Folio MMethod · revision 2026-11-08
How the register is kept
Every entry is built from the vendor’s own pages, linked and dated; unknowns stay blank. Within each approach, products are ordered by how many of five things a buyer can check before a sales call: a price, a free plan or trial, the vendor’s own SOC 2 or ISO 27001, an integration count, and named questionnaires or a rating scale. There are no scores.
What gets in
A product qualifies if it is sold as third-party or vendor risk management software, has a public product page we can cite, and fits one of five approaches.
Assessment workflow 7 in this revision
Built around the vendor inventory and the assessment: questionnaires, evidence, findings and remediation through each stage of the relationship.
7 in this revision
Scores a company from the outside, from what can be seen on the internet, without asking it anything. Used to triage and to watch vendors between assessments.
GRC suite module 9 in this revision
The third-party module of a wider governance, risk and compliance suite. Strongest where the rest of the suite is already in use.
Compliance platform 4 in this revision
A compliance-automation platform (SOC 2, ISO 27001 readiness) with a vendor-risk module added. Lighter, and usually cheaper to start.
AI-first assessment 5 in this revision
Built on AI reading the evidence (SOC 2 reports, policies, questionnaire answers) and drafting the assessment, with a person reviewing.
Left out: procurement and contract suites without a risk-assessment product; consulting firms and managed services sold without software; and trust-center and questionnaire-answering tools, which sit on the other side of the table (they help a vendor answer assessments rather than run them). A product is dropped when its own pages no longer describe it.
What the register records
Approach and ownership
Which of five approaches the product is built on; who owns it today; acquisitions and renames, each from the company’s own announcement or reputable news.
Assessment content
The standard questionnaires the vendor says its library includes (SIG, CAIQ, HECVAT, NIST CSF and so on), and for ratings vendors the published scale.
Integrations
The number of integrations, only when the vendor states one. A list without a number is recorded as text.
Price
The price the vendor publishes, or a list price on an official cloud marketplace (AWS, Azure, Google Cloud), copied exactly and marked as such. Nothing estimated.
Free plan or trial
Only what the vendor offers without a sales call. “Request a demo” is not a trial.
The vendor’s own security
SOC 2 and ISO/IEC 27001 status as the vendor’s trust center or security page states it. A TPRM vendor is itself a third party with your data.
Analyst mentions
Only as the vendor states them, with the vendor’s own page as the source and the report’s name and date kept. We have not read the reports.
Cautions
Pending deals, renamed or retired products, and similar facts a buyer should know, from announcements or reputable news only.
This revision: 32 products, 494 distinct source URLs, every one checked on November 8, 2026.
The order, and why there are no scores
Products are grouped by approach, because a security-ratings service and a GRC suite answer different questions. Within each group they are ordered by how many of these five things the vendor publishes, most first, then alphabetically:
- A price
- A free plan or trial for buyers
- Its own SOC 2 or ISO 27001
- An integration count
- Named questionnaires or a rating scale
That rewards what a buyer can verify before talking to sales. It says nothing about how well the software works, which nobody outside its customers can see. We don’t publish ratings, scores, “best for” badges or reviews: a score from us would be an opinion dressed as a measurement.
Each entry carries a number, such as No. 07. It is the entry’s place in this revision’s order, for reference. It is not a rank, and it changes when the data does.
Prices
Most TPRM vendors don’t publish prices. Where one does, the register copies the text exactly, with the unit (per vendor monitored, per user, per year) and the page it came from. Where a vendor lists a public price on an official cloud marketplace, it is shown as a marketplace list price, which can differ from what a direct contract costs. Prices from third-party price databases, review sites and analyst estimates are not used, and no price is ever estimated. See what TPRM software costs.
Upkeep and corrections
This revision was checked on November 8, 2026. The category is consolidating quickly (see the chain of title on the register), and prices and products change, so confirm with the vendor before you buy.
If an entry is wrong or out of date, send a correction through the form with a link to the public page that shows the right fact. Entries change only from public sources, and nobody can pay to change one. The register is re-checked in full at least every six months.
Sources for this page
- Each vendor’s own product, pricing, trust-center and press pages — Every fact in the register; each entry links its sources.
- AWS Marketplace — Where marketplace list prices are read from, for vendors that list there.
Each product’s own sources are linked from its entry in the register. How products are chosen and ordered, and how to correct an entry: methodology.
Cite this page
Third-Party Risk Management Software. “Methodology: how TPRM software is listed and ordered.” Updated November 8, 2026. https://thirdpartyriskmanagementsoftware.com/methodology/