ThreatWatch

ThreatWatch is a web-based platform for monitoring the security posture of vendors and other third parties. It suits teams responsible for recurring supplier assessments, exposure alerts, and compliance questionnaires. Its free passive scan is a useful first check; portfolio monitoring becomes more capable and frequent on paid plans.

Overview

ThreatWatch watches for vendor breaches, dark-web exposure, attack-surface vulnerabilities, and compliance gaps, then gives each vendor an A-to-F grade drawing on threat intelligence, security scans, questionnaire responses, and certifications. That brings several risk signals into one assessment, although vulnerability matches are confirmed only when the exact software version is readable.

A passive, outside-in scan produces a grade in about 30 seconds without signup or a credit card. The catalogue of 280,770 companies can be searched by name, domain, or alias, which helps teams make a quick initial assessment before bringing a supplier into a recurring programme. Vulnerability matching is included on every plan, but the monitoring schedule and depth vary by tier.

Key features

Rescans run weekly on Free, every two days on Starter, every 12 hours on Professional, every six hours on Enterprise, and every three hours on Enterprise Plus. Breach and dark-web intelligence starts with Starter; the free plan omits both. ThreatWatch re-checks vendor staff devices hourly and leaked credentials daily, giving these checks a faster cadence than the scheduled portfolio rescans.

Enterprise and Enterprise Plus add deep attack-surface scanning, while Professional adds OSINT enrichment. AI Co-Pilot and Ask AI are available from Professional upward, and proposed changes require human approval. This human sign-off keeps AI suggestions from becoming unreviewed changes. Compliance AI supports PCI-DSS, ISO 27001, SOC 2, HIPAA, GDPR, NIST CSF questionnaires, and custom frameworks. The broader supported framework set also includes NIST 800-53, CSA CCM, DORA, NIS2, ISO 42001, and the EU AI Act and Cyber Resilience Act.

Alerts can go to Slack, Microsoft Teams, Jira, ServiceNow, PagerDuty, email, the app, or a generic webhook. Vendors access questionnaires through a one-time email code rather than an account and password, reducing the account-setup burden for suppliers. Traffic uses TLS with one year of preloaded HSTS, and secrets such as API keys, SSO credentials, and integration credentials are encrypted at field level at rest.

One operational wrinkle matters during onboarding: an uploaded vendor file does not trigger scans immediately. Imported companies wait for the first scan in the plan schedule, so teams should account for that delay when moving a portfolio into the system.

Pricing

ThreatWatch is freemium, with a free plan and paid plans on custom pricing.

• Free — free. Covers your own organisation, with weekly rescans and community support. It excludes breach and dark-web intelligence, OSINT enrichment, deep attack-surface scanning, AI agents, SSO, and API access. This is best for an initial grade or limited self-monitoring, not a supplier programme that needs exposure intelligence or integrations.
• Starter — custom pricing. A small-portfolio tier with rescans every two days, breach and dark-web intelligence, API access, and email support. It adds the essential intelligence missing from Free, but lacks the OSINT enrichment, AI features, and SSO offered at higher tiers.
• Professional — custom pricing. Designed for a growing portfolio, with 12-hour rescans, breach and dark-web intelligence, OSINT enrichment, AI Co-Pilot, Ask AI, SAML/OIDC SSO, API access, and priority support. It is the more suitable step up for teams that need AI assistance and centralized sign-on, though it does not include the deep attack-surface scan listed for Enterprise.
• Enterprise — custom pricing. Provides six-hour rescans, deep attack-surface scanning, AI agents, SAML/OIDC SSO, API access, custom branding, and dedicated support. It suits an enterprise programme that prioritizes broader scanning and faster checks.
• Enterprise Plus — custom pricing. For multi-entity programmes, with three-hour rescans, deep attack-surface scanning, AI agents, SAML/OIDC SSO, API access, white-label branding, dedicated support, and an account manager. Its faster cadence and account management are aimed at organizations coordinating monitoring across entities.

No seat or vendor quotas are stated for these plans, so portfolio size and the required scan interval are the clearest published distinctions when choosing a tier.

Platforms

ThreatWatch is web-based. API access is available on Starter and every higher plan, while Free excludes it.

Who it's for

ThreatWatch is a strong fit for security and procurement teams that need to monitor a third-party portfolio, route alerts into existing tools, and support questionnaire-based compliance work. The range of rescan intervals gives small portfolios a lower-commitment starting point and multi-entity programmes a faster schedule. It is not a personal-device security app, and Free is a poor fit when continuous breach intelligence, API access, or SSO is essential.

Pros and cons

• Pro: The no-signup, no-card passive scan provides a quick initial grade, useful for screening a vendor before setting up ongoing monitoring.
• Pro: Multiple alert destinations and API access on paid plans can connect vendor-risk findings to established response workflows.
• Pro: Hourly staff-device checks and daily credential checks add focused dark-web monitoring alongside scheduled rescans.
• Con: Free rescans are weekly and lack breach and dark-web intelligence, making the free tier too limited for active third-party oversight.
• Con: Exact-version readability is required to confirm vulnerability matches, which limits confirmation when a vendor's software version cannot be read.
• Con: Imported vendors wait for their first scheduled scan rather than being scanned on upload, delaying initial coverage during onboarding.

Alternatives

For a broader comparison, see Security Ratings Software.

• SecurityScorecard Third-Party Risk Management is worth considering if a free forever plan focused on your own domain, digital footprint management, issue prioritization, alerts, and questionnaire response better matches the need.
• Bitsight Security Ratings may suit organizations that want API and integrations, peer analytics, benchmarking, risk remediation, and frameworks in a paid Standard plan.
• Panorays is an option when customized supplier assessments and Smart Questionnaire Assessment are the priority.
• RiskRecon may be a fit for teams wanting a 30-day portal trial that covers security ratings for up to 50 vendors and risk-prioritized findings.
• Black Kite Third-Party Cyber Risk is another paid web-based option, with onboarding, enablement, configuration, and environment tuning included in its Standard plan.
• ThreatNG Security offers a limited-time evaluation of its complete platform for teams that want a time-bounded full-capability trial.
• Cybersecurityratings.com may suit users who want a free forever starter snapshot with a basic A–F grade, top five risk factors, and a limited ratings database.
• Scovery is another freemium web-based option.

Verdict

Choose ThreatWatch if your team needs recurring vendor risk grades, exposure monitoring, and questionnaire workflows in one web platform, with scan frequency that can scale to a multi-entity programme. The free passive scan is a practical entry point, but the free plan is not a substitute for ongoing intelligence: breach and dark-web checks, SSO, and API access require a paid tier. If those capabilities are central, compare the custom-priced plans against your required cadence and scanning depth before committing.