On February 10, 2026, we launched Zania Autonomous Third-Party Risk Management (TPRM). It uses AI agents to carry out vendor assessment work, from intake and evidence collection to follow-ups and monitoring, while people review findings and make the final decisions.
A vendor assessment rarely stalls because nobody has assigned the task. It stalls while someone finds a report, checks whether it covers the service being purchased, or waits for an answer from the vendor. Those steps repeat across a growing vendor list.
We built Autonomous TPRM to take on that coordination and analysis. The goal is to let risk teams spend more time on the findings that need judgment and less time moving evidence between documents and inboxes.
Why we built Autonomous TPRM
A summary of a SOC 2 report is one useful input. An assessment also needs business context: what the vendor does, which data it receives, how critical the service is, and which gaps remain unresolved. Automating one task leaves the team to connect all the others.
Autonomous TPRM connects these steps in an assessment workflow that the risk team can inspect.
Zania’s agents collect evidence, review it in the context of the assessment, and coordinate follow-up requests. Reviewers can inspect the supporting sources, edit findings, and decide which risks to accept or escalate. Monitoring helps identify changes that warrant another review. A completed workflow does not remove the need for a risk owner.
Early deployment results
At launch, Zania reported the following results from early deployments:
Up to 90% reduction in manual assessment effort
Up to 80% lower cost per assessment
The ability to scale to 100% coverage across in-scope vendors without increasing headcount
These are reported early deployment results, not guaranteed outcomes. Results vary by organization, vendor mix, and assessment scope. Coverage refers to vendors included in the program; it does not mean every vendor has the same depth of review.
What the assessment workflow covers
With Zania, third-party risk teams can:
Automatically intake and scope third parties using business context, assigning risk tiers and assessment scope based on how each vendor is actually used
Collect and enrich evidence autonomously by researching trust centers, public disclosures, attestations, and regulatory sources, reducing reliance on static questionnaires
Run vendor follow-ups end to end by coordinating requests, responses, reminders, and clarifications so teams aren’t stuck chasing vendors
Produce audit-ready, defensible assessments with a complete evidence trail, clear rationale, and traceability that supports stakeholder review and audits
Maintain full human control over outcomes with configurable guardrails and approvals; teams can review, edit, override, and finalize findings, and every change is recorded in a complete audit trail
Monitor vendors continuously for material changes, triggering reassessments when evidence expires or external risk signals change
A customer perspective
“Zania’s AI agents automate the manual burdens of vendor management, significantly reducing the time and effort teams spend gathering, reviewing, and interpreting lengthy documents—an error-prone and resource-intensive process,” said Sakshi Porwal, Global CISO, Compunnel. “This shift enables GRC professionals to focus their expertise on higher-value, strategic risk activities where they deliver the greatest impact.”
Availability and next steps
Zania Autonomous TPRM became available globally on February 10, 2026.
Request a demo to see Zania in action.
See the original launch announcement for the launch details. If you are evaluating a platform, use our TPRM software evaluation guide to define a pilot using your own vendors and evidence. Read the Compunnel customer story for a closer look at its assessment workflow.
Share
