Request demo

Vendor Discovery

Map a Vendor’s Attack Surface From One Domain.

A questionnaire lists the systems the vendor thinks matter. Third-Party Risk Management starts from the vendor’s primary domain and runs the engine that maps your surface: subdomains, the IPs behind them and related domains. Your team approves what is in scope, and everything approved is monitored.

Request demo

  1. Root domain

    payroll.example

    IP address

  2. www.

    443/tcp · TLS 1.3

    198.51.100.20

  3. portal.

    Login page · HTTP 200

    198.51.100.21

  4. sftp.

    22/tcp · SSH

    198.51.100.34

  5. api.

    Certificate expires in 5 days Medium

    198.51.100.40

  6. docs.

    Apache httpd 2.4.49 High

    CVE-2021-41773 Critical KEV

    198.51.100.52

  7. hr-legacy.

    PHP 7.4 · end of life High

    203.0.113.9

  8. Asset discovery

    not in inventory · found from the root

  9. remote.

    3389/tcp · RDP open Critical

    203.0.113.61

Your Own Surface Already Names Your Providers.

Before you add a single vendor, your inventory holds a list of candidates.

External Attack Surface Management groups your assets by registrar, name server, mail server, network (ASN) and SSL issuer. Read together, that is a list of the companies your internet presence runs on.

Put it next to the vendor list procurement already keeps, and you have your first portfolios. Which third parties to add stays your team’s decision.

RegistrarWho holds your domain registrations
Name serverWho answers DNS for your domains
Mail serverWho receives your email
ASNWhich networks host your IP addresses
SSL issuerWhich authorities sign your certificates

From a Vendor’s Domain to a Monitored Portfolio.

Third-Party Risk Management is External Attack Surface Management running on portfolios. Adding a vendor works like adding your own domain, with the same discovery rules behind it.

  1. 01

    Portfolio

    Each third party gets its own portfolio: its own asset list, its own issues, its own score. Vendors, suppliers and your subsidiaries all work this way.

  2. 02

    Seed

    Add the vendor’s primary domain, plus any other domains or IP addresses you already know it uses.

  3. 03

    Expand

    The engine enumerates subdomains and resolves them, then pivots across Deepinfo’s index with reverse IP, reverse MX, reverse NS and reverse WHOIS to find related domains.

  4. 04

    Approve

    Candidates land in the portfolio’s discovery queue. Your team approves what belongs to the vendor, ignores what does not, and can revert either decision later.

What Vendor Discovery Usually Turns Up.

On the map at the top of this page, the host not in inventory is a remote-access gateway that was missing from the vendor’s own list of systems.

Hosts Outside the Questionnaire

Portals, file-transfer servers and remote-access gateways the vendor never listed, all reachable from the internet.

Group-Company Domains

Domains that share the vendor’s registrant or mail servers, which point to the vendor’s own subsidiaries and brands.

Regional and Product Domains

Separate domains for each market or product line, often run by different teams inside the vendor.

Legacy and Pre-Production

Staging, test and retired environments that still answer on the vendor’s domains.

Hosts Named in Certificates

Each certificate on a vendor host lists the names it covers, and each name is a lead to more of the vendor’s surface.

Mail and DNS Setup

The MX and NS records behind each vendor domain, which show who handles the vendor’s email and DNS.

Discovery Is Where the Rest Starts.

TPRM Continuous Monitoring Vendor assets, scanned layer by layer, with history. Read TPRM Vendor Risk Scoring Vendors on the scale you use for yourself. Read EASM Asset Discovery The discovery engine underneath, run on your surface. Read

Query This Data Through the API

Vendors are discovered and scanned from the index that holds your assets. Your tools can look up any vendor’s domains through the API.

Questions About Vendor Discovery.

Does the vendor have to install anything or grant access?

No. Discovery and scanning work from the public internet: DNS, certificates, WHOIS, open ports and web responses. There is no agent, no login and no access request.

Will discovery find every host a vendor runs?

It finds what links back to the vendor in public data: a shared registrant, mail servers, name servers, IP addresses and certificate names. A service the vendor runs for you under your own domain belongs in your inventory. A host with no public link to the vendor can be added to its portfolio by hand.

Can shared hosting pull in domains that aren’t the vendor’s?

It can. Shared hosting and CDNs put unrelated domains on the same IP addresses, which is why candidates wait for your team’s review unless a rule you configured approves them.

What if the vendor hides its WHOIS details?

Records behind a privacy service can’t be matched in a reverse WHOIS search. Discovery still follows subdomains, certificate names, name servers, mail servers and IP addresses, and anything else can be added to the portfolio by hand.

What happens to a candidate we ignore?

It stays out of monitoring, and the decision is kept. If the candidate turns out to belong to the vendor after all, your team reverts the decision and approves it.

Map Your First Three Vendors.

Bring three vendor domains to a demo and watch discovery run on them.

Request demo