The Q2 2026 report of The Forrester Wave™: Cybersecurity Risk Ratings Platforms offers a clear look into how the category is evolving, and what organizations should expect from third-party risk solutions.
We are excited to announce that Panorays has been named a Leader in the Forrester Wave™: Cybersecurity Risk Rating Platforms, Q2 2026. The report evaluated Panorays and six other vendors across criteria central to third-party cyber risk management, including vendor discovery and mapping, AI capabilities and customer AI adoption, findings prioritization and remediation, roadmap, and vision.
Forrester assessed seven of the most significant vendors across 21 criteria, evaluating both strengths across current offering and strategy. Panorays received the highest scores possible across nine criteria, including asset discovery and attribution, vendor discovery and mapping, AI capabilities and customer AI adoption, innovation, and roadmap.
Matan Or-El, CEO and co-Founder of Panorays, shared: “We are proud to be named a Leader in the Forrester Wave™: Cybersecurity Risk Rating Platforms, Q2 2026. At Panorays, we remain committed to pushing the boundaries of what is possible for third-party risk management by prioritizing an agentic AI-driven approach. This helps organizations reduce manual workflows, scale their programs, and move from risk signals to action more efficiently.”
Several areas have become increasingly important for addressing third-party risk. As the category shifts beyond visibility alone, capabilities that help organizations identify, prioritize, and act on risk with greater speed, context, and control have become vital.
What is the Forrester Wave™: Cybersecurity Risk Rating Platforms, Q2 2026, and why is it important?
Forrester has spent more than four decades helping organizations make better technology decisions through independent research and analysis. The Forrester Wave™: Cybersecurity Risk Rating Platforms, Q2 2026 report compares top providers in the market using a data-driven methodology, assessing vendors’ current offerings to help customers in that domain understand where platforms are strongest, how they differ, and which product best matches the organization’s needs.
The report mentions areas of third-party risk that to Panorays are critical, including visibility, prioritization, automation, AI, remediation, and workflow. For security teams facing larger vendor ecosystems, rising regulatory expectations, and increasing pressure to act in areas of limited visibility, the evaluation offers insight into the capabilities organizations need to manage third-party risk more effectively and turn risk signals into action.
Panorays’ Approach to Modern Third-Party Risk in 2026
Third-party risk has evolved significantly over the past few years. What once focused on assessing known vendors now requires organizations to uncover risks buried deep within extended supply chains. As ecosystems grow more complex, risk often arises from relationships and assets that were never formally tracked in the first place.
Panorays’ approach to risk in 2026 reflects this shift. The platform brings together rating data, vendor discovery, questionnaire workflows, reporting, and automation to support the full lifecycle of third-party risk management. Increasingly, that approach has been driven by agentic AI, with a focus on automating the parts of the process that have traditionally slowed teams down. This includes uncovering assets, technologies, and relationships beyond known suppliers, using AI to surface exposures and create a unified view of an organization’s risks.
Panorays’ AI strategy is also supported by formal governance, including ISO/IEC 42001 certifications, reinforcing a structured and accountable approach to AI adoption. Panorays has capabilities that are increasingly important for managing today’s third-party risk landscape, where visibility, context, and automation must work as one.
The Panorays Approach to Third-Party Risk Management
The Forrester Wave™: Cybersecurity Risk Rating Platforms, Q2 2026, also offers a direct view of how Forrester characterized each vendor’s strengths across strategy, capabilities, and customer feedback. The following are excerpts from Panorays’ vendor profile.
Strategy: Panorays stands out with one of the most ambitious roadmaps and innovation-driven approaches to agentic AI in this evaluation, aiming to use the technology to extensively automate most of the third-party security use case. Several roadmap enhancements focus on using agentic AI technology to drive significant process automation in third-party risk programs. Its pricing, approach to partnerships, and additional services are on par with the broader market.
Capabilities: Panorays excels in how it holistically brings together ratings data, vendor discovery capabilities, and questionnaire management capabilities to deliver high-quality, actionable findings for the third-party use case. Its differentiated and clear user experience and reporting further support its delivery of a robust third-party risk management capability.
Customer feedback: Panorays’ customers praised the flexibility of its platform and ease of use, citing their ability to use it for a wide range of traditional and nontraditional cybersecurity risk ratings use cases.
Forrester’s take: Panorays is an excellent fit for enterprise and midmarket customers that want to integrate risk ratings data into a scalable, highly automated platform to support their third-party risk program.
Here’s a closer look at some of the criteria where Panorays received the highest scores possible and Panorays’ reasoning on why they achieved those scores.
Asset Discovery and Attribution
Panorays gives organizations a sharper way to see what sits outside their environment and how it connects back to their business. Starting from known assets, the platform continuously maps the external perimeter, uncovering domains, subdomains, cloud services, nth-party relationships, and other blind spots that would otherwise go unnoticed. It does this by analyzing signals such as shared infrastructure, ownership records, and other patterns to determine which assets are connected to the organization. These tests run continuously, ensuring updates are processed every 24 to 72 hours.
By pairing high-confidence asset matching with correlation metrics and internal validation through third-party disputes, Panorays helps teams cut through the noise, identify overlooked entry points, and focus on the external assets most likely to impact the business.
Vendor Discovery and Mapping
Panorays automated Supply Chain Discovery brings hidden vendor connections to the forefront, uncovering subcontractor relationships that extend beyond direct suppliers to 4th- and nth-party relationships. This comprehensive view, built on open-source intelligence, proprietary tools, and attribution algorithms, allows Panorays to map the extended supply chain, helping teams identify potential risks and scale risk management as the vendor ecosystem grows.
This reflects a core strength of Panorays, transforming fragmented external data into a structured, actionable view of risk. With this level of insight, teams can reduce blind spots, confidently prioritize critical relationships, and use the Panorays platform as a single source of truth for third-party risk management.
Third-Party Security Assessment Questionnaire
In practice, Panorays transforms third-party security assessments into a streamlined, AI-powered questionnaire module tightly connected to its Cyber Risk Rating engine. The platform supports the full process from inherent risk to questionnaire review, document inspection, remediation, and final decisions.
To ensure accuracy, the AI draws on a range of documents, public information, and previous responses to help vendors and internal teams complete questionnaires more quickly. To improve accuracy, Panorays then validates answers against submitted artifacts and cyber posture tests, flagging important questions, inconsistencies, and risk areas, making it simple to review and address them.
With automated scoring and customizable assessment templates, Panorays reduces the manual workload while strengthening the quality, speed, and consistency of security assessments.
In-Platform Collaboration
Panorays simplifies communication throughout the assessment process by keeping conversations on the platform, where they are tied to the right vendor, asset, finding, questionnaire, task, or incident. This helps teams avoid scattered email threads and gives them a clear record of every exchange. The platform streamlines collaboration by enabling internal teams and vendors to work collaboratively on assessments, questionnaires, and incident responses through a shared workflow.
This highlights how Panorays transforms third-party risk management into a more connected, transparent, and collaborative process. By bringing internal teams and vendors into a single workflow, Panorays helps organizations move faster, reduce confusion, and make decisions with greater speed and confidence.
AI Capabilities and Customer AI Adoption
Panorays champions a practical, efficient way to manage third-party risk by automating the work that typically slows teams down. Tasks such as questionnaires, organizing vendor risk levels, and surfacing key issues are handled automatically using trusted sources, helping teams move faster while improving consistency and accuracy.
Rather than replacing human expertise, Panorays’ approach to AI is designed to support it. The platform handles repetitive work while keeping analysts and business owners in control of higher-stakes decisions, ensuring risk is evaluated with the right business context and appropriate human oversight. Smart Match, for example, is Panorays’ AI-powered auto-fill engine that uses self-hosted engines and Google Gemini to generate accurate, transparent, and fully referenced answers.
The result is AI capabilities that are practical, embedded, and easy to adopt, improving visibility, prioritization, and day-to-day efficiency. Panorays helps organizations make faster, more confident decisions without adding extra layers of complexity.
Reporting and Visualization
To ensure efficiency, organizations must have a clear view of the risks across their third-party ecosystem. Panorays brings data from across the platform into dashboards and reports, so teams can see the full picture of third-party risk in one place. This includes vendor details, business impact, cyber posture, assets, findings, vulnerabilities, threat intelligence, questionnaire responses, remediation progress, and full audit trails.
The reporting can be viewed at multiple levels, from a customer’s own organization to individual third parties, and even extended supply chains, including fourth and fifth parties. It also allows organizations to benchmark their own risk vendors against those of similar organizations and generate high-level executive summaries for leadership.
With customizable dashboards, benchmarking, executive summaries, and flexible reporting tools, Panorays makes it easier for teams to understand risk, share insights, and scale reporting as their vendor ecosystems grow in complexity.
User Experience
Panorays is designed to make third-party risk management easier for everyone involved. It gives internal teams and vendors a shared, user-friendly place to collaborate throughout the full process, starting from evaluation and review to monitoring and remediation.
One of Panorays’ key strengths is its ability to translate complex technical signals into clear, business-relevant insights, making it easier for various teams to work together. Features such as task assignment, scheduled follow-ups, and in-platform messaging facilitate easier collaboration and knowledge transfer between teams.
The platform is also designed to match how an organization already manages risk. Vendors can participate for free, invite collaborators from other departments, and access relevant information about their security posture, making them active participants in the process rather than just passive questionnaire recipients.
Innovation
From the beginning, Panorays was created to support the full third-party risk cycle, from initial vendor tiering and assessments to continuous monitoring, remediation, and compliance reporting. Over time, this has grown beyond traditional TPRM, with customers also using the platform to meet evolving regulatory requirements, demonstrating its adaptability to today’s risk needs.
With nearly a decade of data across cyber posture, threat intelligence, and questionnaire responses, Panorays has built a strong foundation for building programs that reflect real-world depth. With agentic AI, organizations can scale vendor programs, assess more suppliers, and maintain visibility without increasing headcount. Panorays is also developing specific tools and content packages to help customers manage AI-related risks as vendor challenges become more complex.
As the platform continues to expand across the full supplier lifecycle and integrate with broader enterprise systems, Panorays is positioned as a long-term, adaptable solution that grows alongside its existing and prospective customer needs.
Roadmap
Panorays’ 2026 roadmap focuses on using AI to make third-party risk management more scalable, efficient, and responsive. With priorities across automation, efficiency, risk, compliance, and continuous monitoring, the roadmap strengthens Panorays’ ability to support customers during every stage of the vendor relationship.
A central component of this roadmap is the use of AI agents to automate vendor classification, generate intelligent insights, and prioritize next steps for risk teams. Panorays is also enhancing incident management and expanding integrations across the enterprise ecosystem to help customers identify, prioritize, and respond to incidents.
Positioned as a central player within the ecosystem, Panorays provides customers with regular updates through product announcements, releases, and ongoing communication, ensuring they stay informed on evolving regulatory requirements, platform enhancements, and emerging risks across the third-party landscape.
Panorays: Innovative TPCRM Solutions
Panorays is proud to be named a Leader in the Forrester Wave™: Cybersecurity Risk Rating Platforms, Q2 2026, and sees this recognition as a reflection of its long-standing commitment to advancing third-party cyber risk management.
Panorays’ approach to agentic AI is built to help organizations scale as vendor ecosystems become more complex by automating high-value tasks such as questionnaire completion, risk insights, and prioritized next steps. This enables teams to move faster without losing control while also regaining time by replacing manual processes with automation.
Looking ahead, Panorays understands that the future of TPRM will require more than manual reviews and static assessments. With AI embedded across the entire ecosystem, organizations gain a smarter, more efficient, and effective way to identify hidden risks and strengthen resilience. This is particularly relevant in today’s environment, as risk does not always come from a direct vendor but from a broader network of hidden dependencies that span the supply chain.
With Panorays, organizations gain a forward-looking partner that continues to utilize advanced tools while also keeping human expertise at the forefront of critical risk decisions. This balance helps teams move faster, reduce manual workloads, and build a more resilient and future-proof approach to third-party risk management.
Read the full Forrester Wave™: Cybersecurity Risk Rating Platforms, Q2 2026 here.
*Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change.This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester’s objectivity here.
