See every vendor the way an attacker would
VendRisk360 discovers what each vendor exposes to the internet, checks it continuously from the outside, and rolls the findings into an A to F grade on the vendor record, next to the vendor’s assessment, evidence and findings.
Between assessments, a vendor’s exposure keeps changing
A SOC report or a penetration test describes a vendor at a point in time. New subdomains appear, certificates expire, software falls out of support and new vulnerabilities are exploited. Attack surface monitoring watches all of it, for every vendor, without waiting for the vendor to tell you.
- One consistent, outside-in grade for every vendor
- Assets found automatically, including forgotten ones
- Known exploited vulnerabilities called out, not buried
- Every finding shows what was seen, where and when
What VendRisk360 checks on every vendor
Each check feeds one of eight risk categories, the same ones you see on the vendor’s attack surface view and in the cyber risk report.
TLS and certificates
Web security headers
Email and domain protection
Exposed services
Known vulnerabilities
Exposed files and pages
Reputation and compromise
The providers behind the vendor
The hosts a vendor forgot are the ones attackers find
Old campaign sites, staging servers and test APIs are less maintained than the main site, which makes them a common way in. Discovery surfaces them next to the vendor’s known footprint, so the conversation with the vendor starts from facts.
Found, not declared
Assets come from certificate transparency and DNS, not only from the list the vendor gives you.
“Not ours” when it is not
Mark an asset that does not belong to the vendor, and it leaves your score and lists. Other customers are unaffected.
Fix speed
See how quickly a vendor fixes what monitoring finds, and how many findings have been open for over 90 days.
From discovery to a decision on the vendor record
Five steps, each one designed to keep the grade trustworthy.
- 01
Discover the footprint
AssetsHosts and subdomains are found from certificate transparency logs and DNS, with who hosts each address. Another domain is added only after it is confirmed to belong to the vendor, and an asset that stops being seen is marked stale and its findings close. - 02
Check it from the outside
Passive and politeEach asset is checked the way any visitor could see it: no logins, no exploits, no form submissions. Requests are paced and identify themselves, and checks run continuously, from every few hours to weekly depending on the vendor. - 03
Confirm before it counts
No noiseA finding has to be seen twice before it affects the score, unless it is a known exploited vulnerability. A vulnerability guessed only from a version banner is listed as unverified for checking, and never lowers the score. - 04
Grade and record
Eight categoriesFindings roll into eight risk categories and an A to F grade, with the trend over time, next to the vendor’s assessment and evidence. - 05
Act on what matters
Your decisionAcknowledge a finding, request remediation from the vendor with the evidence attached, accept it, or mark it a false positive. Your decisions change your organization’s view only. A material change can lead your team to bring the next assessment forward.
Frequently asked questions
What is vendor attack surface monitoring?
It is the continuous, outside-in check of everything a vendor exposes to the internet: domains, hosts, certificates, web and email configuration, exposed services and known vulnerabilities. It shows what an attacker could see of the vendor, without needing the vendor’s cooperation, and complements the evidence-based assessment of the vendor’s controls.
How is it different from external attack surface management (EASM)?
EASM tools watch your own organization’s footprint. Vendor attack surface monitoring applies the same discovery and checks to each third party, scores them consistently, and records the result on the vendor record next to the assessment, so it informs third-party risk decisions rather than your own patching queue.
Does monitoring scan vendors aggressively?
No. Checks are the ones any visitor’s browser or mail server makes: reading public records, loading public pages and negotiating TLS. VendRisk360 does not log in, exploit or submit forms, paces its requests and honors opt-out requests.
Does a poor grade mean the vendor is insecure?
Not on its own. The grade is an outside-in indicator. It tells you where to look and what to ask, and it sits next to the inside-out assessment of the vendor’s controls on evidence such as SOC reports and penetration tests. Both views together give the full picture.
See the attack surface of your own vendors
A tailored walkthrough with a third-party risk specialist, built around your program, your regulators and your vendors.