Skip to content
Security

How we scan

VendRisk360 continuous monitoring looks at the public, internet-facing side of organizations our customers rely on. This page explains what it looks at, how to recognise it, and how to ask us to stop.

Last updated: 3 October 2026

1. Why we scan

Our customers depend on vendors and service providers, and are expected, often by their regulators, to keep watching the security of those relationships. Continuous monitoring gives them an outside-in view: what anyone on the internet can already see about an organization’s public systems, such as an expired certificate, a missing email protection or a file published by mistake.

We look only at what is publicly reachable. We do not test anything behind a login, and we do not try to get in.

2. Public sources we read

Most of what we know comes from public records that never touch your systems:

  • certificate transparency logs, which list the certificates issued for a domain;
  • public DNS records and domain registration data (RDAP);
  • public blocklists and threat lists that record abuse from domains and addresses;
  • breach catalogues, regulatory filings and news reports.

3. What we send to your systems

Some checks need us to connect to your public services, the way any visitor would:

  • Websites. We request your public pages and read the response, including security headers, cookie settings, redirects and the scripts the page loads.
  • Certificates and encryption. We connect over TLS to check the certificate and which protocol versions and cipher suites are accepted. This opens a series of short connections.
  • Files published by mistake. We request a short, fixed list of well-known paths that are often exposed in error (for example a version-control folder, an environment file or a database backup), and /.well-known/security.txt. We read the response only to confirm whether the file is really there.
  • DNS. We read your public DNS records, including email security records, and check whether your name servers answer recursive queries for anyone.
  • Unclaimed subdomains. We request subdomains that point at cloud services, to see whether the service behind them has been released and could be claimed by someone else.

We do not scan ranges of ports. Where we report an exposed service, the information comes from licensed internet-wide datasets that record what any visitor can see, or from our port check: where it is switched on, we make one ordinary connection to each port on a short, fixed list of services that should not face the internet (remote administration, databases, file sharing and container control planes). We check only addresses your own host names point at, directly or through your own cloud load balancer, never a shared content-delivery or hosting network or a third party one of your names is aliased to. Where we confirm a service is still open, we make one ordinary connection to that port. All of these stay within the same rate limits.

4. What we never do

  • We never try to log in, guess passwords or use credentials.
  • We never send exploit code or attempt to break in.
  • We never submit forms, change data or delete anything.
  • We never run load or denial-of-service tests.

5. Recognising our requests

Every web request our scanner sends carries this User-Agent header:

Mozilla/5.0 (compatible; VendRisk360-Scanner/1.0; +https://www.vendrisk360.com/scanner/)

It names us and links to this page. We do not disguise our requests as an ordinary browser or hide who we are.

If you are unsure whether a request came from us, email security@vendrisk360.com with the time (and time zone), the address it came from and the host it reached, and we will tell you.

6. How often

Monitoring runs continuously. Public sources such as breach catalogues, threat lists, regulatory filings and news are checked on a rolling schedule of their own. Direct checks of an organization’s systems recur on a schedule set for that organization, from every few hours to weekly, with an extra check when a customer asks for one (for example to confirm a fix) or when an earlier check could not reach a site.

Our requests are paced, with limits for each host and for each organization as a whole, so a check never arrives as a burst of traffic.

7. Asking us to stop

To ask us to stop scanning systems you are responsible for, email security@vendrisk360.com from an address at the domain concerned, listing the domains, hosts or address ranges. We will confirm when the change takes effect.

We will then stop sending requests to the systems you name. We may still use public information that does not involve contacting your systems, such as certificate transparency logs, DNS records and public threat lists. Customers who monitor your organization will see that these checks were not run.

8. Reporting a problem

If you think our scanner caused a problem, or you want to report abuse, email security@vendrisk360.com with the time, the host affected and anything from your logs that helps us find the requests. We will investigate, and we will pause scanning of the hosts concerned while we do.

9. What happens to the results

Findings are shown to the customers who monitor your organization through our platform. If you believe a finding is wrong, tell us at security@vendrisk360.com and we will review it. Our privacy notice explains how we handle personal information, and our security page explains how to report a vulnerability in our own platform.