GRC vendors

Qualys provides an enterprise cyber risk and security platform.

IBM is a technology company that sells software, infrastructure, and consulting services.

A-LIGN provides cybersecurity compliance audits and certifications across frameworks like SOC 2 and ISO 27001.

Compliance-focused cybersecurity advisory firm and FedRAMP 3PAO specializing in penetration testing that meets stringent regulatory requirements.

Global risk advisory firm with a 400+ person cyber practice. IR-led penetration testing that feeds active breach intelligence straight into test scoping.

UK compliance and cybersecurity consultancy, formerly IT Governance, offering CREST and NCSC CHECK penetration testing alongside governance, risk and compliance services.

Jones IT provides managed IT services, cybersecurity, and compliance support to businesses in the San Francisco Bay Area.

US cybersecurity consulting, audit and testing firm founded in 2004, focused on community banks and credit unions, with external, internal, web application, wireless and PCI DSS penetration testing plus CMMC Level 1 and 2 readiness work.

CREST-accredited California consultancy blending compliance expertise with penetration testing. First to earn ISO 17020 for MITRE ATT&CK and PTES frameworks.

PreVeil provides end-to-end encrypted email and file sharing for defence and regulated industries.

RedTeam Security is now part of DeepSeas, which offers penetration testing, red teaming and physical testing as its offensive security practice.

Sets standards, audits and insures frontier AI systems and agents for security, safety and reliability.

Provides cloud security, compliance and managed detection and response services to regulated industries.

BARR Advisory helps organisations establish, manage, and audit cybersecurity and compliance programmes.

ISO/IEC 27001 certification audits and information security training from the UK national standards body, which also certifies quality, safety and medical devices.

CRACI provides build-time software supply chain security and SBOM generation for developers.

Data & More is a Danish software company founded in 2016.

Turin firm selling Weseth, a remote platform for automated security and penetration testing of vehicles and devices.

Feedzai provides AI-powered fraud and financial crime prevention software for banks and fintechs.

Fendr provides AI usage controls for businesses.

Heelr is a marketplace connecting organisations with verified cybersecurity professionals and providers.

Integris provides managed IT, cybersecurity, AI and cloud services to small and midsize businesses.

ITSecOps provides managed IT, cybersecurity and compliance services to organisations worldwide.

Johanson Group is a CPA firm providing security and compliance audits.

KirkpatrickPrice is a licensed CPA firm that performs cybersecurity audits and compliance assessments.

Cyber security consulting covering strategy and governance, security transformation and cyber threat management, plus cyber managed services and cloud security from member firms.

Risk data and analytics provider whose ThreatMetrix, Emailage and InstantID products detect fraud and verify digital identities for banks, insurers and governments.

Living Security provides a platform that measures and reduces human risk in organisations.

Fraud management, money laundering detection, KYC and trading compliance software for banks and financial institutions, with case management and investigation tools.

Pillar Security provides a platform to discover, test, secure and govern AI agents across organisations.

Prescient Assurance provides SOC 2 audits and security compliance certifications for SaaS companies.

ProcessUnity provides a software platform for managing third-party and cybersecurity risk.

Pulumi provides an infrastructure as code platform that lets teams build and manage cloud infrastructure using general purpose programming languages such as TypeScript, Python, Go, .NET, Java, YAML and HCL.

Quzara provides FedRAMP compliance advisory and managed detection and response services.

SafeHabits provides managed security awareness training and human risk management for organisations.

Securiti provides a platform for data security, privacy, governance and compliance across hybrid multicloud environments.

Senteon automates endpoint hardening and CIS benchmark compliance for audits.

SkyCloud provides software for managing and automating firewall security policies across multiple vendors.

Provides managed IT services, cybersecurity, compliance support and AI adoption guidance to businesses.

SyntaAI sells Syntasec, an on-premise security and compliance platform for SAP systems.

TRM Labs provides blockchain intelligence and AI tools to help investigate and disrupt criminal networks.

vCISO Lite sells a subscription platform that helps growing companies handle security compliance and risk.

Third-party risk management software with outsourced vendor control assessments, continuous vendor risk monitoring and managed services, now part of Ncontracts.

Virtue AI provides an enterprise AI safety platform for securing AI agents and applications.

Whistic provides a platform for assessing, monitoring, and sharing vendor security and compliance information.

Product security platform for vehicle makers covering TARA, SBOM-based vulnerability management and R155 and ISO 21434 compliance.

Cortile automates vendor security reviews for healthcare third-party risk teams.

Cyberneza provides cybersecurity and compliance consulting for defense contractors and regulated organizations.

Tool for building and updating threat analyses and risk assessments to ISO/SAE 21434, IEC 62443 and the CRA.

Lattix Technologies Corp provides data security with encryption, policy, and audit trails.

Cybersecurity consulting, transformation and managed security services covering risk and compliance, secure business enablement and cyber resilience, from a global IT services company.

ONEKEY provides a platform for product cybersecurity and compliance, automating SBOM analysis, vulnerability detection, and regulatory compliance.

Third-party management and tech risk and compliance software, alongside privacy automation, consent management and AI governance tools.

Third-party cyber risk management platform with vendor security questionnaires, external attack surface ratings, continuous monitoring and remediation workflows for suppliers.

Browser-based tool that automates threat analysis and risk assessment, mainly for vehicle makers and their suppliers.

Safetica provides AI-powered data protection, insider risk, cloud security, and compliance software.

Builds cryptographic validation, information intelligence, regulatory assurance and sovereign AI products for defence and government.

SecurityScorecard provides a platform for managing third-party and supply chain cyber risk.

VxLabs provides an AI-powered platform for automotive cybersecurity compliance and risk management.