RiskXchange Launches The Agency: An AI Workforce for Third-Party Risk

RiskXchange Launches The Agency: An AI Workforce for Third-Party Risk

32 specialised AI agents work as one TPRM team, executing the vendor lifecycle end-to-end and moving third-party risk management from AI-assisted to agentic.

London, 1 October 2026 - RiskXchange, the London-based third-party risk management (TPRM) and cyber risk intelligence provider, today announced the launch of The Agency, an AI-native TPRM platform built around 32 specialised AI agents working together as a single risk team. The Agency executes work across the entire vendor lifecycle - onboarding, scanning, assessment, continuous monitoring, remediation, compliance reporting and offboarding - against the framework each customer operates to.

For years, TPRM has remained heavily dependent on spreadsheets, questionnaires, vendor chasing, manual scoring and point-in-time assessments that can become outdated soon after completion. While AI has increasingly been added to these workflows to assist human analysts, The Agency is built around a different model: AI agents that execute the work itself, continuously, with the organisation deciding how much autonomy to give them.

32 AI Agents. One TPRM Team.

Five lead agents each own a defined domain of the vendor lifecycle, supported by 27 sub-agents that execute granular tasks and hand work to adjacent agents as needed.

NOVA manages vendor lifecycle entry and exit, including intake, discovery, firmographics and automated chasing across email, WhatsApp and in-app chat.

ARIA delivers document and questionnaire intelligence, including questionnaire pre-population and on-demand combined-signal reporting.

REX provides continuous outside-in scanning and external risk intelligence across digital footprint, breach feeds and fourth parties.

TARA handles continuous monitoring, smart risk tiering, treatment and SLA tracking, remediation and DORA gap analysis.

VANCE produces board-grade regulatory and compliance reporting from live data, on demand, with an immutable audit trail.

"Third-party risk doesn't have an AI problem. It has an operating model problem. For fifteen years, the industry has relied on questionnaires, spreadsheets and periodic assessments - and adding a chatbot to that workflow doesn't fundamentally change it. The next evolution of TPRM isn't AI that helps people do the same work faster. It's AI agents capable of doing the work continuously, with humans deciding where and when they want control. That's the shift The Agency represents: from AI-assisted to agentic TPRM."

Darren Craig, Founder and CEO, RiskXchange

Measurable impact from day one

The Agency is designed to turn automation into measurable operational outcomes. ARIA pre-populates up to 94% of questionnaire answers against 157 Universal Controls, allowing teams to review responses rather than type them. NOVA eliminates up to 85% of manual effort across onboarding, follow-up chasing and offboarding. TARA maps vendors against DORA, NIS2, ISO 27001, NIST, SOC 2 Type II and other frameworks, producing a gap analysis and remediation roadmap in under 24 hours. REX monitors the external attack surface 24/7, drawing on intelligence covering more than 5 million companies.

Autonomy without giving up control

Customers can choose how The Agency operates and change the level of autonomy at any time. In Manual mode, agents are inactive and the team operates the platform as normal. In Assisted mode, agents draft and recommend, with every action requiring explicit human approval. In Autonomous mode, agents operate end-to-end and notify the team of outcomes.

"Risk doesn't operate quarterly, so risk management can't either. A supplier's exposure can change overnight. The future of TPRM is continuous - continuously assessing, monitoring and responding as risk changes."

Darren Craig, Founder and CEO, RiskXchange

Built for regulated industries

The Agency supports DORA, NIS2, ISO 27001, NIST CSF, PCI DSS, SOC 2 Type II, APRA CPS 230, ADHICS, GDPR, FCA requirements and UAE regulations. Reports are generated from live data rather than quarterly snapshots.

Pick ten vendors. See what The Agency finds.

The Agency is available from today. RiskXchange is inviting organisations to select ten vendors and deploy The Agency against them. Each organisation receives a sample SnapShot, a REX brief and a DORA gap report based on real vendor data before making any commitment.

Alisha Ramasar
RiskXchange
Email: alisha.ramasar@riskxchange.co
Telephone: +27 79 579 5758
344 Gray's Inn Road
London
England
WC1X 8BP
United Kingdom

Important: openPR specifically says this section must include the company's full postal address, otherwise they may not publish it. 

This release was published on openPR.