Third-Party Risk Management
Assess Every Vendor on What It Exposes.
A questionnaire records what a vendor believed about itself on the day it answered. Third-Party Risk Management runs each vendor as its own portfolio on the External Attack Surface Management engine, with the discovery, scanning, issues and scoring your surface gets.
| Your assets, acme | Vendor portfolio, payroll | |
|---|---|---|
| WHOIS | checked | checked |
| IP WHOIS | checked | checked |
| DNS | checked | checked |
| SSL | checked | checked |
| Ports | checked | remote desktop exposed Critical |
| Web data | checked | checked |
| HTTP | checked | checked |
Questionnaire · last review answered: no exposed services (contradicted by the scan)
One scale, both portfolios
- acme.example
- payroll.example
A Questionnaire Is a Snapshot.
Questionnaires answer governance questions well. They are a poor record of what a vendor exposes to the internet this week.
Self-reported
Answers, Not Observations
A questionnaire tells you what the vendor believes. It can’t show you the staging server the vendor forgot about.
Point in time
Stale by the Next Review
Certificates expire, ports open, software ages. None of it waits for the annual review cycle.
Scale
More Vendors Than Reviewers
Deep reviews go to the largest vendors. The long tail gets a form, or nothing at all.
All Vendors Sit on One Scale.
A grade reads identically for each vendor and for your surface, so the one that falls stands out.
-
acme.example
A
-
payroll.example
C→D
remote.payroll.example· 3389/tcp newly open Critical · not on the vendor’s listdocs.payroll.example· CVE-2021-41773 Critical KEV- The way in: payroll.example → acme.example. Their exposure becomes yours.
-
cloud-hosting.example
A
-
cdn-provider.example
A
-
logistics-co.example
B
-
law-firm.example
C
-
call-center.example
C
-
marketing-agency.example
B
-
subsidiary-eu.example
B
-
crm-saas.example
A
Your Engine Runs on Each Vendor.
Adding a vendor works like adding one of your domains, so the long tail of small suppliers gets the same scanning as the largest.
Vendor Discovery
Start from a vendor’s primary domain and map its subdomains, IP addresses and related domains, then approve what belongs to the vendor.
Continuous Monitoring
Scan every asset in each vendor portfolio across WHOIS, IP WHOIS, DNS, SSL, ports, web data and HTTP, with history per layer.
Vendor Risk Assessments
Misconfigurations, weak TLS, expiring certificates, exposed services and known CVEs on vendor assets, each with evidence and a severity.
Vendor Risk Scoring
A security score per vendor, built the way yours is, with each CVE ranked by CVSS, EPSS and CISA KEV together.
Compliance Tracking
Vendor issues classified against OWASP Top 10 2021, PCI DSS 4.0 and 3.2, HIPAA, CWE, CAPEC and WASC.
From Onboarding to the Annual Review.
-
01
Add
Create a portfolio for each third party from its primary domain, before the contract or for vendors already in place.
-
02
Map
Discovery proposes the vendor’s related assets. Your team approves what belongs to the vendor and ignores the rest.
-
03
Watch
The notification rules that watch your assets cover vendor assets too: new and reappeared issues, score drops, certificate, WHOIS and DNS changes, new open ports.
-
04
Engage
Take the evidence to the vendor. Each issue keeps its state, so the follow-up is on record until a rescan confirms the fix.
-
05
Review
At renewal, the review starts from observed issues and score history. The questionnaire becomes the confirming document.
Use This Data in Your Tools
Your tools can look up any company’s domains, subdomains and registration data through the API, from the index the Deepinfo Platform scans vendors with.
Questions About Third-Party Risk Management
Do we still need questionnaires?
Usually, yes, for contractual and governance questions that external scanning can’t answer, such as policies and internal controls. External evidence changes their role: they confirm what monitoring already shows instead of standing alone as evidence.
Does the vendor have to install anything?
No. Discovery and scanning read what the vendor exposes on the public internet: DNS, certificates, WHOIS, open ports and web responses. There is no agent and no login.
What can external scanning see about a vendor?
Everything the vendor exposes to the internet: domains, subdomains and IP addresses, DNS and certificates, open ports and services, web technologies and their known CVEs. It can’t see inside the vendor’s network.
How are vendors scored?
Exactly as your surface is. Each vendor portfolio gets its own security score, with vulnerabilities ranked by CVSS, EPSS and CISA KEV together. See Vendor Risk Scoring.
How often are vendor assets rescanned?
On the schedule your surface gets. Vendor portfolios run on the engine that scans your assets, and there is no lighter schedule for vendors.
Will discovery find every host a vendor runs?
It finds what links back to the vendor in public data: a shared registrant, mail servers, name servers, IP addresses and certificate names. A service the vendor runs for you under your domain belongs in your inventory, and a host with no public link can be added to the vendor’s portfolio by hand.
Does Deepinfo certify vendors as compliant?
No. Vendor issues are classified against frameworks such as PCI DSS, HIPAA and OWASP Top 10, and your team and auditors use that as evidence for the review. It is not an attestation.
Can subsidiaries be tracked like this?
Yes. A group company runs as its own portfolio exactly like a vendor. See Subsidiary Oversight.
Score Your Vendors on Your Own Scale.
Bring a short list of vendors to a demo and see their external posture scored next to yours.