RiskXchange The Agency (32 AI agents for third-party risk)
Vendor: RiskXchange · HQ: United Kingdom · Category: Risk · Security
Last verified · Added · 4 sources · How we verify
Vendor? Get your “Listed on Agent Index” badge
What it does
RiskXchange is a London-headquartered TPRM and security-ratings platform. The Agency is its AI agent workforce: five lead agents, each commanding sub-agents. NOVA (AI Vendor Relationship Manager) runs outreach, onboarding, questionnaire collection, follow-up, renewal and offboarding and is the only agent that communicates with vendors; REX (Risk & Breach Intelligence) scans vendors from the outside and owns continuous monitoring, breach detection and material-change alerts; ARIA (Assessment & Risk Intelligence) reads the documents vendors supply, and its findings are reconciled with REX's into one combined view; TARA (Tiering, Assessment & Remediation) analyses regulatory compliance gaps and assigns remediation; VANCE (Vendor Analysis & Compliance Engine) composes the reports. Autonomy is set per supplier: in Manual mode people do the work; in Assisted mode agents prepare every email, score and remediation task and queue it for approval; in Autonomous mode agents run approved workflows without per-action approval and humans are notified. Framework pages cover DORA, NIS2, ISO 27001, APRA CPS 230, NIST CSF, Cyber Essentials Plus and SOC 2. RiskXchange publishes annual platform tiers (see pricing); its pages don't say which tiers include The Agency.
Frameworks
No framework tags verified yet.
Vendor-claimed DORA, NIS2, ISO 27001, APRA CPS 230, NIST CSF, Cyber Essentials Plus, SOC 2
Pricing (as published)
Platform tiers published: Essentials GBP 14,900/year (50 vendors), Professional GBP 31,500/year (150 vendors), Enterprise from GBP 75,000/year; unlimited seats, no setup fee. The pages don't say which tiers include The Agency.
Tasks
vendor riskquestionnaire automationrisk assessmentremediationsecurity ratings
Sources
Last verified 19 Oct 2026. Framework tags indicate relevance, not certification; “vendor-claimed” items are as marketed by the vendor. Spotted an error? Submit a correction or email sales@heritageservices.online. See our methodology.
Use-case comparisons
- TPRM and vendor-risk AI agents — 23 verified listings (Third-party risk, vendor assessments, security ratings and questionnaire automation)
- Security questionnaire AI agents — 7 verified listings (Inbound security questionnaires, SIG/CAIQ-style responses and questionnaire automation)
Compare RiskXchange The Agency (32 AI agents for third-party risk) with
Alternatives
-
AiPrise AI agents (AML Agent, Website Agent and Document Agent) — KYC/KYB and compliance platform whose AI agents review AML screening hits (sanctions, PEP, adverse media) and recommend a decision under the customer's AML policy, check business websites for legitimacy and risk with ongoing monitoring, and review documents, with an analyst confirming the outcome. -
BigID — Enterprise data security and DSPM platform for discovering, classifying and governing sensitive data including AI data risk use cases. -
Black Kite AI Agent — Third-party cyber risk agent made of sub-agents (Assessment, Incident Response, Threat Actor Intelligence, Investigation, Prioritization, Procurement) that assess vendors, investigate exposures, trigger rescans and draft outreach. -
Bretton AI agentic back-office platform (formerly Greenlite AI) — Agent platform for bank and fintech financial-crime operations: pre-built and custom agents gather evidence, apply the institution's policy and draft full cases for EDD, monitoring alerts, sanctions, SAR drafting and KYB, with every action logged. - Castellum.AI Arbiter AI agents (alert resolution, transaction and fraud monitoring agents) — AML/KYC agents that resolve L1 and L2 screening alerts (sanctions, PEPs, adverse media) against the institution's own policies, plus transaction-monitoring and fraud-monitoring agents, with a documented rationale for every decision.
- CLEAR Investigate (agentic AI investigations for government, risk and fraud teams) — Agentic investigation tool built on Thomson Reuters CLEAR public-records data. From a plain-language question it plans and runs searches across CLEAR data and the open web, resolves conflicting records and returns concise cited findings with a record of the searches it ran, for AML, fraud, program-integrity and law-enforcement investigators.
See all RiskXchange The Agency (32 AI agents for third-party risk) alternatives →
Stay updated
We use your email only to send the newsletter. See our privacy policy.