Shortlist
Six third-party risk tools buyers shortlist — dedicated TPRM platforms, security ratings and compliance suites — each described from its own public pages.
Choose vendor risk management software by where your risk signal comes from. Dedicated TPRM platforms — ProcessUnity and Mitratech Prevalent — run large assessment programmes with deep questionnaire libraries, external risk data and managed services. Bitsight starts from outside-in security ratings and continuous monitoring of vendors and their own vendors. OneTrust and Vanta add vendor risk to a wider privacy or compliance suite. Noru keeps vendors in the same programme as your frameworks: a register built from identity-provider grants, with GDPR Article 28 and DORA ICT third-party duties carried alongside.
Disclosure: Noru publishes this page and is one of the platforms on it. The entries are unranked, each one describes the vendor from its own public pages, and those pages were last checked on .
Questionnaire-led tools tell you what a vendor says about its controls; ratings-led tools tell you what can be observed from outside. Most mature programmes need both, so check which one a tool is built around and how it brings in the other.
The vendors you forgot carry the risk you never assessed. Ask whether the inventory is discovered from identity-provider grants, procurement or spend, or only typed in.
Depth should follow what a vendor can reach — systems, personal data, privileged access — not contract value. Check that tiering decides which vendors get the long assessment.
GDPR Article 28 needs processor contracts and due diligence, DORA needs an ICT third-party register, and NIS2 makes supply-chain security a required measure. Check the tool keeps those records, not just questionnaire scores.
In no particular order after Noru. Each summary paraphrases the vendor's own positioning; follow the link to check it.
Suits: Teams that want vendor risk run in the same programme as their frameworks and GDPR Article 28 duties, not in a separate tool.
Our product. Third-party risk inside the same compliance platform as SOC 2, ISO 27001, GDPR, NIS2 and DORA: a vendor register built from identity-provider grants and SSO, documents gathered from each vendor, and framework-mapped questionnaires answered from sourced AI suggestions a person accepts.
DORA ICT third parties and sub-processors live in the same register, and sub-processors are published to your trust center. Noru publishes no prices; third-party risk is one capability package on the platform, priced per deployment.
Suits: Dedicated third-party risk teams running large vendor portfolios across several risk domains.
Describes itself as an AI-powered third-party risk management platform with a data-first approach: a risk index that combines a vendor's internal control data with external risk signals, and AI agents for intake, due diligence, monitoring and remediation.
Cites a global exchange of pre-completed vendor risk profiles, 40+ risk data providers and prebuilt connectors to systems such as SAP, ServiceNow and Salesforce. No published prices; pricing is by request.
Suits: Teams that want assessment content, sanctions screening and managed assessment services from one vendor.
Prevalent, now part of Mitratech, describes itself as purpose-built for third-party risk: the lifecycle from sourcing to offboarding, inherent and residual scoring, and 800+ assessment templates with AI that drafts answers from a vendor's earlier assessments.
Adds vendor threat monitoring across news, sanctions and politically exposed persons lists, AI contract analysis, and managed services that run assessments for you. Mitratech sells its suite as cloud SaaS; no published prices.
Suits: Security teams that want continuous external monitoring of vendors, and their vendors, between assessments.
Built on security ratings: daily, outside-in ratings of 40M+ companies, which Bitsight says are independently validated to correlate with breach outcomes, plus automatic discovery of your vendors' own vendors.
Its vendor risk management product adds AI-assisted assessments mapped to SIG Lite, NIST CSF 2.0, ISO 27001 and others, SOC 2 report summaries, and a network of 75K+ vendor profiles. No published prices; the page offers a demo.
Suits: Enterprises already on OneTrust for privacy that want vendor risk in the same suite.
Third-Party Management covers a customisable vendor inventory, contextual tiering with auto-approval for low-risk third parties, and assessments against more than 50 built-in frameworks, with AI that drafts questionnaire responses from external evidence.
Brings in cyber ratings from RiskRecon, SecurityScorecard and HackNotice, and sanctions and adverse-media screening from Dow Jones. Sold as Base and Suite packages metered on admin users and vendor inventory; no published prices.
Suits: Vanta compliance customers who want vendor risk in the same tool.
Sells third-party risk management as a TPRM agent that discovers vendors through integrations and procurement, scores inherent risk, extracts SLA, DPA and security terms from SOC 2 reports, and monitors vendors for breaches.
Available standalone or as an add-on to Vanta's compliance plans; pricing is given on request after a demo.
Software that inventories the third parties you rely on, tiers them by risk, runs due diligence such as questionnaires and document review, monitors them between reviews and records each decision. It is also called third-party risk management, or TPRM, software.
A TPRM platform runs the assessment process: intake, questionnaires, evidence, remediation and offboarding. A security ratings service continuously scores a vendor's externally visible security posture. Several platforms import ratings from a ratings provider, and Bitsight sells both.
Not always. If your vendors number in the hundreds and assessments are owned by your security or compliance team, the vendor module of a compliance platform such as Vanta, OneTrust or Noru may be enough. Programmes with dedicated third-party risk analysts and thousands of vendors usually justify a dedicated platform.
Noru keeps DORA ICT third parties in its vendor register, and Bitsight offers professional services for programme design aligned to DORA and NIS2. Support for the DORA register of information changes quickly, so check it with every vendor on your shortlist.
No. Noru never uses customer data to train, fine-tune or evaluate a model, and every AI feature runs under zero data retention terms — both written into its Terms and DPA. Ask every vendor on your shortlist for the same commitments in writing.
Every claim about the vendors listed on this page comes from the public pages below, last checked on . Competitor products and prices change — if something here is out of date, tell us and we will correct it.
A walkthrough against your frameworks, integrations and evidence — and a straight answer on whether Noru belongs on your shortlist.
