Scytale, a compliance automation company specializing in AI-powered governance, risk, and compliance GRC management, today announced launch of latest AI-powered third-party risk management TPRM capabilities within its Vendors module. Release further extends vendor risk management from periodic review exercise into continuously updated vendor risk intelligence engine, giving security and GRC teams current view of every vendor in ecosystem. Announcement was made from New York on September 9, 2026.
Scytale Vendors module centralizes vendor risk management, security reviews, and continuous monitoring for compliance teams. Expansion arrives as third-party exposure becomes primary breach vector. Verizon 2026 Data Breach Investigations Report found 48 percent of all breaches involved third party, with third-party involvement in breaches up 60 percent year over year. At same time, vendor ecosystems growing faster than most security and GRC teams can review manually, as individual departments adopt new tools independently and existing vendors change security posture, certifications, and risk exposure between annual assessments. Point-in-time questionnaires and static spreadsheets leave gaps that auditors, enterprise customers, and boards increasingly expect organizations to close with evidence.
Scytale new TPRM capabilities designed to close gap inside Vendors module customers already use.
Key capabilities: Automatic vendor discovery discovers vendors from customer SSO provider, connected integrations, and other linked systems, building inventory that updates. Relevant vendors assigned formal security review and risk tier. AI vendor enrichment building profile traditionally meant researching company information, security posture, certifications, compliance status across trust centers, websites, vendor-supplied documentation. AI data chains gather and populate automatically producing evidence-backed profile. Dynamic risk scoring every vendor receives risk score generated from enriched data, security posture signals, certifications, questionnaire responses. Scores update as new information arrives. Continuous security posture monitoring monitors vendors for security incidents including breaches, data exposures, vulnerabilities using third-party security intelligence APIs. Detected incidents appear directly on vendor profile with severity, date, source. Proactive notifications when security incident detected via email. Auto-generated security reports consolidating enrichment data, risk scores, monitoring history, review outcomes into single defensible document for audits, due diligence, leadership reporting.
Centralized, audit-ready vendor reviews sending security questionnaires, collecting documentation, tracking review status against due dates remains core. Enrichment, scoring, monitoring data now feed directly into review process reducing manual evidence gathering.
TPRM capabilities connect to rest of Scytale platform, including cross-framework control mapping across SOC 2, ISO 27001, GDPR, HIPAA, SOX ITGC, and other security, privacy, and AI frameworks, along with customizable Trust Center organizations use to demonstrate security and compliance posture. Vendor evidence collected supports control requirements across frameworks, so third-party oversight contributes to audit readiness instead of running parallel.
Addition reflects broader shift in how compliance programs structured. Vendor oversight historically manual, time-intensive, fragmented obligation, often treated as annual box ticking timed around audits and renewals. Scytale shifts into one central, customized, automated, organized program. As vendor counts climb into hundreds and AI tooling enters supply chain, that model leaves too much unobserved for too long. Continuous discovery, enrichment, monitoring move third-party risk closer to how organizations already manage internal controls.
About Scytale
Founded in 2021, Scytale is leader in trust and compliance, helping businesses worldwide stay ahead of security, privacy, and AI regulatory requirements. Its agentic GRC platform serves organizations at every stage, from startups preparing for first audit to global enterprises managing complex, multi-framework programs, across banking, financial services, insurance, healthcare, technology, manufacturing, and government. Serves customers in 44 countries, including ICL Group, PwC, and Deel.
