Lema

Lema sells an agentic third-party risk management and supply-chain security platform for security, risk, procurement, and compliance teams. Its stated thesis is that a vendor can satisfy a questionnaire and still expose an organization through a vulnerable product, excessive permissions, risky data flows, or changes in public commitments. The platform is organized around three capabilities: forensic AI assessment of vendor documents and security artifacts; open-source reconnaissance across public technical, legal, and security information; and blast-radius monitoring of how a third party connects to an organization's assets, data, identities, and business processes. The Agentic Risk Engineer framing is important because it describes an investigation workflow, not just a language-model chat interface: Lema aims to correlate evidence, validate vendor claims, surface a concrete threat scenario, and recommend remediation.

The product addresses a real operational gap in conventional TPRM. Static questionnaires and security ratings are useful for intake and reporting but can be slow, dependent on vendor assertions, and weak at representing the customer's actual exposure. Lema's public integration catalog shows a practical enterprise deployment model: it can ingest cloud-security findings from Wiz, identity and permission data from Okta, Microsoft Entra ID, and Google Workspace, application activity from Netskope, procurement records from tools such as Ramp, Zip, Vendr, Asana, and OneTrust, and route findings into Jira or ServiceNow. The commercial value proposition is faster vendor review, continuous detection of scope drift, and better prioritization of remediation. Public customer testimonials on Lema's site describe time savings and an increase in the number of vendors actively monitored, but those statements are marketing evidence rather than independently audited performance data.

Lema operates in a crowded market that includes security-rating providers, questionnaire and GRC platforms, vendor-risk specialists, and broader ITSM suites. SecurityScorecard, BitSight, UpGuard, Panorays, Whistic, OneTrust, ServiceNow, and AuditBoard represent relevant competitors or substitutes, although they do not all offer the same combination of technical evidence, relationship mapping, and agentic investigation. Lema's differentiation is therefore a product and execution claim that must be tested in diligence: whether its agents discover material risks that incumbent workflows miss, whether findings are reproducible and evidence-backed, and whether integrations provide enough context to model actual blast radius rather than simply produce another vendor score. The company says it is not a generic GRC or security-ratings product, which sharpens its positioning but also concentrates the burden of proving a distinct category.

Public reporting provides meaningful but limited commercialization signals. Calcalist reported in February 2026 that Lema raised a $17.5 million Series A led by Team8 after an approximately $6.5 million seed led by F2 Venture Capital with Salesforce Ventures participating. The same report described a team of about 35 people, with offices in New York and Israel, and stated that the platform analyzes supplier activity, sensitive-asset access, data movement, and permission changes. Lema's own website names co-founders Eddie Dovzhik, Tomer Roizman, and Omer Yehudai and displays customer references including Klaviyo, SCI, Well Health, OPENLANE, AlphaSense, Cresta, and Delta Dental. These are useful traction signals, but the database should not infer revenue, retention, certification, contract size, or broad product-market fit from them. The company remains an early-stage private startup scaling product, sales, integrations, and trust infrastructure.

The strategic and dual-use case is credible but indirect. Third-party compromise is a shared problem for enterprises, critical infrastructure operators, and government organizations, and a system that maps supplier access, detects scope drift, validates security evidence, and produces actionable remediation can strengthen cyber resilience in those environments. The same technology could support defense supply-chain assurance, contractor risk review, and protection of sensitive data dependencies, subject to procurement, data-residency, and deployment constraints. There is no public evidence here of defense customers or government contracts, so the relevance should be treated as capability adjacency rather than demonstrated defense adoption. The central diligence questions are model reliability, false-positive and false-negative rates, evidence provenance, handling of sensitive vendor and identity data, customer willingness to connect privileged systems, and whether the company can sustain accurate monitoring as the vendor graph changes.