CyberGRX

Founded in 2015 by Fred Kneip, CyberGRX operates as a third-party cyber risk management (TPCRM) platform. Kneip, who serves as the company's CEO, brought his experience from leading the Security and Compliance Departments at Bridgewater Associates and as an Associate Principal at McKinsey & Company to establish the firm. The Denver-based company was created to address the growing exposure to breaches originating from key vendors and partners as enterprises increasingly depend on partner ecosystems.

The core of the business is a cloud-based global risk exchange, which streamlines the process of assessing and managing third-party cyber risk. This platform provides a standardized and scalable approach, utilizing a library of validated assessments to provide a holistic view of an organization's third-party cyber risk posture. The company generates revenue through a subscription-based model, offering tiered levels of access to its suite of tools, which cater to organizations across sectors like finance, healthcare, and technology. In July 2023, CyberGRX was acquired by ProcessUnity, a move intended to combine CyberGRX's risk exchange with ProcessUnity's workflow automation capabilities.

The CyberGRX platform provides a single, validated assessment that can be shared with multiple customers, reducing redundant efforts for third parties. Its methodology identifies both inherent and residual risk by incorporating advanced analytics, threat intelligence, and real-world attack scenarios based on frameworks like the MITRE ATT&CK kill chain. A key feature is the Framework Mapper, which allows the mapping of assessments to over 20 industry standards, including NIST, ISO 27001, and PCI-DSS. The platform also offers Auto Inherent Risk (AIR) Insights for automated risk analysis based on the specific relationship with a vendor and an open API for integration with other governance, risk, and compliance (GRC) tools.

Keywords: third-party risk management, cyber risk exchange, TPRM, vendor risk management, cybersecurity assessment, supply chain security, risk intelligence, compliance management, cyber risk analytics, threat modeling, security ratings, vendor due diligence, risk mitigation, cloud security assessment, cybersecurity platform, enterprise risk management, GRC integration, data security, privacy compliance, vulnerability assessment