Request demo

Vendor Risk Scoring

Score Every Vendor on Your Own Scale.

A vendor score is only useful if it reads the same for all vendors and for you. Each third-party portfolio is scored by the engine that scores your surface, from the issues and vulnerabilities found on the vendor’s assets.

When a score drops, the findings behind it are listed with their evidence. Nobody has to trust a number they cannot open.

Request demo

  1. Findings

    • Remote-access port open
    • Certificate expires in 5 days
    • CVE-2021-41773 KEV

  2. Asset score

  3. Domain score

  4. Vendor scorepayroll.example

On your own scale

  • Your own assets
  • payroll.example
  • cdn-provider.example

domain_security_score_decreased

From Findings to a Comparable Score.

  1. 01

    Findings

    The External Attack Surface Management engine raises issues and vulnerabilities on each vendor asset, each with a severity from Critical to Information.

  2. 02

    Asset score

    Each vendor domain, subdomain and IP address gets its own security score.

  3. 03

    Domain score

    Each vendor domain gets a score that covers its subdomains and websites.

  4. 04

    Vendor score

    The portfolio gets an overall score, as your attack surface does, so each vendor sits on the scale you use for yourself.

Find the Vendor CVEs Worth a Call Today.

A long list of CVEs on a vendor and one KEV-listed CVE on its login portal are different conversations.

Each CVE found on a vendor asset carries its CVSS score, its EPSS probability of exploitation in the next 30 days, and whether CISA lists it as known exploited.

Sort a vendor’s CVEs by all three and the top of the list is what to raise with the vendor now. A high CVSS with a negligible EPSS and no KEV listing can wait for the scheduled review.

CVE on one of the vendor’s assets

Fix first listed in CISA KEV, known to be exploited

  1. CVE-2021-44228

    10.0

    EPSS 0.99999 CISA KEV

    Critical

  2. CVE-2021-41773

    9.8

    CISA KEV

    Critical

The normal patch cycle EPSS low, not in CISA KEV

  1. a CVE

    9.8

    EPSS low

    Critical

  2. a CVE

    5.3

    EPSS low

    Medium

CVSS alone cannot tell the two 9.8s apart. CISA KEV and EPSS can.

Scores That Move With the Evidence.

Score Timeline

A daily, weekly or monthly series for each vendor asset and domain, so a slow decline is as visible as a sudden drop.

Score Alerts

Notification rules on asset and domain score decreases or changes, delivered instantly or as a digest.

Score by Issue Type

Separate score timelines per issue type and per issue category show which kind of issue is pulling a vendor down.

Business Weight

Give the vendor systems that handle your data a higher business-importance weight (0 to 1000) than its marketing sites, and sort by it.

Use the Score Where Decisions Happen.

Onboarding

Before the Contract

Add a prospective vendor as a portfolio and read its score and findings before it gets access to anything.

Renewal

At the Review

Bring the score timeline and the open issues to the renewal conversation instead of last year’s questionnaire.

Oversight

In Between

Score-decrease alerts go to the person on your team who owns the vendor, instantly or as an hourly to monthly digest.

Scores Come From the Findings.

Customer story A major Türkiye-based bank Vendor onboarding now gates on one score that procurement and risk read the same way. Read TPRM Compliance Tracking Vendor findings filtered by the frameworks your audits use. Read EASM Risk Scoring The scoring engine underneath, run on your surface. Read

Query This Data Through the API

Vendors are discovered and scanned from the index that holds your assets. Your tools can look up any vendor’s domains through the API.

Questions About Vendor Scores

Is a vendor score the same kind of score as ours?

Yes. One engine computes both from the same kinds of findings, which is the point: a vendor and your own surface can be compared directly.

What pulls a vendor’s score down?

The issues and vulnerabilities open on its assets. Score timelines per issue type and issue category show the reason for a particular vendor’s score in its own data. See methodology for how the platform collects, scans and scores.

Can a vendor’s score change without the vendor changing anything?

Yes. When a newly published CVE matches a version the vendor already runs, it lands as a new vulnerability on that asset and counts toward the score.

What if a vendor disputes its score?

Open the findings behind it. Each one carries the evidence that raised it, and if the vendor shows a finding is wrong, your team marks it as a false positive with the decision kept on record.

How does a vendor improve its score?

By fixing what was found. Once a rescan confirms a fix, the issue moves to verified resolved and the change shows up in the vendor’s next score snapshot.

Score the Vendors You Depend On.

Bring your shortlist of critical vendors to a demo and compare their scores with yours.

Request demo