Viso Trust

VISO TRUST operates an AI-driven third-party risk management (TPRM) platform that automates vendor cyber risk due diligence across third, fourth and nth parties. Rather than relying on long security questionnaires and annual point-in-time reviews, the platform ingests documents vendors already hold — SOC 1/SOC 2 reports, ISO 27001 certifications and statements of applicability, PCI RoC/AoC, penetration test reports, BAAs, cyber insurance certificates and security policies — plus open-source intelligence and optional security-rating inputs, and produces inherent and residual risk scores with plain-language rationale mapped to frameworks such as SOC 2, ISO 27001, NIST CSF, PCI DSS and GLBA/NYDFS expectations. Where a vendor has no attested documentation, the platform falls back to a streamlined, control-scoped questionnaire delivered through a vendor portal.

The product covers a five-stage lifecycle loop: vendor discovery (compiling third-party mentions from a customer's domain, public trust centers and legal pages, and sanctioned applications from identity providers such as Okta); agent-led evidence requests and expiration tracking; AI risk assessment; continuous breach, news and advisory monitoring correlated to the vendor catalog with impact reports; and reporting, including per-vendor smart summaries and program-level rollups on residual risk distribution, assessment throughput, exceptions and advisory exposure. Additional capabilities include nth-party mapping of sub-processors, shared dependencies and concentration risk, automated reassessment triggers, and integrations with tools including Jira, Coupa, ServiceNow, Archer, Slack and Okta. The underlying AI services are branded VISO Oracle, with a core component called Artifact Intelligence that discovers, classifies and assesses control information in source artifacts.

Founding story

The founders were leading security at LendingClub, where they were responsible for thousands of vendors and accountable to the board. Facing manual processes that did not scale, security ratings that went stale quickly, and no visibility beyond direct vendors, they built an internal system for the problem; peer interest in that system became the basis for VISO TRUST. Paul Valente, previously CISO at LendingClub and Restoration Hardware and also in senior security roles at ASAPP and MicroEdge, co-founded the company with Russell (Russ) Sherman, a security architect who was manager of threat intelligence at LendingClub and had held roles at Varo Money, ASAPP and Dell. Valente is described as CEO in 2024 materials and as CCO and co-founder on the company site; Sherman serves as CTO and co-founder.

Business model

VISO TRUST sells its TPRM platform to enterprise security, risk and compliance teams. Its structure is subscription/SaaS-oriented, with the website advertising unlimited vendors without added overhead and messaging around running enterprise TPRM programs without additional headcount. Vendors being assessed interact through a free-to-use vendor portal, and the accumulation of vendor profiles across customers creates a network effect, though the company states it does not operate as an exchange because assessments are specific to each customer's use of the vendor.

Software platform sold to enterprise customers for third-party risk management; the company positions savings on assessment hours and headcount as the purchasing rationale.

Traction

The company reports 98% vendor response/adoption rates, up to 90% reductions in vendor assessment and onboarding time, assessments completed in 5-7 days (2024) and risk assessments generated in about 30 seconds to under a minute per vendor (2026 site), and thousands of vendors in its system across customers. Named users include Upwork, Instacart, Notion, Bain Capital, Loews Corporation, Butterfly Network, James Hardie, Branch and Mezmo. Cumulative disclosed funding is $24m.

Latest developments

Company news listings cite availability of the AI-powered vendor risk management platform on Amazon Web Services, an Inc. recognition dated March 31, 2026, and an April 21, 2026 announcement with Protecht Group aimed at simplifying third-party risk at scale and accelerating platform enhancement. Recent product positioning emphasizes agentic AI, vendor discovery via domain and identity provider data, and nth-party continuous monitoring.