DigitalXForce named a Leader in the 2026 IDC MarketScape for TPRM, after its 2025 Leader recognition in GRC software.
DigitalXForce, the AI-native Enterprise Trust, Risk, Security and Compliance Management (TRiSCM™) platform, today announced that it has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Software 2026 Vendor Assessment (Doc #US53007725, September 2026).
DigitalXForce brings third-party risk management, GRC and Continuous Control Monitoring onto one AI-native platform, using continuous evidence instead of annual snapshots.”
— Lalit Ahluwalia, Founder and CEO, DigitalXForce
The IDC MarketScape evaluated third-party risk management software vendors based on their current capabilities and future strategies. DigitalXForce was positioned in the Leaders category.
DigitalXForce was also positioned as a Leader in the IDC MarketScape: Worldwide Governance, Risk, and Compliance Software Vendor Assessment, 2025 (Doc #US53615325, June 2025).
Third-party risk built on evidence
Many third-party risk programs still follow the same annual questionnaire cycle. A vendor is onboarded, a questionnaire is sent, responses are reviewed, a risk tier is assigned, and the file may remain largely unchanged until the next scheduled review. The problem is that a supplier’s security posture can change long before the next questionnaire is due. DORA, NIS2 and the OCC’s third-party guidance have all increased the focus on ongoing oversight rather than relying only on periodic attestations.
Also Read: CIO Influence Interview with John Elliott, Cybersecurity Author Fellow at Pluralsight
DigitalXForce’s Automated Third-Party Risk Management with External Risk View module is designed to bring continuous evidence into that process. It ranks vendors by business impact, compliance exposure and data access so teams can focus first on the relationships carrying the greatest risk. During onboarding and review, AI-assisted document analysis reads and summarizes vendor submissions. External Risk View then monitors vendors from the outside for exposed services, misconfigurations, vulnerability exposure, breach intelligence, cyber ratings and fourth-party dependencies.
Between formal reviews, the vendor risk score can change as new external evidence appears rather than remaining tied to a point-in-time self-attestation. Material changes can therefore surface when they happen. Findings can be turned into remediation plans and tracked with the vendor against agreed SLAs through closure. Because the module operates on the same platform as DigitalXForce’s automated GRC and Continuous Control Monitoring (CCM), third-party evidence can be mapped to the same frameworks the enterprise already uses for risk and compliance reporting, connecting the external view of a supplier with the internal view of the organization’s own controls.
“A vendor questionnaire gives an answer with a shelf life of 1 day, and most third-party risk programs act on that answer for a year,” said Lalit Ahluwalia, Founder and CEO of DigitalXForce. “We built the External Risk View so that a risk team learns about a supplier’s change from evidence, not from the next year’s questionnaire. We believe being named a Leader by the IDC MarketScape in third-party risk management, one year after being named a Leader in GRC, tells us the market is moving toward the model we built the platform on.”
“Third-party risk management is moving from periodic questionnaires to continuous evidence, and the vendors pulling ahead are the ones that built AI into their operating model rather than adding it to old workflows,” said Philip D. Harris, Research Director, Governance, Risk, and Compliance Solutions, IDC. “DigitalXForce runs third-party risk on the same evidence and the same platform as its GRC and posture monitoring, which is the unified approach enterprise buyers are consolidating toward.”
One platform for trust, risk, security and compliance
DigitalXForce uses the TRiSCM category to describe a platform that brings automated GRC, security posture management and Continuous Control Monitoring into one real-time system. Controls are mapped once to 50+ compliance frameworks across 250+ technology integrations, allowing the same evidence to be reused across multiple risk, security and compliance requirements. Two proprietary AI engines, AI JedAI and XForce GPT, support automation across the platform, including control testing, risk quantification, policy generation and orchestrated remediation.
Catch more CIO Insights: How Are CIOs Aligning Technology with Workforce Agility?
[To share your insights with us, please write to psen@itechseries.com ]
