The Forrester Wave™: Cybersecurity Risk Ratings Platforms, Q2 2026
Vendors or products added in this year’s report may indicate a change in the market, change in evaluation criteria, or change of focus by the vendor.
No vendors were added in this report.
Vendors or products dropped from one year to the next may indicate a change in the market, change in evaluation criteria, or change of focus by the vendor.
No vendors were dropped in this report.
The Forrester Wave evaluation is an assessment of the top vendors in the market; it doesn't represent the entire vendor landscape. Additional vendors that Forrester considers to be notable for enterprise clients can be found in the corresponding report: The Cybersecurity Risk Ratings Platforms Landscape, Q4 2025.
A: Vendors are included in the Forrester Wave evaluation based on specific inclusion criteria: broad cybersecurity risk ratings platforms capabilities coverage, solution available for purchase as a standalone product, substantial revenue in the market (at least $15 million in revenue from CRR platform product over the past four quarters), and mindshare among Forrester's enterprise clients. Vendors that met the defined inclusion criteria but declined to participate in or contributed only partially to the evaluation are scored in accordance with Forrester's vendor participation policy and their positioning is published along with participating vendors. The market and vendor offerings change over time, and vendors are evaluated using materials provided by a specific cutoff date (January 9, 2026 for this report).