AI Governance & Security Vendor Wiki

8 min read

Safe Security

Primary category: vendor-risk. Also listed in enterprise-grc.

One-liner — Safe Security (“SAFE”) is a Palo Alto-based, venture-backed cyber risk company. It started in cyber risk quantification (CRQ), which expresses cyber risk as likely dollar loss. Since 2025 it has also sold SAFE TPRM, a vendor-risk product in which AI agents do the intake, evidence review, vendor chasing and monitoring. Both run on its SAFE One platform.

What it does — The SAFE One platform bundles three products relevant here:

  • SAFE TPRM (launched 2025-05-28) is the reason for this page. SAFE markets it as “the industry’s first 100% autonomous third-party risk management platform” built from “25-plus specialized AI agents”. The product page lists:

    • outside-in detection of vulnerabilities, misconfigurations and breaches at each vendor, combined with questionnaire, contract and document evidence into one score;
    • an Inline Review Agent that checks vendor answers against your standards;
    • a Vendor Interaction Agent that chases vendors for responses;
    • a Document Analyzer Agent that summarises SOC reports and policies;
    • a Threat Intel Agent for breaches, leaked credentials and legal events;
    • a Contract Analysis Agent that tracks expiry and SLAs and triggers reassessments;
    • a Fourth-Party Discovery Agent for concentration risk;
    • tier-based offboarding.

    It integrates with GRC and ticketing tools and offers a free trial. In short, SAFE TPRM covers both halves of vendor-risk: the questionnaire/assessment workflow and the outside-in rating.

  • Cyber risk quantification, the company’s original product. It is built on FAIR, the industry-standard model for quantifying cyber risk in financial terms, and SAFE bought RiskLens, a FAIR software vendor, in 2023 (per an aggregator, not verified). SAFE cites a Leader placement in the Forrester Wave for CRQ Solutions, Q2 2025. CRQ output is a board- and insurer-facing risk register in dollars, which is why the page is cross-listed to enterprise-grc.

  • Exposure management (CTEM). SAFE bought Balbix (announced 2025-11-18) to connect vulnerability and asset exposure to the quantified risk model. In May 2026 it also launched SAFE AI-SPM, which monitors enterprise AI platforms (ChatGPT, Claude, Gemini, Copilot). SAFE AI-SPM is not cross-listed to ai-spm for now because the only evidence is a single launch release.

Naming / provenance — Founded 2012 as Lucideus at the IIT Bombay incubator by Saket Modi (CEO), Vidit Baxi and Rahul Tyagi. The company later rebranded as Safe Security and moved its headquarters to Palo Alto, keeping a large engineering base in India. The market name is “SAFE” and the legal name in the Balbix deal is SAFE Securities, Inc. Do not confuse it with other “Safe”/“SAFE” security brands, or with the SAFE network/agile framework. Check the domain: safe.security.

Ownership & viability — independent, venture-backed.

  • Funding history. John Chambers (ex-Cisco) led a US$5M Series A through JC2 Ventures in 2018. BT led a US$33M round in 2021.
  • Series C. US$70M led by Avataar Ventures, dated 2025-07-31 (CB Insights) and reported 2025-08-01. Susquehanna Asia VC, NextEquity, Prosperity7 (Aramco Ventures), Eight Roads, Sorenson Capital and Chambers also took part, for a reported total of more than US$170M.
  • Balbix acquisition. Announced 2025-11-18, terms undisclosed. Balbix’s founder joins as President of CTEM. A separate close notice was not found.
  • Viability. Well funded for its stage and buying rather than being bought.
  • Acquisition-risk note. Plausible acquirers are a GRC suite, a security-ratings vendor or a large security platform. A buyer would most likely keep CRQ and fold TPRM into its own product, so TPRM-only customers carry more roadmap risk than CRQ customers.

Positioning & differentiators — ai-native-disruptor in vendor-risk: SAFE entered TPRM in 2025 with an agent-first design rather than a questionnaire workflow. niche-specialist in enterprise-grc: it covers the cyber-risk-quantification slice, not full GRC.

  • Versus processunity and mitratech (Prevalent): those are questionnaire-workflow systems with AI added. SAFE claims agents run the workflow. It is newer, with less content-network depth and a shorter track record.
  • Versus viso-trust: also AI-native and also assesses from vendor artifacts. SAFE adds outside-in scanning and ties vendor risk into dollar-quantified enterprise risk. VISO is now part of the Protecht GRC suite.
  • Versus ratings vendors (bitsight, black-kite): Black Kite also frames vendor risk in financial-impact terms. SAFE’s difference is that the same dollar model covers first-party risk (CRQ, CTEM), so vendor risk and internal risk share one scale.
  • Versus upguard and panorays: those also combine ratings and questionnaires. SAFE’s angle is agent automation plus quantification.

Who should choose them / anti-fit — Fits a larger firm that already reports cyber risk to its board, CRO or insurer in dollar terms, or wants to, and that wants vendor risk on the same scale with little TPRM headcount. The marketing references (Instacart, T-Mobile, Carvana, Fidelity, S&P Global and Fannie Mae logos) all describe large enterprises. Anti-fit:

  • A small hedge fund with a short vendor list and no CRQ programme. The quantification machinery is overhead it does not need, and a lighter tool or specialist service will do.
  • A firm that wants a proven, long-running TPRM system with a large shared-assessment library. SAFE TPRM is about 17 months old as of this page.
  • Buyers who want a human-run managed TPRM service.

The survey respondent was evaluating, not in production, which is consistent with an early-stage product in this audience.

Known weaknesses / gotchas —

  • “100% autonomous” is marketing. Ask which decisions agents make on their own (e.g. accepting a vendor, closing a finding), which need human approval, and how agent conclusions are logged for examiners.
  • CRQ outputs are model outputs. Dollar-loss figures depend on FAIR inputs and assumptions. Treat them as directional, and ask how the model is calibrated for a small asset manager rather than a Fortune 500 firm.
  • Young TPRM module. It launched in May 2025, and the analyst recognition (Gartner Market Guide “representative vendor”, Liminal index) is vendor-cited and was not independently checked. A Market Guide listing is not a ranking.
  • Platform sprawl. CRQ, CTEM (Balbix), TPRM and AI-SPM all arrived within about two years, partly through acquisition. Integration depth across them is unverified.

Deployment & data handling — SaaS. The platform processes vendor documents and questionnaire responses, plus first-party telemetry if CRQ and CTEM are connected (asset, vulnerability and identity data from your security tools). Hosting regions, data residency (the company has a large engineering presence in India), retention, sub-processors and LLM training-use terms are unverified and should be first-pass diligence questions.

Integrations & partnerships — “Integration with GRC tools and ticketing systems” and an integrations marketplace (specific names not verified). The CRQ and CTEM side connects to security tools for telemetry (list not verified). MCP support unverified.

Compliance & FS traction — FS traction is claimed: Fidelity is named as a customer in Series C coverage, and Fannie Mae and S&P Global logos appear on the homepage. No hedge-fund or asset-manager case study was found. Certifications were not verified (none are listed on the pages fetched).

Commercial — Pricing not public. A free trial is offered for SAFE TPRM. Enterprise subscription otherwise (model and band unverified).

Survey note — 2026-10 CTO survey write-in: 1 respondent, not in production (evaluating), under Q55 Third-Party Risk (TPRM).

Open questions

  • Where is customer and vendor data hosted and processed? Which regions, which sub-processors, and is it used for model training?
  • SOC 2 Type II / ISO 27001 / ISO 42001 status.
  • Human-in-the-loop controls and audit trail for agent decisions in SAFE TPRM.
  • Whether the Balbix deal has closed (no close notice found), and integration status.
  • RiskLens acquisition (2023) date from a primary source.
  • Named asset-management customers; pricing bands.

Sources

History

  • [2026-10-24] Page created via wiki-create and researched the same day. Triggered by a single not-in-production write-in under Q55 Third-Party Risk (TPRM) in the 2026-10 CTO survey. Primary vendor-risk because SAFE TPRM covers both assessment workflow and outside-in monitoring. Cross-listed to enterprise-grc for its cyber-risk-quantification core. AI-SPM noted but not cross-listed (single launch release).

Graph View

Backlinks