Vendor risk that stays current
Continuous, evidence-driven vendor risk — not a spreadsheet you update once a year.
TPRM is questionnaires nobody reads and risk scores that go stale the day after onboarding.
Automated questionnaires via a vendor portal, AI-powered evidence analysis of SOC 2 reports, pen tests and ISO certs, residual-risk scoring with analyst decisions, and live breach correlation that re-scores a vendor the moment they are compromised.
Vendor risk inventory with security scoring
A live security grade per vendor
Every vendor gets an external posture assessment — DNS, TLS, headers, email auth, open ports, breach history, subdomain takeover, cloud exposure and code-leak — rolled into one grade, alongside a CVE matrix matched against their detected stack. No questionnaire required to start.
Risk tiered by the relationship, not a guess
Inherent risk is calculated from environment access, integration depth, data types and business dependency — then blended with the external posture and control evidence into a residual risk an analyst confirms, with a review cadence so it never goes stale.
What you get
Portal questionnaires
Automated send, reminders and weighted scoring via a vendor portal.
AI evidence analysis
Reads SOC 2 / pen-test / ISO PDFs and extracts the findings that matter.
Residual-risk scoring
Analyst accept / mitigate / transfer decisions with expiry.
Breach correlation
A vendor breach instantly re-scores your exposure.
CVE matching
The vendor's tech stack matched against live CVEs.
Concentration risk
DORA-aligned view of critical-vendor dependence.
How it works
Onboard the vendor
Send the portal questionnaire and request evidence.
Analyze
AI reads the evidence; analysts score residual risk.
Decide
Accept, mitigate or transfer — with a review deadline.
Watch continuously
Breach and CVE signals keep the score live.
TPRM wired into the same threat-intel and CVE pipeline as the rest of the platform — so vendor risk is live, not a snapshot.
One platform. Not ten point tools.
See Third-Party Risk · TPRM alongside the rest of your security program — correlated, not siloed.