ProcessUnity wants to end the questionnaire pileup

A supplier can spend Monday answering a security questionnaire and Tuesday answering almost the same questionnaire for somebody else. Across the table, two risk analysts wait for documents that already exist. This is the small absurdity at the center of ProcessUnity’s business: every organization wants independent reassurance, but much of the work required to obtain it gets repeated.

ProcessUnity sells cloud software to the procurement, cybersecurity and compliance teams living inside that loop. Its proposition has two parts. Make the review process orderly. Then reduce how much evidence everyone must collect afresh. The second part became much more substantial when ProcessUnity acquired CyberGRX in July 2023.

01 The queue is the clue

Third-party risk management sounds abstract until a useful vendor cannot get approved. Procurement wants the relationship moving. Security wants proof that customer data will be handled properly. Legal needs the contract settled. When those requests travel through separate spreadsheets and inboxes, the supplier becomes the courier between departments.

ProcessUnity’s platform gives that work a common record. Teams can register a vendor, judge its inherent risk, scope due diligence, assign reviews, track outstanding issues and keep monitoring after the contract is signed. Its no-code configuration lets administrators adjust workflows without treating every process change as a software-development project.

There is a practical distinction here. Completing a questionnaire records an answer. Resolving an issue requires an owner, a deadline and a decision. ProcessUnity sits in the space between the two. Its expertise is the machinery of risk programs: routing evidence, maintaining control libraries and making the next action visible.

02 Buy the evidence, connect the work

Co-founder Todd Stone started ProcessUnity in 2003 and handed the CEO role to Cronin in 2019. Long Ridge had taken a majority stake in 2018; Marlin Equity Partners made a majority-control investment in 2021. That history matters because this is an established software business adding data and AI to an existing workflow. Its advertised values include trust, curiosity and teamwork, all sensible requirements when departments must share uncomfortable findings.

The CyberGRX acquisition supplied the other half of the idea. ProcessUnity already organized reviews; CyberGRX operated a shared cyber-risk assessment exchange. Combining them put reusable vendor intelligence beside the workflows where people could act on it. The announced transaction left existing CyberGRX shareholders with a minority stake.

CEO Sean Cronin described the combination as bringing “program workflow, validated vendor assessment data and artificial intelligence in a single solution.” It was a specific architectural bet: a workflow becomes more useful when relevant evidence is already waiting inside it.

The current Global Risk Exchange page describes more than 18,000 control attestations and over 370,000 vendor profiles. Those are different measures. A profile does not mean a completed, attested assessment exists for that vendor. Buyers still need evidence that fits the service, its access to information and the date of the review.

This combination helps locate ProcessUnity in a crowded market. Aravo and OneTrust offer alternative third-party risk platforms. Broader GRC suites also compete for the work. ProcessUnity’s pitch centers on joining configurable workflows, shared assessments and AI. Bitsight illustrates the market’s overlapping roles: its security intelligence can feed ProcessUnity through an integration.

03 200 tickets become 75

The customer evidence gets interesting at ICON, the clinical research organization. A GRC 20/20 case study describes cumbersome supplier questionnaires and inconsistent risk calculations. Surveys arrived in sequence; legal review followed. The process consumed time across departments while business-critical services waited to become available.

ICON used ProcessUnity to support a common supplier-management approach, including procurement and contract portals. The case study reports monthly procurement support tickets falling from 200 to 75 after implementation. Staff also used recurring ticket patterns to create training materials. Fixing the queue generated information about why the queue existed.

That is a more useful buying signal than an unqualified promise of speed. It describes a particular process and a visible outcome. ProcessUnity’s other public customer references include Accenture, Live Nation Entertainment, Abercrombie & Fitch and VyStar Credit Union. The common thread is the coordination problem, rather than a single industry.

04 Give AI a small job

ProcessUnity now offers Assessment Autofill, which uses submitted documentation to prepopulate assessments, and Evidence Evaluator, which helps review supporting material. Its task-specific agents tackle jobs such as detecting duplicate vendors and drafting remediation instructions. Human review remains part of the design, with oversight configurable to the program.

That restraint matters. A document can support a control without settling whether a particular relationship is acceptable. An AI draft may accelerate the conversation, but someone must still accept the exposure, demand a fix or stop the purchase. In October 2026, ProcessUnity announced ISO/IEC 42001 certification for its AI management system within a defined product scope. Certification addresses governance; it does not guarantee every answer.

For suppliers, the exchange offers a different incentive: maintain an assessment that can serve multiple customer requests. Its walkthrough documentation describes customer approval before access to assessment data. That permission step is easy to overlook in the enthusiasm for reuse. Sharing evidence needs a boundary as well as a shortcut.

Reuse the document.
Keep the responsibility.An editorial takeaway

05 The useful thing to copy

The commercial model is enterprise SaaS and risk-data services, with implementation and partner support around them. Pricing plans sit behind an inquiry form. A published Bitsight connector datasheet also specifies an annual connector fee and a separate Bitsight subscription. Buyers should budget for the complete workflow, including integrations and the people maintaining it.

The approach pays off when repeatable reviews consume scarce attention and departments agree on ownership. It becomes less helpful when evidence is stale, the exchange lacks relevant coverage or nobody owns remediation. A small vendor portfolio may need less machinery. Even without buying the software, a team can copy the discipline: keep one vendor record, reuse current evidence, scale the review to the exposure and assign the next action. Count unresolved issues alongside completed forms.