Lema Agentic Third-Party Exposure Management

Lema AI was founded in 2023 by Eddie Dovzhik (CEO), Omer Yehudai (CPO) and Tomer Roizman (CTO), and its release is datelined New York. It addresses third-party risk, where static questionnaires and compliance checklists fail to show what a vendor can actually reach in the customer's environment.

The agentic platform runs continuous forensic analysis of vendors: it reads vendor reports and documents for hidden issues, analyses public information, tracks vendor access to critical assets and data, models exposure paths and suggests mitigation such as revoking access or enforcing least privilege. The vendor says a new vendor can be assessed in under five minutes. Testimonials come from Klaviyo, OPENLANE, AlphaSense, Cresta and Delta Dental.

• Forensic Artifact Analysis: scans vendor reports and documents for hidden or misclassified issues.
• Open-Source Recon: analyses public vendor information such as layoffs affecting security teams.
• Blast Radius Monitoring: tracks vendor use, access to critical assets and procurement activity.
• Exposure Paths: models how an attack through a vendor could reach the business.
• Mitigation guidance: suggests revoking access, least privilege and contract changes.
• Third-party AI governance: flags vendor shadow AI and sub-processors.

A bank can review the real access of its core-banking and fintech vendors beyond annual questionnaires. A retailer can detect a marketing SaaS tool that gained admin access to company email. A group IT team can monitor vendors using customer data to train AI.

• Evidence-backed findings on vendor risk instead of questionnaire answers.
• Real-time detection of vendor scope drift and permission changes.
• Vendor assessments in under five minutes, per the vendor.
• Concrete mitigation steps that reduce the impact of third-party failures.

The Lema site states that 48% of breaches occur through third parties, and regulators increasingly expect continuous vendor oversight. Vietnamese banks and enterprises relying on SaaS and outsourced IT face similar supply chain exposure and data protection obligations.

Founded 2023. February 2026: $24M total funding, with Series A led by Team8, seed led by F2 Venture Capital and participation from Salesforce Ventures; announced 9 February 2026.