MetricStream is an AI-first Connected GRC software company focused on helping organizations simplify governance, risk, and compliance. Its portfolio brings together risk, compliance, audit, cyber, third-party risk, and resilience capabilities on a single low-code/no-code cloud platform so teams can work from a more connected operating model.
MetricStream positions its offering around a unified approach to enterprise-wide visibility, workflow automation, and risk-aware decision-making. The company supports programs that span enterprise and operational risk, regulatory compliance, internal audit, SOX, cyber risk, third-party oversight, and operational resilience, while using AI to reduce manual effort and surface more actionable insights from GRC data.
Offerings, Capabilities, and Integrations
MetricStream centers its capabilities on a common platform that connects data across risks, controls, regulations, assets, processes, issues, and organizational entities. Core platform capabilities include a federated data model, embedded analytics, AI-powered recommendations, continuous control monitoring, and business APIs for integrating third-party systems and data sources.
The company also extends its products through MetricStream AppStudio, which allows customers to configure workflows, forms, dashboards, reports, and business rules without heavy custom development. Its integration ecosystem supports connections across cloud environments, IT service management, vulnerability management, regulatory intelligence, and third-party risk data providers, helping customers consolidate operational and compliance signals into a single GRC environment.
Products and Services
- Connected GRC: MetricStream’s flagship unified cloud offering that connects risk, compliance, audit, cybersecurity, third-party risk, and operational resilience on a single low-code/no-code platform.
- Enterprise Risk: A structured enterprise risk management product that supports qualitative and quantitative risk assessments, risk profiling, and visibility into top organizational risks.
- Operational Risk: An operational risk management product for tracking KRIs, KCIs, and KPIs, setting thresholds, triggering alerts, and visualizing risk movement through dashboards and heat maps.
- Regulatory Compliance: A compliance management offering that centralizes regulations, risks, controls, and policies, with regulatory intelligence and automated mapping of updates to compliance activities.
- Internal Audit: An internal audit management product designed for risk-based planning, audit universe management, fieldwork, reporting, and AI-assisted issue and action management.
- SOX Compliance: A configurable SOX compliance product for control testing, documentation, certifications, issue remediation, and management of complex organizational structures.
- IT & Cyber Risk: A cyber GRC product that helps organizations identify, assess, mitigate, and quantify IT and cybersecurity risks, including threat intelligence and control-based risk management.
- Third-Party Risk: A third-party risk management product that supports due diligence, onboarding, continuous monitoring, performance tracking, and risk assessment from onboarding through offboarding.
- Operational Resilience: An AI-first operational resilience product for mapping critical services and dependencies, managing scenario testing, embedding resilience into continuity planning, and accelerating recovery from disruptions.
- AiSPIRE: MetricStream’s AI-powered, knowledge-centric GRC product that uses large language models, knowledge graphs, and generative AI to generate connected insights from GRC and transactional data.
- Business Continuity Management: A business continuity and disaster recovery product for continuity planning, business impact analysis, disaster tracking, recovery action management, and emergency mass notification.
- MetricStream Platform: The underlying GRC cloud platform that provides the common data model, analytics, AI, APIs, and extensibility foundation for MetricStream’s risk, compliance, audit, cyber, and resilience products.
- MetricStream AppStudio: A web-based development and configuration environment for tailoring MetricStream products through workflow, form, dashboard, report, template, and business-rule customization.
Target Customers
MetricStream primarily serves organizations that need coordinated oversight across multiple GRC domains, especially those operating in highly regulated or risk-intensive environments. Its customer focus spans banking and financial services, insurance, healthcare, life sciences, energy, technology, manufacturing, and government-related environments.
The platform is built for cross-functional stakeholders including enterprise risk teams, compliance leaders, internal audit groups, SOX program owners, CISOs and cyber risk teams, third-party risk managers, and operational resilience or business continuity leaders. MetricStream is suited to enterprises that want to replace siloed point solutions with a connected model that can scale from focused use cases to broader enterprise GRC programs.
Cloud Integrations and Marketplace
- AWS Marketplace: MetricStream has a verified AWS Marketplace presence for ConnectedGRC. Its AWS-related capabilities include marketplace availability plus integrations with AWS Audit Manager and AWS Security Hub to support IT compliance, evidence collection, and continuous control monitoring.
- Microsoft Azure Marketplace: MetricStream has a verified Microsoft Azure Marketplace listing for IT & Cyber Risk Management. The listing positions the offering for security and risk leaders seeking cloud-based cyber risk visibility, risk quantification, and framework-aligned IT and cyber risk management.
Key People
- Marc Levine: Chief Executive Officer
- Gunjan Sinha: Executive Chairman
- Gaurav Kapoor: Co-founder & Vice Chairman
- Brian Frohn: Chief Financial & Operating Officer
- Rahul Vaidya: Chief Technology Officer
- Rahul Maheshwari: Chief Customer Officer
- Thien Dinh: General Counsel
- Elaine Wamboldt: Senior Vice President, Global Professional Services
- Vallinayagam Nallaperumal: Senior Vice President, Cloud
- Subramanian Sivaraman: Senior Vice President Operations
Key Facts
- Headquarters: San Jose, California, United States
- Employees: Approximately 1,200-1,500
- Annual Revenue: Approximately US$300M-US$330M
- Parent Company: None
- Subsidiaries: At least 2 active subsidiaries, including MetricStream Infotech (India) Private Limited and METRICSTREAM UK LIMITED
- Publicly Listed: No (privately held)
Analyst Recognitions
- Gartner: Gartner Magic Quadrant for IT Risk Management Tools (2021) — Leader. Gartner Magic Quadrant for IT Vendor Risk Management Tools (2021) — Leader.
- Forrester: The Forrester Wave™: Governance, Risk, and Compliance Platforms, Q2 2026 — Strong Performer. The Forrester Wave™: Third-Party Risk Management (TPRM) Platforms, Q1 2024 — Leader.
- IDC: IDC MarketScape Worldwide Governance, Risk, and Compliance Software Vendor Assessment (2025) — Leader.
