FlowForma launches FlowAssure for vendor risk checks

FlowForma has launched FlowAssure, an AI platform for vendor risk assessments, following a beta programme at the Dublin-based workflow automation company.

FlowAssure is aimed at security, compliance, procurement, and risk teams that review third-party suppliers. The software is designed around an evidence-first approach, bringing vendor questionnaires, certifications, audit reports, penetration tests, vulnerability scans, and other supporting documents into one place.

According to FlowForma, beta customers in enterprise security teams used the platform to reduce manual effort by 91%, speed up vendor onboarding fivefold, and cut reporting workloads by 82%.

Those figures come as businesses face a growing administrative burden around supplier oversight. Security teams can spend up to 70% of their time gathering evidence rather than making decisions, while a mid-market organisation may manage more than 300 vendors and review more than 200 pages of evidence for each one every year, the company said.

Assessment process

The platform analyses supplier evidence against frameworks including ISO 27001:2022, NIS2, Cyber Essentials, NIST CSF 2.0, and SOC 2. It is also designed to route lower-risk vendors to automated approval while sending higher-risk cases for human review.

That places the product in a part of the governance and compliance market where companies are looking to shorten review cycles and create an audit trail for decisions on suppliers and software providers. FlowForma says the system is built to reduce assessment cycles from days to minutes while improving consistency and transparency.

John Murphy, Chief Executive Officer of FlowForma, linked the launch to wider pressure on security teams from regulation and the rising number of third-party relationships.

Murphy said: "Vendor risk management has reached a breaking point. Regulation is tightening fast, from the NIST Cybersecurity Framework to ISO standards and many more that raise the bar every year.

"On top of that, vendor risk workloads are exploding. Organisations are working with more third parties than ever before. That's why FlowAssure shifts the model to evidence-first assessment, where AI helps security teams interpret real security documentation, surface meaningful risk, and make decisions that are faster and fully defensible.

"FlowAssure extends our company's 15 years of experience helping enterprises move from spreadsheets and email threads to auditable processes."

FlowForma says it is trusted by more than 300,000 users across sectors including financial services, healthcare, government, higher education, manufacturing, and other large organisations. The new product extends its process automation work into vendor and application risk management.

Beta feedback

Niamh Lordan, Head of Marketing at FlowForma, cited early customer responses from the beta programme.

Lordan said: "Early beta customer feedback shows FlowAssure is already delivering clear operational value for security teams.

"A global FMCG client praised FlowAssure's ability to support enterprise-scale vendor onboarding, automate high-volume security assessments across approximately 350 applications per year, and deliver significant time savings for its 10-12 person security team.

"Another healthcare beta customer valued FlowAssure's ability to centralise vendor questionnaires, evidence, and communications in one auditable location, while using AI agents to analyse penetration-test reports, generate instant risk assessments, and reduce reactive, resource-intensive audit work."

The company also pointed to customer views on auditability from its wider automation business. In a public administration example, a customer said: "We love FlowForma Process Automation from a compliance perspective. The last time we were audited, there were no queries at all, because we could show exactly who approved what and when, with all the data and metadata we captured."

Vendor risk assessment has become a growing issue for companies as procurement, legal, compliance, and security teams face greater scrutiny over the suppliers they use and the systems those suppliers can access. Reviews often involve a mix of questionnaires, policy documents, technical reports, and follow-up exchanges, leaving teams to rely on email chains and spreadsheets to track progress.

By concentrating those materials into a single workflow, FlowForma is seeking to address a common operational problem rather than simply add another security dashboard. The emphasis on evidence collection and review suggests it is targeting organisations that need documented reasoning for decisions, especially in regulated sectors where supplier reviews can become part of internal audits or external inspections.

FlowAssure is being offered as a standalone software-as-a-service product. Organisations can begin using it with their own security documentation and workflows without complex implementation, according to FlowForma.