New York, NY, Sept. 09, 2026 (GLOBE NEWSWIRE) -- Scytale, a compliance automation company specializing in AI-powered governance, risk, and compliance (GRC) management, today announced the launch of their latest AI-powered third-party risk management (TPRM) capabilities within its Vendors module. The release further extends vendor risk management from a periodic review exercise into a continuously updated vendor risk intelligence engine, giving security and GRC teams a current view of every vendor in their ecosystem.
Scytale's Vendors module centralizes vendor risk management, security reviews, and continuous monitoring for compliance teams.
The expansion arrives as third-party exposure becomes a primary breach vector. Verizon's 2026 Data Breach Investigations Report found that 48 percent of all breaches involved a third party, with third-party involvement in breaches up 60 percent year over year. At the same time, vendor ecosystems are growing faster than most security and GRC teams can review them manually, as individual departments adopt new tools independently and existing vendors change their security posture, certifications, and risk exposure between annual assessments. Point-in-time questionnaires and static spreadsheets leave gaps that auditors, enterprise customers, and boards increasingly expect organizations to close with evidence.
Scytale's new TPRM capabilities are designed to close that gap inside the Vendors module customers already use.
Key capabilities of the Vendors module
- Automatic vendor discovery: Scytale discovers vendors from a customer's SSO provider, connected integrations, and other linked systems, building a vendor inventory that updates as the environment changes. Relevant vendors are assigned a formal security review and a risk tier, so oversight expands with the vendor footprint instead of lagging behind it.
- AI vendor enrichment: Building a vendor profile has traditionally meant researching company information, security posture, certifications, and compliance status across trust centers, websites, and vendor-supplied documentation. Scytale's AI data chains gather and populate that information automatically, producing an evidence-backed profile without the manual research cycle.
- Dynamic risk scoring: Every vendor receives a risk score generated from its enriched data, security posture signals, certifications, and questionnaire responses. Scores update as new information arrives, so risk tiering reflects where a vendor stands currently rather than where it stood at the time of onboarding.
- Continuous security posture monitoring: Scytale monitors vendors for security incidents, including breaches, data exposures, and vulnerabilities, using third-party security intelligence APIs. Detected incidents appear directly on the vendor's profile with severity, date, and source, giving teams visibility between formal review cycles rather than only during them.
- Proactive notifications: When a security incident is detected for a monitored vendor, Scytale notifies the customer's team by email, providing lead time to assess exposure and re-evaluate the vendor's broader risk to the business. .
- Auto-generated security reports: For audits, customer due diligence, or leadership reporting, Scytale can generate a security report for any vendor that consolidates enrichment data, risk scores, monitoring history, and review outcomes into a single defensible document.
- Centralized, audit-ready vendor reviews: Sending security questionnaires, collecting documentation, and tracking review status against due dates remains core to how Scytale supports vendor reviews. Enrichment, scoring, and monitoring data now feed directly into that review process, reducing manual evidence gathering and giving reviewers a fuller risk picture on which to base decisions.
The TPRM capabilities connect to the rest of the Scytale platform, including cross-framework control mapping across SOC 2, ISO 27001, GDPR, HIPAA, SOX ITGC, and other security, privacy, and AI frameworks, along with the customizable Trust Center organizations use to demonstrate their security and compliance posture to customers and prospects. Vendor evidence collected through the Vendors module supports control requirements across those frameworks, so third-party oversight contributes to audit readiness instead of running parallel to it.
The addition reflects a broader shift in how compliance programs are structured. Vendor oversight has historically been a manual, time-intensive, and fragmented obligation, and often treated as an annual box ticking exercise timed around audits and contract renewals. Scytale shifts this into one central, customized, automated, and organized program. As vendor counts climb into the hundreds and AI tooling enters the supply chain, that model leaves too much unobserved for too long. Continuous discovery, enrichment, and monitoring move third-party risk closer to how organizations already manage their own internal controls, on an ongoing basis with evidence attached.
The AI TPRM capabilities are available now to Scytale customers. Teams interested in seeing the Vendors module in action can book a demo.
Scytale's AI GRC platform automates vendor discovery, risk scoring, and evidence collection across compliance frameworks.
About Scytale
Founded in 2021, Scytale is a leader in trust and compliance, helping businesses worldwide stay ahead of security, privacy, and AI regulatory requirements. Its agentic GRC platform serves organizations at every stage, from startups preparing for their first audit to global enterprises managing complex, multi-framework programs, across banking, financial services, insurance, healthcare, technology, manufacturing, and government. With a global team spanning New York, Tel Aviv, Johannesburg, Cape Town, Berlin, Lisbon, and Prague, Scytale serves customers in 44 countries, including industry leaders such as the ICL Group, PwC, and Deel. Through intelligent automation and AI GRC workflows, Scytale turns complex compliance obligations into a lasting source of competitive advantage.
Press Inquiries
Melissa Dil
melissa [at] scytale.ai
https://scytale.ai/
