Customer story · Financial services · Türkiye
A Major Bank Moves Vendor Risk to Continuous Monitoring.
A Türkiye-based universal bank serving more than 10 million customers needed monitoring that doesn’t stop between annual vendor assessments. Its regulators expect continuous evidence of vendor posture, and a questionnaire program could not produce it.
-
Before
Tier-1
one questionnaire a year
about 25 of 100 -
Now
Every vendor
continuously
all 100 - Time to detect a vendor incident
- Months (before)Hours now
- Compliance evidence
- Weeks (before)Minutes now
A Universal Bank With 100+ Vendor Relationships.
A Türkiye-headquartered universal bank with retail, commercial, capital markets and asset management business lines. Its 10M+ customers are spread across the country and selected international markets.
Its third-party program covers 100+ vendors across tiers: payment processors, core banking platforms, customer-data partners and regional service providers. Each was assessed once a year, through a questionnaire that took weeks per cycle.
- Revenue
- €5B+ a year
- Employees
- 30,000+
- Customers
- 10M+
- Vendors
- 100+
Yearly Evidence for Daily Risk.
A questionnaire records what a vendor said on the day it answered. Vendor risk kept moving between answers.
Evidence
Paperwork Without Posture
Annual questionnaires produced documents. The bank’s regulators expected continuous evidence.
Detection
The News Arrived First
Risk events between cycles reached the bank through public news. The vendor-management program did not surface them.
Impact
Compromise Before the Next Window
When a tier-1 vendor was compromised, operations felt it before the next questionnaire was due.
Vendors Are Scanned at First-Party Depth.
Third-Party Risk Management replaced the questionnaire as the primary evidence source. Each of the 100+ vendors became a portfolio, scanned across the data layers the platform applies to a first-party surface: WHOIS, IP WHOIS, DNS, SSL, ports, web data and HTTP.
Findings carry their compliance classifications, so audit pulls framework-mapped evidence when it needs it. Procurement reads the same vendor score at onboarding.
- Continuous Monitoring of each vendor asset, with history per layer
- Compliance Tracking, with findings classified against compliance frameworks, PCI DSS 4.0 among them
- Vendor Risk Scoring as the procurement gate
-
acme.example
A
-
payroll.example
C→D
remote.payroll.example· 3389/tcp newly open Critical · not on the vendor’s listdocs.payroll.example· CVE-2021-41773 Critical KEV- The way in: payroll.example → acme.example. Their exposure becomes yours.
-
core-banking.example
A
-
card-processor.example
A
-
collections-agency.example
C
-
law-firm.example
B
-
call-center.example
C
-
cloud-hosting.example
A
-
fintech-partner.example
B
-
kyc-provider.example
B
From the Tier-1 Set to Every Vendor.
The Questionnaire Stays. Its Job Changed.
The annual cycle still runs, as a confirmatory and contractual exercise. The evidence now comes from somewhere else.
| Capability | Now | Before |
|---|---|---|
| Primary evidence | Continuous external monitoring | Annual questionnaire |
| Time to detect a vendor incidentMeasured against public breach disclosures by vendors in the portfolio | Hours | Months |
| Where vendor incidents surface | In the vendor scans | In public news |
| Compliance evidence | Minutes, exported on demand | Weeks of quarterly collection sprints |
| Procurement gate | One Deepinfo score per vendor | Questionnaire review |
| Role of the questionnaire | Confirmation and contract | The evidence itself |
Monitor Every Vendor From Tier 1 Down.
Book a demo and we’ll scan your domain before the call. Third-Party Risk Management runs the same scans on each vendor you add.