There is a particular kind of corporate purgatory that begins when a company wants to hire a vendor. Procurement wants the contract. The business wants the software yesterday. Security sends an Excel file with several hundred questions. The vendor sends it back. Security asks what three of the answers actually mean. A new column appears. Nobody is happy, but everyone can prove they were busy.
Panorays, a New York and Tel Aviv cybersecurity company founded in 2016, built its business around ending that ritual. The platform gathers the vendor's answers, inspects its internet-facing systems from the outside, watches for vulnerabilities and threat signals, and asks how important that vendor is to the customer. Then it turns the mess into a rating, a queue of fixes and an audit trail.
That last part matters. The crowded security-ratings market can already tell a CISO that Supplier A looks healthier than Supplier B. Panorays' more interesting claim is that the same supplier should not receive the same verdict everywhere. A payroll processor holding employee records is not the office-coffee subscription. The software's “Risk DNA” folds the relationship, the customer's own policy and the supplier's evidence into the score. It is risk with a job description.
A score that has somewhere to go
The product begins with inventory. Panorays centralizes known suppliers and uses affiliation data to uncover companies farther down the chain - the fourth party hosting a third party, and the nth party behind that. It tiers those relationships by business impact. Next come two forms of evidence that usually live apart: a questionnaire describing controls and compliance, and an external scan describing what is visible to an attacker. AI checks supporting documents, suggests answers from prior evidence and flags contradictions. Monitoring keeps the picture from freezing on assessment day.
The operating loop
Build the supplier inventory and expose deeper dependencies.
Join questionnaires, scans, evidence and business impact.
Assign gaps, challenge findings and collaborate in one record.
Alert when posture, threats or the relationship changes.
If a vendor misses a control, the buyer can create a remediation task, set a deadline and keep the conversation inside the platform. If an outside scan finds an exposed service, the vendor can dispute the attribution or show the fix. If a breach appears in the news or on the dark web, Panorays can alert the affected customers. The score is not the final product. The shrinking to-do list is.
“Panorays gives you the cyber posture information about your vendors in black and white. This is the ammunition needed to tell the third party that this issue must be addressed.”Carl Johnson, Howden Group Holdings
The case studies are really stories about waiting
Payoneer offers the cleanest early example. Preparing for GDPR, its security team needed to review more than 200 vendors. The old process took weeks. With a customized Panorays assessment, vendors began returning results within two days and the portfolio was assessed in days. The change was procedural as much as technical: every new vendor would now start with the security team, and a purchase would not proceed before the assessment did.
TestFairy sat on the other side of the table. Its enterprise sales repeatedly stalled at security approval. The company would spend days answering a spreadsheet, only to receive the sheet again with requests for clarification. By maintaining a reusable security profile through Panorays, TestFairy reported cutting that part of its sales cycle from two months to two weeks. Same ritual, radically less retyping.
At British insurer Markerstudy, the scale problem was labor. Its program grew from roughly 200 supplier assessments a year to more than 500. The company says Panorays' continuous monitoring and AI-assisted questionnaire validation helped it avoid building an additional team, saving more than 100 work hours each week. Pinsent Masons, the law firm, described a similar outcome more bluntly: “We've actually pretty much saved a headcount.”
These are company-published customer accounts, so the numbers deserve the usual case-study discount. Still, they point to the right measure. Vendor-risk software should not be judged only by how many weak certificates or exposed ports it discovers. It should be judged by elapsed review time, vendor response rate, remediation closure and the number of capable people freed from spreadsheet archaeology.
What failed first: one machine for every scan
Panorays' own infrastructure offers a useful miniature of the customer's problem. In the beginning, the company launched a new Google Compute Engine virtual machine whenever it needed to scan and onboard a customer. For an early product, this was wonderfully direct. As the customer base grew, it became expensive, cumbersome and difficult to observe. The architecture had automated the task without designing for the system around it.
The team moved the scanning environment and customer-facing services to Kubernetes. Managed orchestration let capacity expand without engineers changing code for each wave of customers. Panorays later said it doubled its customer base in a year while keeping engineers focused on product work. The reusable lesson is not “use Kubernetes.” It is to watch for the moment a clever shortcut becomes the business's most expensive employee.
A busy market, a useful middle
Panorays competes with BitSight, SecurityScorecard, UpGuard, Black Kite, Mastercard's RiskRecon, Prevalent and suites such as OneTrust. Some began with external ratings. Others began with governance workflows and questionnaires. Everyone has moved toward the middle. Panorays' position is that the outside-in scan, internal evidence, business criticality and remediation exchange should be native parts of the same product.
That positioning has traveled well in regulated industries. Named users include Payoneer, ClearBank, AppsFlyer, Sisense, Sompo and CAPTRUST; current marketing also displays Puma, TSMC, Cimpress and Torq. Cyber-insurance MGA Onda went further, integrating Panorays into underwriting. Brokers can move from an application to a risk snapshot in hours, and applicants receive a security assessment with the quote. Onda had been maturing its own external-risk dataset. It changed course because Panorays supplied tested data and a collaborator willing to adapt it to insurance decisions.
The company has raised $62 million in publicly announced rounds: $5 million in 2018, $15 million in 2019 and a $42 million Series B led by Greenfield Partners in 2021. The last round followed a fivefold revenue increase since the end of 2019. Co-founder Demi Ben-Ari offered an unfashionable rationale at the time: the company preferred methodical, organic growth to raising for a valuation it might later have to defend.
Now make the risk speak CFO
In 2026, Panorays pushed beyond the letter grade. Its Cyber Risk Quantification module estimates annual financial exposure across supplier outages, data leaks, fraud and supply-chain attacks. The inputs already sit in the platform: posture, evidence, threat signals and the role of the supplier. The result is designed for a board conversation that “Vendor X is a 72” cannot carry. A dollar estimate can still be wrong, but at least everyone knows what is being argued about.
The AI story has acquired guardrails, too. Panorays earned ISO/IEC 42001 certification in 2025 for its AI management system, alongside ISO 27001 and SOC 2 Type II controls. In 2026 it introduced Panorays Axis, a remote MCP server through which approved AI tools can work with tenant risk data. This is the company following its own thesis: automation is useful when policy, provenance and human responsibility travel with it.
What a buyer can copy - and where it breaks
- Tier suppliers by business impact before choosing the depth and frequency of the review. Equal diligence is not efficient diligence.
- Compare self-reported controls with external evidence, then give vendors a clean way to challenge attribution and prove remediation.
- Measure cycle time and closed gaps, not the quantity of alerts generated.
- Keep the assessment attached to onboarding, renewal and incident workflows so it can change a decision.
- This approach underperforms when the vendor inventory has no owner, risk policy is vague, or nobody has authority to insist on a fix. Software can organize the chase. It cannot supply institutional nerve.
Panorays is not a magic shield around the supply chain. External scans can misattribute shared infrastructure. Questionnaires can still contain polished fiction. Financial models can make uncertainty look tidy. And a small company with twelve low-risk vendors may need a disciplined spreadsheet more than an enterprise platform with custom pricing.
But for a regulated business with hundreds of suppliers, the status quo is stranger than the cure: annual evidence that begins aging the moment it arrives, scattered email threads, and security staff repeating detective work another customer already did. Panorays' bet is that a vendor relationship should have a living security record. The useful part is not the panorama. It is knowing where to look next.