magnitude spread is the single most useful fact a first-time buyer can absorb. Data: Part 3.1.
3.2 Analyst scoreboard, 2026 editions
Notable absences: the security-ratings platforms were not evaluated in the TPRM MQ; ServiceNow, IBM and Wolters Kluwer were not among its 15 vendors; and no EU SMB platform in Family A (including StartComply) appears in any of the above, which reflects inclusion thresholds rather than product quality, as Section 5.2 explains.
3.3 Sovereignty at a glance
EU-owned and EU-hosted: StartComply (GR), Venvera (BG), Copla (LT), Cyberday (FI), DataGuard (DE), Secfix (DE), Orbiq (DE), Securapilot (SE), SECJUR (DE), Formalize (DK, AWS Frankfurt), QuoIntelligence (DE), Enactia (CY, hosting unstated), Priority eQualSuite (GR, hosting unstated), Vendorica (LT, self-stated), eramba (UK company; self-hosting gives the customer control), SAP (DE, EU data centres). US-owned with EU hosting available: Vanta (Frankfurt opt-in), Sprinto (Frankfurt region), UpGuard (paid add-on), OneTrust, ServiceNow, IBM OpenPages (Germany, since November 2025), Hyperproof (Azure EU), LogicManager (Oracle EU), Resolver (AWS EU options), Coupa (regional models), Prevalent (arrangeable). No EU residency found in public documentation at research time: Drata, Secureframe (US/UK), Scytale, Scrut, Thoropass, Optro, Compyl, Continuum GRC, Aravo, Certa, Whistic, Venminder, apexanalytix, SecurityScorecard, Bitsight, Panorays, Black Kite, RiskRecon, FortifyData, Interos, Exiger, RapidRatings, MetricStream, CyberArrow. UK-centred: Risk Ledger, Neotas, D&B Risk Analytics (UK G-Cloud hosting).
3.4 Three cost scenarios (list and estimated prices, July 2026)
The scenarios below use public prices where they exist and clearly labelled third-party estimates where they do not. Currency conversions are avoided; each figure is shown in its vendor’s quoted currency. Full sourcing appears in the pricing table in 5.1 and the per-vendor profiles
Third-party risk management priced on its own, with no framework or policy packages, on published prices only. This is the comparison closest to the subject of this report: it is the only one where an EU SMB platform and an enterprise TPRM suite are buying the same thing. Log scale, because the field spans two orders of magnitude. Data: Parts 3.1 and 5.1.
Scenario 1: a 120-employee manufacturer, NIS2 important entity, 30 vendors, needs NIS2 plus ISO 27001.
The Part 3.4 scenario (120-employee manufacturer, NIS2 plus ISO 27001, 30 vendors) priced over three years and ordered from lowest to highest. Public prices are solid grey; estimates are violet and labelled. The second line under each platform records whether external scanning of vendor domains is included in that figure, because the same headline price does not buy the same scope. Data: Parts 3.4 and 3.1.
Under the modular pricing StartComply published in 2026, Copla, Cyberday and Venvera price below it for this multi-framework scenario. StartComply’s figure remains the only one that includes external scanning of each vendor’s domain, and its TPRM module alone (EUR 4,500 over three years) remains the lowest-priced structured TPRM line item in the report.
Scenario 2: a 400-employee financial entity under DORA, 80 ICT vendors, needs DORA plus ISO 27001 plus the register of information.
StartComply prices at EUR 10,500 per year under its modular model (DORA and ISO 27001 packages plus the TPRM module; three years EUR 31,500). Venvera Professional runs ~EUR 9,600 per year with genuinely strong DORA register tooling (xBRL-CSV export), which this report treats as the reference implementation in the segment. Copla prices DORA at ~EUR 4,500 per year plus its Registry product from ~EUR 500 to 600. The enterprise alternatives (OneTrust, ProcessUnity from USD 25,000, Prevalent at reported USD 50,000+) remain the right answer above roughly a thousand employees, and a ratings feed (SecurityScorecard, Bitsight, reported entry USD 15,000 to 35,000) is a defensible addition for concentrated ICT risk at any size.
Scenario 3: a 40-employee SaaS company selling to US enterprises, needs SOC 2 first.
StartComply is the wrong tool here and does not offer SOC 2 as a native framework. Vanta, Drata, Secureframe, Sprinto and Scrut are the natural shortlist, at reported entry prices between roughly USD 5,000 and 15,000 per year. This report’s ranking lens (EU regulatory buyers) simply does not apply to this scenario, and we say so rather than force a comparison.
Part 4. The State of the TPRM Market in July 2026
4.1 Why third-party risk became the centre of the compliance conversation
Third-party risk management, the discipline of assessing and monitoring the risk that suppliers and service providers introduce, has moved in a few years from a banking-sector speciality to a board-level obligation across the European economy. Three forces converged to cause that.
The first is structural, and it predates the current legislation by years: organisations now run on other organisations’ software and services, and attackers know it. The lesson arrived in instalments. The SolarWinds compromise disclosed in December 2020 turned one vendor’s software update into an intrusion vector for thousands of its customers; the Kaseya incident of July 2021 and the Log4Shell disclosure of December 2021 widened the pattern; and ENISA’s Threat Landscape for Supply Chain Attacks of July 2021 estimated that supply-chain attacks would quadruple in 2021 compared with 2020. The MOVEit Transfer exploitation of May and June 2023, documented in a joint CISA advisory, then showed the cascade at full scale, pushing breach notifications through thousands of downstream organisations via a single file-transfer supplier. By 2024, no European board could claim the risk was theoretical.
The second is regulatory, and it is the decisive one for European buyers. DORA, the EU’s Digital Operational Resilience Act, has applied to financial entities and their ICT providers since 17 January 2025, with an entire pillar devoted to ICT third-party risk and a mandatory register of information (sourced in Section 4.2). NIS2 extends cybersecurity duties, including explicit supply-chain security requirements and personal management liability, to hundreds of thousands of essential and important entities across 18 sectors. Section 4.2 details where its national implementations stood in July 2026.
The third is economic: assessing vendors by spreadsheet and email does not scale, and audit and regulatory scrutiny has made the gap visible. Software that automates the work has become one of the fastest-growing categories in security and compliance, which is exactly why choosing between the 68 platforms this report examines has become genuinely difficult.
4.2 The regulatory wave, dated and sourced
The demand behind this market is not hypothetical marketing; it is legislation with dates, and the dates explain the market’s growth curve.
The wave did not start in 2025, and reading it as new is a mistake; each current obligation has a dated ancestor. GDPR (Regulation (EU) 2016/679), adopted on 27 April 2016 and applicable since 25 May 2018, made processor due diligence a legal duty through Article 28 and put vendor relationships inside every European privacy programme. The EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02), published in February 2019 and applying from 30 September 2019, required banks, payment and e-money institutions to keep a register of all outsourcing arrangements, the direct ancestor of DORA’s register of information. The Court of Justice’s Schrems II judgment of 16 July 2020 (Case C-311/18) invalidated the EU-US Privacy Shield and forced transfer risk assessments onto every EU organisation using US-based processors, which is where many compliance teams first met structured vendor assessment. NIS2 and DORA themselves were adopted in late 2022 and published together in the Official Journal on 27 December 2022 (Directive (EU) 2022/2555), giving the market more than two years of visible runway before the deadlines that now drive purchases.
DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025 (EIOPA overview). Its register of information is now an annual operational reality: competent authorities submitted the first registers to the European Supervisory Authorities by 30 April 2025, feeding the designation of critical ICT third-party providers (ESMA timeline), and the 2026 cycle ran with a 31 December 2025 reference date and national submission windows in February and March 2026 (for example, Luxembourg’s CSSF portal opened 11 February 2026, CSSF notice). Whether a platform can generate that register in the ESAs’ xBRL-CSV format is therefore a concrete product question this report asks of every vendor.
NIS2 (Directive (EU) 2022/2555) was due for national transposition by 17 October 2024; only four member states met the deadline. As of May 2026, 22 of 27 member states had adopted transposing legislation (EC transposition tracker; status overview), and in July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failure to transpose (Commission press release). Article 21(2)(d) of the directive makes supply-chain security an explicit required measure, which is the legal root of most NIS2-driven TPRM purchases.
The national laws add local mechanics that platforms must model. Germany’s NIS2-Umsetzungsgesetz entered into force on 6 December 2025, expanding the regulated population from roughly 4,500 to roughly 29,500 entities with a three-month registration duty (Bundesgesetzblatt; analysis). The Netherlands adopted its Cyberbeveiligingswet on 7 July 2026, in force 15 August 2026 with no grace period (Bird & Bird alert). Greece transposed early via Law 5160/2024, in force 27 November 2024, operationalised through ministerial decisions in 2025 (EY summary).
Alongside the two EU flagships sit ISO/IEC 27001, whose 2022 revision (published October 2022) formalises supplier-relationship security in Annex A controls 5.19 to 5.23 for the certification market; GDPR Article 28, which has regulated processor relationships since 2018; and, in shipping, the IMO’s Maritime Cyber Risk Management framework (resolution MSC.428(98)), adopted in June 2017 and enforced through safety-management audits since the first annual Document of Compliance verification after 1 January 2021.
Nine dated milestones, from the missed NIS2 transposition deadline of October 2024 to the Dutch Cyberbeveiligingswet entering force on 15 August 2026. Sources in Part 4.2.
4.3 How big this market is, according to people who measure it
Estimates of the TPRM market’s size differ by methodology but agree on the direction, and their baselines predate the current regulatory rush. MarketsandMarkets sizes it at USD 8.57 billion in 2024, projecting USD 37.34 billion by 2035 at a 14.2 percent compound annual growth rate (MarketsandMarkets). Grand View Research estimated USD 7.42 billion in 2023, reaching USD 20.59 billion by 2030 at 15.7 percent, with Europe projected around USD 5.04 billion by 2030 (Grand View Research). Mordor Intelligence puts 2025 at USD 9.27 billion and 2031 at USD 20.71 billion at 14.34 percent (Mordor Intelligence).
The precise figures matter less than what they imply: a roughly USD 9 billion market growing at roughly 14 to 16 percent attracts capital, consolidation and marketing budgets, all three of which this report documents, and all three of which make independent comparison harder for buyers.
4.4 The analyst landscape: 2026 is the year TPRM got its own Magic Quadrant
Until this year, TPRM buyers navigated adjacent analyst categories. That changed on 6 April 2026, when Gartner published its first Magic Quadrant for Third-Party Risk Management Tools for Assurance Leaders, evaluating 15 vendor solutions (Gartner document page; a public reprint is listed in Appendix B). Five vendors placed in the Leaders quadrant, each confirmed by its own announcement: Diligent, OneTrust, Optro, the platform formerly known as AuditBoard (press release, 8 April 2026), Aravo and Certa, with the remaining Leader announcements listed in Appendix B. The reported evaluated roster also included Archer, GAN Integrity, LogicGate, LogicManager, MetricStream, NAVEX, Onspring, ProcessUnity, Riskonnect and SAI360; non-Leader placements were not publicly disclosed at the time of research.
Two absences from that roster are as informative as the placements. The security-ratings platforms (UpGuard, SecurityScorecard, Bitsight, Panorays) were not among the evaluated vendors, reflecting Gartner’s decision to treat assurance tools and cyber-ratings services as different categories; Gartner separately published a 2026 Magic Quadrant for Supplier Risk Management Solutions covering the procurement side (document listed in Appendix B). And the entire EU SMB family of this report (StartComply, Venvera, Copla, Cyberday, Secfix, Orbiq and peers) is absent, which reflects inclusion criteria built around scale, not an assessment of fit. A small European buyer reading the Magic Quadrant should understand that its shortlist was assembled for a different buyer than them.
Forrester published The Forrester Wave: Third-Party Risk Management Platforms, Q1 2026, a 27-criterion evaluation of 12 platforms; ProcessUnity, LogicGate and Archer announced Leader placements (Archer’s release, 18 March 2026; the other announcements are listed in Appendix B). Forrester’s broader Landscape report (Q3 2025) catalogued 29 vendors (Forrester).
Forrester also published its first GRC Platforms Wave in Q2 2026, and Vanta announced a Leader placement in its first inclusion (20 May 2026; announcement listed in Appendix B).
This report uses all of these signals and weights them for what they are: strong evidence about the enterprise tier, weak evidence about the SMB tier, and no evidence at all about the newest entrants, exactly as Section 5.2 explains.
4.5 The consolidation wave, dated and sourced
The market is consolidating quickly enough that several vendors in this report changed owners or names during the research window. The dated sequence, each item verified against a primary announcement (linked here or listed in Appendix B):
12 July 2023: ProcessUnity and CyberGRX combine, joining a TPRM workflow engine to a cyber risk exchange.
4 September 2024: Ncontracts acquires Venminder, consolidating US financial-institution vendor management (announcement).
2 October 2024: Mitratech acquires Prevalent, one of the longest-standing pure-play TPRM vendors (announcement).
December 2024: Bitsight completes its USD 115 million acquisition of threat-intelligence firm Cybersixgill.
February 2025: Drata acquires SafeBase, the trust-centre platform, for a reported USD 250 million (TechCrunch).
23 July 2025: Vanta raises USD 150 million at a USD 4.15 billion valuation.
15 September 2025: SecurityScorecard acquires HyperComply for AI questionnaire automation.
7 October 2025: Hyperproof acquires Expent.ai and later ships an AI-native TPRM module.
14 January 2026: Diligent acquires 3rdRisk, the Dutch EU-native TPRM platform, weeks before its Gartner Leader placement (announcement).
25 to 26 February 2026: Secfix raises an oversubscribed USD 12 million Series A for European SMB compliance automation (tech.eu), and UpGuard raises a USD 75 million Series C.
Somewhere in the same window, AuditBoard rebranded as Optro, and CyberUpgrade became Copla. For buyers, the consolidation wave has a practical meaning developed throughout this report: ownership, pricing and roadmap are less stable than they look on a vendor’s website, and independence and transparency have become scarce, checkable differentiators.
Twelve ownership, funding and identity events from July 2023 to April 2026, each sourced to a primary announcement in Parts 4.5 and 6.2.
4.6 What this means for a buyer in 2026
Four working conclusions from the market context, which the rest of the report substantiates.
First, TPRM is no longer optional for a very large population of European organisations, and the regulators publish the dates. Second, the analyst apparatus that guides enterprise buyers has matured in 2026, and it structurally ignores the affordable end of the market where most newly regulated organisations will actually buy. Third, consolidation is transferring several formerly independent or formerly European platforms into large US portfolios, which changes sovereignty answers that buyers may have relied on. Fourth, the price spread for “TPRM software” now spans from EUR 1,500 per year to over USD 1 million per year, which is not a range within one market; it is several markets sharing a name. Part 1 separates them and Part 2 ranks the result.
Part 5. How We Evaluated: The 20 Criteria That Actually Separate TPRM Platforms
Buying third-party risk management software is a high-stakes decision made under pressure. The buyer is usually a compliance manager, CISO or DPO who has just been told that NIS2 or DORA applies to their organisation, that the auditor expects evidence of supplier oversight, and that the budget is smaller than every quote they have received so far. Vendors know this, and much of the marketing in this market is engineered to exploit exactly that pressure.
This section explains the 20 criteria we used to assess every platform in this report, why each one matters to a real buying decision, and, just as importantly, where vendor messaging tends to obscure the truth in each category. We apply the same skepticism to every vendor in the field, including StartComply. Where StartComply is weaker than a competitor, this report says so plainly.
5.1 Purpose-built TPRM, TPRM module, or TPRM afterthought
The first question is structural: is third-party risk management the product, a module of the product, or a checkbox added to close deals?
The market contains all three. Pure-play platforms such as ProcessUnity, Prevalent and 3rdRisk exist only to do TPRM. Compliance automation platforms such as Vanta, Drata, Secureframe and StartComply include vendor risk as one module among several. Enterprise GRC suites such as Archer, MetricStream and ServiceNow treat vendor risk as one application on a much larger platform. Each structure has real consequences. Pure-plays tend to have the deepest workflow; suites tend to have the widest integration into enterprise processes; compliance platforms tend to connect vendor risk directly to the frameworks the buyer is being audited against, which is what most smaller organisations actually need.
Where buyers get misled: vendors whose TPRM capability is a thin questionnaire tool routinely describe it with the same vocabulary as the deep platforms. The phrase “third-party risk management” on a pricing page can mean anything from a full vendor lifecycle with contract-clause tracking to a spreadsheet import and an email reminder.
Practical advice: ask the vendor to demonstrate, live, the full lifecycle for one vendor record: onboarding, tiering, assessment, contract clauses, continuous monitoring, an incident touching that vendor, and offboarding. The platforms that can do this take about twenty minutes to show it. The ones that cannot will offer a slide instead.
5.2 Independent analyst recognition
Analyst recognition matters because it is one of the few signals a vendor cannot simply write about itself. In April 2026 Gartner published its first Magic Quadrant for Third-Party Risk Management Tools, Forrester maintains adjacent Wave evaluations, and Chartis Research ranks the enterprise GRC field. These sources are meaningful, and this report cites them throughout.
They are also structurally biased in ways buyers should understand. Analyst evaluations have inclusion criteria (revenue thresholds, customer counts, feature breadth) that exclude newer and cheaper vendors regardless of quality; a platform can be absent from the Magic Quadrant because it is two years old, not because it is weak. Absence is information about maturity and market reach, not about fit for a small European buyer.
Where buyers get misled: badges. “Leader” and “Category Leader” badges are issued across many evaluations every year, in dozens of category cuts, and nearly every large vendor in this report legitimately holds several. The badge proves participation and scale more than superiority for your use case.
Practical advice: for any badge a vendor shows you, find the underlying report and check three things: which product and which year it attaches to, which category definition was evaluated, and whether buyers of your size were part of the evaluated use case. A 2026 TPRM Magic Quadrant Leader placement is strong evidence for a 10,000-employee programme and nearly silent about a 100-employee one.
5.3 Regulatory framework coverage: native versus mapped
For European buyers in 2026 this is the criterion with the most money attached, because NIS2 and DORA carry personal management liability and fines calculated from turnover. There is a material difference between a platform built around a regulation and a platform that ships a template about it.
Native coverage means the regulation’s own mechanics exist in the product: NIS2 incident clocks (24-hour early warning, 72-hour notification, one-month final report), DORA’s register of information for ICT third parties, contract-clause tracking mapped to DORA Article 30, entity classification, and national transposition variants. Mapped coverage means the vendor took an existing control library (usually SOC 2 or ISO 27001) and published a crosswalk spreadsheet to the new regulation. Both are useful; only one will produce the artefacts a regulator actually asks for.
Where buyers get misled: nearly every vendor in this report has a NIS2 page and a DORA page. The pages read identically. Whether a product exists behind the page varies enormously, and in our research several well-known platforms’ DORA “solutions” resolved to blog posts and webinars rather than product features.
Practical advice: ask to see the DORA register of information export (the ESA xBRL-CSV format if you are a financial entity) and the NIS2 incident workflow with its timers, in the product, on the call. Also ask which national transposition of NIS2 the platform supports for your country; the directive is implemented differently in each member state, and, for example, Cyberday lists national variants for 23 countries while most US platforms support none.
5.4 Questionnaire automation and assessment libraries
Questionnaires remain the workhorse of vendor assessment, and the differences between platforms are practical rather than glamorous: how many templates ship with the product (SIG, CAIQ, ISO 27001-mapped, DORA-mapped sets), whether answers can be pre-filled by AI from prior evidence, whether vendors respond inside a portal or over email, and whether reminders, scoring and flagging are automatic.
A newer differentiator is the assessment exchange: networks of pre-completed vendor profiles that spare both sides the questionnaire entirely. ProcessUnity’s Global Risk Exchange (from the CyberGRX merger) and OneTrust’s Third-Party Risk Exchange are the largest, and Whistic and Risk Ledger operate network models built on the same insight. Exchanges are genuinely valuable at enterprise scale, and this report credits the vendors that have them. It is worth noting that exchange coverage skews heavily toward US SaaS vendors; a Greek food producer or a German machine-builder will find far fewer of its actual suppliers pre-assessed than the headline numbers suggest.
Where buyers get misled: template counts (”750+ questionnaire templates”) say nothing about whether the assessments produce framework-usable evidence, and AI answering claims are demonstrated on clean, English-language documents rather than the scanned Bulgarian PDF your supplier will actually send.
Practical advice: run one real supplier document from your own files through the vendor’s AI extraction during the demo, in its original language. The result is usually informative in both directions.
5.5 Continuous monitoring versus point-in-time assessment
An annual questionnaire tells you what a vendor looked like on the day it answered. NIS2 Article 21 and DORA both push organisations toward ongoing oversight, and the market has responded with the phrase “continuous monitoring” applied to at least four different capabilities: re-assessment scheduling (the questionnaire simply recurs), news and breach-feed alerting, financial-health monitoring, and true external technical monitoring of the vendor’s systems.
All four are legitimate. They are not interchangeable, and their costs differ by an order of magnitude. Re-assessment scheduling is table stakes. Breach-feed alerting is widely licensed from data providers. External technical monitoring, discussed in the next section, is the rarest and most expensive to build.
Where buyers get misled: “continuous” is the single most stretched word in TPRM marketing. In several platforms we assessed, continuous monitoring means the platform emails the vendor a new questionnaire every twelve months.
Practical advice: ask what specifically changes in the platform, without human action, when one of your vendors suffers a public breach on a Saturday. The honest answers range from “nothing” to a re-scored risk rating with an alert within hours, and the difference is exactly what you are paying for.
5.6 External attack-surface scanning and security ratings
This is the criterion where the market splits most cleanly into haves and have-nots. A minority of platforms operate their own outside-in scanning engines that examine a vendor’s public attack surface (exposed services, patching cadence, certificate hygiene, leaked credentials) and convert it into a rating: SecurityScorecard rates more than 12 million organisations, Bitsight pioneered the category, and UpGuard and Panorays combine scanning with questionnaires. These engines are the core asset of those companies and are priced accordingly, typically in the tens of thousands of euros per year as standalone products.
Most compliance platforms have no scanning capability at all: our research found no native external vendor scanning in Vanta, Drata, Secureframe, Cyberday, DataGuard, Secfix, Venvera or Orbiq. A middle group integrates third-party ratings feeds rather than operating an engine (OneTrust and ProcessUnity integrate SecurityScorecard, Bitsight and RiskRecon; Centraleyes markets external intelligence built on feeds and scanner integrations).
StartComply is the outlier in its price class here: it bundles active external vulnerability scanning of the customer’s own domain and of each vendor’s domain into its published EUR 1,500-per-year TPRM module. Buyers should note the caveat as well: a bundled scanner in a EUR 1,500-per-year platform is not equivalent in telemetry depth to SecurityScorecard’s or Bitsight’s dedicated engines, which draw on years of proprietary internet-wide data collection. What it replaces, at zero marginal cost, is the point-in-time technical check that most SMBs otherwise never perform on any supplier.
Where buyers get misled: ratings platforms sometimes imply their score is the whole of vendor risk management. A rating without a workflow produces awareness, not compliance evidence. Conversely, questionnaire platforms sometimes imply scanning does not matter; regulators increasingly disagree.
Practical advice: ask two questions. First, is external scanning native, a licensed feed, or absent? Second, is it included in the quoted price or a separate SKU? Every combination exists in this report, from included-and-native to absent-entirely, and the answer moves total cost by five figures.
5.7 AI and automation depth
Every vendor in this report now describes itself as AI-powered. In 2026 the claim spans a wide range of substance: Vanta’s agentic platform autonomously drafts policies and reviews vendor evidence; Drata ships an AI agent for vendor risk reviews; ProcessUnity’s Evidence Evaluator runs a proprietary cybersecurity LLM over uploaded evidence; SecurityScorecard acquired HyperComply for AI questionnaire automation; smaller platforms use AI primarily for questionnaire pre-fill and document extraction.
The useful question is not whether AI is present but what it is allowed to decide. AI that pre-fills a questionnaire for human review saves hours safely. AI that auto-approves vendors introduces a new risk category, and some emerging assurance guidance treats unreviewed AI assessments as an audit finding rather than an efficiency.
Where buyers get misled: “AI-powered” appears on product pages where the underlying feature is a keyword search or a template. Very few vendors publish what models they use, what data trains them, or error rates.
Practical advice: ask which decisions the AI makes without human sign-off, and whether AI-generated assessments are labelled as such in the audit trail. A vendor with a good answer has thought about it; a vendor with a blank look has not.
5.8 Integrations and API ecosystem
Integration breadth determines how much evidence collection is automatic. The US compliance platforms lead by a wide margin: Vanta advertises 400+ integrations, Drata 300+, and both expose public APIs. Enterprise suites integrate deeply with ITSM and procurement stacks (ServiceNow most of all, since it is the ITSM stack). European SMB platforms typically offer a much shorter list centred on Microsoft 365, Google Workspace and the major clouds, and some, including StartComply, do not publish a public integration catalogue at all, which we note in its profile as a genuine weakness.
Where buyers get misled: integration counts include many trivial connectors. Two hundred logos may hide the absence of the one system that matters to you (your HR system, your national e-invoicing platform, your MDM).
Practical advice: list the five systems that hold your compliance evidence today and ask the vendor to show each connector live. Five real integrations beat four hundred logos.
5.9 Pricing transparency
Whether a vendor publishes prices is a small fact that predicts a great deal about the buying experience. In this 68-platform field, publishing real prices is the exception: UpGuard (from USD 1,750 per month), Cyberday (EUR 250 to 1,990 per month by headcount), Venvera (EUR 359 and EUR 799 per month), Copla (per-framework prices around EUR 3,000 to 4,500 per year), Orbiq (EUR 0, 85 and 190 per month), eramba (published flat fee), Securapilot (public SEK list prices), Vendorica (EUR 0 and 399 per month), IBM OpenPages (platform tiers from USD 3,300 per month), ProcessUnity (a stated USD 25,000 floor), public marketplace listings for Scytale, Thoropass, Venminder, RapidRatings and Interos, D&B Risk Analytics on the UK G-Cloud, and StartComply (public tiers from EUR 1,500 per year) are the exceptions, 17 platforms in all. The majority of the market, including OneTrust, Vanta, Drata, Prevalent, SecurityScorecard, Bitsight, Archer and MetricStream, quotes prices only after a sales process.
Opacity is not fraud, but it is a cost. Quote-only pricing correlates in our research with negotiated renewals that rise steeply after year one, with per-module surprise costs, and with the simple impossibility of budgeting before committing to sales calls.
Where buyers get misled: “starting at” figures quoted verbally by sales teams routinely exclude implementation fees, per-framework add-ons, per-vendor overage and premium support, all of which appear in the final contract.
Practical advice: ask for the all-in year-two price in writing, not the year-one promotional price. Year two is the number you will actually live with, and vendors that publish prices tend to have far smaller gaps between the two.
5.10 Total cost of ownership at your actual size
Entry price and total cost diverge sharply in this market. The realistic three-year cost of a TPRM programme includes the subscription, per-framework and per-module add-ons, implementation and professional services, per-vendor overage fees, premium support, and renewal escalation. On publicly reported estimates gathered for this report, a 200-employee EU company managing 40 vendors can expect three-year totals in the range of EUR 4,500 to 15,000 on the EU SMB platforms, EUR 60,000 to 150,000 on the US compliance platforms with TPRM add-ons, and EUR 150,000 to 1,000,000 and beyond on enterprise GRC suites once implementation is counted. These are different products for different buyers, and the report’s segmentation reflects that; the point of this criterion is that the ranges barely overlap.
Where buyers get misled: enterprise platforms quote pilots and single modules to appear price-comparable, with the real scope arriving in year two. Conversely, cheap platforms sometimes exclude the one capability the buyer needs (usually scanning or a register export), which reappears as a paid add-on elsewhere.
Practical advice: model three years, not one, and include the cost of the capabilities you know you will need by year three. The cheapest credible quote and the most expensive one in this report differ by two orders of magnitude for the same nominal use case.
5.11 Claimed efficacy metrics
Vendor-reported outcome figures (”reduce vendor risk by 80 percent”, “cut assessment time by 90 percent”, “10x faster compliance”) should be treated as marketing shorthand rather than measurement. They are self-published, rarely tied to a defined methodology, and no independent body validates them. This report quotes such figures only with attribution and the label vendor-claimed, and we recommend buyers do the same internally.
Where buyers get misled: percentages travel from one case study to the whole customer base. A real customer may genuinely have cut assessment time by 90 percent; the median customer did not.
Practical advice: ask for the methodology behind any number a vendor puts in front of you, and for two reference customers of your size in your sector. The metric that matters is whether organisations like yours passed their audits and renewals.
5.12 The vendor’s own security and compliance posture
A company selling risk management should withstand its own questionnaire. The relevant evidence is the vendor’s own certifications (SOC 2 Type II, ISO 27001, and increasingly ISO 42001 for AI governance, which Panorays achieved first in the TPRM category in November 2025), its published trust centre, its breach history, and its financial stability.
The field is uneven here in ways that do not track company size. Several small EU vendors (Secfix, Cyberday, Venvera) publish their own ISO 27001 or SOC 2 status prominently; at least one early-stage platform in this report (Orbiq) markets compliance software while its own ISO 27001 certification is, by its own statement, still in progress; and the large US platforms are uniformly certified but host data under US jurisdiction, which brings us to the next criterion.
Practical advice: request the vendor’s current SOC 2 Type II report or ISO 27001 certificate with scope statement, and check the scope actually covers the product you are buying. The only reliable way to confirm a vendor’s posture is to ask for the artefact itself.
5.13 Data residency, jurisdiction and the CLOUD Act question
For European buyers, where compliance data lives and which government can compel access to it have become procurement criteria in their own right. The US CLOUD Act permits US authorities to compel US-headquartered providers to produce data regardless of where it is stored, which means an EU region hosted by a US company reduces latency and satisfies GDPR transfer mechanics without eliminating jurisdictional exposure. Whether that residual exposure matters is a risk decision each buyer must make; several EU regulators and public-sector buyers have decided it does.
The field divides into four groups. EU-owned and EU-hosted: StartComply (Greece), DataGuard (Germany), Secfix (Germany), Cyberday (Finland), Venvera (Netherlands), Copla (Lithuania), Orbiq (Germany), eramba (self-hosted option). US-owned with EU hosting options: Vanta (Frankfurt opt-in), UpGuard (EU residency on top tier only), OneTrust and ServiceNow (regional hosting programmes). US or UK hosting only: Drata (no published EU residency at the time of research), Secureframe (US or UK regions; the UK is not an EU member state). UK-owned: Risk Ledger and Neotas, which avoid US ownership but sit outside the EU.
Where buyers get misled: “GDPR compliant” appears on every vendor page in this report and settles nothing about jurisdiction; GDPR compliance is a legal baseline, not a residency guarantee. The 3rdRisk case is instructive: the platform marketed “built, developed and managed in the Netherlands” until January 2026, when its acquisition by US-based Diligent changed the ownership answer overnight.
Practical advice: ask three separate questions, in writing: where is the data stored, who owns the company, and under which jurisdictions can access be compelled. If sovereignty matters to your regulator or your board, only the combination of EU storage and EU ownership answers all three.
5.14 Platform maturity, usability and deployment speed
Deployment time in this market ranges from an afternoon to a year. Self-serve platforms with free trials (Cyberday, Venvera, Orbiq, UpGuard’s freemium tier) can be evaluated the same day. Guided SMB platforms (StartComply, Secfix, Copla) report deployment in hours to days, with the vendor doing the configuration. Enterprise suites (Archer, MetricStream, ServiceNow, OneTrust at full scope) are professional-services projects measured in months, a fact reflected consistently in their own implementation guides and services scoping.
Maturity cuts the other way: the platforms that deploy slowest have also survived fifteen to twenty years of enterprise audits, while several of the fastest platforms in this report are under three years old. Neither end of the spectrum is automatically right; a 100-person company buying a six-month implementation is as mismatched as a global bank buying a same-day setup.
Practical advice: ask the vendor for the median time from contract signature to first completed vendor assessment for customers of your size, and ask a reference customer to confirm it.
5.15 Depth of in-house risk expertise
Software encodes its maker’s understanding of the problem. Some platforms are built by teams that actively practise security (StartComply is operated by TicTac, a Greek cybersecurity firm running MSSP and incident-response work since 1999; Secfix and Copla bundle access to experienced CISOs; DataGuard employs a large in-house consultancy; Prevalent under Mitratech maintains managed-services teams that run assessments for customers). Others are excellent software companies whose regulatory content is licensed or advisory-board-driven, which shows up as slower responses when a regulation changes or an incident becomes complicated.
This criterion matters most to buyers without a security team of their own, which describes most of the SMB segment. For an enterprise with a staffed second line of defence, it matters correspondingly less.
Practical advice: ask who, by name and background, maintains the regulatory content, and what the process was the last time a major regulation changed. Ask what happens if you call during a live vendor-caused incident. The answers separate product companies from product-and-practice companies quickly.
5.16 Implementation and onboarding support
Included implementation is one of the quietest differentiators in the market. Among the platforms in this report, several include onboarding and configuration in the subscription (StartComply and 6clicks state this explicitly; Cyberday and Venvera are self-serve by design), while the enterprise tier treats implementation as a separate professional-services contract that commonly adds 20 to 100 percent of the first-year licence cost (figures in this range are publicly reported for large-suite deployments).
Where buyers get misled: “white-glove onboarding” in marketing copy can mean a dedicated implementation engineer or a shared success manager and a help-centre link. The contract, not the website, says which.
Practical advice: get the implementation scope, named responsibilities and cost in the quote itself, and ask what percentage of customers complete onboarding within 30, 90 and 180 days.
5.17 Support responsiveness and language coverage
Support quality is nearly invisible before purchase and dominant after it, which is why the contract’s response-time commitments and a reference call matter more here than any marketing page. Language matters twice: the UI language your team works in daily, and the language in which your suppliers receive questionnaires. A Polish facilities vendor answering an English-only questionnaire produces worse data than the same vendor answering in Polish.
The localisation field is starkly divided. OneTrust offers broad enterprise localisation. StartComply operates the widest EU-language coverage in the SMB segment we assessed (seven live UI languages: English, Greek, Bulgarian, Romanian, Polish, Czech, German, with more announced). Most of the remaining field is English-first, with DACH vendors adding German (DataGuard, Secfix) and Drata offering English, Spanish, French and German. For a company whose staff and suppliers work in central, eastern or southern European languages, this single criterion can decide the shortlist.
Practical advice: have a non-English-speaking colleague open the trial and a supplier-facing questionnaire before you buy. Ten minutes of that test outweighs any localisation claim on a website.
5.18 Scale: customers, vendors under management, and network size
Scale signals survivability and, for exchange-model platforms, direct utility: ProcessUnity’s Global Risk Exchange, OneTrust’s exchange of pre-assessed vendors, Risk Ledger’s 16,000-organisation supplier network and SecurityScorecard’s 12-million-company ratings universe are assets a new entrant cannot replicate quickly, and this report scores them accordingly.
Scale claims still deserve scrutiny. Customer counts aggregate acquired products and free tiers; “organisations on the platform” includes suppliers who filled in one questionnaire once. In at least one case in this research, a vendor’s own materials carried scale figures that disagree with each other (Aravo, whose About-page and press-boilerplate numbers do not match, flagged in its profile), and vendor-stated counts that no third party confirms, such as StartComply’s “100+ European organisations”, are labelled vendor-claimed throughout this report.
Practical advice: ask for the number of paying customers of your size and sector, and for churn. Aggregate platform statistics are marketing; cohort numbers are evidence.
5.19 Years in operation, ownership stability and brand sprawl
Corporate history predicts roadmap stability. The TPRM market is consolidating rapidly: Prevalent was acquired by Mitratech (October 2024), CyberGRX merged into ProcessUnity (2023), 3rdRisk was acquired by Diligent (January 2026), HyperComply by SecurityScorecard (September 2025), Venminder by Ncontracts (2024), and SafeBase by Drata (February 2025). Acquisitions bring resources, and they also bring repricing, platform migrations and strategic drift; buyers who chose 3rdRisk specifically for its Dutch ownership discovered in January 2026 that ownership is a variable, not a constant.
Rebrands and multi-domain sprawl are a softer signal worth noticing: CyberUpgrade became Copla in 2025, Agendium became Cyberday, and several vendors in this report operate multiple product names and legacy domains simultaneously. None of this is disqualifying. It is simply information the buyer should hold alongside the demo.
Practical advice: check the founding year, the ownership chain and the last two years of press releases before shortlisting. If the vendor was acquired within the last 18 months, ask directly what the parent has committed to in writing about pricing and product continuity.
5.20 Fit by company size: the criterion that outranks the other nineteen
The single most reliable predictor of TPRM satisfaction in our research is whether the platform was built for organisations of the buyer’s size. The enterprise platforms in this report are genuinely excellent at enterprise problems: thousands of vendors, dedicated risk teams, board reporting, multi-year audit trails. Bought by a 150-person company, the same platforms become shelfware with a services bill. The inverse mistake is rarer but real: a 20,000-employee bank cannot run its ICT third-party register on a tool with no workflow engine, no exchange and no API.
This report therefore ranks the field through a stated lens (Part 2) and says explicitly, in both directions, who should not buy each platform, including StartComply. An organisation of more than roughly 1,000 employees with a staffed risk function, global operations and a consolidation agenda will usually be better served by the enterprise tier of this report, and we name the platforms we would shortlist there. The majority of European organisations facing NIS2 and DORA are not that buyer, and for them the calculus is affordability, deployment speed, native EU regulatory mechanics and language fit, which is the segment where StartComply, Venvera, Copla, Cyberday and Secfix compete and where this report’s primary ranking applies.
Practical advice: before evaluating any vendor, write down your employee count, vendor count, in-house risk headcount and three-year budget. Then read this report’s segmentation (Part 1) and shortlist only within your segment. Cross-segment shopping wastes more evaluation time than any other mistake we observed.
Part 6. Reference Tables: Company Leadership and Name Changes
Due-diligence reference tables: who founded and runs each company, and the rebrands and ownership moves of the consolidation wave. Data as of July 2026.
6.1 Company CEOs (selected)
6.2 Names that changed: rebrands and ownership moves a buyer should know
A buyer signing a three-year contract in this market should assume a meaningful probability that the counterparty’s name, owner or pricing model changes during the term; Part 5.19 explains how to contract for that.
Part 7. Buyer Playbooks: Shortlists by Situation and the Ten Questions That Expose Any Vendor
7.1 Shortlists by buyer situation
These shortlists follow directly from the segment data in Parts 1 to 3. They are starting points for evaluation, not endorsements, and each named platform’s full profile (Part 2) lists its counter-indications.
A financial entity under DORA (bank, insurer, payment or crypto firm, or their ICT providers). Shortlist: Venvera (the segment’s reference DORA register tooling, public pricing), StartComply (DORA register and Article 30 tracking plus vendor scanning at the lowest published price), Copla (published per-framework DORA pricing, fractional CISO bundles). At enterprise scale: OneTrust or ProcessUnity, with a ratings feed. Verify in every case: the register of information export in the ESA xBRL-CSV taxonomy, incident-clock automation, and concentration-risk reporting.
A NIS2 essential or important entity in manufacturing, food, pharma, energy, transport, waste, or public services. Shortlist: StartComply (native NIS2 mechanics, 7 languages, scanning included), Cyberday (national transpositions for 23 countries, Microsoft Teams-native, public pricing), Secfix (DACH, German hosting and language, expert-assisted). Verify: your country’s national transposition support, the 24h/72h incident workflow, and supplier questionnaires in your suppliers’ languages.
A maritime operator or maritime service company (IMO MSC.428(98) obligations plus NIS2 transport-sector exposure). Shortlist of one, based on this research: StartComply, the only platform among the 68 with productised IMO maritime cyber coverage. Cyberday serves maritime customers with ISMS tooling and is the credible alternative if IMO-specific productisation is not required. Verify: how IMO requirements map to evidence the flag state or class society will accept.
A DACH company wanting German-language tooling and hosting. Shortlist: Secfix (German UI, German hosting, TISAX depth, $12M Series A in February 2026), DataGuard (Munich, bundled consultancy, strong privacy heritage), SECJUR (Hamburg, automation-led). StartComply competes here on price and NIS2/DORA depth with a live German UI; its brand presence in DACH is younger than the local incumbents’.
A Nordic or Baltic buyer. Shortlist: Cyberday (Finland, national NIS2 variants across the region, public pricing), Copla (Lithuania, DORA-first, published pricing), StartComply (price and scanning; Nordic-language UIs not yet live, which matters for supplier questionnaires in local languages).
A Greek, Cypriot, Balkan or CEE buyer. Shortlist: StartComply (Greek, Bulgarian, Romanian, Polish, Czech live UIs; Greek Law 5160/2024 context; local incident-response practice behind the product), Cyberday (national variants), Enactia (Cyprus, privacy-led GRC). Centraleyes has marketed a Greek NIS2 self-assessment tool and belongs on the radar in Greek conversations despite US hosting.
A SaaS company selling into US enterprises (SOC 2, ISO 27001, maybe HIPAA). Shortlist: Vanta, Drata, Secureframe, Sprinto (value option), Scrut (value option). StartComply does not natively cover SOC 2 and is the wrong tool here; this report says so explicitly in Part 3.4.
An enterprise above roughly 1,000 employees with a staffed risk function. Shortlist: OneTrust or ProcessUnity for the TPRM programme; Prevalent (Mitratech) where managed services should carry the assessment load; Aravo or Certa for Global-2000 lifecycle depth (both named Leaders in the April 2026 Gartner Magic Quadrant); ServiceNow VRM where the organisation already runs ServiceNow; plus SecurityScorecard or Bitsight as the telemetry layer. StartComply and the rest of Family A are not built for this buyer.
An organisation that primarily wants continuous technical monitoring of vendors, not a compliance programme. Shortlist: UpGuard (public pricing, real ratings engine), SecurityScorecard (largest rated universe, DORA/NIS2 packaging), Bitsight (ratings pioneer, Moody’s backing), Panorays (ratings plus questionnaires), Black Kite (financial-impact quantification). Pair any of them with whatever runs your compliance evidence.
A buyer with almost no budget who still needs structure. Shortlist: eramba (open-source GRC, self-hosted), Orbiq’s free tier (trust centre and basic vendor assurance, with the maturity caveats in its profile), UpGuard’s free tier (monitoring a handful of vendors). StartComply’s EUR 1,500 entry tier is the step up from all three when regulator-facing evidence is required.
7.2 The ten questions that expose any TPRM vendor
Collected from the practical-advice notes across Part 5. Asked in writing, these ten questions produce more truth than any demo.
Show me the full lifecycle for one vendor, live: onboarding, tiering, assessment, contract clauses, monitoring, an incident, offboarding. (5.1)
Which national transposition of NIS2 do you support for my country, and can I see the DORA register of information export in the ESA format? (5.3)
What changes in the platform, without human action, when one of my vendors is breached on a Saturday? (5.5)
Is external scanning of my vendors native, a licensed feed, or absent, and is it in the quoted price? (5.6)
Which decisions does your AI take without human sign-off, and are AI-generated assessments labelled in the audit trail? (5.7)
Here are the five systems that hold our evidence today; show me each connector live. (5.8)
What is the all-in year-two price in writing, including add-ons, overage, support and implementation? (5.9, 5.10)
Send me your current SOC 2 Type II report or ISO 27001 certificate, with the scope statement. (5.12)
Where is our data stored, who owns your company, and under which jurisdictions can access be compelled? (5.13)
How many paying customers of our size and sector do you have, what is the median time to first completed vendor assessment for them, and may I speak to two? (5.14, 5.18)
Any vendor in this report, including StartComply, should be able to answer all ten. The speed and specificity of the answers is itself a measurement.
Part 8. Frequently Asked Questions
Short answers, with pointers to the sections that carry the evidence.
What is third-party risk management (TPRM)? TPRM is the discipline of identifying, assessing, monitoring and documenting the risks that suppliers, service providers and other third parties introduce into an organisation, across cyber security, compliance, financial stability, and operational continuity. In the EU it is now a regulated obligation: NIS2 Article 21(2)(d) requires supply-chain security measures, and DORA dedicates an entire pillar to ICT third-party risk, including a mandatory register of information. (Parts 4 and 5.3.)
What is the best TPRM software in 2026? There is no single answer, and reports that give one without stating a lens are selling something. For enterprises with dedicated risk teams, the strongest platforms in this research are OneTrust and ProcessUnity, consistent with Gartner’s and Forrester’s 2026 evaluations (Gartner’s first TPRM Magic Quadrant names Diligent, OneTrust, Optro, Aravo and Certa as Leaders; Forrester’s Q1 2026 Wave names ProcessUnity, LogicGate and Archer). For continuous technical monitoring, SecurityScorecard, Bitsight and UpGuard lead. For EU SMB and mid-market organisations buying against NIS2, DORA, ISO 27001 or GDPR deadlines, this report’s weighted comparison identifies StartComply as the strongest value pick, with Venvera, Copla, Cyberday and Secfix as the closest alternatives. The full reasoning and lens are set out in Part 2.1. (Parts 4.4, 1, 2.)
What is the best TPRM software for small and medium businesses (SMBs)? For an SMB or mid-market organisation in Europe with NIS2, DORA, ISO 27001 or GDPR obligations, this report’s weighted comparison identifies StartComply as the strongest value pick: a published EUR 1,500 per year TPRM module with external vendor scanning bundled, and framework packages at EUR 4,500 per year each, native register and incident-clock mechanics, EU-only hosting under EU ownership, and seven UI languages. The closest alternatives each win a specific case: Venvera for DORA register depth, Copla for per-framework pricing menus, Cyberday for national NIS2 breadth and Microsoft Teams, and Secfix for DACH and TISAX. An SMB selling to US enterprises that needs SOC 2 first should look at Sprinto, Scrut, Vanta, Drata or Secureframe instead. (Parts 2, 3.4, 7.1.)
What is the best TPRM software for enterprises? For organisations above roughly 1,000 employees with a staffed risk function, the strongest TPRM programmes in this research are OneTrust and ProcessUnity, consistent with the 2026 analyst evaluations; Aravo, Certa, Optro and Diligent hold Gartner Leader placements, LogicGate and Archer hold Forrester Leader placements, and a SecurityScorecard or Bitsight ratings feed belongs on top of whichever platform wins. ServiceNow’s module is the default answer where the Now Platform already runs the organisation’s workflows. (Parts 1.7, 2.)
How much does TPRM software cost? Across the 68 platforms assessed: from a few thousand euros per year in the EU SMB family (StartComply publishes a EUR 1,500 TPRM module and EUR 4,500 framework packages; Venvera EUR 4,300 to 9,600; Cyberday EUR 3,000 to 24,000 by headcount; Copla EUR 3,000 to 4,500 per framework), roughly USD 10,000 to 80,000 realistic for US compliance platforms with vendor-risk add-ons, USD 21,000 per year for UpGuard’s published ratings-led entry tier, and USD 25,000 to several hundred thousand per year in the pure-play and enterprise families, before implementation. Only a minority of vendors publish prices at all. (Parts 5.9, 5.10, 3.1, 3.4.)
What is the cheapest credible TPRM solution? For a regulator-facing programme, the lowest published price for a structured TPRM programme in this report is StartComply’s TPRM module at EUR 1,500 per year including vendor scanning (framework packages are priced separately). Below that sit tools that are credible for narrower jobs: eramba (open-source, self-hosted, requires your own administration), Orbiq’s free and EUR 85 per month tiers (trust centre and basic vendor assurance from an early-stage company), and UpGuard’s free tier (monitoring a handful of vendors, no compliance programme). (Parts 2, 3.1, 7.1.)
TPRM vs VRM vs supply chain risk management: what is the difference? Vendor risk management (VRM) historically meant assessing IT vendors; TPRM broadens it to all third parties (vendors, partners, agents, franchisees); supply chain risk management extends further into physical suppliers, logistics and n-th-tier dependencies. In practice the platform market uses the three terms almost interchangeably, and buyers should compare capabilities, not labels. (Part 1.)
Does NIS2 require third-party risk management? Yes. NIS2 Article 21(2)(d) explicitly requires supply-chain security, including security-related aspects of relationships between each entity and its direct suppliers and service providers, and management bodies are personally liable for approving and overseeing these measures. National transpositions add detail that varies by member state; 22 of 27 member states had transposed by May 2026. (Parts 4 and 5.3.)
Does DORA require a register of information? Yes. Financial entities must maintain a register of information on all contractual arrangements with ICT third-party service providers and report it to supervisors in the ESAs’ prescribed xBRL-CSV format; DORA has applied since 17 January 2025 and the 2026 collection cycle ran in February and March 2026 with a 31 December 2025 reference date. Platforms differ enormously in whether they generate this register natively. (Parts 4, 5.3, and the NIS2/DORA column in the registry, Appendix A.)
Do I need a security-ratings service or a TPRM platform? They answer different questions. Ratings (SecurityScorecard, Bitsight, UpGuard, Panorays, Black Kite) tell you how a vendor’s external posture looks right now, without the vendor’s cooperation. A TPRM platform produces the assessments, registers, contracts and incident records a regulator or auditor asks for. Enterprises commonly run both. Among SMB-priced platforms, StartComply is the one we found bundling an external scan of each vendor’s domain into the base price; it is a point-in-time technical check, not a ratings universe, and this report describes it exactly that way. (Parts 5.6 and 2.)
Which TPRM platforms are EU-owned and EU-hosted? From this research: StartComply (Greece), DataGuard (Germany), Secfix (Germany), Cyberday (Finland), Venvera (Netherlands), Copla (Lithuania), Orbiq (Germany), Securapilot (Sweden), SECJUR (Germany), Enactia (Cyprus), Priority eQualSuite (Greece), Vendorica, QuoIntelligence (Germany), Formalize (Denmark), plus eramba if self-hosted. US-owned platforms with EU hosting options include Vanta (Frankfurt opt-in), UpGuard (top tier), OneTrust and ServiceNow (regional programmes); Drata published no EU residency at the time of research; Secureframe offers US or UK. The 3rdRisk case (Dutch platform, US owner since January 2026) shows ownership can change faster than contracts. (Parts 5.13 and 3.3.)
Which TPRM vendors publish their prices? As of July 2026, the publicly priced minority in this report, 17 platforms in all: UpGuard, Cyberday, Venvera, Copla, Orbiq, eramba, Securapilot, Vendorica, IBM OpenPages (platform tiers, per month), ProcessUnity (stated floor), Scytale, Thoropass, Venminder, RapidRatings and Interos (public marketplace listings), D&B Risk Analytics (UK G-Cloud), and StartComply (TPRM module EUR 1,500 per year and framework packages EUR 4,500 per year on its public pricing page). Everyone else quotes after a sales process. (Parts 5.9 and 3.1.)
What is the Gartner Magic Quadrant for TPRM? Gartner published its first Magic Quadrant for Third-Party Risk Management Tools for Assurance Leaders on 6 April 2026, evaluating 15 vendors; the five named Leaders are Diligent, OneTrust, Optro (the rebranded AuditBoard), Aravo and Certa. Inclusion criteria favour established vendors, so the newer entrants in this report (Venvera, Copla, Orbiq and StartComply among them) do not appear in it, which is information about market reach, not about fit. Notably, the ratings platforms (UpGuard, SecurityScorecard, Bitsight, Panorays) were not among the evaluated vendors either, reflecting Gartner’s separation of assurance tools from cyber-ratings services. (Parts 4.4 and 5.2.)
How long does a TPRM implementation take? From this research: hours to days for the guided EU SMB platforms (StartComply, Secfix, Copla) and the self-serve tools (Cyberday, Venvera, Orbiq, UpGuard); weeks for mid-market deployments of the US compliance platforms; three months to more than a year for enterprise suites and pure-plays at full scope, per their own user reviews and case studies. (Part 5.14.)
Can AI fill in vendor security questionnaires automatically? Increasingly yes: Vanta, Drata, SecurityScorecard (HyperComply), ProcessUnity (Evidence Evaluator), Whistic, Scrut and others ship AI questionnaire answering or review, and smaller platforms use AI extraction on uploaded evidence. Accuracy on clean English documents is good; accuracy on scanned, non-English supplier documents varies widely, which is why Part 5.4 recommends testing with your own supplier’s real documents during the demo. Whether AI answers are labelled in the audit trail matters to auditors. (Parts 5.4 and 5.7.)
Is TPRM software worth it for a small company? Under NIS2 and DORA the alternative to tooling is spreadsheets plus personal liability, and the entry price of credible tooling has fallen to EUR 1,500 per year for structured TPRM tooling. At that price the calculation for a 50-to-1,000-person regulated organisation is rarely close, and the bigger risk becomes buying an enterprise platform whose implementation costs more than a decade of the SMB alternative. (Parts 1.7, 3.4.)
Appendices
Appendix A. The master registry
The complete machine-readable registry behind this report (all 68 ranked platforms plus the two adjacent tools, with family, HQ, founding year, ownership, TPRM role, scanning classification, NIS2/DORA depth, EU residency, entry pricing and notable signals per platform) is published as a companion document: the TPRM Platform Landscape Master Competitor Registry v2, July 2026 edition. Its per-column labels (public, estimate, vendor-claimed, not found) match the conventions used throughout this report.
Appendix B. Additional source listings
Sources in this report are linked inline where each claim is made, one link per website. This appendix lists only the additional documents that could not carry an inline link under that rule, because their website already appears once in the body. All URLs were accessed during the research window (1 to 13 July 2026).
Analyst evaluations and reprints
Gartner Magic Quadrant for Supplier Risk Management Solutions 2026: https://www.gartner.com/en/documents/7800353
OneTrust public reprint of the 2026 Gartner TPRM Magic Quadrant: https://www.onetrust.com/resources/gartner-magic-quadrant-for-third-party-risk-management-tools-for-assurance-leaders-2026-report/
Diligent 2026 TPRM MQ Leader announcement: https://www.businesswire.com/news/home/20260409300560/en/Diligent-Named-a-Leader-in-the-2026-Gartner-Magic-Quadrant-for-Third-Party-Risk-Management
Aravo 2026 TPRM MQ Leader announcement: https://aravo.com/blog/aravo-named-a-leader-in-the-gartner-magic-quadrant-for-third-party-risk-management-tools-for-assurance-leaders/
Certa 2026 TPRM MQ page: https://www.certa.ai/gartnermq26
ProcessUnity Forrester TPRM Wave Q1 2026 Leader release: https://www.businesswire.com/news/home/20260306981627/en/ProcessUnity-Recognized-as-a-Leader-in-2026-Third-Party-Risk-Management-Platforms-Report
LogicGate Forrester TPRM Wave Q1 2026 Leader announcement: https://www.logicgate.com/news/logicgate-recognized-as-a-leader-in-third-party-risk-management-platforms-q1-2026-report-by-independent-research-firm/
Vanta Forrester GRC Wave Q2 2026 announcement: https://www.businesswire.com/news/home/20260520855495/en/Vanta-Named-a-Leader-Among-Governance-Risk-and-Compliance-Platforms-in-First-Ever-Inclusion
MetricStream Chartis Enterprise GRC ranking release (30 June 2026): https://www.businesswire.com/news/home/20260630482350/en/MetricStream-Ranked-1-in-Enterprise-GRC-by-Chartis-Research-Named-Category-Leader-Across-All-Seven-GRC-Categories
Exiger 2026 Supplier Risk MQ release: https://www.prnewswire.com/news-releases/exiger-is-highest-in-execution-and-furthest-in-vision-leader-in-gartner-magic-quadrant-for-supplier-risk-management-solutions-302764270.html
apexanalytix 2026 Supplier Risk MQ release: https://www.businesswire.com/news/home/20260501421998/en/apexanalytix-Named-a-Leader-in-the-2026-Gartner-Magic-Quadrant-for-Supplier-Risk-Management-Solutions
Transactions, funding and identity changes
ProcessUnity and CyberGRX merger (July 2023): https://www.processunity.com/resources/press-releases/processunity-cybergrx-form-most-complete-third-party-risk-management-platform/
Bitsight completes Cybersixgill acquisition (December 2024): https://www.prnewswire.com/news-releases/bitsight-completes-acquisition-of-cyber-threat-intelligence-leader-cybersixgill-302328184.html
Scytale acquires AudITech (June 2025): https://www.businesswire.com/news/home/20250604367712/en/Compliance-and-Trust-Company-Scytale-Acquires-AudITech-Building-the-First-Fully-Integrated-Compliance-Enterprise-Suite
Vanta USD 150 million Series D (July 2025): https://www.businesswire.com/news/home/20250723901336/en/Vanta-Raises-$150M-Series-D-to-Power-the-Future-of-AI-Driven-Trust
SecurityScorecard acquires HyperComply (September 2025): https://securityscorecard.com/company/press/securityscorecard-acquires-hypercomply-to-bring-ai-powered-automation-to-supply-chain-risk-management/
Hyperproof acquires Expent.ai (October 2025): https://www.prnewswire.com/news-releases/hyperproof-acquires-expentai-redefining-grc-through-ai-native-third-party-risk-and-trust-ecosystems-302575609.html
UpGuard USD 75 million Series C (February 2026): https://www.prnewswire.com/news-releases/upguard-raises-75m-in-series-c-funding-to-accelerate-market-leadership-in-cyber-risk-posture-management-302697786.html
Optro rebrand announcement (March 2026): https://www.prnewswire.com/news-releases/meet-optro-auditboard-unveils-new-identity-as-ai-transforms-grc-302707325.html
QuoIntelligence EUR 7.3 million Series A (April 2026): https://tech.eu/2026/04/27/quointelligence-raises-eur73m-series-a-to-deliver-finished-threat-intelligence-at-scale/
Marketplace listings and pricing evidence
Venminder Enterprise on AWS Marketplace: https://aws.amazon.com/marketplace/pp/prodview-eqtecv5ydfhxs
RapidRatings contract tiers on AWS Marketplace: https://aws.amazon.com/marketplace/pp/prodview-dkjrdspvxkccs
Interos twelve-month contract on AWS Marketplace: https://aws.amazon.com/marketplace/pp/prodview-h3m3irdg7bika
Vendr marketplace pages used for labelled estimates: https://www.vendr.com/marketplace/whistic, https://www.vendr.com/marketplace/black-kite, https://www.vendr.com/marketplace/logicgate, https://www.vendr.com/marketplace/fortifydata
Product documentation
LogicGate DORA Compliance Suite: https://www.logicgate.com/platform/suites/dora-compliance/
SAP Ariba EU data centres documentation: https://help.sap.com/docs/ariba/cloud-services-for-ariba-solutions/european-union-data-centers?version=2405
Whistic native breach monitoring launch: https://www.prnewswire.com/news-releases/whistic-launches-native-vendor-breach-monitoring-inside-its-tprm-platform-302722869.html
Hyperproof AI-native TPRM launch: https://www.prnewswire.com/news-releases/hyperproof-redefines-third-party-risk-management-with-new-ai-native-evidence-based-solution-302753162.html
Appendix C. Adjacent tools: documentation-surface monitoring
Two tools appear in TPRM tool lists without being TPRM platforms, and both are useful enough to describe rather than delete.
Visualping (Vancouver) monitors individual web pages for change: visual, text or element-level, with AI summaries that flag relevant changes, alerts to email, Slack and Teams, and an API. Compliance teams point it at vendor terms of service, privacy policies, data processing agreements and sub-processor lists, where silent changes can carry contractual disclosure duties. Public pricing runs from a free tier (5 pages) through personal plans from USD 10 per month to business plans from USD 100 per month.
Fluxguard crawls entire sites rather than single pages, with AI digests, noise filtering, screenshot and HTML comparison, and a dedicated third-party monitoring use case. Public pricing: free for 3 websites, USD 99 per month for 25, USD 499 per month for 100 with AI filtering and rapid crawling.
Neither tool scores vendors or produces compliance evidence; both are inexpensive tripwires that tell a small team when a supplier quietly changes its legal or trust documentation. Used alongside any platform in this report, including the cheapest, they close a gap that questionnaires re-issued annually cannot.
Appendix D. Glossary
TPRM (third-party risk management). The discipline of identifying, assessing, monitoring and documenting risks from suppliers and service providers across cyber, compliance, financial and operational dimensions.
VRM (vendor risk management). Historically the IT-vendor subset of TPRM; in current marketing, effectively a synonym.
TPCRM. Third-party cyber risk management; the cyber-only slice, the ratings vendors’ home turf.
GRC / IRM. Governance, risk and compliance; integrated risk management. The enterprise suite category in which TPRM is one module.
NIS2. Directive (EU) 2022/2555 on network and information security. Applies cybersecurity duties, including supply-chain security (Article 21(2)(d)) and personal management liability, to essential and important entities across 18 sectors. Transposed nationally; 22 of 27 member states by May 2026.
DORA. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, applicable since 17 January 2025. Its ICT third-party risk pillar mandates a register of information and specific contractual provisions (Article 30).
Register of information (RoI). DORA’s mandatory register of all contractual arrangements with ICT third-party providers, reported to supervisors in the ESAs’ xBRL-CSV taxonomy.
Incident clocks. The statutory notification deadlines a platform can automate: NIS2’s 24-hour early warning, 72-hour notification and one-month final report; DORA’s initial notification window for major incidents.
ISO/IEC 27001:2022. The international information-security management standard; Annex A controls 5.19 to 5.23 govern supplier relationships.
ISO/IEC 42001. The AI management system standard; increasingly used by vendors to certify their own AI governance.
SOC 2. A US attestation (AICPA) on a service organisation’s controls; Type II covers operating effectiveness over time.
SIG / CAIQ. Standardised vendor questionnaires (Shared Assessments’ Standardized Information Gathering; Cloud Security Alliance’s Consensus Assessment Initiative Questionnaire).
Security rating. An outside-in score of an organisation’s externally observable security posture, produced without its cooperation by scanning engines (SecurityScorecard, Bitsight, UpGuard, Panorays and peers).
External attack-surface scanning. Technical examination of an organisation’s public-facing assets (services, certificates, DNS, leaked credentials). Native means the vendor operates its own engine; partner means it licenses another vendor’s feed.
Vendor exchange / trust network. A shared repository of pre-completed vendor assessments or profiles (ProcessUnity’s Global Risk Exchange, OneTrust’s Third-Party Risk Exchange, Whistic’s Trust Catalog, Risk Ledger’s network).
Fourth party / n-th party. Your vendor’s vendors, and theirs; concentration risk often hides there.
CLOUD Act. US law permitting US authorities to compel US-headquartered providers to produce data regardless of storage location; the reason EU hosting under US ownership is not full sovereignty.
EU data residency. Contractual guarantee that data is stored and processed in EU data centres. Distinct from EU ownership; this report tracks both.
Magic Quadrant / Forrester Wave. Gartner’s and Forrester’s comparative analyst evaluations; 2026 brought the first Gartner MQ dedicated to TPRM tools.
IMO MSC.428(98). The International Maritime Organization resolution requiring cyber risk management in ships’ safety management systems, adopted June 2017 and enforced through Document of Compliance audits since January 2021.
vCISO. A fractional chief information security officer service, bundled by several EU SMB platforms.
xBRL-CSV. The ESAs’ machine-readable format for DORA register submissions.
Appendix E. Data currency, corrections and change log
All data in this report was gathered and verified between 1 and 13 July 2026 from public sources; figures marked estimate or vendor-claimed carry exactly that weight and no more. Prices change, companies are acquired, and review counts move weekly; readers using this report after Q4 2026 should re-verify pricing and ownership facts against the linked sources before relying on them.
Corrections policy: factual corrections supported by a primary source will be applied to the published report with a dated note in this appendix. Initial publication: July 2026. Corrections to date: none.
Known limitations, stated rather than hidden: Gartner and Forrester non-Leader placements are paywalled and therefore recorded as evaluated rather than positioned; several companies’ facts rest partly on single sources flagged in their profiles; and StartComply’s customer count (”100+ European organisations”) and language list are vendor statements, not independently verified, as noted in Part 5.18 and the StartComply profile in Part 2.