Third-party risk management software, judged on what it removes.

Every TPRM platform is assembling the same picture — how risky is this supplier, on what evidence, and what should we do about it — from four broad capability groups. Products differ enormously in which of the four they are genuinely good at.

• Inventory and tiering. The register of who your third parties are, what they access, and how critical each one is. Sounds trivial; it is where most programmes discover they have no authoritative list.
• Assessment. Questionnaires, evidence collection, control mapping and scoring. This is the part buyers look at hardest and the part that varies least between products.
• Outside-in monitoring. Security ratings, attack-surface observation and breach intelligence, gathered without the supplier’s involvement. This is what keeps a view current between assessments.
• Workflow and reporting. Remediation tracking, SLAs, evidence trails and the board or regulator-facing output at the end.

The category splits roughly into three. Ratings-led products start from outside-in scoring and add questionnaires. GRC-led products start from workflow and control mapping and add ratings, often through a partner feed. Network-led products build a shared supplier community so assessments can be reused across customers. Each is strong where it started.

Four models dominate, sometimes combined:

• Per supplier monitored. The most common in ratings-led products. Predictable, but it penalises the thing you want to encourage — broad coverage — and creates pressure to monitor only the top tier.
• Tiered platform fee. A band based on supplier count or company size, with the assessment capability bundled.
• Per assessment. Charged by questionnaire or by report. Cheap to start, and it scales exactly with the activity you are trying to increase.
• Per seat. Now unusual as a primary model in TPRM, and worth questioning where it appears, since it discourages the wider stakeholder access that makes remediation work.

Three costs sit outside the licence and are routinely missed at business-case stage: implementation and data migration; the internal effort of onboarding suppliers onto the platform; and the cost of the assessments themselves where a vendor charges per report. Compare on total cost per supplier assured per year, not on licence price.

RiskXchange publishes pricing across three tiers — Essentials, Professional and Enterprise — with unlimited user seats on every tier and no setup fees. See platform pricing for the detail, and our blog on TPRM software pricing for how the category prices generally.

RiskXchange’s answer to the capacity problem is The Agency — a fleet of AI agents that do the work a TPRM team would otherwise do by hand, across five lead roles.

• NOVA runs the supplier relationship end to end — outreach, onboarding, questionnaire collection, chasing and renewal — across email, WhatsApp and in-app chat, and detects when a contact has left and redirects to a new one.
• ARIA handles document and questionnaire intelligence: pre-populating responses from SOC 2 reports, ISO certificates and policies against 157 universal controls, then validating what a supplier claimed against evidence.
• REX owns the outside-in side — digital footprint, continuous monitoring, breach and dark-web correlation, fourth-party discovery.
• TARA covers regulatory compliance assessment, risk tiering and remediation orchestration with SLA tracking.
• VANCE produces the board and regulator-facing reports from live data rather than from a report writer’s notes.

Autonomy is set per supplier, not per customer or per agent: a critical supplier can require human approval on every individual action while a low-risk one runs hands-off with notification only.