Supercharging Vendor Risk Management: Vanta acquires Riskey

Today, we're taking a big step toward making trust management even easier for our customers: Vanta has acquired Riskey, a company leading the way in real-time third-party risk monitoring. Their continuous vendor monitoring and alerting will soon be part of Vanta’s Vendor Risk Management product.

‍

Managing vendor risk is more important than ever. 45% of organizations have seen an increase in business interruptions due to third-party cybersecurity incidents¹, and the number of vendors each company relies on grows about 9% every year². It’s no surprise then that IT teams are now spending over six hours a week just reviewing vendor risk.³

‍

Traditionally, vendor risk programs used point-in-time assessments, like questionnaires, or outside-in scores to vet vendors. Questionnaires provide momentary snapshots at best, and they are only as accurate as the vendor’s attestation. Outside-in scores can be opaque, gamed, and many GRC professionals we’ve spoken to find them unreliable. Besides, risks evolve rapidly, independent of the timing of an annual audit or documentation refresh.

‍

Riskey built industry-leading third- and fourth-party risk monitoring for vulnerabilities, breaches, misconfigurations, leaked credentials, and subprocessors. Their AI scoring model dynamically categorizes findings, reducing noise and driving focus. 

‍

We’ve already integrated Riskey’s technology into Vanta’s Vendor Risk Management product, allowing customers to compliment their existing first party reviews with third party signals. This has unlocked continuous vendor risk monitoring that allows teams to identify threats proactively and take action, protecting key company assets.

‍

“Vanta's vendor risk monitoring is a great platform for both our CISO and CIO, especially when validating vendors during onboarding as well as continuous vulnerability assessments."

— Itay Yefet, CIO, Liberty Latin America

‍

‍

Vendor risk monitoring in Vanta will help businesses:

‍

• Run comprehensive risk assessments that combine first-party security reviews and third- and fourth-party continuous monitoring
• Accelerate security reviews with automatically-collected vendor documentation and Riskey's risk attributes
• Monitor, alert, triage, and respond to shifting vendor risk with continuous, always-on monitoring and actionable next steps
• Evaluate a company’s risk profile intelligently with AI-powered insights and prioritization

‍

“The pain in the current vendor risk market is deep and profound. Plugging Riskey’s monitoring technology into Vanta’s VRM offering is an absolute game changer. We’re incredibly excited to join this team and bring even more value to customers, together.”

– Koren Molcho, Co-founder at Riskey

‍

Vanta customers can access the new continuous vendor risk monitoring by reaching out to their account team. If you’re interested in seeing a demo or trying out Vanta VRM, we’d love to hear from you!

‍

‍

Sources:

1. Gartner®, Optimize Use of Certifications and Attestations for Third-Party Security Review, Pedro Pablo Perea de Duenas, Alicia Booker-Carney, 9 January 2025

2. Okta Businesses at Work 2025

3. Vanta State of Trust Report 2024.

GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.

‍