Riskey
2025
Why
Continuous AI-driven vendor risk monitoring.
Vanta
Automated Security ComplianceFounded 2018- HQ today: San Francisco, California, United States
Reviewed by Swet Parvadiya
Company data updated: October 2026
Acquisitions
Vanta Acquisitions
3
Major Deals Covered
What are Vanta's biggest acquisitions?
This page covers 3 major deals from 2023 to 2025, each with its price where disclosed and the reason behind it.
- Major deals covered
- 3
- First deal
- 2023
- Most recent
- 2025
| Company | Year | Price | Purpose |
|---|---|---|---|
| Trustpage | 2023 | Undisclosed | Security reviews and trust centers. |
| Riskey | 2025 | Undisclosed | Continuous AI-driven vendor risk monitoring. |
| Questionnaire AI Automation Tech Assets | 2024 | Undisclosed | Acquired specialized NLP questionnaire completion and security review automation algorithms. |
- What companies has Vanta bought?
- Major acquisitions by Vanta documented here include Riskey (2025), Questionnaire AI Automation Tech Assets (2024) and Trustpage (2023).
- What is Vanta's most recent acquisition?
- The most recent Vanta acquisition documented here is Riskey, in 2025.
Questionnaire AI Automation Tech Assets
2024
Why
Acquired specialized NLP questionnaire completion and security review automation algorithms.
Impact
Automated up to 90% of lengthy enterprise vendor security questionnaires using historical audit evidence.
Outcome
Integrated directly into Vanta AI vendor risk assessment workflows.
Trustpage
2023
Why
Security reviews and trust centers.
Vanta's Growth & Acquisition Strategy
Vanta grows by selling more frameworks and modules to existing customers, moving upmarket into larger companies, and adding products around the audit itself: Trust Center, security questionnaire automation, vendor risk management and AI agents. It has also bought small companies (Trustpage in 2023, Riskey in 2025) to fill product gaps.
How Vanta Makes Money
Vanta sells annual software subscriptions. Price depends on company size, the number of compliance frameworks a customer needs and which modules it adds, such as Trust Center, questionnaire automation and vendor risk management. Vanta does not publish a price list; deals are quoted by sales. Customers start with one framework, usually SOC 2, and spend more as they add ISO 27001, HIPAA or other frameworks and extra products.
Vanta Acquisitions FAQ
What was Vanta's first significant corporate acquisition?
In January 2023, Vanta acquired Trustpage, an innovative security trust center startup founded by Chase Lee that helped companies publicly publish and manage their security documentation.
Why was the Trustpage acquisition strategically critical for Vanta?
Trustpage transformed Vanta from an internal audit preparation tool into a customer-facing sales enablement platform, allowing Vanta customers to replace 100-page security questionnaires with live, interactive Trust Centers.
How did Vanta integrate Trustpage's team and technology?
Trustpage's software was redesigned and fully integrated into Vanta's core platform as "Vanta Trust Center," and founder Chase Lee and his engineering team joined Vanta to lead trust management product development.
What did the acquisition of Riskey in 2025 add to Vanta?
In 2025, Vanta acquired Riskey, a specialist vendor risk intelligence platform, strengthening Vanta's third-party Vendor Risk Management (VRM) module with automated risk scoring and continuous threat telemetry.
How does Vanta utilize M&A to outpace competitors in product breadth?
Rather than spending years building non-core modules from scratch, Vanta selectively acquires fast-moving niche startups with proven customer traction, folding their features into Vanta's unified subscription.
What role does AI play in Vanta's technology tuck-ins?
Vanta acquires specialized AI talent and natural language processing IP to power its automated questionnaire answering engine, enabling semantic matching of complex enterprise security questions.
How does Vanta evaluate potential acquisition targets?
Targets must offer high product synergy, native API integrations, high-velocity engineering talent, and features that directly accelerate deal velocity or automate tedious GRC tasks for customers.
Why does Vanta avoid buying legacy GRC software companies?
Legacy GRC vendors rely on outdated on-premise architectures and manual consulting; Vanta focuses strictly on modern cloud-native, API-first SaaS platforms aligned with continuous monitoring.
How does Vanta retain founders and key engineering talent post-acquisition?
Vanta provides acquired founders with significant product ownership, integrating them into senior engineering and product management leadership with competitive equity retention packages.
How has Vanta's acquisition strategy expanded its total addressable market (TAM)?
By moving beyond core compliance audits into buyer trust centers, vendor risk reviews, and AI questionnaires, Vanta expanded its TAM from $5 billion in audit automation to over $25 billion in total GRC and trust management.
What is Vanta's approach to partnering versus acquiring in adjacent sectors?
Vanta partners with specialized pentesting firms, cybersecurity insurance brokers, and CPA firms via its ecosystem marketplace, reserving acquisitions for proprietary SaaS workflows.
What is Vanta's future M&A outlook leading toward an IPO?
Armed with strong cash reserves and a $4.15 billion valuation, Vanta will continue making selective tuck-in acquisitions in AI governance, data privacy automation, and enterprise risk analytics.
Related M&A Histories
Compare corporate acquisition records, deal values, and strategic targets
Explore Vanta
Core profile pages, founders and related research hubs for this company.