Whistic

Primary category: vendor-risk.

One-liner — Two-sided vendor security assessment: buyers run AI-assisted vendor assessments, vendors publish proactive security profiles to a shared network — questionnaire automation as the product.

What it does — Automates the security-questionnaire loop of TPRM from both sides. Buy side: request, score, and track vendor assessments. Sell side: publish a “Whistic Profile” (SOC 2, ISO certs, CAIQ/SIG answers) once and share on demand. The Whistic Vendor Security Network claims 40,000+ on-demand vendor profiles; current positioning (2026) is AI-first — LLM-drafted questionnaire answers and automated assessment review (“Whistic AI”).

Naming / provenance — Founded 2015, Provo, Utah. No renames found.

Ownership & viability — independent, VC-backed. $35M Series B announced 2022-06-07 led by JMI Equity (Album VC, Emergence, Forgepoint, FJ Labs participating); ~$51M total. No later round or acquirer found as of 2026-07-27 — smaller war chest than category neighbors, so acquisition risk is worth watching in a consolidating TPRM market.

Positioning & differentiators — Questionnaire/assessment-exchange specialist, vs workflow suites (processunity, venminder) and outside-in ratings (bitsight, securityscorecard, black-kite). The network model (assess once, share many) and AI questionnaire automation are the differentiators; SecurityScorecard’s HyperComply buy (2025) put the ratings vendors into the same questionnaire-automation lane.

Who should choose them / anti-fit — Fits teams drowning in inbound/outbound security questionnaires who want the exchange model. Anti-fit: firms wanting full vendor-lifecycle workflow or continuous external monitoring — Whistic complements rather than replaces those.

Known weaknesses / gotchas — Narrower scope than TPRM suites; funding scale suggests possible consolidation target. AI-answered questionnaires cut both ways — your vendors’ answers may be LLM-drafted too.

Deployment & data handling — SaaS. Details unverified.

Integrations & partnerships — Unverified.

Compliance & FS traction — Unverified; no named FS customers found.

Commercial — Pricing not public; subscription, separate buy-side/sell-side packaging.

Open questions

• Any funding or M&A events after the 2022 Series B (none found ≠ none exist).
• FS/hedge-fund references.
• Depth of “Whistic AI” beyond marketing.

Sources

• Whistic announces $35M Series B (Business Wire) — fetched 2026-07-27 — supports: funding, investors, founding, network model; confidence: high
• Whistic raises $35M (SecurityWeek) — fetched 2026-07-27 — supports: independent corroboration, 40,000-profile network claim; confidence: high
• Cached: raw/sources/2026-07-27--whistic--series-b-funding.md

History

• [2026-07-27] Page created via wiki-create + researched same day (user-requested addition to vendor-risk).