Panorays

Panorays provides a third-party cyber risk management (TPCRM) platform for organizations that need to understand and control risk across vendors, suppliers, service providers, and deeper supply-chain relationships. The product combines cyber-posture ratings, business-impact context, internal questionnaires, external attack-surface assessment, relationship mapping, continuous monitoring, and remediation tracking. Its current product material describes AI-assisted questionnaire completion, document and certification analysis, third- and nth-party discovery, threat-signal prioritization, and an incident-response portal. This is a workflow and intelligence layer around vendor risk, not an endpoint, network, or offensive-security product.

The commercial problem is concrete: large organizations cannot manually reassess every supplier at the same frequency, yet point-in-time questionnaires and generic security ratings can miss the business context that determines whether an exposure is material. Panorays says its platform applies each customer's risk policies and "Risk DNA" to prioritize vendors, tailor assessments, expose hidden dependencies, and route issues toward remediation. The addressable market benefits from regulatory and operational-resilience pressure, cloud concentration, outsourcing, and increasingly complex software supply chains. The buyer set can span CISOs, third-party risk teams, procurement, legal, privacy, internal audit, and business owners, which creates both cross-functional value and a potentially difficult enterprise sale.

There are credible commercialization signals, but the public record does not establish revenue, retention, contract value, or independently verified market share. Panorays identifies enterprise customers and case-study participants on its site, including Puma, Cimpress, Torq, AppsFlyer, TSMC, Markerstudy, and Howden Group Holdings; those references are useful evidence of target-market engagement but should not be treated as proof of scale. LinkedIn lists the company as privately held, founded in 2016, headquartered in New York, with a 51–200 employee range and additional locations including Tel Aviv and London. The company also publicly lists institutional investors and security-industry advisors, while the exact current financing stage and total capital remain undisclosed in the sources reviewed.

Competition is substantial. SecurityScorecard, BitSight, UpGuard, Black Kite, ProcessUnity, OneTrust, and larger GRC or security-platform vendors cover overlapping combinations of ratings, questionnaires, monitoring, and workflow. Panorays' differentiation is therefore more likely to come from integration quality, relationship-specific scoring, nth-party visibility, remediation adoption, data coverage, and customer trust than from a single protected technical invention. The company states that it is certified to ISO/IEC 42001:2023 and ISO/IEC 27001:2022 and has completed a SOC 2 Type II review; these are relevant assurance signals, but diligence should verify scope, dates, auditor documentation, data lineage, and how AI outputs are tested in production.

The defense and national-security case is substantive but indirect. Supplier assurance, software and cloud dependency mapping, continuous monitoring, and remediation accountability are relevant to defense primes, critical infrastructure operators, government contractors, and other sensitive ecosystems. Panorays could help a security organization prioritize vendors and subcontractors whose compromise would create operational or mission risk. There is no reliable public evidence in the reviewed sources of defense contracts, classified deployments, or a product designed specifically for military operations, so the dual-use thesis should remain defensive, procurement-oriented, and conditional on integration, data quality, and buyer requirements.