Elteni

Primary category: vendor-risk. Also listed in enterprise-grc.

One-liner — A small New York cybersecurity consultancy for financial-services firms. It runs an outsourced cyber programme (vCISO, assessments, pen tests, training) that includes vendor risk and monitoring as a service line, delivered by its staff and tracked in a client portal.

Survey placement — Written in once in the October 2026 CTO survey under Q55 “Third-Party Risk (TPRM)” (1 respondent, in production). The placement matches a real service line. But, as with drawbridge, the respondent is most likely describing Elteni staff doing vendor due diligence for the firm, not a self-service TPRM platform.

What it does (vendor-described, 2026-10-24) — One programme across four disciplines it calls Assess / Test / Govern / Monitor:

• Vendor Risk & Monitoring: vendor tiering, diligence, evidence review, remediation tracking and ongoing monitoring, keeping “the human judgment risk requires”.
• AI, Cloud & SaaS Assessments: how data, identity, access and third parties create risk across AI systems, M365, Azure, AWS, GCP, Google Workspace and critical SaaS.
• Penetration testing (external, internal, web app, social engineering); vCISO & cyber advisory (outsourced security leadership that “coordinates providers”); training and tabletop exercises.
• Elteni Client Portal: a single view of programme data, findings, vendors, phishing results and monitoring insights. Its pitch is joining up work that otherwise sits in separate places: “A penetration test lives in one report. Vendor reviews live in a spreadsheet.”

Naming / provenance — The name comes from the Esperanto word for endurance (directory profile). Founded 2018 per a directory listing (not confirmed on the company site). No renames found. Founders and leadership are not named on the site, and a web search found none.

Ownership & viability — independent. Privately held, about 10+ staff per directory, no outside funding found. The main risk is key-person and capacity: a firm this size depends on a few senior people, so ask who will actually do your vendor reviews and how they cover holidays and departures. A sale to a larger alt-industry IT or cyber MSP is the most plausible exit. That would most likely change pricing and staffing, not software access.

Positioning & differentiators —

• Versus drawbridge: the closest analogue. Both are FS-focused cyber programmes with vendor DD as one line, staffed by advisors, with a client platform. Drawbridge is much larger (claims 1,200+ alt-manager clients), PE-backed, and has a proprietary scoring and peer-benchmarking platform. Elteni is a boutique with a NYC-local, vCISO-led model.
• Versus horizontal TPRM software (processunity, whistic): Elteni sells people doing the work, not a platform your team operates. Closer to venminder’s analyst-completed assessments, but bundled with the rest of the cyber programme.
• Includes AI/SaaS exposure reviews alongside vendor reviews. This is relevant for firms that want one party to assess both their AI tool vendors and their M365/cloud configuration.

Who should choose them / anti-fit — Fits a small NYC-area hedge fund, PE firm or family office with no in-house CISO that wants one trusted outside team to run its cyber programme, vendor due diligence included. Anti-fit: firms with their own security team that want a self-service TPRM platform, firms with hundreds of vendors needing continuous outside-in ratings (bitsight, securityscorecard), and firms needing global or 24x7 coverage. It is not an MDR/SOC.

Known weaknesses / gotchas —

• Very thin public footprint. Almost everything here comes from the vendor’s homepage and one directory profile. There is no press, no named leadership and no independent reviews.
• Category ambiguity. As a services firm, it is not like-for-like with TPRM software in survey analysis.
• Unverified scale. Headcount, client count and depth of vendor assessments are all unknown.

Deployment & data handling — Services plus a hosted client portal (hosting, retention and sub-processors unverified). Vendor documentation, findings and pen-test results sit with Elteni, which makes it a concentrated store of your security weaknesses. Ask for its own SOC 2 and data-handling terms. A Trust Center is linked from the site but its content was not retrieved.

Integrations & partnerships — None found. MCP not applicable or unverified.

Compliance & FS traction — FS traction claimed: “Built for financial services”. It cites a hedge-fund client with “$2.5B+ AUM” (testimonial, unnamed firm). The directory says the team has built technology for financial institutions “from the New York Stock Exchange to Hedge Fund and Private Equity firms”. Its own certifications are unverified.

Commercial — Not public (“Talk to an advisor”). Likely a retainer or programme fee (unverified).

Open questions

• Founders and leadership; actual headcount; founding date (2018 from a directory only).
• Is the client portal proprietary or a white-labelled GRC/TPRM tool? Does vendor monitoring use an outside-in ratings feed?
• Elteni’s own SOC 2 / ISO 27001 status (Trust Center content).
• Pricing and typical engagement size.

Sources

• Elteni homepage: fetched 2026-10-24. Supports: service lines, FS focus, client portal, hedge-fund testimonial, location. Confidence: low (vendor marketing).
• Elteni profile (village.ai): via search snippet 2026-10-24 (page 403). Supports: founding 2018, 10+ employees, team background. Confidence: low (directory).
• Cached: raw/sources/2026-10-24--elteni--homepage-services.md

History

• [2026-10-24] Page created and researched. Triggered by one in-production write-in under Q55 “Third-Party Risk (TPRM)” in the October 2026 CTO survey. Primary vendor-risk matches respondent placement and a real service line. enterprise-grc cross-listed, following the drawbridge precedent, because it runs the whole cyber programme. Flagged as a consultancy, not a TPRM platform.