SAFE Named a Leader in the Liminal Index for Cyber TPRM

Third-party risk now changes faster than most programs can check it. Vendor estates keep growing, AI vendors have become a new category to assess, and an annual questionnaire cannot catch what changes between reviews. Buyers are moving to continuous monitoring and automated due diligence, and they are choosing vendors on that basis.

Liminal’s 2026 Index for Cyber TPRM measures which vendors are built for that shift. Liminal evaluated 87 vendors on Product Execution and Strategy and named 21 Leaders. SAFE is one of them, with the highest scores of all 21 on both: 90% for Product Execution and 89% for Strategy. It is our second consecutive year as a Leader.

On what sets SAFE apart, Liminal’s analyst note says: “Safe Security differentiates from ratings-first TPRM vendors through deep contextual correlation, continuous monitoring, and autonomous execution across the entire vendor lifecycle rather than competing primarily on external security ratings or questionnaire automation alone.”

What Sets SAFE Apart

• An agent swarm across the lifecycle. More than 100 specialized AI agents split the work across intake, due diligence, remediation, continuous monitoring, and offboarding.
• Zero-touch due diligence. Automated follow-ups, inline response validation, and remediation verification take analysts out of routine vendor cycles. One deployment onboarded and assessed more than 600 vendors in three weeks.
• One vendor record, every signal. Outside-in scanning, questionnaires, breach and leaked-credential intelligence, contract analysis, and fourth-party discovery all update the same record. SAFE reads them together instead of averaging separate scores into one number.
• Vendor risk in dollars. Third-party exposure feeds SAFE’s cyber risk quantification, so the board sees financial impact. Compliance reporting maps to SEC, NYDFS, PCI-DSS, HIPAA, and DORA.

Inside the Report

• Where Safe Security placed, and how Liminal scored 87 vendors on Product Execution, Strategy, and Market Presence
• The twelve product requirements a Cyber TPRM platform has to meet
• Buyer survey data on purchasing criteria, five buyer personas, and where demand is running ahead of adoption
• Liminal’s full analyst note on SAFE

Why This Matters

Point-in-time assessment is losing its hold on bank TPRM programs. In Liminal’s July 2026 buyer survey, 69% of banks already use continuous external monitoring as a primary or supporting control for third-party cyber risk, and 81.6% have had a strategic vendor refuse or limit a custom questionnaire in the past two years.

The bigger gap is what happens after an alert. 89.7% of practitioners rate third-party alerts and case management as a high- or medium-demand capability, yet only 35.6% have it deployed, so teams end up with more signal than workflow to act on it. SAFE’s remediation agents open issues and drive them to verified closure, so a finding becomes a fix instead of another alert in a queue.

About the Liminal Index

Liminal evaluated 87 vendors that solve the Cyber TPRM use case. Product Execution measures coverage of the required capabilities and performance against buyers’ top purchasing criteria. Strategy measures how closely a vendor’s direction tracks buyers’ priorities for the coming years. Vendors needed at least 31% on Product Execution and 33% on Strategy to qualify as Leaders. Market Presence is scored separately on company size, employee growth, leadership perception, funding, digital footprint, and media coverage.

Source: “Liminal Index Report: Cybersecurity Third Party Risk Management”, Liminal, Fall 2026.