RiskXchange
RiskXchange is a London-based AI-native third-party risk management platform that uses 32 named AI agents to continuously monitor vendor security, automate regulatory reporting, and assess 5M+ companies for enterprise customers in financial services, healthcare, technology, and insurance.
- Company typePrivate
- Founded2020
- HeadquartersLondon, United Kingdom
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What RiskXchange does
RiskXchange is an AI-native third-party risk management (TPRM) platform founded in 2020 and headquartered in London, with regional offices in Dubai (MENA) and Austin (Americas). The company is built around a three-layer architecture: The Platform (a TPRM runtime supporting 360-degree assessments, attack surface management, and 157 Universal Controls), The Trust Layer (a shared backbone of 5M+ continuously monitored companies plus vendor-curated posture pages), and The Agency (a workforce of 32 named AI agents — five lead agents named NOVA, REX, ARIA, TARA, and VANCE, each commanding specialist sub-agents — that autonomously manages the vendor risk lifecycle from onboarding through continuous monitoring to regulatory reporting). Core capabilities include the combined-signal security rating model (0–900 scale) reconciling inside-out evidence reading with outside-in scanning, automated questionnaire pre-population (70%+ from existing evidence), dark-web and breach intelligence (BreachWatch), fourth-party supply chain discovery, and regulatory reporting across nine-plus frameworks including DORA, NIS2, ISO 27001, NIST CSF, PCI DSS, APRA CPS 230, ADHICS, GDPR, and FCA.
The company sells SaaS subscriptions in three annual tiers — Essentials at £14,900 (50 vendors), Professional at £31,500 (150 vendors), and Enterprise from £75,000 (unlimited vendors) — with unlimited user seats and no setup fees. Revenue is generated through direct enterprise sales (Account Executives covering UK & Ireland and North America), a four-model Partner Programme (Reseller/VAR, MSP/MSSP, Technology Integrator, and Referral/Advisor), a managed services offering (RiskXchange Assured), and product-led free SnapShot reports. Target segments are Financial Services (primary), Healthcare, Technology & SaaS, and Insurance, with a customer logo wall emphasising major banks, insurers, the Big Four consultancies, and large technology companies. The company has three co-founders (Darren Craig CEO, Anisa Cader CCO, Rhys Nicholls CTO) with a combined two decades of experience running TPRM programmes inside banks, insurers, and regulators, and was recognised as a Gartner Cool Vendor 2024 in third-party risk management.
RiskXchange firmographics
Firmographics- Name
- RiskXchange
- Legal name
- RiskXchange Limited
- Website
- https://riskxchange.co
- Company type
- Private
- Founded year
- 2020
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- RiskXchange is a London-based AI-native third-party risk management platform that uses 32 named AI agents to continuously monitor vendor security, automate regulatory reporting, and assess 5M+ companies for enterprise customers in financial services, healthcare, technology, and insurance.
- Ownership category
- akta.pro rank
RiskXchange industry classification
Industry- Product category
- Third-Party Risk Management Software
- NAICS
- Software Publishers (5132), Security Systems Services (except Locksmiths) (561621), Computer Systems Design Services (541512)
- SIC
- Services-Prepackaged Software (7372), Services-Computer Integrated Systems Design (7373)
- akta.pro primary industry
- Third-Party/Vendor Risk & Due Diligence (TPRM, continuous monitoring) (FSAGAFAJ)
- akta.pro secondary industries
- Third-Party Model/Vendor Risk & Supply-Chain Assurance (HDAAAMAK), Model Risk Management & AI Governance (validation, monitoring, explainability) (FSAGAFAL), Third-Party & Supply Chain Risk Management (TPRM) (HLACAJAK)
Keywords
Where RiskXchange is headquartered
LocationHeadquarters
- HQ city
- London
- HQ country
- United Kingdom
- HQ region
- Europe
Offices3 records
Markets served
RiskXchange business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure
Revenue model
- SaaS Subscription - Three Tiers: Annual subscription-based pricing across three tiers (Essentials £14,900/year for 50 vendors, Professional £31,500/year for 150 vendors, Enterprise from £75,000/year for unlimited vendors). Unlimited user seats on all plans. No setup fees.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | For risk teams running their first proper TPRM programme - 50 vendors monitored, core AI agents, manual and assisted autonomy modes |
| Subscription | Annual | For growing programmes with regulatory pressure and a real vendor stack - 150 vendors monitored, most agents, all three autonomy modes |
| Subscription | Annual | For organisations running TPRM at scale across multiple frameworks - unlimited vendors, all 32 agents, white-glove onboarding, premium support |
Go-to-market motion3 records
Distribution channels5 records
Marketing channels7 records
RiskXchange product offering
Product offeringCore offering
RiskXchange operates an AI-native third-party risk management (TPRM) platform sold as annual SaaS subscriptions across three tiers (Essentials, Professional, Enterprise). The product automates the full vendor risk lifecycle—from onboarding and continuous monitoring to regulatory reporting—through 32 named AI agents (NOVA, REX, ARIA, TARA, VANCE plus 27 specialists) operating on top of a platform that runs 360° risk assessments, attack surface management, and the 157 Universal Controls framework. A managed service offering (RiskXchange Assured) is also sold separately.
Product overview
RiskXchange is an AI-native third-party risk management (TPRM) platform built around a three-layer architecture: The Platform (TPRM runtime with 360° assessments, attack surface management, and 157 Universal Controls), The Trust Layer (5M+ continuously monitored companies plus vendor-shared posture pages), and The Agency (32 named AI agents that autonomously manage the full vendor risk lifecycle). The Agency consists of 5 lead agents - NOVA (vendor relationship management), REX (outside-in scanning and breach intelligence), ARIA (document and questionnaire intelligence), TARA (compliance assessment and remediation), and VANCE (regulatory reporting) - plus 27 specialist sub-agents. The platform is sold in three tiers (Essentials at £14,900/year for 50 vendors, Professional at £31,500/year for 150 vendors, Enterprise starting at £75,000/year for unlimited vendors). Additional offerings include Managed Services (RiskXchange Assured), Smart Assessments, Security Ratings, Attack Surface Management, Digital Risk Protection, Trust Centre, and SnapShot reports.
Differentiator
Problem solved
Functional benefit
Products and services
- The Agency AI-native third-party risk management workforce of 32 named AI agents (5 lead agents NOVA, REX, ARIA, TARA, VANCE plus 27 specialist sub-agents) that autonomously manage the full vendor risk lifecycle from onboarding through continuous monitoring to regulatory reporting. Operates in three autonomy modes per customer: Manual, Assisted, and Autonomous.
- The Platform The TPRM runtime and system of record that The Agency operates on - includes 360-degree risk assessments, attack surface management, continuous monitoring, workflow and audit trail, 157 Universal Controls framework, and the regulatory framework mappings (DORA, NIS2, ISO 27001, NIST CSF, PCI DSS, APRA CPS 230, ADHICS, GDPR).
- The Trust Layer Shared trust backbone consisting of 5M+ continuously monitored companies plus vendor-curated posture pages that suppliers publish back. Forms the data backbone behind every score and every assessment, creating network effects between buyer-side scoring and vendor-side transparency.
- RiskXchange Assured Managed services offering where RiskXchange operates The Agency on the customer's behalf with a dedicated TPRM lead, autonomous agent execution, and outcome delivery including board packs, remediation plans, and breach reports. Also offered as an optional co-delivery service for managed service partners running TPRM-as-a-service for clients.
Quantifiable outcome
- Replaced two analysts' worth of questionnaire chasing with The Agency in eight weeks
- +9 more outcomes
Companies that use RiskXchange
Customer profileNamed customers28 records
Segments4 records
Ideal customer profiles4 records
RiskXchange technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration7 records
AI capability8 records
Feature14 records
RiskXchange partnerships and signals
Strategic signalPartnerships
Five partnerships are on record, tiered core and minor.
- Resellers and Value-Added Resellers (VARs)coreChannel partners selling cyber, GRC and TPRM solutions into mid-market and enterprise customers. Receive margin on every tier (Essentials, Professional, Enterprise), deal registration and protection, co-branded SnapShot reports for prospect outreach, and sandbox environment for live demos.
- Managed Service Providers (MSPs) and MSSPscorePartners running TPRM-as-a-service for clients who want the outcome but not the tooling. White-label on supported tiers, tenant-per-client architecture, multi-tenant analyst console, optional co-delivery with RiskXchange Assured managed services team.
- Technology Platforms and IntegratorscorePlatforms and tools that complement TPRM - IRM, GRC, identity, ticketing, communications. API and webhook access, MCP server and Agency-side integration paths, joint go-to-market on shared customers, listing on RiskXchange integrations page.
- Consultancies, Audit Firms, and AdvisorsminorReferral partners introducing RiskXchange without reselling. Simple referral commercials, no fulfilment or support obligations, co-branded materials when needed, direct line to the partner team.
- Gartner (Analyst Recognition)coreRiskXchange recognised as a Cool Vendor in Third-Party Risk Management by Gartner in 2024. Selected for agentic approach to TPRM and depth of outside-in intelligence.
Scale indicators32 records
Recent moves6 records
Expansion highlights5 records
RiskXchange competitors and assessment
Company assessmentDirect peers
- CyberGRX: Third-party cyber risk management platform with a shared-assessment library and predictive risk analytics. Competes with RiskXchange's Smart Assessments and Predictive Analytics capabilities for the same enterprise TPRM buyer.
- SecurityScorecard: Largest independent security ratings and TPRM vendor, offering continuous outside-in scoring, questionnaires and vendor risk workflows. Directly competes with RiskXchange's Trust Layer and Security Ratings modules for the same financial services and enterprise buyer.
- ProcessUnity: Dedicated TPRM and vendor risk management platform focused on regulated enterprises, with workflow, assessments and continuous monitoring. Directly comparable product offering and target buyer profile to RiskXchange's Platform layer.
- Bitsight: Security ratings and TPRM platform with continuous monitoring and analytics, historically strong in financial services. Competes head-to-head with RiskXchange on continuous external posture scoring, fourth-party visibility and cyber underwriting use cases.
- Prevalent: TPRM platform combining vendor assessments, network intelligence and continuous monitoring. Sells to financial services and healthcare buyers with similar use cases to RiskXchange's ARIA + REX combined-signal approach.
- Whistic: Vendor security review and proactive trust centre platform focused on SaaS vendors responding to enterprise security questionnaires. Directly comparable to RiskXchange's Trust Centre and ARIA-driven questionnaire automation use case.
- Panorays: TPRM platform combining automated security questionnaires, external attack surface scanning and remediation workflows. Overlaps RiskXchange on the combined-signal model and serves similar financial services and healthcare buyers.
Broad incumbents
- OneTrust: Broad privacy, GRC and third-party risk platform with very large enterprise footprint. Overlaps RiskXchange on TPRM and trust centre workflows but bundles them into a wider privacy/GRC portfolio rather than specialising in agentic TPRM.
- RSA Archer: Long-established enterprise GRC platform with vendor risk management modules, deeply embedded in large financial services and healthcare GRC programs. Represents the legacy incumbent alternative RiskXchange displaces in TPRM procurement.
- ServiceNow Integrated Risk Management (IRM): Enterprise GRC/IRM suite embedded in the ServiceNow platform, used by large banks and insurers to operationalise TPRM. Competes as an incumbent stack choice versus a specialist TPRM platform like RiskXchange.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat6 records
Key risks6 records
Key highlights7 records
Customer concentration
RiskXchange social profiles
Digital presenceRiskXchange compliance and trust
Trust signalCompliance9 records
RiskXchange financial estimates
Financial estimateRevenue estimate
Valuation estimate
RiskXchange leadership team
Management profileNumber of profiles
Profiles3 records
RiskXchange subsidiaries and ownership
Company hierarchySubsidiaries1 record
RiskXchange funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
RiskXchange M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about RiskXchange
What does RiskXchange do?
RiskXchange operates an AI-native third-party risk management (TPRM) platform sold as annual SaaS subscriptions across three tiers (Essentials, Professional, Enterprise). The product automates the full vendor risk lifecycle—from onboarding and continuous monitoring to regulatory reporting—through 32 named AI agents (NOVA, REX, ARIA, TARA, VANCE plus 27 specialists) operating on top of a platform that runs 360° risk assessments, attack surface management, and the 157 Universal Controls framework. A managed service offering (RiskXchange Assured) is also sold separately.
Is RiskXchange a public or private company?
RiskXchange is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was RiskXchange founded?
RiskXchange was founded in 2020. It employs 11 to 50 people.
Where is RiskXchange based?
RiskXchange is headquartered in London, United Kingdom, in the Europe region.
How does RiskXchange make money?
One revenue line is on record: saaS Subscription - Three Tiers.
Who are RiskXchange's main competitors?
Direct peers on record are CyberGRX, SecurityScorecard, ProcessUnity, Bitsight, Prevalent, Whistic and Panorays. Broad incumbents are OneTrust, RSA Archer and ServiceNow Integrated Risk Management (IRM).
Does RiskXchange have an API?
Yes. Full API access available on Professional and Enterprise tiers. Partners page mentions 'API and webhook access' for technology partners. Enterprise tier includes custom integrations.
What industry is RiskXchange in?
RiskXchange's product category is Third-Party Risk Management Software. Its primary akta.pro industry code is FSAGAFAJ, Third-Party/Vendor Risk & Due Diligence (TPRM, continuous monitoring), with a secondary code of HDAAAMAK, Third-Party Model/Vendor Risk & Supply-Chain Assurance. Its NAICS code is 5132 and its SIC code is 7372.