AI Governance & Security Vendor Wiki

4 min read

Hyperproof

Primary category: enterprise-grc. Also listed in vendor-risk.

One-liner — “Compliance operations”: a GRC platform that sits between the audit-automation tools (vanta, drata) and the heavyweight systems of record (servicenow, archer) — a real risk register and multi-framework control library without a six-month implementation.

What it does — Maintains a single control set mapped across many frameworks, so one control tested once satisfies SOC 2, ISO 27001, NIST CSF, PCI, SEC cyber rules and so on rather than being re-evidenced per audit. Around that sits automated evidence collection from cloud/identity/HR systems, a risk register with scoring and treatment workflow, third-party/vendor risk assessment, and audit-management workflow for both internal and external auditors. The framing the company uses — compliance operations — is the accurate one: it is built for a compliance team that runs a continuous programme, not for a startup racing to a first SOC 2 badge.

Naming / provenance — Founded 2018 in Bellevue, WA by former Microsoft people. Single brand, no renames.

Ownership & viability — independent, VC-backed. $66.5M total from Riverwood Capital and Toba Capital; the $40M growth round led by Riverwood closed 2023-08-30. No round found since, and no acquisition as of 2026-08-26. Recognised as a Category Leader in three 2026 Chartis RiskTech Quadrants (eGRC, TPRM, IT Risk) — analyst validation, not independent financial evidence. Mid-size and independent in a consolidating GRC market: acquisition is a plausible outcome.

Positioning & differentiators —

  • The gap between compliance automation and enterprise GRC. vanta and drata optimise for getting certified; servicenow and archer optimise for enterprise-wide risk process. Hyperproof deliberately targets the firm that has outgrown the first and cannot justify the second — which is precisely the shape of a $2–20B AUM manager.
  • Cross-framework control mapping is the core artifact, not evidence-collection connectors. That distinction shows up when a firm carries SEC/FINRA obligations plus SOC 2 for institutional investor diligence plus client-driven ISO requests.
  • TPRM in the same platform — overlaps vendor-risk without a second purchase, though it is questionnaire-and-workflow TPRM, not the outside-in cyber ratings bitsight or securityscorecard sell.
  • AI governance coverage is unverified. Whether Hyperproof ships an AI-risk framework module comparable to optro’s (post-FairNow) or onetrust’s is an open question below, and it is the question that decides whether this is relevant to the AI thesis or merely to the compliance baseline.

Who should choose them / anti-fit — Fits a mid-size regulated firm with a small compliance team and several overlapping frameworks — the common hedge-fund/asset-manager profile. Anti-fit: a firm that only needs one SOC 2 (vanta/drata are cheaper and faster), or a large institution that already runs servicenow as the enterprise system of record and should extend it rather than add a parallel platform.

Known weaknesses / gotchas — Smaller vendor with less integration breadth than the incumbents. Named references skew tech/manufacturing (Fortinet, Motorola, 3M, Veeva), not financial services. Acquisition risk given size and market structure.

Deployment & data handling — SaaS. Data-handling specifics unverified.

Integrations & partnerships — Cloud, IdP, HRIS, ticketing connectors for evidence collection; detail unverified.

Compliance & FS traction — Unverified. Chartis Category Leader placements in 2026 eGRC/TPRM/IT Risk quadrants are the strongest external signal found; no named financial-services customers confirmed.

Commercial — Not public. Tiered SaaS subscription.

Open questions

  • Does Hyperproof ship an AI-risk / AI-governance framework module? This decides its relevance to the wiki’s core thesis.
  • Named financial-services customers; any hedge-fund or asset-manager references.
  • Certifications held; data residency options.
  • Any funding or ownership change since the 2023 Riverwood round.
  • How its TPRM module compares to a dedicated vendor-risk purchase for a firm that needs both.

Sources

History

  • [2026-08-26] Page created via wiki-create + researched same day. Sourced from the 2026-08-25 competitor scan (Tier A, score 10) — surfaced as a peer by Drata, LogicGate and Vanta.

Graph View

Backlinks