Governance, Risk & Compliance
Cybersecurity governance, risk assessment, compliance monitoring, and regulatory reporting.
Chainalysis
The dominant, decade-plus incumbent in blockchain analytics, tracing illicit crypto flows and screening sanctions/AML risk for exchanges, banks,…
Vanta
Continuous automated compliance monitoring platform that replaces manual audit evidence-gathering with live, integration-based control checks.
Arcova
Cybersecurity advisory and managed services firm, rebranded from MorganFranklin Cyber, offering GRC, IAM, OT security, and a cloud-based…
Credo AI
AI governance platform that discovers, assesses, and continuously monitors enterprise AI systems and agents against regulations like the…
Level 6 Cyber
CISO ReviewedContinuous decision-intelligence platform (LISN) that replaces point-in-time security audits with a live digital twin of a CISO's program.
Drata
Continuous compliance automation platform, Vanta's closest direct competitor, covering SOC 2, ISO 27001/42001, HIPAA, PCI DSS, DORA, and…
Coalition
A San Francisco 'active insurance' pioneer pairing cyber insurance with continuous attack-surface monitoring, having raised ~$860M total.
Elliptic
A London blockchain-analytics and AML compliance vendor with a 13-year track record, backed by Nasdaq Ventures and Deutsche…
OneTrust
Privacy-management pioneer that expanded into a broad trust and risk platform spanning AI governance, data governance, and third-party…
BitSight
Security ratings pioneer that scores organizations' cyber risk on a 300-820 scale using continuously collected external telemetry.
Fortress Information Security
Orlando-based supply chain and third-party cyber risk management provider that secures a reported 40% of the U.S. power…
Ontic
An Austin protective-intelligence platform unifying insider-risk, workplace-violence, and executive-protection signals for corporate security and HR teams, backed by…
Hawk AI
A Munich AML vendor layering machine learning onto traditional rules engines to cut false positives for banks, with…
Cynomi
AI-powered vCISO platform that lets MSPs and MSSPs deliver virtual CISO services and risk assessments to SMEs at…
CyberCube
The de facto standard cyber-risk-analytics provider for the insurance industry, powering underwriting and catastrophe modeling across brokers, MGAs,…
Resilience Cyber Insurance Solutions
A San Francisco cyber insurer running an in-house risk-operations center that ties underwriting and pricing directly to policyholders'…
Fravity
Fravity is an Austin-based agentic AI startup that automates fraud, risk, and anti-money-laundering compliance investigations, offering more than…
At-Bay
At-Bay is a San Francisco-based cyber InsurTech that has grown into a top-10 U.S. cyber insurer, combining cyber…
Behavox
A New York RegTech vendor using proprietary language models to surveil employee communications for insider risk and market…
ThetaRay
An Israeli AI-driven AML platform (SONAR) using unsupervised anomaly detection, built on applied mathematics, to catch money-laundering patterns…
Optro
Optro is AuditBoard's 2026 rebrand: an AI-powered GRC platform used by over half the Fortune 500 and named…
Panorays
Third-party cyber risk management platform combining continuous external attack-surface scanning with context-based, AI-assisted vendor questionnaires.
Norm AI
New York startup whose AI agents convert regulations into executable compliance logic, now valued at $1.2 billion.
RegScale
AI-driven continuous controls monitoring platform that automates GRC evidence collection, audits, and compliance for regulated industries.
BreachRx
Incident-response orchestration platform that automates breach-notification workflows and legal-compliance obligations, backed by a $15M Series A with Kevin…
Coalfire
A Colorado-based cybersecurity and compliance advisory firm and accredited assessor (PCI QSA, FedRAMP 3PAO) serving cloud, healthcare, finance,…
Onspring
A no-code governance, risk, and compliance platform out of Overland Park, Kansas that lets teams configure risk registers,…
Rencore
Rencore is a governance, security, and compliance platform for Microsoft 365, Power Platform, and enterprise AI (Copilot and…
Theta Lake
Theta Lake provides AI-driven compliance, security, and archiving for modern communication and collaboration platforms like Zoom, Microsoft Teams,…
AllTrue.ai
AllTrue.ai is an AI Trust, Risk, and Security Management (AI TRiSM) startup founded in 2022 by Ron Bennatan,…
Cowbell
A Pleasanton, CA cyber-insurance MGA offering continuously underwritten, telemetry-informed coverage for SMEs, backed by Zurich Insurance.
ServiceNow (Governance, Risk & Compliance)
ServiceNow's GRC and Integrated Risk Management module extends its enterprise workflow platform to unify risk, policy, and vendor…
Secureframe
Automated compliance platform for SOC 2, ISO 27001, and similar frameworks, competing with Vanta and Drata but at…
DigitalXForce
Irving, Texas-based AI-powered platform unifying governance, risk, compliance, and security posture management into one real-time system.
MITRE
The nonprofit federally funded research center behind ATT&CK, CVE, CWE, and STIX.
CyberSaint Security
Boston-based cyber risk management platform that automates control assessments and translates cyber risk into financial terms for executives…
Riskified
A publicly traded ecommerce fraud and risk decisioning platform that guarantees approved transactions against chargebacks, used by many…
Risk Ledger
Risk Ledger is a London-based third-party risk management platform that replaces one-off vendor security questionnaires with a shared…
Defense Unicorns
A founder-led defense software-supply-chain company that reached unicorn status on a $136M Series B.
Oneleet
Compliance automation platform bundling penetration testing, code scanning, cloud security, attack surface monitoring, and security training to make…
Lema AI
Lema AI runs an autonomous, agentic system that continuously investigates how third-party vendors actually access and move enterprise…
Kovrr
Cyber risk quantification platform that uses Monte Carlo simulation to translate technical risk into financial-loss estimates for boards…
6clicks
AI-assisted governance, risk, and compliance platform offering all-inclusive pricing and sovereign/air-gapped deployment options for global organizations.
A-LIGN
Large-scale compliance and cybersecurity audit firm delivering SOC 2, ISO 27001, and related assessments, now majority-owned by private…
Black Kite
Third-party cyber risk rating platform (formerly NormShield) providing continuous, automated vendor risk assessment across technical, financial, and compliance…
Onyxia
Onyxia gives CISOs a unified operational view across 40+ security tools to identify coverage gaps, benchmark performance, and…
Mitratech Prevalent
Third-party and vendor risk management platform, formerly independent as Prevalent, now operated as a product line inside Mitratech's…
Arco Cyber
Arco Cyber is a UK-based cybersecurity assurance company, founded in 2022 and led since inception by CEO Matt…
DataGuard
A Munich compliance-as-a-service platform pairing software with outsourced privacy/security officers for mid-market GDPR, ISO 27001, and SOC 2…
Immersive
A Bristol cyber-resilience platform with hands-on labs and crisis simulations, expanding into AI-agent readiness.
Cybervergent
AI-native continuous governance, risk, and compliance platform helping African enterprises replace periodic manual audits with ongoing posture monitoring.
Ethoca
A Toronto-founded, now Mastercard-owned network that lets merchants and card issuers share real-time data to resolve card fraud…
Vanta
Compliance automation platform that continuously collects evidence for frameworks such as SOC 2 and ISO 27001 and extends…
Whistic
AI-assisted third-party risk management platform that lets vendors publish standardized security profiles once and reuse them across buyer…
Censinet
Censinet runs a healthcare-specific third-party and enterprise risk management platform used by hospital systems to assess vendor, medical…
CyberVadis
CyberVadis provides standardized, evidence-based third-party cybersecurity and data-privacy risk ratings, letting enterprises assess suppliers once and share the…
Interos
Arlington, Virginia-based AI supply chain risk management platform mapping cyber, operational, and geopolitical risk across an organization's extended…
Secfix
Berlin-based AI-powered compliance automation platform helping European SMBs and mid-market companies manage ISO 27001, SOC 2, NIS2, DORA,…
Vendict
Israeli GRC startup using generative AI to automate security questionnaire responses and third-party vendor risk assessments for enterprise…
DeNexus
A Sausalito-based cyber risk quantification vendor specializing in operational technology and industrial environments, backed by insurer AXA XL…
Corvus Insurance
A Boston cyber insurer using proprietary risk scanning to underwrite, backed by Travelers since its 2023 acquisition.
TRM Labs
A San Francisco blockchain-intelligence unicorn that doubled its valuation to $2B through a Series C extension.
Prevalent AI
Prevalent AI builds a security data fabric that unifies fragmented enterprise data — asset, vulnerability, identity, and exposure…
OutThink
London-based human risk management platform founded by ex-CISOs that scores and reduces employee cyber risk using behavioral data…
Cyesec
A PE-backed Israeli exposure-management vendor combining attack-path automation with human-led pen testing.
Sprinto
Compliance automation platform for cloud and tech companies, automating framework monitoring and audit readiness with a growing India-US…
Squalify
Munich Re venture translating cyber exposure into financial-loss estimates using Monte Carlo simulation and a reinsurer-scale historical cyber-loss…
Tenchi Security
Tenchi Security's Zanshin platform automates continuous, evidence-based third-party cyber risk assessment for insurers, MSSPs, and consultancies managing risk…
MCP Manager
MCP Manager, based in New York, is an AI security company focused on bringing consent and trust controls…
Drata
Compliance automation and trust management platform that continuously monitors controls and automates audit evidence collection.
Telos Corporation
Telos Corporation is a publicly traded cyber risk management company best known for Xacta, a cyber GRC automation…
Anecdotes
An AI-powered GRC data platform, founded by Israeli 8200-unit alumni, that automates evidence collection and control monitoring for…
Transcend
A privacy and data-governance platform, founded by Ben Brook and Mike Farrell, that helps enterprises manage personal-data inventories,…
Vespia
Vespia is an Estonia-based Know Your Business (KYB) technology provider founded in 2021 by Julia Ront — Veriff’s…
Envelop Risk
A Bristol, UK cyber risk-modeling and underwriting firm backed by SoftBank Vision Fund 2, with a reinsurance track…
Certa
A Saratoga, CA-based no-code third-party risk management platform, named a Leader in Gartner's inaugural 2026 TPRM Magic Quadrant.
Hoxhunt
Hoxhunt is a gamified human risk management platform that runs adaptive phishing simulations and security training, used by…
VikingCloud
A global cybersecurity and PCI compliance platform serving distributed enterprises across 70+ countries with managed security, threat detection,…
Supply Wisdom
Supply Wisdom operates a continuous, AI-driven third-party and location risk intelligence platform that folds cyber risk monitoring into…
NAVEX
GRC and ethics compliance software platform built around whistleblower hotlines, policy management, and risk oversight, majority-owned by a…
TrustArc
TrustArc is a privacy and AI risk management platform offering consent management, data governance, and compliance certification, recently…
Conveyor
A San Francisco AI-driven platform that automates vendor security-questionnaire responses and runs an agentic customer-facing trust center, backed…
Comp AI
Comp AI (Bubba AI, Inc.) is an open-source, AI-agent-driven compliance automation platform that helps companies achieve and continuously…
ZeroRisk
ZeroRisk gives banks and payment providers a unified view of cyber risk and compliance across their merchant portfolios.
SoSafe
A Cologne-based, GDPR-native security-awareness training platform with ISO 27001:2022 certification, built for European compliance from the ground up.
RSA Archer (Archer IRM)
Long-running enterprise GRC platform used by half of the Fortune 500 to run integrated risk, compliance, and audit…
LogicGate (Risk Cloud)
No-code risk and compliance workflow platform, Risk Cloud, letting enterprises build and connect custom GRC applications without heavy…
Relativity
A Silver Lake-backed eDiscovery leader relevant to breach response, litigation, and compliance workflows.
Findings (CloudVRM)
CloudVRM automates real-time third-party cloud risk auditing, connecting directly to vendor AWS/Azure/GCP environments for continuous compliance data.
GM SECTEC
San Juan-based payment security leader with 50+ years of history, serving 50,000+ clients across Latin America, the U.S.,…
Quantifind
A Palo Alto financial-crime risk intelligence vendor (Graphyte) serving six of the top 10 Tier 1 banks.
Axio
A cyber risk quantification platform, named a Leader in Forrester's 2025 Cyber Risk Quantification Wave, that translates cyber…
nsKnox
nsKnox is an Israeli cyber-fintech company that verifies banking details before B2B payments are sent, preventing vendor-impersonation and…
Cyvatar.ai
A cybersecurity-as-a-service provider selling fixed-price, subscription-based compliance and security program management to small and mid-sized businesses.
Meditology Services
Healthcare-focused cybersecurity and GRC consultancy offering HITRUST, SOC 2, and HIPAA compliance assessments, backed by Primus Capital.
Finosec
Automated cybersecurity governance platform helping community banks and credit unions manage exam-ready infosec, access, and vendor risk programs.
ComplyAdvantage
A London-based financial crime risk data company providing AML transaction monitoring, sanctions/PEP screening, and KYC/KYB tooling used by…
Zurich
A global insurer whose roughly $11B Beazley acquisition and BOXX deal build a leading cyber-insurance and incident-response business.
Red Alert Labs
French independent cybersecurity laboratory and EUCC-accredited certification body for IoT and connected products; acquired by Fime in September…
Trustible
Arlington, VA AI governance platform that gives enterprises a unified inventory of AI systems and agents to manage…
Cyber Guru
A Series B Roman awareness-training leader with over one million active users and a 2025 Mantra acquisition.
ProcessUnity
Dedicated third-party risk management (TPRM) platform covering vendor sourcing, due diligence, ongoing monitoring, and remediation.
Resolver (a Kroll Business)
Cloud-based GRC platform connecting enterprise risk, compliance, audit and third-party risk data into one risk intelligence view.
MindPoint Group
A federal-focused managed cybersecurity and compliance advisory firm, accredited as a FedRAMP 3PAO, acquired by systems integrator Tyto…
Mitigata
A Bangalore cyber-resilience platform bundling insurance, SecOps, and compliance, with a Bessemer-backed Series B.
Copla
Copla (formerly CyberUpgrade) is a Lithuanian GRC and compliance automation platform that combines AI-driven evidence collection with CISO-as-a-service…
Ideagen
A long-established UK governance, risk, and compliance software provider used across audit, quality, and regulatory-compliance workflows in regulated…
Diligent
The largest GRC SaaS platform for boards, audit and risk teams, which acquired AI-native third-party risk startup 3rdRisk…
3rdRisk
3rdRisk is an Amsterdam, Netherlands-based third-party risk management platform that helps organizations assess, monitor, and manage risk across…
Clearly AI
Clearly AI uses AI to continuously review new products, features, vendors, and AI deployments for security and privacy…
Palqee Technologies
London-based compliance and AI governance platform, originally built for GDPR privacy management and now offering continuous runtime monitoring…
Avertro
Sydney-based GRC platform, CyberHQ, that converts security telemetry and compliance data into board-ready cyber risk quantification and automated…
CYRISMA
A Rochester, NY-based cyber risk and compliance platform built for MSPs, consolidating vulnerability management, data discovery, attack surface…
Ketch
A San Francisco-based data privacy and governance platform, founded by the former founders of Krux (acquired by Salesforce),…
StrongKeep
Singapore SMB cybersecurity platform, founded by the country's former Deputy Cyber Chief, bundling compliance, protection, training, and response…
CyberUpgrade
Vilnius-based AI compliance copilot helping small and mid-sized businesses manage ISO 27001, NIS2, and DORA requirements.
Breach Secure Now
A bootstrapped, MSP-channel security-awareness and compliance training vendor.
CYBERDISE
A Swiss seed-stage awareness-training startup with multi-channel simulations and over 80,000 reported users.
Hyperproof
Compliance-operations platform serving as a system of record for controls, risk, and vendor data across 160+ supported frameworks.
Scrut Automation
Compliance automation platform that maps shared controls across 60+ frameworks to cut duplicate audit and evidence work.
Axiom GRC
A London Inflexion-backed GRC and assurance platform (1,300+ specialists, 40,000+ clients) built from a GBP 500M carve-out.
Strike Graph
AI-native compliance automation platform helping companies achieve and maintain SOC 2, ISO 27001, HIPAA, and other framework certifications…
LeapXpert
A New York communications-governance leader for WhatsApp, iMessage, and Signal, a two-time Gartner Visionary.
Osano
Data privacy management platform combining consent/cookie compliance, data subject request automation, and vendor privacy risk assessment in one…
MedStack
A healthcare compliance automation platform that gives digital health developers infrastructure-as-code tooling and pre-built policies to meet HIPAA…
Clearwater
Healthcare-focused cyber risk management and HIPAA compliance provider combining risk-assessment software with 24x7 SOC services, majority-owned by Sunstone…
Paramify
Compliance automation platform that generates and maintains FedRAMP and other security authorization documentation.
CyberSheath Services International
CyberSheath is a Registered Practitioner Organization providing CMMC 2.0, DFARS, and NIST 800-171 compliance implementation and managed security…
Upfort
Upfort combines a small-business cyber risk mitigation platform with streamlined access to cyber insurance underwritten by partner carriers.
Venminder
Third-party/vendor risk management SaaS platform covering the full vendor lifecycle, from onboarding and due diligence through contract and…
X-Analytics
Arlington, Virginia cyber risk quantification platform from Secure Systems Innovation Corporation that translates technical security posture into financial…
Fusion Risk Management
A Chicago-based operational resilience platform covering business continuity management, disaster recovery planning, third-party risk, and crisis management, backed…
Exiger
An AI-driven supply chain and third-party risk platform used to map risk down to the 'nth tier' of…
Workiva
A publicly traded (NYSE: WK) connected-reporting and compliance platform, founded in 2008 in Ames, Iowa as WebFilings and…
Spektrum
Spektrum Labs builds a cyber resilience platform that generates cryptographic proof — Cyber Resilience Tokens — that an…
MedSec
MedSec provides cybersecurity research, penetration testing, and risk-assessment services focused specifically on medical devices and hospital environments.
IntelliGRC
IntelliGRC is a compliance automation platform built specifically for MSPs, MSSPs, and small defense contractors navigating CMMC and…
GAN Integrity
GAN Integrity is a two-decade-old GRC platform, recognized by Gartner as a Challenger in third-party risk management, used…
Quod Orbis
A London continuous controls monitoring specialist, acquired by Deda Group.
Red Education
A Sydney vendor-authorized cybersecurity training partner with over 100,000 seats delivered.
SPHERE Technologies Solutions
An Edison Partners-backed identity-hygiene specialist automating access cleanup across large identity estates.
Riskassure
RiskAware platform scans networks to locate and value sensitive data, helping businesses right-size cyber insurance coverage and quantify…
SecurityMetrics
Longstanding Utah-based provider of PCI compliance, vulnerability scanning, and forensic services purpose-built for small and mid-sized merchants.
Wolters Kluwer
A listed information-services company that acquired GRC platform StandardFusion for about EUR 32M to unify audit and GRC.
PECB
PECB is a global certification body providing ISO 27001, cybersecurity, and compliance training and professional certification used by…
ZINAD
AI-driven cybersecurity awareness training combining adaptive learning, VR simulations, and psychology-informed phishing protection to reduce human-factor risk.
Balance Theory
A Columbia, MD platform tying cybersecurity investment planning to market intelligence and procurement.
Trustpair
Paris-based platform that validates vendor payment details and flags anomalies to prevent wire fraud, increasingly positioned against AI-generated…
Providence Consulting Group
Australian protective-security and risk advisory firm serving Defence and government clients, now part of Tetra Tech's global advisory…
heyData
A Berlin compliance and security SaaS platform (2,000+ customers) that raised a $16.5M Series A.
Stoik
A Paris cyber-insurtech pairing coverage with active prevention (10,000+ clients, ~EUR 50M premiums).
Anitian
Compliance automation platform that helps SaaS companies achieve FedRAMP authorization inside their own AWS or Azure environment, with…
TÜVIT
Accredited German IT security testing and certification body (TUV NORD Group) issuing Common Criteria, Security Qualification, and ISO…
Cypago
Cyber GRC Automation platform that connects directly to cloud and on-prem systems to automate compliance evidence collection and…
Data Rudder
A 2018-founded Brazilian fraud and AML detection startup being acquired by Nuclea, pending Central Bank approval.
Onlayer
Onlayer (formerly PCI Checklist) is a London-based merchant risk platform combining PCI DSS compliance automation with fraud, AML,…
StandardFusion
StandardFusion, based in Vancouver, Canada, provides governance, risk, and compliance (GRC) software that helps organizations manage risk assessments,…
StackAware
AI governance and security advisory firm helping companies reach ISO 42001 readiness and manage AI cyber, privacy and…
Ostendio
Ostendio is an Arlington, Virginia GRC company whose MyVCM platform helps organizations, especially in healthcare, manage compliance across…
Regulativ.ai
Regulativ.ai is a London-based RegTech platform that uses AI agents to automate regulatory compliance work such as control…
Evolver
A 25-year-old Reston federal systems integrator with a $500M DOJ blanket purchase agreement.
iDNA
iDNA (Groupe IDNA, encompassing IDNA and AURA iT) is a Paris-based cybersecurity consulting and engineering specialist with roughly…
Xamin
Xamin is a Chicago-based managed services provider with more than 25 years of experience serving banks, credit unions,…
Milou
Milou is an AI-first platform that orchestrates penetration-testing workflows end to end — centralizing raw scanner and tester…
CyberPilot
CyberPilot is a Danish security awareness training and phishing simulation company, employing around 50 people and working with…
Complyance
A New York agentic GRC platform that automates evidence review and vendor risk assessment, backed by a $20M…
Kertos
A Munich-based no-code platform that automates GDPR, ISO 27001, SOC 2, TISAX, and NIS2 compliance evidence-gathering for European…
Logiq Consulting
NCSC-assured Bristol cyber consultancy and managed-services provider for UK defence, government and critical infrastructure; acquired by IBM in…
Zania
A Palo Alto company whose AI 'teammates' automate GRC busywork—controls testing, evidence collection, and security questionnaires—for compliance teams.
Evolve Security
A Chicago offensive-security firm pairing continuous pen testing with its Evolve Academy bootcamp.
Apptega
GRC automation platform that maps a single control set across dozens of frameworks (SOC 2, PCI, HIPAA, CMMC,…
Astelia
A Tel Aviv exposure-management platform founded by former leaders of Israel's National Red Team, backed by Index Ventures…
ValueMentor
Dubai-headquartered security services firm holding PCI QSA, SWIFT and CERT-IN accreditations, offering managed security, VAPT, DFIR and compliance…
Ostrich Cyber-Risk
Cyber risk quantification platform using Monte Carlo simulation and the Open FAIR ontology to translate security findings into…
Carbide
Nova Scotia-based GRC and compliance automation platform (formerly Securicy) mapping evidence across SOC 2, ISO 27001, HIPAA, GDPR,…
Thoropass
Compliance automation platform combined with in-house auditors for SOC 2, ISO 27001, HIPAA and other frameworks.
Perimeter
Minnetonka, Minnesota-based vendor and third-party risk management platform (rebranded from ProcessBolt in 2025) automating security questionnaires, evidence review,…
SafeGuard Privacy
Privacy compliance management platform combining assessment workflows, vendor risk tracking, and an AI assistant, used as the backbone…
Compyl
AI-guided governance, risk, and compliance platform automating control testing and evidence collection across 70+ frameworks including SOC 2,…
Sign In Compliance
Sign In Compliance (formerly ThreatSwitch) is a NISPOM insider-threat and compliance management platform for cleared federal contractors, now…
Chino.io
Italy-based GDPR/HIPAA/AI Act compliance platform and outsourced DPO service for digital health, acquired by Sicuro.it in March 2025.
Riskonnect
A Thoma Bravo-owned integrated risk management (IRM) suite spanning enterprise risk, third-party risk, business continuity, ESG, and claims/insurance…
ZenGRC
A cloud GRC platform (originally launched by Reciprocity, briefly rebranded RiskOptics, and reverted to the ZenGRC name in…
Centraleyes
An AI-powered cyber GRC platform, formerly known as CyGov, that automates risk and compliance data collection to help…
Panacea Infosec
Panacea Infosec is a New Delhi-based information security firm founded in 2012 by CEO Ajay Kaushik, with more…
PrivacyPal
PrivacyPal (Privacy Pal LLC / PrivacyPal.ai), based in Miami, Florida, builds AI governance and ‘shadow AI’ detection technology…
HelmGuard AI
London-based agentic GRC platform where AI agents monitor controls, manage third-party risk, and govern other AI agents.
SPECTRA
MSP certification and cyber-resilience warranty platform linking managed service providers to insurance carriers and brokers.
Phished
Belgian security awareness training company offering AI-personalized phishing simulations and gamified training to reduce human-error breach risk.
Fime
Paris testing, consulting and certification group for payments, smart mobility and digital identity; acquirer of Red Alert Labs…
Pulse Security
AI-driven operational management platform that acts as a system of record for the cybersecurity program, built for CISOs.
MetricStream
One of the oldest enterprise GRC vendors, offering a low-code/no-code cloud platform spanning risk, compliance, audit, and third-party…
Destination Certification
A bootstrapped Victoria training provider specializing in CISSP, CCSP, and CISM, co-founded by a CISSP Study Guide co-author.
ThriveDX
A well-funded Miami cybersecurity training provider spanning corporate, higher-education, and consumer programs.
Munich Re
A global reinsurer whose HSB subsidiary acquired cyber insurer At-Bay for $575M.
ControlCase
A PE-backed compliance-certification firm that added CMMC assessment capability by acquiring CyberNINES in April 2026.
Flagright
A San Francisco explainable-AI financial-crime compliance platform with a Series A and multi-country customers.
CyberGuard360
White-label compliance-as-a-service and vCISO platform built for managed service providers to manage cybersecurity risk assessments and compliance across…
Tevora
Tevora is a cybersecurity and compliance consultancy providing penetration testing, GRC program development, and PCI/HIPAA compliance advisory services…
Quantivate
Governance, risk, and compliance software for banks and credit unions, now operating as a distinct product brand within…
Nova Leah
Nova Leah automates FDA cybersecurity risk documentation for medical device manufacturers, replacing manual spreadsheet-based compliance processes.
SecurityStudio
Minnetonka, Minnesota SaaS platform built around the S2Score, a 300-850 credit-score-style measure of organizational information security risk, paired…
Aravo Solutions
A San Francisco-based third-party risk management (TPRM) platform used by large global brands to onboard, assess, and continuously…
Cority
A Toronto-based EHS (environment, health, and safety) and GRC software provider, originally founded as Medgate in 1985 and…
Trustero
A Palo Alto-based AI-driven compliance platform that automates gap analysis, remediation guidance, questionnaire responses, and evidence collection for…
Kovr.ai
A FedRAMP-authorized agentic compliance platform (Agent Artemis) acquired by Gryphon-backed Fortreum in April 2026.
Beazley
A major Lloyd's specialty insurer with an in-house incident-response cyber offering, being acquired by Zurich for GBP 8.1B.
Summit
Summit Security Group is a Pacific Northwest-based cybersecurity consultancy founded in 2011, delivering services across the security spectrum:…
SmarterD
SmarterD is an AI-powered data convergence platform that unifies IT, security, and compliance data scattered across an organization's…
AssurancePoint
AssurancePoint is an Atlanta-based CPA firm specializing in independent security and compliance assessments, issuing attest and compliance reports…
DSShield
A Riyadh-based, PE-backed national cybersecurity integrator serving Saudi government and critical-infrastructure clients under Vision 2030 mandates.
Elm AI
A New York startup (formerly Esger) that deploys AI agents to automate supplier compliance, due diligence, and third-party…
HyperCube
Board-reporting SaaS from Cyberseconomics that translates technical security posture into business-relevant metrics for CISOs and boards.
SGS
A Geneva-based certification giant that acquired PCI DSS specialist Panacea Infosec in January 2026.
Hackmetrix
Santiago-based compliance automation platform helping Latin American startups and mid-market companies reach ISO 27001, SOC 2, and PCI…
Midship
A Y Combinator-backed San Francisco AI SOX-automation startup being folded into Optro's GRC platform.
Compleye
Amsterdam-based compliance automation platform helping small and mid-sized businesses achieve ISO 27001, SOC 2, and GDPR compliance without…
Bastion
AI-driven compliance and security automation platform for startups, built by former Palantir engineers to get companies SOC 2,…
IPKeys Technologies
Federal cybersecurity contractor whose CLaaS platform automates NIST Risk Management Framework compliance and continuous monitoring for the Department…
Secure Digital Solutions
Secure Digital Solutions is a Minneapolis-based information security consulting firm offering virtual CISO, risk and compliance advisory services,…
Apollo Secure
Automated compliance and security-readiness platform for startups, small businesses, and schools, generating policies, running vulnerability scans, and mapping…
Tenacy
Lyon-based, France-hosted GRC platform helping organizations manage multi-framework cybersecurity compliance from a single system, positioned around EU digital…
IRM (Information Risk Management)
UK-founded cyber GRC and penetration testing consultancy, now the cybersecurity division of Capgemini Group, built around its SYNERGi…
Responsible Cyber
Singapore-based cyber risk and third-party risk management vendor offering CISO-as-a-service consulting alongside its RiskImmune vendor-risk platform.
Solidrange
A Riyadh-based, Sharaka Capital-backed GRC automation startup whose EasyCompliance platform has landed government and publicly listed customers across…
Pervade Software
Cardiff, Wales-based vendor whose OpView and OpAudit platforms combine SIEM-style monitoring, vulnerability tracking and compliance evidence management, and…
LogicManager
A Boston-based enterprise risk management (ERM) platform, founded and grown without outside venture funding, that helps organizations tie…
Corporater
A Norwegian GRC and business-management software vendor with 12 global offices, offering a configurable low-code platform (branded GPRC…
Ncontracts
A Nashville-area GRC platform built specifically for banks, credit unions, and other financial institutions, combining risk and compliance…
Cyberday
A Finnish information security management system (ISMS) and compliance platform, formerly Agendium, that helps European small and mid-sized…
Hicomply
A North East England-based compliance automation platform, backed by growth-capital firm BGF, that helps fast-growing businesses achieve and…
Isora GRC
A collaborative GRC assessment platform built by public-benefit company SaltyCloud, originally focused on higher-education and public-sector security teams,…
Stealth – ISS Group Inc.
An Arlington compliance and consulting firm with SDVOSB and WOSB certifications and over two decades of federal experience.
BD Emerson
BD Emerson is a Richmond, Virginia-based cybersecurity, compliance, and privacy consulting firm founded in 2020, offering cybersecurity consulting,…
TovenAI
AI agents that automate manual, data-intensive compliance surveillance and evidence work for institutional trading firms.
Prescient Security
Prescient Security is a Nashville-based audit and penetration-testing firm delivering SOC 2, ISO, FedRAMP, and CREST-accredited compliance services.
Klever Compliance
Boutique GRC advisory firm providing tool-agnostic Compliance Management as a Service for mid-sized organizations building right-sized governance programs.
GoComply
Early-stage GRC platform that continuously validates whether written security policies are actually enforced in practice, not just documented.
Cybeta
A DoD-pedigreed cyber-risk quantification firm whose IP was absorbed by insurance broker Howden.
Cable
A continuous control-testing startup for sponsor banks and fintech partners, acquired by Synctera but still operating standalone.
DynaRisk
London-based cyber risk scoring and dark web monitoring platform built for insurers underwriting and monitoring cyber policies.
VISO TRUST
A San Francisco AI-powered third-party risk platform acquired by Australian GRC leader Protecht.
BreakPoint Labs
A national-security red-team and DevSecOps firm acquired by Bluestone-backed Valiant Solutions.
Altamira
Altamira Technologies Corporation, based in McLean, Virginia, is a Northern Virginia government technology and data/AI solutions provider serving…
Aptible
A San Francisco compliance-automation vendor combining audit-prep workflow (SOC 2, HIPAA, ISO 27001) with managed compliant cloud hosting,…
Trava Security
Cyber risk management platform for small and midsize businesses that ties vulnerability and compliance posture directly to cyber…
C2 Risk
London-based third-party and supply-chain risk management platform (formerly branded C2 Cyber), whose RiskStore platform helps public and private…
Ethico
A Charlotte-based ethics and compliance company, originally founded as ComplianceLine in 1997 and rebranded as Ethico in 2022,…
Waterleaf International
A self-funded Florida managed-security and CMMC/SOC 2 compliance provider serving municipal and DoD-contractor clients.
TrackLight
A government anti-fraud vendor led by the founders of Pondera Solutions, adding identity validation by acquiring Plum Identity…
Protecht
An Australian GRC vendor that added AI-driven third-party risk assessment by acquiring San Francisco-based VISO TRUST in April…
AssurePoint
Sydney IRAP, ISM and Essential Eight assessment firm founded in 2025; acquired by A-LIGN in September 2026 to…
Fortreum
A Gryphon-backed cybersecurity advisory firm that added AI-driven FedRAMP and CMMC automation by acquiring Kovr.AI.
Mobile Mentor
A Microsoft-first managed services provider that added healthcare and legal compliance depth by acquiring 5th Gear in April…
SBS CyberSecurity
A cybersecurity audit, consulting, and vCISO firm built around the regulatory compliance needs of U.S. community banks and…
Casco
A Y Combinator-backed San Francisco AI red-teaming platform that maps findings to SOC 2, NIST AI RMF, and…
DQS
A 40-year-old global certification body (200+ standards, 20,000+ clients) now backed by private equity firm Montagu.
RiskQ
Cyber risk quantification platform that translates security posture into financial and insurance-aligned risk terms for board and executive…
CyNation
A London-based third-party and integrated risk management platform (CyDesk) that combines cyber posture, regulatory compliance, and AML/KYC/ESG risk…
CISO Global
Scottsdale-based public cybersecurity company (Nasdaq: CISO, formerly Cerberus Sentinel) combining managed SOC services, compliance/pen-test consulting, and a small…
Enveedo
Enveedo is a Miami-based cyber risk management platform that helps mid-market companies plan, build, and operationalize a security…
Zeron
Mumbai-based cyber risk posture management startup that quantifies technical exposure into financial terms for enterprise risk teams and…
Secure&IT
Independent Spanish cybersecurity consultancy combining regulatory compliance advisory (ENS, GDPR, NIS2, DORA) with a managed SOC-CERT and industrial…
Basware
A PE-owned Finnish AP-automation leader extending into payment-fraud prevention via Trustpair and Glantus.
FALKIN
FALKIN is a London startup building AI tools embedded in banking apps to flag scam manipulation before a…
Cytrusst
An India-based platform combining GRC, data-privacy compliance, third-party risk, and attack surface management in one workspace.
Synctera
A banking-as-a-service platform that embedded automated AML/KYC control testing by acquiring Cable in April 2026.
Koniag Cyber
An Alaska Native Corporation cybersecurity subsidiary that built CMMC capability by acquiring SoundWay Consulting's practice.
Tyto Athene
A PE-backed federal IT integrator that built FedRAMP and CMMC compliance depth via MindPoint Group and stackArmor.
Montagu
A London private equity firm taking a majority stake in certification body DQS in April 2026.
Arkenstone Defense
A seed-stage Menlo Park managed platform for the federal compliance burden of selling into government.
TruOps
Cloud-based GRC platform from longtime IT/security consultancy SDG Corporation, integrating IT risk, compliance, vendor risk, and vulnerability management…
Sagenso
Polish SME-focused platform combining ransomware behavior detection (Ransom SpAI) with a cybersecurity compliance-tracking SaaS tool (Telescope).
InnoSec
STORM platform quantifies cyber risk in business-impact terms for enterprises, insurers, and M&A due diligence, recognized as a…
CyberNINES
An authorized CMMC C3PAO assessment organization acquired by ControlCase.
ACG Cybersecurity
Paris-based independent cybersecurity consultancy specializing in penetration testing, ISO 27001 implementation, and regulatory compliance audits (GDPR, PCI DSS,…
SafeStack
An Auckland developer secure-coding training specialist acquired by NINJIO in July 2026.
DeepView
Small UK compliance-archiving and data-leak-detection platform for regulated firms, monitoring WhatsApp, iMessage, and social media under FINRA/SEC/FCA rules.
Quantum Fort
Swiss cyber risk quantification firm, rebranded from Corax Cyber Security, translating technical exposure into financial risk metrics for…
Allgress
Allgress provides an integrated IT governance, risk, and compliance platform that helps organizations map controls, manage risk assessments,…
Rimstorm
A managed CMMC Level 2 enclave provider for defense contractors, acquired by BOOST LLC in March 2026.
Nuclea
A Brazilian financial-infrastructure operator building fraud and AML capability by acquiring Data Rudder, pending Central Bank approval.
Verdict Machine
Verdict Machine is an early-stage Tel Aviv startup using AI to assess and pre-approve institutional blockchain transactions against…
Howden
A global insurance broker that acquired Cybeta's cyber-risk analytics IP in May 2026.
Wipfli
A top-25 US accounting and advisory firm that added infosec and privacy compliance by acquiring CompliancePoint in 2026.
Gryphon Investors
A San Francisco private equity firm whose portfolio company Ncontracts acquired Quantivate to form a 4,000-institution GRC platform.
Datavault AI
A NASDAQ-listed data-tokenization company that diversified into cyber-risk compliance with a $94.5M all-cash CyberCatch acquisition.
Hard2Hack
A bootstrapped fractional-CISO practice led by a 35-year cybersecurity veteran.
Magnitude
A seed-stage San Francisco autonomous third-party-risk platform backed by Ballistic Ventures.
SoundWay Consulting
A Cyber AB-authorized CMMC C3PAO whose CMMC business line was acquired by Koniag Cyber in March 2026.
FICO (Cybersecurity Score)
Analytics giant best known for consumer credit scoring that also produces a third-party cyber risk rating, competing in…
3Point
A roughly 20-person Belgian defense-sector security consultancy with a proprietary threat-monitoring service, acquired by Cegeka.
mhm
A five-year-old Calgary assurance firm and ISO 42001 accreditation pioneer acquired by Axiom GRC.
Cybernance
Austin-based cyber risk governance platform built on the NIST Cybersecurity Framework, giving boards and executives a maturity-scoring system…
RealSecurity
REAL Security (trading as RealSecurity) is a specialist cybersecurity distributor and consultancy based in Maribor, Slovenia, serving the…
CyberNut
A K-12-focused security-awareness vendor that added a student digital-citizenship curriculum by acquiring Neptune Navigate in July 2026.
Andersen
A global professional-services association extending into cyber and privacy advisory through BD Emerson and a collaboration with S-RM.
Stelau
A 24-year-old Paris digital-identity security consultancy acquired by iDAKTO to complete an end-to-end identity value chain.
Capslock
A Manchester cyber-reskilling bootcamp (1,200+ career changers placed) fully absorbed into joint-venture partner mthree.
HaystackID
An eDiscovery services provider adding GenAI-native document intelligence through its February 2026 acquisition of eDiscovery AI.
QuickStart
A cybersecurity workforce-development and talent marketplace company expanding AI-powered training via its IronCircle acquisition and a new Maryland…
CompliancePoint
A 25-year-old Georgia compliance and privacy advisory firm being absorbed into Wipfli.
Cyberangels
A Milan-based white-label cybersecurity platform bundling risk assessment, threat monitoring, compliance tracking, and embedded cyber insurance for SMEs…
Catalyst Cyber
A Canberra federal-government cyber-assurance specialist acquired by ASX-listed Infotrust for about AUD 5M in March 2026.
ImagineX Cybersecurity
ImagineX's Atlanta cybersecurity advisory arm, carved out and acquired by TekStream.
Security Centric
A Sydney cybersecurity consultancy with defence heritage, acquired by Virtual IT Group.
Lovell Consulting
A five-year-old Paris GRC and IAM consultancy (EUR 4.2M revenue) acquired by cybersecurity group Squad.
The Collective
The Collective is a Belgian cybersecurity consultancy based in Lochristi, specializing in Microsoft security services — including Microsoft…
mthree
A workforce-training company that took full ownership of cyber-reskilling provider CAPSLOCK in June 2026.
Fifth Gear Technology Concepts
A healthcare- and legal-focused MSP and cybersecurity firm acquired by Mobile Mentor.
4A Security & Compliance
A boutique U.S. cybersecurity and compliance consultancy offering risk assessments, penetration testing, and vCISO services to regulated organizations,…
CRACI
Helsinki pre-seed startup automating EU Cyber Resilience Act compliance and software-supply-chain documentation inside CI/CD pipelines.
Teron Labs
A Canberra product-security and cryptographic certification lab acquired by Applus+ Laboratories.
eDiscovery AI
A Minneapolis AI early-case-assessment startup acquired by HaystackID in February 2026.
Insignis
A small women-owned national-security engineering firm acquired by Falfurrias-backed Woven Solutions.
Security Vitals
A Michigan CMMC compliance specialist combining with managed IT and security firm Brightline Technologies.
CyberCatch
Automated cyber risk assessment and compliance platform for small organizations tied to critical infrastructure, including municipal utilities, community…
THL (Thomas H. Lee Partners)
A Boston private equity firm that standardizes eSentire MDR across more than 35 portfolio companies.
Lexverify
A Birmingham AI legal-compliance startup from the NCSC accelerator, acquired outright by Trust Stamp for GBP 190,000 in…
Delve
A San Francisco AI-compliance-automation startup facing unresolved, actively disputed fabrication allegations over its SOC 2 attestations as of…
TechnoMile
AI-enabled cloud software for government contractors; combined with facility-security software maker SIMS Software in January 2026.
ThreatCaptain
An early-stage cyber risk quantification tool built for MSP sales teams, translating client security posture into estimated financial…
Cyberwatch Finland
A small Helsinki cybersecurity-culture consultancy acquired by Netum Group.
Zen Cyber
A small Canadian privacy and cybersecurity compliance consultancy acquired by TSXV-listed TrustBIX.
Ready Support Services
An intelligence-community ServiceNow and cloud-migration specialist acquired by Arlington Capital-backed Tyto Athene.
Neptune Navigate
A K-12 digital-citizenship curriculum provider acquired by CyberNut in July 2026.
Ikigai Ventures
A London-listed acquisition vehicle merging with the Dotlines Group in a GBP 55.7M all-share deal and rebranding as…