AI Agents Replace Questionnaires: SpartanX Redefines Third-Party Risk

BOSTON — October 16, 2026 — The modern enterprise is a fortress with a thousand unguarded backdoors. As organizations increasingly rely on sprawling networks of third-party suppliers, the traditional perimeter has evaporated, replaced by a complex web of vendor dependencies. Today, a Boston-based cybersecurity firm is attempting to close those backdoors not with more paperwork, but with an army of artificial intelligence agents.

SpartanX Technologies has announced a significant leadership reorganization alongside the launch of a new platform capability designed to fundamentally alter how businesses measure third-party risk. Erik Hardy, previously President and Chief Operating Officer, has been appointed Chief Executive Officer. Concurrently, the startup unveiled "Olympus," a major platform update featuring a Vendor Management module that replaces static compliance questionnaires with continuous, autonomous offensive security testing.

The shift signals a maturing market for Autonomous Exposure Management, a category that moves beyond passive vulnerability scanning to actively simulate real-world cyberattacks. But more importantly, the firm's latest release attempts to solve one of the most persistent, legally complex, and opaque challenges in the cybersecurity ecosystem: proving whether the vendors you trust are actually secure.

Moving Past the Questionnaire

For over a decade, Third-Party Risk Management (TPRM) has been an exercise in administrative trust. When a corporation wants to assess the security posture of a new software supplier or data processor, the standard protocol involves sending a lengthy spreadsheet of compliance questions. Sometimes, this is supplemented by external security ratings from incumbent vendors like BitSight or SecurityScorecard, which passively monitor publicly observable data to generate a risk score.

"For decades, the industry has pretended that a spreadsheet with two hundred 'yes or no' questions constitutes security," noted one veteran cybersecurity analyst. "It doesn't. It constitutes compliance, and compliance does not stop a dedicated adversary."

The new Vendor Management module takes a radically different approach, abandoning self-reported attestations in favor of empirical evidence. Organizations invite their suppliers onto the platform, where each supplier operates within a strictly isolated workspace. Once onboarded, the system deploys specialized AI agents to continuously test the supplier's shared assets using the same techniques deployed by malicious hackers.

Instead of asking a vendor if they patch their servers, the system actively attempts to exploit unpatched vulnerabilities. The client organization is then presented with a validated risk posture grounded in continuous testing.

"SpartanX has built something the market has never seen: an autonomous platform that attacks the way a real adversary would, at a scale no human team can match," said Erik Hardy, Chief Executive Officer of SpartanX. "Our customers are not just finding vulnerabilities, they are proving which ones actually matter. With Vendor Management, we extend that same proof to the one part of the attack surface every company worries about and almost no one can measure: their vendors. I am honored to lead this team into its next chapter."

Navigating the Legal and Privacy Minefield

Deploying offensive security tools against a third party's infrastructure is traditionally a legal minefield. The Computer Fraud and Abuse Act (CFAA) strictly criminalizes unauthorized access to computer systems. In the past, automated penetration testing of external vendors was deemed too risky due to the potential for inadvertently causing system outages, data corruption, or violating privacy agreements.

To navigate this, the Olympus platform introduces strict architectural and contractual boundaries. The architecture relies heavily on explicit consent and granular control. The supplier chooses precisely which assets to share and test. Furthermore, a rigid privacy boundary ensures that while the enterprise client sees the final, validated risk posture and shared-asset scores, the underlying raw vulnerability findings and internal proprietary data remain entirely within the supplier's control.

This dual-blind approach protects the intellectual property and internal security data of the supplier while providing the client with the mathematical certainty that a vulnerability exists and is exploitable. It effectively transforms a legal liability into a mutually beneficial security validation exercise, aligning with the stringent supply chain risk management guidelines outlined in frameworks like NIST Special Publication 800-161.

The Next Frontier in Enterprise AI Defense

The introduction of Vendor Management is built upon a significant expansion of the startup's core offensive capabilities. The Olympus release integrates more than 500 specialized AI agents designed to cover six critical attack surfaces: web applications, APIs, network infrastructure, cloud environments, identity and access management (IAM), and even other AI systems and Large Language Models (LLMs).

While competitors like Horizon3.ai have popularized automated penetration testing for internal networks, the Boston-based company is pushing the boundary by applying these autonomous agents to the external supply chain. The platform maps attack chains end-to-end without human intervention, proving which exposures are genuinely exploitable.

Beyond mere discovery, the platform features automated remediation guidance. Over 100 of the specialized AI agents are dedicated to triage and generating code-level fixes. A newly introduced retesting feature allows security teams to instantly confirm whether a deployed fix for code or mobile vulnerabilities has actually closed the loop, turning a traditionally weeks-long validation process into an instantaneous verification.

Reorganizing for Enterprise Scale

The technological leap forward coincides with a strategic realignment of the company's executive board. The transition of Erik Hardy to CEO marks a clear pivot from early-stage product incubation to aggressive commercial scaling. Hardy, whose operational background includes building go-to-market teams at EMC and scaling category-defining tech companies, originally joined the firm in April 2026. His arrival coincided with an undisclosed seed funding round led by Boston-based venture capital firm Venture Guides.

Meanwhile, founder Diego Spahn transitions to the role of Co-Founder and Chief Technology and Product Officer. Spahn is a multi-time founder with a deeply personal connection to the mission. After his previous automated vulnerability management platform, Neuralys, was acquired by Coalfire in 2021, Spahn experienced a significant financial and professional loss in 2024 due to issues with payment and trust in a subsequent venture. That experience catalyzed the creation of a company built entirely on the premise of zero-trust, attack-validated proof.

By stepping away from the chief executive role, Spahn can focus entirely on the architectural complexities of the Olympus platform and the continued evolution of its AI agents. The reorganization also elevates co-founders Alejandro Aguirre Soto to Senior Vice President of Engineering and Martin Voelk to Chief Research Officer, ensuring the founding technical vision remains central to the firm's operations.

As enterprise technology ecosystems become increasingly decentralized, the perimeter is no longer defined by a corporate firewall, but by the weakest link in the supply chain. By replacing trust with continuous, autonomous validation, the industry is taking a necessary step toward a future where security is proven rather than promised.