Third-Party Risk Management
Your Vendors’ Exposures Are Yours Too.
Third-Party Risk Management assesses the cyber risk that vendors, suppliers and partners bring into your organization. Deepinfo runs its External Attack Surface Management engine on each third party: every vendor becomes a portfolio with its own asset inventory, scanned and scored like your surface, without waiting for a questionnaire to come back.
- Your building, whole and shut: your own surface, graded A.
- A covered bridge to the vendor, payroll.example: the link its service needs.
- Vendor discovery: beside the vendor, an annex nobody put on its list: remote.payroll.example.
- Continuous monitoring: its door, 3389/tcp, newly open between two questionnaires, critical. The questionnaire said “Are internet-facing systems patched?” “Yes.”
- Vendor risk assessments: docs.payroll.example runs Apache httpd 2.4.49: CVE-2021-41773 · KEV, critical.
- Compliance tracking: Weak TLS cipher · pay.payroll.example, a PCI DSS 4.0 finding.
- Vendor risk scoring: the vendor's score fell (domain_security_score_decreased), from C to D, below your own A.
- The way in: from the street, by the open door, through the vendor and over the bridge into your building. Their exposure becomes yours.
- Every vendor, scanned like your surface: an asset inventory per vendor, scored on your own scale, without waiting for a questionnaire.
Vendor Risk Changes Between Reviews.
A questionnaire tells you what a vendor believes about itself. A scan shows what an attacker sees.
The usual third-party program runs on annual questionnaires and certificates collected in spreadsheets. The answers describe one moment, written by the party being assessed.
Between two reviews a vendor can let a certificate lapse, expose a remote desktop port or fall behind on a CVE that CISA has listed as exploited. None of that waits for the next questionnaire.
- certificate lapses
- 3389/tcp opens
- KEV-listed CVE
- a scan
- the change
- caught at the next scan
Discovery to Compliance Across Your Vendor Portfolio.
Vendor Discovery
Start from a vendor’s primary domain and map what it runs on the internet: the subdomains, IP addresses and related domains no questionnaire lists.
Continuous Monitoring
Scan the assets in each vendor portfolio across the data layers used for yours, and keep each layer’s history so you can see what changed.
Vendor Risk Assessments
Misconfigurations, weak TLS, expiring certificates, exposed services and known CVEs on vendor infrastructure, each with evidence and a severity from Critical to Information.
Vendor Risk Scoring
A security score for each vendor, built like yours, with every CVE ranked by CVSS, EPSS and CISA KEV together.
Compliance Tracking
Vendor findings classified against the frameworks your issues use, from OWASP Top 10 2021 to PCI DSS 4.0 and HIPAA.
Your Vendors on One Scale.
Each third party is its own portfolio, scored by the engine that scores your surface, so a weak vendor stands out against the rest and against you.
-
acme.example
A
-
payroll.example
C→D
remote.payroll.example· 3389/tcp newly open Critical · not on the vendor’s listdocs.payroll.example· CVE-2021-41773 Critical KEV- The way in: payroll.example → acme.example. Their exposure becomes yours.
-
cloud-hosting.example
A
-
cdn-provider.example
A
-
logistics-co.example
B
-
law-firm.example
C
-
call-center.example
C
-
marketing-agency.example
B
-
subsidiary-eu.example
B
-
crm-saas.example
A
Your Scan Engine Runs on Vendors Too.
A portfolio holds one organization’s assets: its own inventory, its own scans, its own issues and its own score. Adding a vendor works like adding a new part of your surface.
Because the engine is shared, a vendor finding looks exactly like one of your own. The severity scale, the issue states, the evidence and the CVE ranking are identical, so the two can be compared line by line.
| Data layers | WHOIS to HTTP, per vendor asset |
|---|---|
| Issue states | The lifecycle your issues use, with the history of each change |
| Severity | Critical, High, Medium, Low, Information |
| Frameworks | OWASP, PCI DSS 4.0 and 3.2, HIPAA, CWE, CAPEC, WASC |
Scan Layers Read as Vendor Risk.
The layers are the ones EASM scans on your assets. What changes is the question you ask of them.
- WHOIS: which registrar holds the vendor’s domains, and when each registration expires
- IP WHOIS: which networks, owners and countries the vendor’s services run on
- DNS: how its name servers and mail exchangers are set up, and when records change
- SSL: expired and expiring certificates, their issuers, and the host names each one reveals
- Ports: services open to the internet over TCP and UDP, such as remote access or databases
- Web data: technologies in use, login pages and screenshots
- HTTP: response headers and status codes for each host it exposes
Scanall checked
remote.payroll.example
-
WHOIS
whoispayroll.example · renews in 23 days
snapshot 2026-09-24
-
IP WHOIS
ipwhoisAS64500 · 203.0.113.0/24
snapshot 2026-09-24
-
DNS
dnsA 203.0.113.61
snapshot 2026-09-24
-
SSL
sslcertificate reissued
snapshot 2026-09-24
-
Ports
port_scan3389/tcp · remote desktop open
snapshot 2026-09-24
Critical -
Web data
webdatalogin page
snapshot 2026-09-24
-
HTTP
http200 · response headers
snapshot 2026-09-24
What Each Source Can Tell You.
Questionnaires still matter for what only the vendor knows. External scanning covers what anyone on the internet can already see, and keeps covering it between reviews.
| Capability | External scanning | Questionnaire |
|---|---|---|
| Visible from the internet | ||
| Expired or expiring certificates | Yes | Self-reported |
| Open ports and exposed services | Yes | Self-reported |
| Known CVEs on internet-facing technology | Ranked by CVSS, EPSS and KEV | Self-reported |
| Changes between review cycles | Yes | No |
| Needs the vendor to take part | No | Yes |
| Known only inside the vendor | ||
| Security awareness training | No | Yes |
| Incident response procedures | No | Yes |
| Internal access controls | No | Yes |
Where It Fits in Your Vendor Program.
Before signing
Onboarding
Add a prospective vendor’s primary domain as a portfolio and review its external posture before the contract is signed.
During the contract
A Continuous Watch
The notification rules that watch your assets cover vendor assets too: new and reappeared issues, score drops, certificate, WHOIS and DNS changes, new open ports. Instant, or as an hourly to monthly digest.
At review time
Evidence on Record
Each vendor issue keeps its evidence, its state history and its framework classification, so a review starts from records instead of a request for answers.
Query This Data Through the API
Vendors are discovered and scanned from the index that holds your assets. Your tools can look up any vendor’s domains through the API. The index holds 400M+ domains, 2B+ subdomains, 200B+ DNS records and 30B+ SSL certificates.
Questions About Third-Party Risk Management
What is Third-Party Risk Management?
Third-Party Risk Management is the continuous assessment of the cyber risk introduced by vendors, suppliers and partners with access to your data, systems or brand. What a third party reports about itself and what an attacker can observe are two different pictures, and a program needs both. Deepinfo TPRM supplies the second one, from external evidence.
What does Deepinfo monitor for each third party?
The same data layers the platform runs on your surface: WHOIS, IP WHOIS, DNS, SSL, open TCP and UDP ports, web data and HTTP. Findings are scored and ranked like yours too, with CVSS, EPSS and CISA KEV on each CVE.
How is it different from security questionnaires?
Questionnaires are point-in-time and self-attested. Tools that inspect a vendor’s cloud configuration need access the vendor has to grant. Deepinfo TPRM works entirely from external observation, continuously, and needs nothing from the vendor.
What is the workflow for adding a new vendor?
Add the vendor as a portfolio, starting from its primary domain. The platform discovers related assets for your team to approve, scans the approved ones layer by layer and scores them. From then on the vendor is monitored exactly like your own surface.
Where should we start with our vendor list?
With the providers your own surface already names. External Attack Surface Management groups your assets by registrar, name server, mail server, network and SSL issuer, and that list, read next to procurement’s vendor list, points to the first portfolios. See Vendor Discovery.
Does it replace our vendor risk program?
No. It gives the program evidence. Questionnaires and contracts still cover what only the vendor can tell you, such as training, incident response and internal access controls, while the platform covers what is visible from the internet, continuously.
How is TPRM priced?
Pricing depends on the scope you monitor. See pricing for how it works, or talk to us for a scoped quote.
See Your Vendors’ Attack Surfaces.
Bring a short list of vendors to a working demo and see their external posture scored on the same scale as yours.