Vanta Speeds Vendor Proof While Most Risks Stay Open

Vanta’s TPRM agent halves vendor assessment time, while its customer data shows firms review only 7% of vendors. The June 2, 2026 launch sold continuous monitoring and an AI reviewer as the way out of questionnaire grind. The second effect is simpler: proof now moves at software speed, and most listed risks still sit unfixed.

That gap is the product. Sales teams get a faster packet. Security teams get a longer list. European rules now ask for both.

Vanta’s Own Data Shows a 7% Review Rate

With the new agent, Vanta published figures drawn from 16,000 customers. Enterprises, it said, review 7% of vendor inventory. When a risk does surface, teams remediate it 12% of the time. Builder roles, which Vanta said were up 311% year over year, adopt AI vendors at a 73% higher rate, and 30% of those vendors land as high or critical risk.

Jeremy Epling, Vanta’s chief product officer, put the design goal in one line: risk does not live in a single tool, and neither does the exposure that matters most. The agent maps vendor findings into the internal risk register and onto the assets they touch. Discovery got cheaper. Closure is still a human queue.

THE RATIOS VANTA PUT ON THE TABLE

• Vendor coverage: Enterprises review 7% of vendor inventory, per Vanta’s June 2 customer data.
• Fix rate: Teams remediate 12% of the risks that do get surfaced.
• Breach history: 56% of firms in Vanta’s State of Trust survey reported a vendor-related breach in the past 6-12 months, up from 48% the year before.
• Risk mood: 72% of security decision-makers said overall risk has never been higher, up from 55% in 2024.

The same survey, Vanta’s third annual State of Trust Report, asked 2,500 business and IT leaders. Almost two-thirds said they spend more time proving security than improving it. Teams now burn 12 weeks a year on compliance work and 9 weeks on vendor reviews. 80% are confident a vendor would disclose a breach. 57% ended a vendor relationship over security concerns in the past 6-12 months, up from 50%.

Those figures can sit in one dashboard without contradicting each other. A firm can feel sure its vendors would call, cut a supplier after a scare, and still leave most of the remaining roster unreviewed.

What the TPRM Agent Automates

Vanta’s product page says the agent will cut risk assessment time by 50%, with 62% faster vendor evidence collection. The module is sold standalone or as an add-on. It pulls findings from SOC 2 reports, data-processing agreements, and questionnaires so reviewers spend their time on the calls that still need a person.

HOW THE AGENT RUNS A VENDOR FILE

1. Shadow IT and AI: Discovers newly adopted tools and ties into procurement so unlisted AI vendors show up on the same roster.
2. Evidence pull: Retrieves documents from first- and third-party trust centers instead of chasing inboxes.
3. Risk extract: Reads SLAs, DPAs, and custom terms in SOC 2 reports and flags exposure in seconds.
4. House rules: Applies the buyer’s risk tiers and scoring logic to every assessment.
5. Vendor chase: Sends document requests and follow-ups until the file moves.
6. 24/7 watch: Scans for material changes and breaches, then drafts a remediation plan.

An IDC white paper Vanta sponsored in January 2025 (doc US52656824) put a 526% three-year ROI on the platform, a 3-month payback, and 54% productivity gains for TPRM teams. That 54% is time given back. It is not the 12% share of findings that get closed. Firms managing 50 vendors, IDC said, can save about $81,000 a year through discovery, AI reviews, and monitoring.

Vanta has also been folding internal GRC and vendor GRC into one view, the pitch behind the June agent. The company is still making that case in public.

Somewhere out there, an internal risk team and a vendor risk team are both very confident that "everything is fine.”

And they're right… if "fine" means spending countless hours debating the risk matrix, blatantly missing connections that expose your business to risk, and… pic.twitter.com/MFYaaJFxuo

— Vanta (@TrustVanta) June 11, 2026

Proof Moves Faster Than the Fixes

The customer quotes Vanta puts next to TPRM are about hours and sales, not a lower breach rate. Pigment, the planning platform, said Vendor Risk Management gave its team a live overview of vendor security status and let it answer security requests fast enough to shorten the sales cycle. Quentin Berdugo, Pigment’s chief information security officer, said Vanta “alleviated a lot of tedious work … so I could focus on building our security programme and raising our posture.”

Duolingo’s Mandy Matthew, lead senior security risk program manager, said the AI layer “pulls out the most important details so we don’t have to spend time combing vendor documentation word for word.” Vanta has also said Duolingo saves 12 hours a week with AI-powered vendor risk work. That is time for the next questionnaire, the next customer security call, the next audit packet.

It used to take us 50 hours per vendor to perform a security assessment, a process my team had to repeat across more than 50 vendors annually. Vanta’s TPRM solution cut that to only a few hours a week for each vendor, freeing up time for us to focus on more strategic security objectives.

George Uzzle, Chief Information Security Officer, Vibrent Health

A few hours a week per vendor is still a queue when the roster is 50 names. It is a different job from a SOC 2 project that a CTO can run before standup. Vendor reviews, access reviews, and policies that match how the company actually works do not appear because a template was imported. They appear when someone owns the register after the agent has finished highlighting.

Europe Now Wants a Live Vendor Register

The June pitch leaned on Europe for urgency, and the law is not a slogan. The NIS2 Directive on network and information systems (Directive (EU) 2022/2555) gave member states until 17 October 2024 to transpose. On 8 July 2026 the European Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the European Union for failing to notify transposing measures. Management-body accountability for risk-management duties is written into the directive. Supply-chain security sits in Article 21.

DORA, Regulation (EU) 2022/2554, has applied to financial entities since January 2025. It is stricter on ICT suppliers than NIS2. Firms must keep a register of ICT third-party arrangements and run due diligence on ICT third-party providers before they sign, including reputation, resources, security standards, and whether subcontractors sit in the chain. For banks and insurers, DORA is the rule that binds; NIS2 yields where the two overlap.

WHAT THE TWO RULEBOOKS ASK FOR

A questionnaire that is 50% faster still has to feed a register a supervisor can read. Privacy work in Europe also runs through how vendors process, store, transfer, and use data, not only whether they had a breach. Vanta’s own report ties 77% of organisations to stakeholders who now want verified proof, and 82% to the claim that stronger security and compliance raise trust. The buyer of TPRM software is often the person who has to show that file, not the person who patches the vendor.

Unreviewed AI Tools Follow Builder Hires

Vanta’s customer telemetry puts the growth of “builder” roles at the centre of the vendor pile. Those teams ship automations and pick AI tools outside classic engineering. Vanta said organisations with formal builder roles use 42% more vendors. Separate Vanta research has put Shadow AI in 70% of organisations, with Shadow IT up 36% year over year, and estimated that 98% of Shadow IT vendors never get a security assessment.

Twelve months before that snapshot, Vanta reported no AI security alerts across its customer base. It later described hundreds of AI-related alerts a month, nearly half of them virtual machines running suspicious or untrusted models. The agent is built to find those tools. Finding them writes them into the 7% problem: the roster gets longer, the reviewed slice stays thin, and the 12% fix rate applies to whatever did get scored.

The same State of Trust edition says 59% of teams admit AI-related threats outpace their expertise, and 67% say so at companies with 1,001 to 2,000 employees. 79% are using or planning to use agentic AI. 65% say that use already outpaces their understanding of it. Only 48% have a framework for granting or limiting autonomy. 61% would be comfortable with an agent overriding a human decision in some security scenarios; 71% are comfortable with an agent in an advisory role. 95% report some gain from AI and automation. Comfort and control are not the same control.

On inbound questionnaires, a different Vanta AI, the one that answers customers rather than grades vendors, drafts more than 80% of responses, with those drafts accepted 95% of the time and reviews finishing 81% faster. One model fills the form. Another model reads the form. The human still signs it, in Vanta’s telling. The circular loop is the point of the category, and it only holds if someone still rejects a bad answer.

$4.15 Billion for a Faster Proof Machine

Christina Cacioppo, Vanta’s chief executive and founder, wrote in July 2025 that the company had raised a $150 million Series D at $4.15 billion. The first product, in 2018, automated SOC 2 so startups could sit in larger deals. Vendor risk, trust centers, and questionnaires came later, as buyers stopped accepting a nine-month-old audit letter as an answer to “how secure are you right now?”

THE MONEY AND THE HEADCOUNT AROUND THE AGENT

1. 2018: Vanta launches to automate SOC 2 for startups that need proof before they have a security team.
2. January 2025: IDC publishes the Vanta-sponsored business-value paper that TPRM pages still cite for 526% ROI and 54% team productivity.
3. July 23, 2025: Series D prices the company at $4.15 billion. Vanta then counted more than 12,000 customers, 200 million-plus assets monitored, 1.5 million employees and 33,000 vendors under management, 1.7 billion vulnerabilities remediated within SLA, and 10 million Trust Center views.
4. April 2026: Vanta said it had passed $300 million in annual recurring revenue and 16,000 customers, including names such as Atlassian, Snowflake, and Duolingo.
5. June 2, 2026: The TPRM agent ships as a unified internal and third-party risk worker, after Vanta also bought Riskey to thicken continuous monitoring.
6. September 11, 2026: Tokyo Electron Device begins selling Vanta in Japan, still citing more than 16,000 companies on the platform.

Average vendor counts in Vanta’s TPRM research still scale the old way. Firms with 1 to 50 employees sit at about 55 vendors. Firms with 1,000 or more sit at 182, more than triple. Security still gets 10% of the IT budget against a 17% ideal. 44% of organisations have an AI policy, up from 36%. 45% run AI risk assessments, up from 37%. Only 31% require customer opt-in when that data trains a model. The paperwork stack grew. The headcount that closes tickets did not grow with it.

So the agent does what it says on the hours. Vibrent’s 50-hour reviews collapsed. Duolingo got 12 hours a week back. IDC’s 50-vendor shop can bank about $81,000. What it does not do, on Vanta’s own 7% and 12% figures, is turn a longer, better-labelled vendor list into a shorter residual-risk list. The companies paying for TPRM are buying a faster way to show the register to a customer, an auditor, or a supervisor. The vendors that never make the 7% still sit in the same contracts the register is meant to govern.

Disclaimer: This article is news reporting and analysis of Vanta’s TPRM product, customer figures, and related EU rules. It is informational only and is not legal advice, compliance advice, or investment advice, and it is not a recommendation to buy, sell, or subscribe to any software or security. Readers who need to design a vendor-risk programme or judge NIS2 or DORA duties should consult a qualified solicitor or compliance professional in their jurisdiction, and readers who treat private-company funding or valuation figures as a financial decision should consult a licensed investment adviser. Figures and product claims reflect the company papers, survey, and official pages cited here and may change as Vanta, regulators, and customers update them.