Today we're launching Third-Party Risk Management, a newly standalone agentic approach to vendor risk that replaces fragmented, questionnaire-heavy reviews with criteria-based, evidence-driven decisions in a single platform. It's built for how third-party risk actually works now: a vendor list that keeps growing, questionnaires that keep piling up, and an onboarding review that says very little about whether a vendor is still safe six months later.
Third-party risk has become one of the hardest — and busiest — jobs in security. The pressure shows up in the data too. In our upcoming 2026 State of TPRM research report, nearly 85% of IT and security teams reported at least one third-party incident in the past 12 months. Having a TPRM tool was rarely the problem. Keeping up with the volume, depth, and pace of vendor review is.
We built the Third-Party Risk Management to close that gap, so teams can raise the bar on every assessment, surface risk gaps, and stand behind every vendor decision with full traceability.
Why We Built It
We kept hearing the same thing from security teams: most third-party risk programs are stretched thin across three problems at once.
The first is defensibility. Vendor decisions still come down to inconsistent, subjective judgment calls that are hard to explain after the fact, and growing regulatory pressure makes that gap harder to ignore.
The second is fragmentation. Third-party risk tends to spread across multiple disconnected tools, accumulated through separate purchases or inherited through mergers and acquisitions. Answering one question about a vendor means checking five places.
The third is capacity. Third-party counts keep growing faster than headcount ever does, so teams triage: real scrutiny for a handful of critical vendors, while the rest go unchecked or under-assessed. In our new research, staffing was the number one obstacle teams named (59%) — and only 11% plan to hire to fix it. The answer they're reaching for is automation.
What Drata Third-Party Risk Management Does
We put an agent to work on the most time-consuming parts of vendor review, while keeping a human in control of every decision. It runs the review end to end — syncing your vendors, tiering inherent risk, gathering and scoring evidence against your residual risk standards, and recording the decision — with a reviewer signing off on every result.. Here's how that holds up against the three problems above.
Make Decisions You Can Defend
When a regulator, auditor, or customer security team asks why a vendor was approved, subjective judgment calls don't hold up, and regulators keep expecting more documented oversight. It's the capability teams value most: in our latest research, defensible assessments — ones that stand up to customers, regulators, and auditors — rated the single most important capability, at 4.38 out of 5, just ahead of speed.
Drata evaluates every third party against standards you set in plain language, not limited to a rigid checklist, and every result carries the specific logic and evidence behind it. Ask the agent to explain any decision, or generate an automated report, and you get an audit-ready record every time — with criteria outcomes, evidence references, and residual risk.
Design partners are already seeing it. "Drata's TPRM Agent allows us to level up our security risk management program across the board by reducing manual work and letting us focus on the risks that matter," says Priyanka Chaudhary, Head of GRC at Brex. Allan Silva, Senior GRC Lead at Brex, adds that it's made the team "a lot more productive while also improving the quality of our reviews."
Bring Third-Party Risk Into One System of Record
Vendor inventory, risk tiers, assessments, and evidence live together in a single system of record. Sync your full vendor population from procurement, CLM, and other systems, let Drata AI enrich each profile with firmographic and risk context, and write decisions back to those same tools to keep everything current. Every third party's risk profile, assessment history, and decisions sit in one place, so teams work from one consistent view instead of reconciling five tools.
Keep Every Vendor Current, Not Just at Onboarding
A questionnaire completed at onboarding tells you nothing about whether a vendor is still safe today. We keep every vendor's risk profile current with recurring reviews, tailored follow-up questionnaires, and automated reassessment cadences so a vendor's status reflects its most recent evidence, not just what it looked like on day one.
Cover the Whole Portfolio
Our agent tiers each third-party's inherent risk based on how it's actually used. Then it collects vendor security information, maps it to your criteria, and scores residual risk automatically. What used to take days per vendor now takes minutes. Reviewers drive the entire process in natural language: kicking off an assessment, surfacing vendor context, or submitting the final decision right in the app. The same team ends up covering far more of the portfolio while aligning to the same standards.
Manage Third-Party Risk with Drata
Your vendor list keeps growing, and so does the pressure to prove your program holds up. Drata Third-Party Risk Management gives your team defensible, evidence-backed vendor decisions across the entire portfolio, ready to hand over the moment a regulator or customer asks.
Get a Demo to see agentic third-party risk management in action.