Magnitude introduces CISO Staff Agent, an AI chief of staff for Third-Party Risk management & supply chain resilience. New AI agent reasons across vendor and product assessments, monitoring, incidents and Nth-party relationships to surface portfolio-wide weaknesses and prioritize critical actions. Magnitude, the autonomous governance and defense platform for continuous third-party risk management (TPRM) and supply chain resilience, announced CISO Staff Agent, an AI chief of staff purpose-built for third-party risk. The new capability lets security leaders ask questions across potentially thousands of vendors, products and downstream dependencies to identify systemic weaknesses and quickly surface the most critical risks that require their attention. The CISO Staff Agent analyzes and connects risk signals and context from across an organization's third- and Nth-party environment, helping CISOs understand what matters most, investigate specific issues, surface emerging risks earlier and determine how to reduce or remediate them. CISOs and their teams can ask questions and issue requests such as: * What vendor failure would create the biggest blast radius across my business and supply chain? * Create a presentation detailing the five highest-risk products and recommended actions. Schedule it to refresh every Monday at 9 a.m. * How exposed am I to concentration risk from fourth- and fifth-party dependencies that I may not even know about? * Across the portfolio, which controls have the most negative sentiment or negative answers? * What did the state of controls or risk look like six months ago, and how has it changed since then? CISOs can also drill into specific issues, such as identifying which products lack single sign-on or multifactor authentication, or where business continuity and recovery gaps are appearing across the portfolio. From Questions to Real Risk Reduction CISOs can ask the CISO Staff Agent natural-language questions and receive answers grounded in continuously updated context from across the Magnitude platform. It works with Magnitude's coordinated AI risk agents, which gather and validate evidence, assess vendors and products, monitor changes, analyze security incidents and map third- and Nth-party relationships. That context enables the CISO Staff Agent to identify systemic weaknesses, investigate emerging issues and determine which risks matter most. It can then work with Magnitude's Risk Impact Agent and Risk Remediation Agent to assess the potential impact and suggest actions to reduce or remediate the risk. It can also incorporate relevant external research, save analyses, schedule recurring requests and turn findings into executive-ready summaries, presentations and visualizations. The CISO Staff Agent is also accessible through the Model Context Protocol (MCP), enabling organizations to bring Magnitude's third-party risk context and reasoning into compatible AI experiences and workflows. "CISOs do not need another dashboard that assumes they already know what to look for," said Ken Liao, vice president of product at Magnitude. "They need an experienced member of their staff who can reason across their supply chain and tell them what requires their attention. That's what CISO Staff Agent does. It can identify those issues across the entire ecosystem, N-levels deep, and help the security team focus on what matters most." Reasoning and Action Across the Entire Third-Party Portfolio Traditional TPRM platforms organize information primarily around individual vendors, questionnaires and point-in-time assessments, making it difficult to see whether weaknesses are isolated or systemic. Instead, the CISO Staff Agent analyzes horizontally across all vendors and products, surfacing patterns such as repeated control weaknesses, business continuity gaps, identity and access issues, AI-related risk trends and concentration around shared downstream providers. It can also reason within the context of a specific vendor or product, drawing on assessments, controls, supporting evidence, monitoring history and supply-chain relationships. Because many important security questions generate detailed narrative responses rather than simple yes-or-no answers, Magnitude's AI agents can interpret free-form evidence and quantify those findings across the broader portfolio. The same vendor may represent different risks to different organizations. Magnitude applies enterprise-specific reasoning based on each organization's policies, risk tolerance, vendor tiering, compensating controls and governance requirements. The CISO Staff Agent grounds its responses in that organization-specific context and the evidence continuously developed by Magnitude's autonomous governance and defense system. "The CISO Staff Agent reasons across your entire portfolio and thinks the way an organization thinks, using its risk tolerance, tiering, and controls," said Sean Wilcox, vice president of corporate marketing at Magnitude. "It's like having a risk analyst with 20 years of experience on staff, one who already knows exactly how your business weighs risk, and what needs to be done to minimize it, in priority order." Built for Continuously Changing Third-Party Risk Anthropic reported in May that Claude Mythos Preview identified more than 23,000 potential vulnerabilities in more than 1,000 open source projects, demonstrating the scale at which frontier AI can now search for software weaknesses. This compresses the time between vulnerability discovery, exploitation and business impact, putting pressure on third-party risk programs to account for direct suppliers, products, downstream dependencies, AI-enabled services and a growing volume of rapidly changing security signals at machine speed. CISO Staff Agent is designed for that environment, helping security leaders understand new exposure and prioritize attention faster than human teams or point-in-time reporting can keep pace.

Magnitude raises $10m to automate third-party risk. June 17, 2026 Magnitude, an autonomous AI workforce provider for third-party risk management (TPRM), has emerged from stealth after securing $10m in seed funding led by Ballistic Ventures. The round was led by Ballistic Ventures, with the company founded by a team of AI and security professionals who previously held roles at Amazon, Abnormal AI, Proofpoint, and Pandora. Magnitude says it is launching what it describes as the world's first autonomous AI workforce purpose-built for TPRM teams. The platform deploys AI risk agents that work continuously to assess vendor risk and govern AI agents across third- and Nth-party ecosystems. These agents gather and validate evidence, make risk decisions, and drive remediation, all in line with each enterprise's policies. The system is designed to improve its reasoning over time, creating what the company describes as an autonomous governance and defence system for managing external dependencies. Magnitude chief executive and founder Rami Habal said, "Today's third-party risk model was built for a different era. As autonomous offense becomes a reality, organizations need autonomous defense to keep pace. "Modern organizations rely on deeply interconnected ecosystems of vendors, products, and AI agents, creating external dependencies that traditional governance and third-party risk programs were never designed to manage continuously. Magnitude delivers a new autonomous governance and defense system for managing third- and Nth-party risk, where assessment, monitoring, correlation, and remediation operate continuously across all external dependencies, enabling high-confidence decisions at scale." Ballistic Ventures co-founder and general partner Jake Seid said, "A core thesis for us at Ballistic is that the most important security companies will both help companies be more secure and help enable them to move faster. "Magnitude fits this thesis directly. With every third-party vendor adding AI capability, you need AI to help you adopt AI quickly and safely. But with the adversary using AI to attack the third-party enterprise surface at machine scale and speed, you need AI to help you defend against the new reality of autonomous offense. People think Mythos, but any adversary can do this today with openweight models for 20x less cost than the closed-weight models. Magnitude redefines TPRM for the agentic era." Enjoying the stories? Investors. The following investor(s) were tagged in this article.