Panorays is a third-party cyber risk management company that helps security and procurement teams understand and reduce the risk their suppliers bring. It is for organisations that depend on large numbers of vendors and need to know which ones are weak, how those vendors connect to further suppliers, and what to do about the gaps.
The aim is to replace spreadsheet-driven vendor reviews with one continuous process that security, procurement and the suppliers themselves all work from.
At A Glance
| Vendor | Panorays |
|---|---|
| Category | Third-party cyber risk management |
| Deployment | Web platform |
| AI | Panorays AI for nth-party discovery, AI-assisted questionnaires |
| Customers | Puma, Cimpress, TSMC, Lemonade, ClearBank |
| Certifications | ISO/IEC 42001 |
| Market classification | Governance, Risk & Compliance; also Supply Chain Security |
What Panorays Does
Supplier risk programmes often stall on spreadsheets, slow questionnaires and point-in-time reviews that miss what changes between them. Panorays treats supplier risk as a continuous cycle rather than an annual review. It starts from visibility of the whole supply chain, including suppliers of suppliers, judges each vendor against the organisation’s own policies and inherent risk, and keeps watching after approval. Findings are worked through with the vendor inside the platform, so the risk team and the supplier share one record of what has been fixed and what is still open.
Products
Assessment
Assessment tells a risk team how secure a supplier actually is. The External Attack Surface module “performs hundreds of tests across your attack surface” at the network, application and human layers without touching the supplier’s systems. Panorays AI uncovers hidden third, fourth and nth-party relationships that would otherwise be pieced together by hand, using Google Cloud’s Gemini models. Cybersecurity Questionnaires, including AI-assisted ones, check the vendor’s controls and compliance, and Smart Inventory keeps every vendor in one central repository.
Engagement
Engagement is for the back-and-forth that usually happens over email and phone. Vendors receive findings in the platform, can challenge or validate them, get mitigation guidance and report progress, so both sides work from the same record.
Monitoring
Monitoring keeps the picture current after onboarding. It sends live alerts on security changes or breaches at suppliers, and adds reporting and dashboards, regulatory compliance views and portfolio management for teams responsible for many vendors at once.
Cyber Risk Quantification
Cyber Risk Quantification puts a figure on supplier risk for executives and boards. It “gives security leaders the estimated cost of a supplier breach”, which helps decide where remediation spend should go.
How It Works
Panorays is delivered as a web application. Work moves through analysis, engagement, remediation, approval and monitoring.
| Component | What it does |
|---|---|
| External scanning | Automated tools scan thousands of assets across the supply chain around the clock, including third and fourth parties, covering web servers, mail servers, DNS, TLS, cloud and exposed services. |
| Rating | Scan results and questionnaire answers are combined into the single risk rating. |
| Approval | The platform shows which vendors do not meet the organisation’s security policies before they are approved. |
| Ongoing evaluation | Suppliers are continuously re-evaluated after approval, which drives the monitoring alerts. |
Integrations
| Area | Integrations |
|---|---|
| GRC platforms | Archer, AuditBoard, Diligent, Drata, ServiceNow |
| Procurement and ERP | Coupa, Gatekeeper, HP PPM, NetSuite, OneTrust, Oracle, SAP |
| ITSM and workflow | Commit, Jira, Zapier, Asana, Monday.com |
| Contract lifecycle management | DocuSign, Ironclad |
| SIEM and data | QRadar, Splunk, Snowflake |
| Vulnerability management | Tenable, which can draw on the external assets Panorays discovers |
Company Background
| Headquarters | New York, United States |
|---|---|
| Founders | Matan Or-El (co-founder and CEO), Meir Antar (co-founder and COO) and Demi Ben-Ari (co-founder and Chief Strategy Officer) |
| Investors | StepStone, BlueRed Partners, Greenfield, Oak HC FT, Aleph and Moneta Venture Capital |
| Recognition | Included in The Forrester Wave: Cybersecurity Risk Ratings Platforms, Q2 2026; Cybersecurity Excellence Awards 2023 (Gold) |
Note: This overview is compiled from Panorays’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.