Black Kite Third-Party Cyber Risk vs Neotas

Black Kite Third-Party Cyber Risk is a web platform for monitoring and assessing cyber risk across vendor portfolios and extended supply chains. It provides visibility from first-party posture through fifth-party exposure, flags suppliers, software products, and geographies as possible single points of failure, and maps downstream exposure. Black Kite Monitor continuously tracks vendor portfolios, while FocusTags connect breaches, active exploits, CVEs, and dark-web exposures to vendors. The Ransomware Susceptibility Index provides a predictive, vendor-specific signal. Black Kite Assess parses policies and compliance documents, mapping evidence to more than 25 global frameworks or a custom framework; its shared workspace supports gap sharing, remediation requests, and follow-up with vendors. The platform grounds findings in open, auditable standards, and Open FAIR-based analysis translates cyber posture into dollar-denominated exposure. It supports hybrid assessments, questionnaire libraries, framework mapping, evidence collection, and workflow automation. Official integrations include ServiceNow, Aravo, OneTrust, Splunk, Jira, Power BI, Slack, Zapier, Microsoft Teams, and others. Pricing is on request.

Neotas combines risk intelligence, enhanced due diligence, background screening, and forensic investigations for risk-critical decisions. Its third-party risk platform supports configurable workflows for onboarding, screening, assessment, monitoring, and mitigation, with live intelligence and no-code lifecycle automation. Screening analyzes risk profiles, adverse media, internet results, and public and corporate records, then summarizes information across sources and languages. The TPRM page states support for 30+ native languages and advertises 400+ ERP and CRM connectors, including SAP and Salesforce. Neotas describes coverage across archived web pages, court and corporate records, social media, and media sources in more than 100 countries. Teams can configure thresholds, scoring, approvals, and escalation paths; an audit trail records evidence, decision logs, rationale, and source attribution. Options include self-service AI due diligence reports and analyst-led investigations, while employment screening includes right-to-work checks, social media screening, biometric ID verification, disclosures, and credit checks. Its operations are stated to be ISO 27001 and ISO 27701 certified. The company says most clients can deploy within 2–4 weeks; the self-service AI report offer is subject to qualification.