Whistic Deploys Four-Agent AI System for Vendor Risk Assessments

Four AI agents now handle vendor assessment workflows

Whistic has released Automation Orchestrator, a platform that coordinates four specialized AI agents to automate the vendor assessment lifecycle. The system, now generally available to all Whistic Assess customers with AI enabled, addresses a workflow where roughly 90% of third-party risk management effort traditionally goes to administrative tasks rather than risk analysis.

According to details first reported by PRNewswire, the four agents each handle distinct phases: the Initiator triggers assessments based on configured cadence and risk criteria, the Collector gathers evidence from Trust Centers and existing records while requesting additional documents, the Analyst reviews evidence and generates findings with confidence scores and source citations, and the Reporter compiles executive summaries and notifies the team.

When enabled together as Full AutoAssess, the agents move an assessment from trigger to summary without routine human touchpoints. A person still reviews findings, makes the final risk decision, and closes each assessment. Teams can also run agents individually, set pause points, or intervene manually at any stage, with all agent activity logged.

Built on two years of production AI

The system runs on Whistic AI, which the company reports has been in production for more than two years with 96% accuracy. All agent outputs include confidence scores and source citations.

"Most assessment work is chasing documents, reading evidence, and rebuilding the same summaries over and over," said Juan Rodriguez, CEO of Whistic. "Automation Orchestrator gives that work to agents built on Whistic AI that has been in production for more than two years, with 96% accuracy, confidence scores, and source citations."

Manual vendor assessments typically require 12 to 15 hours of work. By automating the administrative components, Orchestrator returns that time to risk decision-making.

Why it matters

Third-party risk management teams face mounting vendor volumes while regulatory scrutiny intensifies. Automating the evidence-gathering and initial analysis phases without removing human judgment from final risk decisions addresses a critical scaling challenge. The approach also creates an audit trail of agent activity, which matters for compliance documentation. As agentic AI systems move from pilot to production, this architecture—specialized agents coordinated through a central orchestrator—offers a template for automating complex, multi-step workflows while preserving human oversight at decision points.

Roadmap extends to additional workflows

Automation Orchestrator is designed as a general agent hub for risk operations, with vendor assessments as the first automated workflow. The company's roadmap includes extending the architecture to vendor intake, issue management, agent metrics, and agentic reassessments that surface changes since the last vendor review.

Whistic requires no separate purchase or add-on for Automation Orchestrator; it's included for existing Whistic Assess customers with AI enabled. The company demonstrated the system at the ISACA + IIA GRC Conference in San Diego, August 17-19, 2026.

These details were first reported by PRNewswire.