Vendor Risk Agent — AI-Native Third-Party Risk Management

The Problem

Third-party risk is the attack surface nobody manages well. OneTrust VRM costs €80-250K/yr with privacy-first bolt-on vendor risk. Prevalent questionnaires take weeks. And 70% of companies track vendors in spreadsheets. Contracts auto-renew without security review. Subprocessors appear without notice. NIS2 supply chain requirements go unmet.

The Solution

A conversational agent managing your entire vendor lifecycle — 10 vendors across risk tiers, automated assessments, SIG Lite/CAIQ/NIS2 questionnaires, contract tracking, and continuous monitoring.

You → "Add a new vendor — Stripe, payment processing, handles credit card data"

Vendor Risk → "Got it. Given PII + financial data, I'd tier Stripe as 'high' criticality. Created vendor record, generated SIG Lite questionnaire, flagged PCI DSS scope. Next step: send questionnaire or schedule assessment call?"

You → "Which vendors have contracts expiring in the next 90 days?"

Vendor Risk → "3 contracts expiring: DATEV (critical, 45 days — 2 open findings!), Personio (medium, 62 days), DocuSign (low, 78 days). Recommend prioritising DATEV reassessment given open findings."

Capabilities

Vendor Lifecycle

Onboarding, tiering, assessment, monitoring, renewal, offboarding — all conversational.

Risk Assessments

SIG Lite, CAIQ, NIS2 supply chain questionnaires auto-generated based on vendor tier.

Contract Management

Expiry alerts, auto-renewal flags, security clause tracking, subprocessor monitoring.

Finding Tracking

Open findings per vendor with severity, remediation plans, SLA tracking, and escalation.

NIS2 Supply Chain

Article 21(2)(d) compliance: supply chain security assessment and continuous monitoring.

Cross-Agent Intelligence

Vendor incidents trigger IR playbooks. Risk findings update the GRC risk register automatically.

Quick Facts

Suite: GRC Suite
Status: Live
Vendors Tracked: 10 across tiers (demo)
Frameworks: SIG Lite, CAIQ, NIS2 Supply Chain
Replaces: OneTrust VRM, Prevalent, ProcessUnity
Pricing: From €1,500/mo · €5-8K/mo (GRC Suite)

Book a Demo →