Vendor Risk Management Software
Bitsight review
Security-ratings company that sells outside-in cyber risk scores and a third-party risk management product built on them.
Bitsight at a glance
- Category
- Vendor Risk Management Software
- Starting price
- Contact sales
- Pricing model
- custom
- Public pricing
- No
- Free plan
- No
- Free trial
- No
- Contract
- annual (not verified)
- G2 rating
- 4.5 (76 reviews)
- Founded
- 2011
- Headquarters
- Boston, US
- Employees
- about 740 (2026 estimates; range 515 to 914 across trackers)
- Funding or owner
- Venture backed; bought Cybersixgill for $115M (announced Nov 2024)
Buying Bitsight: security, admin and contract
- Contract
- Annual (not verified)
Questions to ask Bitsight before you sign
- Which plan includes SAML SSO, and what does it cost for our seat count?
- Is SCIM provisioning included, or a paid add-on?
- Which plan includes audit logs, and how long are they kept?
- Where is our data stored, and can we choose the region?
- Can we sign your standard DPA without changes?
- What will the price be at renewal, and is the increase capped?
Questions are listed where Bitsight's public pages leave the answer open.
Who Bitsight is for
Choose Bitsight if
- Teams that want outside-in security ratings to monitor many vendors continuously.
- Security-led TPRM programs with a dedicated analyst.
Look elsewhere if
- Small teams that only need questionnaires and a vendor register.
- Buyers who want a published price.
Bitsight pricing
Bitsight does not publish a price list; pricing is quoted on request.
Vendr buyer data: average contract value about $34,010 across 36 deals, range roughly $650 to $80,000 (vendr.com/buyer-guides/bitsight, checked 2026-10-24). SpendHound: about $21,126/yr for SMB, about $147,732/yr for enterprise (spendhound.com/marketplace/bitsight-pricing). A competitor page says monitoring and assessments are licensed separately (upguard.com, biased source).
Bitsight features by buying criteria
| Criterion | What we found |
|---|---|
| Continuous monitoring | Core product: external security ratings monitored continuously. |
| Pricing / add-on | Quote only; monitoring and assessment modules reportedly licensed separately. |
What reviewers say about Bitsight
Praised for
- Rating gives a fast read on a vendor's security posture.
- Scans cover a wide range of external signals.
Common complaints
- Score updates can lag after a vendor fixes issues.
- Some reviewers miss features.
- Pricing escalates when adding monitoring and assessment modules (per competitor claims)
Themes paraphrased from public reviews on G2 and similar sites, not quotes.
What most Bitsight reviews leave out
- Vendr buyer data shows a wide contract range ($650 to $80,000), so quotes depend heavily on number of monitored vendors.
- Cybersixgill acquisition (announced Nov 2024, $115M) adds dark web threat intel to monitoring.
- The rating is outside-in only: it sees internet-facing assets, not internal controls, so it complements questionnaires.
- G2 lists it under Third Party and Supplier Risk Management, not as a GRC platform.
Bitsight alternatives
SecurityScorecardSecurity teams that want outside-in continuous monitoring of many vendors.Contact sales- UpGuardMid-size security teams that want published entry pricing for vendor risk.$1,750 per month, billed annually
PanoraysSecurity teams monitoring a vendor base with outside-in cyber scoring.Contact sales
Mitratech PrevalentMid-market and enterprise risk teams running structured vendor assessment programs.Contact sales
VenminderBanks and credit unions needing examiner-ready vendor due diligence.Contact sales
DrataCompanies already using Drata for compliance that want vendor risk in the same system.Contact sales
Sources
Every fact on this page comes from Bitsight's own pricing, product or documentation pages, G2 and company records, checked on October 24, 2026. Unknown values are left out instead of estimated.