Tenchi Security

• No source outside the company confirms its inclusion in Gartner's buyer's guide for third-party cyber-risk management tools, its listing in the Gartner market guide, or its contribution to Verizon's 2026 breach report, so the three claims that lead its homepage do not establish independent market validation.
• The 81% reduction in third-party vulnerabilities that the homepage attributes to customers carries no stated method or sample, so the public record does not let a buyer test the figure.
• The newest independently reported named customer traces to 2021, and no case study, revenue figure or customer count appears in the reviewed sources, so they do not establish current commercial scale.
• B3 appears in 2021 reporting as a customer and in 2024 reporting as an investor through the L4 Venture Builder fund, so its testimonial on the site carries an investor's interest as well as a customer's.
• Zanshin's inside-out assessments need each supplier's consent, and the reviewed sources do not say how many suppliers have granted it, so the size of that network is unverified.
• No certification, trust portal or audit report of Tenchi Security's own appears on the probed surfaces, so a buyer assessing its read-only access into the cloud, identity and endpoint consoles of its customers' suppliers has only the company's own control descriptions.

Tenchi Security sells against the distance between what a supplier says about its security and what its systems actually show. The company frames self-attestation and point-in-time sampled evidence as the failure it replaces, and it offers daily automated tests in place of annual audits and questionnaires.

Brazil's data-protection law gave that pitch its opening. Exame reported in October 2021 that the founders described the regulation, in force that August, as moving third-party risk management from desirable to mandatory. The same reporting quotes the founders describing large companies as having had only limited visibility into supplier security before that shift.

Outside measurement of the problem is thin in the reviewed sources. Accenture said in its February 2024 investment announcement that its own research found 51% of chief executives ranking supply chain as their second highest external risk. The homepage points at a Gartner buyer's guide, a Gartner market guide and a contribution to Verizon's 2026 breach report, and each of those is the company's own statement. [s1, s2, s10, s14]

Zanshin connects to a supplier's own consoles and tests them every day. The company describes automated tests across a third party's cloud, endpoints, identity and SaaS that return security metadata rather than the supplier's data, and it states that the access is read-only and cannot modify the supplier's infrastructure. Release notes through 2025 and 2026 add scan targets across successive releases, including Azure DevOps, JumpCloud, CrowdStrike Falcon and Microsoft Defender for Endpoint.

Zanshin reduces those tests to a single score. Tenchi Security says the score design was a joint project between its own engineering and data science teams and the Cyentia Institute, and that a first assessment produces a score within six hours, refreshed every six hours after that. The company rewrote the score in November 2025, saying its dataset had grown in volume and variety.

Compliance reporting and questionnaires ride alongside the tests. Zanshin reports against CIS Controls 8.1, NIST CSF v2.0, ISO 27001:2022 and PCI DSS v4.0.1, and it carries security questionnaires with a summary feature that reads uploaded evidence such as SOC 2 reports and ISO certifications. A public command-line utility talks to the same API.

The release notes link documentation pages that were not separately reviewed, so the reference material a buyer would read before an evaluation is not among the pages reviewed and the release notes carry the operating detail here. [s2, s3, s7, s8, s22]

Tenchi Security positions against a method rather than against named rivals. Its page for third parties contrasts its model with security scoring, with internal vendor security teams and with what it calls traditional third-party cyber risk management. No competitor is named on the reviewed pages.

The commercial structure is where the difference gets concrete. The assessed supplier pays nothing, because the customer that depends on it buys its access, and the company says the licensing model lets a supplier opt in to a customer investing in its security. That arrangement needs the supplier's agreement, which the company describes as consent rather than audit. The reviewed sources carry no comparison of what rival products require, so they do not establish that permission-based licensing is unique to Zanshin.

One feature cuts against the cooperative framing. The product offers an anonymous mode, in which the third party is unaware of the monitoring, beside a cooperative mode in which it consents to share data. [s3, s2, s7, s1]

Every customer named in independent reporting was named in 2021. Exame reported in October of that year that the founders named Cielo, XP, BTG Pactual, B3 and Telefônica as customers, and startups.com.br repeated that company-reported roster in February 2024. The testimonials page attributes a quote to Ricardo Redenschi, head of cyber security and data protection at B3, and the homepage carries another attributed to Finnet.

Accenture is the newest outside signal. Its newsroom said in February 2024 that it had invested through Accenture Ventures and would use the platform as a new component of its managed security services. The company also runs a partner program aimed at cyber insurers, managed security providers and consultancies.

Proof of conversion stops there. No case study, revenue figure or customer count appears in the reviewed sources. The homepage says customers report an 81% reduction in third-party vulnerabilities within their first month, and it shows no method or sample behind that figure. [s10, s12, s14, s6, s1, s20]

Felipe Bouças and Alexandre Sieira have built and sold two security companies together. Baguete reports that Bouças founded Niddel and Cipher, acquired by Verizon and Prosegur, and Exame reports the two founded both companies together. Exame reported in 2021 that the two had worked together for two decades.

Both then ran product organizations at the acquirer. The company's page lists Bouças as global director of product for managed security services at Verizon and Sieira as global head of detection and response products there, which puts their post-exit work in the same market they sell into now.

The bench below the founders appears only on the company's page, so the reviewed record does not independently establish its depth. That page lists a head of engineering with Apple and Google in his background, a head of customer success who was cyber chief technology officer at Santander Brasil, a chief financial officer, a sales director and a chief marketing officer. Baguete also names a third founder, Dani Dilkin, whom the leadership page does not list. [s4, s11, s10]

No security assurance of Tenchi Security's own appears in the reviewed sources or on the probed surfaces. The trust and security subdomains do not resolve, the trust, security and compliance paths return 404, and the privacy policy names no certification.

Stated controls stand in place of published attestations. The company says Zanshin is read-only and cannot modify a supplier's infrastructure, that it returns only the amount and type of security issues along with time-to-fix and severity metrics, and that its AI features run through third-party sub-processors under Brazil's data-protection law. A buyer has the company's description of those controls.

One assurance signal comes from outside the company. The Center for Internet Security lists Tenchi among its certified security vendor members. The compliance content the product carries serves the customer, reporting against CIS Controls 8.1, NIST CSF v2.0, ISO 27001:2022 and PCI DSS v4.0.1, and it says nothing about how Tenchi Security runs its own systems. [s24, s8, s3, s23, s7]

Add analyzed competitors to compare them side by side with Tenchi Security.

Tenchi Security's reported customers concentrate in Brazilian financial services and telecoms. Exame reported in October 2021 that the founders named Cielo, XP, BTG Pactual, Telefônica and B3 as customers, and the testimonials page carries a quote from the head of cyber security and data protection at B3. Its own leadership page describes four years of work with major banks.

The product has two sides, and each side is a different segment. On one side is the large company that buys the licence, and on the other is a supplier that gets access at no cost because that customer pays for it. The company aims material at both, with one page for buyers and another that tells suppliers what the relationship asks of them.

Reach outside Brazil is stated rather than shown. Accenture's 2024 announcement placed the platform inside its managed security services offering, and the privacy policy names Mexican and European data protection law alongside Brazil's. No customer outside Brazil appears in the reviewed sources.

Zanshin reads a supplier's own security consoles with that supplier's permission. The company describes automated daily tests across cloud, endpoint, identity and SaaS accounts that return security metadata rather than the supplier's data, and it states the access is read-only and cannot modify the supplier's infrastructure. Release notes through 2025 and 2026 add platforms one at a time, including Azure DevOps, JumpCloud, CrowdStrike Falcon and Microsoft Defender for Endpoint.

The score is the part with a data story behind it. Tenchi Security says its engineering and data science teams designed it with the Cyentia Institute, that a first assessment returns a score within six hours, and that scores refresh every six hours after that. In November 2025 the company published a new security score, saying its own dataset had grown in volume and variety. The dashboard compares a customer against the organizations that score an A.

AI appears as a feature rather than as the product. A summary tool reads evidence a supplier uploads with a questionnaire, such as SOC 2 reports and ISO certifications, and checks whether it supports the answers given. The privacy policy says those AI features run through third-party sub-processors.

The reviewed sources give no way to check the claim the vendor leads with. Its homepage says customers report an 81% reduction in third-party vulnerabilities within their first month, and no method, sample or outside measurement of that figure appears in the reviewed sources.

Every customer named in independent reporting was named in 2021, so those sources do not establish current customer traction. Exame reported that October on Cielo, XP, BTG Pactual, Telefônica and B3, and startups.com.br repeated the roster in February 2024. The homepage and testimonials pages add quotes attributed to named people at B3 and at Finnet, a supplier on the other side of the model.

Accenture supplies the newest outside evidence. Its newsroom said in February 2024 that it had invested through Accenture Ventures and would use the platform as a new component of its managed security services, which is a distribution route rather than a logo. The partner program also courts cyber insurers, managed security providers and consultancies.

Demand generation runs through the company's own publishing. Its site carries a newsletter, a podcast and an annual report on third-party risk, plus an analysis of Verizon's 2026 breach findings that says Tenchi Security contributed a dataset to that report. The reviewed sources contain no case study, no revenue figure and no customer count, so current commercial scale remains unestablished.

The buyer pays for its suppliers' access as well as its own. Tenchi Security tells suppliers their access is paid for completely by their customers, and it frames that as aligning both sides on the same outcome. A supplier therefore evaluates a product it will not be billed for.

Exame described the charging model in 2021. It reported an annual fee charged to large companies for monitoring the network of companies in their ecosystem, with smaller companies charged directly, and prices varying with the size of the environment monitored.

No figure sits behind that model in the reviewed sources. No pricing page appears among the reviewed pages, and no tier, list price or worked example appears anywhere in them. A buyer can describe the shape of a bill and not its size.

Onboarding asks a supplier for read-only access. The company states that Zanshin is read-only and cannot modify a supplier's infrastructure, and that what reaches the customer is the amount and type of security issues along with time-to-fix and severity metrics. A first score arrives within six hours, and scores refresh every six hours after that.

Operational control shows up in the product's own release history. Tenchi Security shipped role-based access control in October 2025 and dates each change it publishes, which gives a buyer a running record of what the platform gained and when.

Zanshin exposes an API used by a public command-line utility and a Python software development kit that Tenchi Security publishes on its own GitHub organization. No hosted documentation site for that API appears in the reviewed sources, so a prospective integrator has the public utility and SDK as its implementation references.

No security assurance of Tenchi Security's own appears in the reviewed sources or on the probed surfaces. The trust and security subdomains do not resolve, the trust, security and compliance paths return 404, and the privacy policy names no certification. That gap sits under a product that holds read-only access into other companies' cloud, identity and endpoint consoles.

Stated controls stand in place of published attestations. The company says Zanshin is read-only and cannot modify a supplier's infrastructure, that it returns only the amount and type of security issues along with time-to-fix and severity metrics, and that its AI features run through third-party sub-processors under Brazil's data protection law.

One assurance signal comes from outside the company. The Center for Internet Security lists Tenchi among its certified security vendor members. The compliance content the product carries serves the customer, reporting against CIS Controls 8.1, NIST CSF v2.0, ISO 27001:2022 and PCI DSS v4.0.1, and it says nothing about how Tenchi Security runs its own systems.

Zanshin sits between two organizations rather than inside one. The company calls it a two-sided security communication platform and says it gives a supplier cloud, SaaS and attack-surface posture management without exposing that supplier's private information to its customers. The follower and following model in the release notes is that structure made concrete.

Its ecosystem work runs through channels rather than through an app marketplace. The partner program targets cyber insurers, managed security providers, consultancies and technology vendors, and the company's own funding announcement said Accenture clients would get access. No cloud marketplace listing appears in the reviewed sources.

What Zanshin consumes are other vendors' consoles. Scan target types added across 2025 and 2026 include Azure DevOps, JumpCloud, CrowdStrike Falcon and Microsoft Defender for Endpoint, and the release notes date each addition.

Felipe Bouças and Alexandre Sieira built and sold two security companies before this one. Baguete reports that Bouças founded Niddel and Cipher, acquired by Verizon and Prosegur, and the company's page gives Sieira the co-founder title at both. Exame reported in 2021 that the two had worked together for two decades.

Both also held product roles at the acquirer, which puts their post-exit work in the market they sell into now. The company lists Bouças as global director of product for managed security services at Verizon and Sieira as global head of detection and response products there.

The bench below them appears only on the company's page, so the reviewed record does not independently establish its depth. That page lists a head of engineering with Apple and Google in his background, a head of customer success who was cyber chief technology officer at Santander Brasil, a chief financial officer, a sales director and a chief marketing officer. Baguete also names a third founder, Dani Dilkin, whom the leadership page does not list.

The company hires remotely and says its team is spread across the globe. Exame reported a plan in 2021 to grow from 10 people to between 50 and 60, and the reviewed sources record no headcount since, so the current team scale is not established.