Know when a vendor’s risk changes, not at the next review

Continuous monitoring watches for changes in a vendor’s risk between scheduled assessments. It is the outside-in half of the VendRisk360 360 approach: the vendor’s external attack surface, shadow infrastructure, indicators of compromise, breaches and security incidents, adverse news and litigation, regulatory and enforcement actions, and sanctions screening, across nine monitoring categories.

An assessment is an inside-out, point-in-time review of the vendor’s controls based on evidence such as SOC reports and penetration tests. Monitoring is the outside-in view that runs continuously between those reviews. Both land on the same vendor record, so a confirmed signal can raise a finding or bring the next reassessment forward. Together they give 360-degree coverage between and across assessments.

Internet-facing assets linked to a vendor that are unknown or unmanaged, such as forgotten hosts, stray subdomains or services outside the footprint the vendor declared. They are often less well maintained than the vendor’s known systems, which makes them a common entry point.

For services customers, the VendRisk360 team triages confirmed signals, follows up with the vendor where needed and records the outcome on the vendor record, where your team sees it. If you run the Vendor Lifecycle Management Platform yourself, confirmed signals can instead be routed straight to your vendor owner.

No. Monitoring relies on automated collection and scanning of external sources, and signals are matched and confirmed before they alert. Triage and any decision about a vendor are made by people: the VendRisk360 team for services customers, or your own vendor owner on the platform.

A raw signal is not sent to your team until it has been matched to the correct vendor and confirmed. That filters out name collisions, duplicates and stale news, so analysts spend their time on real events rather than triaging noise.

It summarizes the security posture of a vendor’s internet-facing footprint, such as exposed services and TLS configuration, into a single score with a category breakdown and trend. It is an outside-in indicator that complements, and does not replace, the inside-out, evidence-based assessment.

Yes. A confirmed signal is recorded on the vendor record and can raise a finding or bring the next reassessment forward, for example after a disclosed breach or an enforcement action.

No. Monitoring depth follows the tier and your policy. A common pattern is the full signal set for Critical vendors, key signals for Material vendors, and sanctions and public-source checks for Low-risk vendors.

The US Interagency Guidance on Third-Party Relationships, the EBA Guidelines on outsourcing, DORA, APRA CPS 230, MAS and RBI outsourcing requirements all expect ongoing monitoring proportionate to risk. VendRisk360 is aligned to these expectations; each organization remains responsible for its compliance.