Lema AI

Every enterprise runs on vendors - the payroll processor, the analytics tool, the cloud service quietly holding customer records. And every year, security teams try to keep those vendors honest with the same instrument: a questionnaire. Lema AI, a New York cybersecurity startup that emerged from stealth in February 2026 with roughly $24 million in funding, was built on the belief that the questionnaire is theater.

"Third-party risk needs to be treated like a security problem, not a compliance checklist," says co-founder and CEO Eddie Dovzhik. "The industry is relying on manual assessments that miss real-time business context." It is a pointed critique of a market that has, for two decades, graded suppliers on paperwork rather than behavior. A vendor can hold a spotless SOC 2 report and still be a live wire inside your systems. As Lema puts it in its own bluntest phrasing: you can be fully compliant and still be completely exposed.

Lema's answer is a platform it describes as an "Agentic Risk Engineer" - an AI trained to investigate a vendor the way an elite vulnerability researcher would, rather than to read and summarize documents. Instead of asking a supplier what it does, Lema watches what that supplier can actually reach: which critical assets it touches, how data moves, and - crucially - how permissions and scope drift over time. The company claims it can produce a full assessment of a new vendor in under five minutes.

What the company actually does

The product sits on top of a simple but under-served idea: risk is not a snapshot, it is a movie. A vendor onboarded with a clean review in January can accumulate new integrations, new permissions and new access by June - a phenomenon Lema calls "risk drift" or "scope drift." Traditional tools, which reassess annually, are structurally blind to it. Lema's engine monitors continuously, combining telemetry about how a vendor is used inside the enterprise with agentic AI that validates threat scenarios and maps realistic attack paths.

That approach reframes the core question of vendor security. Where a security-ratings company asks "is this vendor compliant?", Lema asks "if this vendor is breached, what happens to us?" It is the difference between a credit score and a stress test.

Lema's founding team shares a background in Israel's elite signals-intelligence unit, and it shows in the product's offensive-security posture. The company's whole thesis inverts the usual assumption that the threat is outside the walls - your vendors, after all, are already inside.

Competitors in the space - BitSight, SecurityScorecard, UpGuard, Panorays, Whistic - largely score vendors from the outside or automate the questionnaire itself. Lema's differentiator is that it links a vendor's behavior directly to the customer's business-critical assets. "Lema is the first platform to solve this by directly linking third-party behavior to business-critical assets," says Liran Grinberg of Team8, which led the Series A.

Lema is entering a large and fast-growing category. The third-party risk management market is estimated at roughly $8 billion in 2026 and is projected to reach about $15 billion by 2030 - a crowded field of GRC suites and security-rating vendors that most buyers quietly know is due for a rethink.