The Proactive Vendor Security Platform

What do you like best about the product?

Whistic has streamlined our vendor risk assessment process by providing a centralized platform for security questionnaires, compliance documentation, and third-party risk reviews. The platform reduces manual effort, accelerates due diligence, and improves transparency when evaluating vendors and responding to RFP requirements. Its standardized approach helps ensure consistent assessments while giving stakeholders quick access to security and compliance information.

What do you dislike about the product?

One drawback of Whistic is that its effectiveness relies on vendor adoption. For vendors that do not maintain current profiles or participate in the platform, organizations may still need to conduct manual security reviews and follow-up assessments.

What problems is the product solving and how is that benefiting you?

Whistic solves the challenge of efficiently managing third-party risk assessments and security due diligence by providing a centralized repository of vendor security, compliance, and privacy documentation. Instead of relying on lengthy email exchanges and manual questionnaires, our team can quickly review vendor security posture, obtain evidence, and complete risk assessments through a standardized process. This benefits us by reducing the time and effort required for vendor reviews, improving consistency across assessments, accelerating procurement and RFP processes, and providing greater visibility into our third-party risk landscape.

What do you like best about the product?

We initially started with spreadsheets, then moved to a VRM tool, and eventually transitioned to Whistic. Since making that switch, Whistic has noticeably improved our workflow and made the process feel more streamlined. I would suggest using the ai features of Whistic to truly take advantage of the application. Vendor Summary and SOC 2 Summary along with Next Assessment are really tremendous features.

What do you dislike about the product?

The Bulk Assessment was not ideal as Active and Inactive vendors are selected as eligible for the bulk send. The only way to send to just Active is to manually click each vendor. I have requested upgrades to this feature.

What problems is the product solving and how is that benefiting you?

We struggled with sending assessments on a cadence. Next Assessment allows for me to send on an automated schedule which helps keep us in compliance.

What do you like best about the product?

Automation and the AI capabilities. The onboarding set up was great. Whistic's support team is responsive and helpful if any issues ever arise. Both reps we have had been great.

What do you dislike about the product?

With the speed that the platform is expanding, sometimes features are a bit buggy.

What problems is the product solving and how is that benefiting you?

Whistic is helping us to enhance and modernize our TPRM program. Right now the program is manual in Excel, and we have a lot of vendors to keep track of. Whistic is helping us catalogue, assess, and organize our library.

What do you like best about the product?

I like using Whistic's Trust Center because it saves me time by reducing interactions with documentation requests. I can just direct people to the Trust Center and let them find what they need. I also appreciate the vendor approval process feature as it consolidates everything in one place, so I don't have to use other tools to involve my approvers. It's efficient for managing high-level vendors that require secondary approval.

What do you dislike about the product?

When I am doing vendor assessments, most Trust Centers for our vendors require an NDA to be signed. This is a blocker for the AI document retrieval features. I'm looking forward to seeing how Whistic finds a way around this.

What problems is the product solving and how is that benefiting you?

Whistic helps us track vendor assessments and automate the approval workflow. The Trust Center saves time by reducing documentation requests, and the approval process centralizes communication, eliminating the need for other tools.

What do you like best about the product?

I find Whistic easy to search and see potential for many more service providers to be connected to it. I appreciate the overview of relevant SOC-2 reports, periodic security assessments, and information security policies that can all be found in one place. It is easy to install and I am glad that there is multi-factor authentication (MFA) on the website login.

What do you dislike about the product?

I see a number of our other suppliers and I don't know how to request the same insight. A quick video tour of the solution would be great. I see many areas that I haven't explored yet. It would be nice to understand the why and usability of those functionalities.

What problems is the product solving and how is that benefiting you?

I use Whistic to verify vendor assessments and reports. It gathers all the latest versions of documentation in one place and allows us to view relevant SOC-2 reports and security assessments. Vendors manage their information better with watermarks on downloaded files.

What do you like best about the product?

Whistic’s customer service is top-tier. They are very personable, clearly explain concepts, and swiftly offer solutions.

What do you dislike about the product?

“Dislike” is a strong term here, but the Knowledge Base could be more organized. The ability to create folders would be very helpful.

What problems is the product solving and how is that benefiting you?

Our TPRM program used to be endless spreadsheet reviews. Managing those was time consuming and it was difficult to review legacy information. Sharing our security documentation and an endless email tag among internal teams and the customer. Whistic allows us to amalgamate resources and automate permissions.

What do you like best about the product?

Whistic is relatively easy to use from both the analyst perspective, as well as the vendor's perspective. The AI works very well when vendor's submit adequate documentation and answers are well supported with accurate sources. This tool has helped our organization produce faster risk assessment results, improve risk outcomes, and support continuous monitoring across the entire vendor portfolio. Whistic's customer support team is also an extremely valuable resource to our organization.

What do you dislike about the product?

Since Whistic doesn't allow domain level risk assessments, the process to gather evidence and sequence it to run the AI is manual, which can lead to errors.

What problems is the product solving and how is that benefiting you?

Implementation of AI within the organization.

What do you like best about the product?

Very thorough and well thought through product -- both on the evidence vault and the vendor assessment components

What do you dislike about the product?

Need to stay current with the "table stakes" offered by their competitors, such as the public trust profile, the continuous monitoring of vendors, etc.

What problems is the product solving and how is that benefiting you?

3rd party vendor management, evidence vault of auditors who do not have their own vault, and finding out where certain controls live in our policies and procedures

What do you like best about the product?

The vendor catalog is a tremendous time saver for due diligence. It gives me the ability to quickly find and search some of our key indicators.

What do you dislike about the product?

Simpler access to trust catalogs. It may be more of a responsibility of the vendors themselves, but we all need a standard NDA or agreement that allows us to share critical information with each other faster.

What problems is the product solving and how is that benefiting you?

Quick and fast supplier/vendor assessments for due diligence and continuous monitoring.

What do you like best about the product?

Compared to other TPRM solutions, Whistic is very easy to use and saves a ton of time on assessments. Their Trust Catalog model includes a lot of vendors and their security documents to streamline the assessment. For vendors who haven't contributed, it's easy to send requests and questionnaires based on many different assessment frameworks. The AI features allow you to upload audit reports and security documents of any kind and assess them against the framework of your choice. Their implementation services and support are top notch.

What do you dislike about the product?

Sometimes the docs provided by the vendor aren't kept up to date, but that's really not a Whistic issue so much as it's the vendors. It easy enough to upload updated docs.

What problems is the product solving and how is that benefiting you?

3rd party risk assessments can be very time consuming. Whistic helps streamline the process.