Total Products under this Category: 143
Last updated: November 01, 2026
Why You Can Trust G2's Software Rankings:
G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category.
Highlighted products: Vanta, UpGuard Vendor Risk, Drata, Secureframe, Sprinto, Scrut Automation, Thoropass, and IBM OpenPages.
Underlying data: [Grid® JSON](https://www.g2.com/categories/vendor-security-and-privacy-assessment/grids.json?focus%5B%5D=vanta&focus%5B%5D=upguard-vendor-risk&focus%5B%5D=drata&focus%5B%5D=secureframe&focus%5B%5D=sprinto-inc&focus%5B%5D=scrut-automation&focus%5B%5D=thoropass&focus%5B%5D=ibm-openpages)
Ubiscore is a leading provider of privacy ratings and privacy analytics for businesses. The company's mission is to help organizations of all sizes achieve their full potential by providing them with the tools and insights they need to understand and improve their privacy practices.
VendorGuard automates every stage of the vendor lifecycle — onboarding, security reviews, GDPR/DPA compliance, contract management, and offboarding. 100+ pre-built checklists.
VendorLens is trust center and vendor security assessment software for small and growing B2B companies. It helps teams share existing security, privacy and compliance evidence with customers while also assessing the suppliers they depend on. The Trust Center module provides a branded external portal for documents such as SOC 2 reports, ISO certificates, data processing agreements, subprocessor lists, security policies and penetration-test summaries. Each document can be public, restricted behind an NDA and approval workflow, or private. Restricted PDF downloads can be watermarked for the requester and delivered through time-limited links. An activity log records views, requests, approvals, downloads and expirations. The Vendor Assessments module, currently in Beta, supports point-in-time supplier reviews. Teams add a supplier, answer six exposure questions and receive an explainable inherent-risk rating. VendorLens then recommends a questionnaire pack based on the supplier’s exposure. Available packs include Lightweight Core and add-ons for personal data, critical services, payments and iGaming. Suppliers respond through an expiring link without creating an account and can provide supporting evidence. Reviewers can request clarification and record an approval, conditional approval or rejection, together with residual risk, rationale and the next review date. Key capabilities include: Branded trust portals with custom-domain support on eligible plans. Public, NDA-gated and private document visibility. Requester-specific PDF watermarking, expiring access and audit history. Inherent supplier-risk scoring with the contributing factors displayed. Supplier questionnaires, evidence collection, clarifications and recorded decisions. VendorLens is designed for founders, operations teams, sales and RevOps, security and compliance teams, and people responsible for a manageable supplier portfolio. It is particularly relevant to B2B SaaS, fintech, payments, data and AI, and iGaming suppliers. VendorLens is not an auditor, certification provider or security-rating service. It does not perform continuous supplier monitoring, automate internal compliance controls or replace a full enterprise GRC or TPRM programme.
Connect G2 to Claude or ChatGPT for answers grounded in G2's trusted reviews, comparisons, and pricing from real user insights.
VendorLens is a public-evidence pre-screen for the teams who choose vendors. Describe what you need, and in minutes you get a shortlist, a side-by-side comparison of who is most likely to clear a due diligence review, and a ready-to-send RFP for the vendors you pick. It verifies certifications against authoritative registries (SOC 2, ISO 27001, FedRAMP, PCI DSS, CSA STAR, Common Criteria), screens for breaches and exploited vulnerabilities (Have I Been Pwned, CISA KEV, SEC 8-K cyber disclosures), checks sanctions and denied-party lists (US, UN, UK, EU), federal debarment and exclusions (SAM.gov, HHS OIG), corporate legitimacy and ownership, and industry-specific records (FINRA and SEC for financial firms, FDIC for banks, FMCSA for carriers, EPA and FDA for regulated products, and more). Every finding is anchored to public sources and to NIST and ISO standards. No black box. What makes it different: it is honest by design. "Not found" is never a failing grade; it tells you exactly which document to request instead of guessing, and it never makes the decision for you. There is no bank linking and no account wall to see a live example. It does a first pass in minutes that would otherwise take a reviewer hours. Built by Larraondo Labs LLC. Free to try, with paid plans for unlimited screening and ongoing vendor monitoring.
The Vendor Risk Management Maturity Model (VRMMM is a comprehensive framework designed to help organizations assess and enhance their third-party risk management programs. By evaluating existing practices against industry benchmarks and best practices, the VRMMM enables organizations to identify areas for improvement, allocate resources effectively, and establish a baseline for program maturity. This model is particularly beneficial for organizations aiming to adapt their risk management strategies based on factors such as industry type, organizational size, and risk tolerance. Key Features and Functionality: - Program Governance: Establishes a risk management governance model with defined objectives, board reporting, and oversight, including considerations for ESG and codes of conduct. - Policies, Standards, and Procedures: Develops comprehensive policies for vendor risk management, including risk categorization, due diligence standards, and lifecycle management. - Contracts Management: Provides guidelines for contract provisions, relationship management, and procedures for vendor termination or exit. - Vendor Risk Assessment Process: Implements processes for pre-outsourcing risk evaluation, vendor risk tiering, ongoing assessments, and process automation. - Skills and Expertise: Defines roles and responsibilities, staffing levels, training programs, and qualifications necessary for effective risk management. - Communication and Information Sharing: Facilitates integration of vendor risk programs, reporting mechanisms, and communication protocols. - Tools, Measurement, and Analysis: Utilizes workflow management, risk scoring tools, financial analysis, and automation to monitor vendor risks. - Monitoring and Review: Establishes procedures for tracking contract provisions, monitoring service level agreements, and conducting continuous monitoring programs. Primary Value and Problem Solved: The VRMMM addresses the critical need for organizations to manage and mitigate risks associated with third-party vendors. By providing a structured approach to evaluate and improve vendor risk management programs, the VRMMM helps organizations make informed decisions regarding resource allocation and vendor-related risks. It enables the establishment of a maturity baseline, identification of high-value components, and tracking of program progress over time. Ultimately, the VRMMM empowers organizations to enhance their risk management capabilities, ensuring robust governance and compliance in their third-party relationships.
VendorSafe automates security questionnaire responses for vendors and suppliers. It analyzes your company profile, maps answers to common frameworks (SIG Lite, CAIQ, SOC 2), and generates Word, PDF, and Excel exports ready to submit. Free tier available — no credit card required. Built by cybersecurity consultants who review vendor security assessments daily.
Vendor legal documents change constantly, and almost no one reads the diff. Venpo tracks the Terms of Service, Privacy Policies, Data Processing Agreements, and subprocessor lists of the SaaS vendors you rely on, detects every change, and tells you what it actually means - in plain English, with a clear verdict on whether it matters. Built for lean teams that own vendor due diligence without a dedicated GRC function. Instead of quarterly manual reviews or finding out about a new subprocessor from a customer's security questionnaire, you get an alert the day it happens: what changed and why it matters. Venpo replaces manual ToS re-reading, ad-hoc diff checking, and "we'll catch it at renewal" as a vendor monitoring strategy.
ZeroRisk is a Done-for-You vendor risk and compliance platform for mid-market regulated firms in the EU, UK and US. Most compliance tools give you a dashboard and leave the work to you. ZeroRisk runs the work itself: an agent assesses each vendor clause by clause against the frameworks you're held to, gathers the evidence, and produces a verdict your team reviews and signs. Vendors are re-checked continuously, so the record stays current between audits rather than going stale the day after you finish. The same evidence base powers internal certification readiness, so you're not maintaining two separate programs. Scope your ISMS, upload what you already have, and the platform tells you what's missing and what still needs an owner. Covers ISO 27001:2022, SOC 2, GDPR, NIS2, DORA and the Cyber Resilience Act. Includes a vendor library of 10,000+ pre-monitored suppliers, an asset register, access reviews, a risk register, and audit-ready evidence packs you can hand straight to an assessor. Pricing is published, from $149/month. No sales call required to find out what it costs.
