CYMETRIS vs RiskWatch Vendor Risk Management
CYMETRIS
cymetris.comRiskWatch Vendor Risk Management
riskwatch.comSide by side
| Figure | CYMETRIS | RiskWatch Vendor Risk Management |
|---|---|---|
| Price from | €99/mo | — |
| Free plan | — | — |
| Free trial | — | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| iOS | — | Yes |
| Android | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 3 |
| Spec score · Risk Assessment Software | 7.9 (#2) | 7.7 (#5) |
| Headquarters | CYMETRIS GmbH lists its address in Munich, Germany. | Sarasota, Florida, United States |
| Intended users | The maker describes CYMETRIS Lite as suitable for freelance security engineers, consultancies, mobility and vehicle-development startups, automotive supply-chain security teams, and service providers running TARAs. | The maker describes teams managing 200–2,000 vendors and presents reference tiers for small teams, mid-market teams, and enterprise or multi-entity programs. |
| Purpose | CYMETRIS is a software platform for cyber risk analysis and TARA across the product lifecycle. | RiskWatch helps organizations identify, assess, monitor, and report risks introduced by vendors and other third parties. |
| Reports | CYMETRIS Lite includes automatic audit-ready reports for ISO/SAE 21434 and UN R155. | Risk reports include per-vendor scorecards, portfolio rollups, and regulatory exam packs, with PDF and Excel exports. |
| Security | The maker says its cloud service uses server locations in Germany, offers on-premise deployment, and is GDPR compliant. | RiskWatch states that its platform is audited under SOC 2 Type II and ISO/IEC 27001:2022, encrypts data in transit and at rest, and segments data by tenant. |
Plans
RiskWatch Vendor Risk Management
- EnterprisePriced on request
- GrowthPriced on request
- StarterPriced on request
In their own words
CYMETRIS
CYMETRIS is a cyber risk analysis and TARA platform for work across a product lifecycle. Its guided workflow follows ISO/SAE 21434 and applies automated consistency and logic checks. Teams can inspect attack paths interactively and map risks to components in system architecture, with risk prioritization, collaborative review, templates, frameworks, and multiple modeling methods. CYMETRIS Lite generates audit-ready reports for ISO/SAE 21434 and UN R155. The maker describes AI assistance through MCP for importing architectures, identifying assets, developing attack vectors, and querying TARA datasets in natural language. A public API is intended to connect requirements, architecture, PLM, ticketing, ALM, and reporting systems. Vulnerabilities can be imported from CVE databases, vendor advisories, or internal analyses and mapped to affected components; this capability is described as a selected-customer prototype. Access is available through web, API, or self-hosted deployment. Lite costs €99.00 per month, includes one full TARA project, and allows up to five active projects.
RiskWatch Vendor Risk Management
RiskWatch Vendor Risk Management helps organizations identify, assess, monitor, and report risks from vendors and other third parties. It assigns vendors to Tier 1, Tier 2, or Tier 3, then uses the tier to set questionnaire depth and reassessment cadence. Teams can use libraries covering SIG, CAIQ, and NIST 800-161 or upload custom questionnaires. Vendors respond through a portal, where they can complete questionnaires and attach SOC 2 reports; a parser extracts criteria, exceptions, CUECs, and gap findings from Type 1 and Type 2 reports and maps them to the customer's control library. Risk scoring covers eight categories, from cybersecurity and compliance to fourth-party risk. Monitoring integrations include BitSight, SecurityScorecard, sanctions watchlists, news feeds, and breach databases. Reports include vendor scorecards, portfolio rollups, and regulatory exam packs, with PDF and Excel exports. Mappings cover frameworks and regulations including ISO 27036, DORA, HIPAA, PCI DSS, and SOC 2. RiskWatch lists Android, iOS, API, self-hosted, and web platforms. Pricing is by request; a 7-day trial requires no credit card.