FortaRisks Third-Party Risk
FortaRisks Third-Party Risk monitors vendor security by comparing questionnaire responses with external scans of vendor attack surfaces, then flagging differ…
What FortaRisks Third-Party Risk is
FortaRisks Third-Party Risk monitors vendor security by comparing questionnaire responses with external scans of vendor attack surfaces, then flagging differences between what vendors report and what scans observe. It offers 24-, 39- and 139-question assessments across nine domains and 35 control domains, with six optional thematic modules. Answers map to SCF controls, with stated coverage for NIST, ISO 27001, SOC 2 and GDPR. Vendors can use an emailed-code portal to reuse answers across clients and share versioned evidence without buying a licence. The platform scores vendors from 0–100 with A+ to F grades and applies more than 500 finding types per vendor; it says the first alert arrives within 7 days. Web-based and hosted in Canada, it includes remediation workflows, exportable registers and optional AI enrichment. Pricing starts at $15,000/yr, and there is no free plan. Essential lists up to 10 monitored vendors, Advanced up to 50, and Enterprise unlimited.
Good
- Questionnaires map to SCF controls and listed frameworks.
- Vendors can reuse answers through a passwordless portal.
- Includes remediation requests, deadlines and reminders.
- Optional AI enrichment; core capabilities work without it.
- Native OT/ICS scanner can be included for industrial vendors.
Watch out
- Paid pricing starts at $15,000/yr.
- No free plan is listed.
- Essential excludes questionnaires.
- Vendor limits vary by plan.
Who it suits
It is aimed at organizations in regulated sectors and critical infrastructure, including finance, healthcare, manufacturing, energy, public sector and SaaS. It may suit teams that need ongoing vendor checks, questionnaire workflows and remediation tracking.
Verdict
FortaRisks combines questionnaire assessment with external scanning, vendor scoring and remediation workflows. Its plan limits and starting price are important considerations for teams comparing coverage needs.
Plans and prices
From FortaRisks Third-Party Risk's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Advanced | Priced on request | Up to 50 monitored vendors · 25 third-party questionnaires/year · 2 expert workshops/year · priority support |
| Enterprise | Priced on request | Unlimited monitored vendors and questionnaires · 5 expert workshops/year · dedicated CSM · integrations and Risk Engine scoped to environment |
| Essential | Priced on request | Up to 10 monitored vendors · questionnaires not included · expert workshops on demand |
The facts
Each one read from FortaRisks Third-Party Risk's own pages, with the date it was checked.
What it does
- AI option
- AI enrichment is optional per workspace and can assist with questionnaire pre-filling, inconsistency flagging and vendor-file summaries; the page says core capabilities work without it.checked 4 Oct 2026
- Integrations
- The integrations page lists Microsoft 365 and Azure, ITSM and ticketing, SIEM and SOAR, identity and SSO, cloud and infrastructure, and notifications as integration categories.checked 4 Oct 2026
- Intended users
- FortaRisks describes its platform as built for regulated sectors and critical infrastructure, and lists finance, healthcare, manufacturing, energy, public sector and SaaS among its sectors.checked 4 Oct 2026
- OT/ICS
- The native OT/ICS scanner can be included for vendors categorized as industrial and runs read-only with adapted rate limiting.checked 4 Oct 2026
- Purpose
- FortaRisks continuously cross-checks vendor questionnaires against external scans of vendor attack surfaces and flags divergences between declared and observed posture.checked 4 Oct 2026
- Questionnaires
- The product offers 24-, 39- and 139-question assessment levels across 9 domains and 35 control domains, plus 6 optional thematic modules.checked 4 Oct 2026
- Remediation operations
- The product provides 12 configurable alert policies, remediation requests with deadlines and reminders, bulk vendor import and five XLSX-exportable registers.checked 4 Oct 2026
- Scanning and scoring
- FortaRisks assigns a 0–100 score with A+ to F grades, applies more than 500 finding types per vendor and states that the first alert arrives within 7 days.checked 4 Oct 2026
- Security and hosting
- FortaRisks says the platform is built and hosted in Canada, and that customer data is not used to train an AI model.checked 4 Oct 2026
- Support
- FortaRisks says Advanced and Enterprise include priority support, while Enterprise includes a dedicated customer success manager.checked 4 Oct 2026
- Vendor portal
- Vendors can access a passwordless portal using an emailed code, reuse answers across clients and share a versioned evidence library without buying a licence.checked 4 Oct 2026
Where it runs
- Framework mapping
- Questionnaire answers map to SCF controls, with stated coverage for NIST, ISO 27001, SOC 2 and GDPR.checked 4 Oct 2026
The company
- Headquarters
- Saint-Augustin-de-Desmaures, Quebec, Canadachecked 28 Sep 2026
Money
- Plan limits
- The pricing page lists up to 10 monitored vendors on Essential, up to 50 on Advanced and unlimited monitored vendors on Enterprise.checked 4 Oct 2026
Alternatives to FortaRisks Third-Party Risk
- 1
UpGuard
Free planAndroidiOSWebAPI8.2From $1,750 a month - 2
Drata
AndroidiOSWebAPI7.2 - 3
Gatekeeper
WebAPI6.7 - 4
RiskWatch Vendor Risk Management
AndroidiOSWebAPI6.6 - 5
RiskXchange
WebAPI6.4From £14,900 a year - 6
Riskonnect
AndroidiOSWebAPI6.3