Skip to content
Continuous Vendor Monitoring

Know when a vendor’s risk changes, not at the next review

An assessment is the inside-out view of a vendor’s controls at a point in time. Continuous Vendor Monitoring adds the outside-in view in between: attack surface, shadow infrastructure, indicators of compromise, breaches, adverse news, regulatory actions and sanctions, confirmed before they alert, triaged by VendRisk360 and recorded on the vendor they belong to.

Book a demoTalk to sales
The 360 approach

Outside-in monitoring, between inside-out reviews

A point-in-time review is only as current as its evidence. Monitoring keeps watch from the outside for the rest of the cycle, and both views live on the same vendor record.

Inside-out

Evidence-based review of the vendor’s controls from SOC reports, penetration tests, policies and questionnaires, repeated on the cadence your policy sets.

Outside-in

Continuous watch on attack surface, shadow infrastructure, indicators of compromise, breaches and incidents, adverse news and regulatory actions.
Together

360-degree coverage

A confirmed signal can raise a finding or pull the next reassessment forward, so coverage holds between and across assessments.

Managed on the platform

We watch. We confirm. We follow up.

Monitoring only helps if someone reads the signals and acts on them. With Continuous Vendor Monitoring, the VendRisk360 team does that work for you, and every outcome lands on the vendor record your team already uses.

Automated collection

External sources are scanned and checked continuously for every vendor in scope, at the depth your policy sets for each tier.

Triaged by VendRisk360

Confirmed signals are reviewed by our team, who assess relevance and severity and follow up with the vendor where needed.

Early reassessment

A material signal can raise a finding or bring the vendor’s next assessment forward, instead of waiting for the scheduled date.

Visible on the platform

Signals, their evidence and the outcome are recorded on the vendor record and flow into executive and board reporting.
Pair monitoring with Managed Vendor Risk Assessments
Signal families

The signals that change a vendor’s risk

These are the headline families of monitoring signals, the ones most likely to change a residual rating, a notification decision or a board conversation.

External attack surface

TLS certificate and protocol posture, plus exposed services and open remote-access and database ports from licensed internet-wide data and, where it is switched on, our own check of a short list of risky ports, across the vendor’s internet-facing domains. Rolled into the vendor attack surface score.
Attack surface monitoring

Shadow infrastructure

Internet-facing hosts and subdomains linked to the vendor that are easy to forget, found from certificate transparency logs and DNS rather than from the list the vendor declares.
Attack surface monitoring

Indicators of compromise

Signs that a vendor may already be compromised, such as infrastructure associated with malicious activity, so a possible incident is visible before it is disclosed.
Data breach alerts

Adverse news and litigation

Litigation, regulatory action and financial distress reported in the news, which can change a vendor’s risk or viability.
Financial distress alerts

Breaches and security incidents

Breaches and cyber incidents disclosed in SEC filings and state breach notices, leak-site claims and breach databases, the signals most likely to require a notification decision.
Data breach alerts

Regulatory and enforcement actions

Consent orders, fines and enforcement actions against the vendor reported in the news, which often precede service or compliance impact for you.

Sanctions screening

Where Vendor Intelligence is included, screening against the OFAC Specially Designated Nationals list and the HHS OIG exclusion list at onboarding and on an ongoing basis, with possible matches reviewed by a person.
Confirmed-only alerting

Fewer alerts. Every one of them real.

Monitoring tools fail when analysts stop reading the alerts. VendRisk360 confirms each signal before it reaches a person, so the feed stays short enough to act on.

Matched to the right vendor

Signals are resolved to the vendor entity on your register, not to a similarly named company.

Confirmed before alerting

Duplicates and stale items are filtered. Only a confirmed signal becomes an alert.

Routed with the evidence

The owner receives the source, the severity and the vendor context in one place, and records the response.

Vendor attack surface

An outside-in view of every vendor’s exposure

What attackers can see of a vendor is often the first sign of weakness: a remote desktop port left open, an expired certificate, a deprecated TLS version on a customer-facing login, or a host nobody knew was still running.

  • Score with category breakdown and trend, per vendor
  • Exposed services listed with host, port and severity
  • TLS certificate validity and protocol posture
  • Score drops recorded on the vendor record, with the underlying evidence
  • Shadow infrastructure surfaced alongside the vendor’s declared footprint
  • Complements, never replaces, the evidence-based assessment

Exposed services

Internet-facing services and open ports from licensed internet-wide data and, where it is switched on, our own port check, prioritized by what they expose.

TLS posture

Certificate validity, expiry and protocol configuration on vendor domains.

Footprint over time

Trend of the score, so a deteriorating vendor is visible before an incident.

From signal to decision

How a signal reaches the vendor record

Monitoring is only useful if it changes something. Every confirmed signal lands on the vendor record and can reshape the assessment cycle.

Monitoring depth by tier: an example policy

Tier 1 CriticalFull signal set
Tier 2 HighKey signals
Tier 3 MediumKey signals
Tier 4 LowSanctions and public sources
  1. 01

    Signal detected

    Collection
    Sources are checked continuously, each on its own schedule. A raw signal is a candidate, not an alert.
  2. 02

    Signal confirmed

    Before anyone is paged
    The signal is matched to the right vendor entity and confirmed. Name collisions, stale news and duplicates are filtered out, so your team sees only what is real.
  3. 03

    Scored and routed

    To the right owner
    The confirmed signal is scored for severity and routed to the people who own vendor risk, with the source evidence attached.
  4. 04

    Recorded on the vendor

    One record
    The signal, its evidence and the owner’s response are stored on the vendor record, next to the assessment and findings, and appear in executive reporting.
  5. 05

    Assessment brought forward

    Outside-in meets inside-out
    A confirmed breach, an indicator of compromise, an enforcement action or a material drop in attack surface score can lead your team, or ours with managed monitoring customers, to raise a finding or bring the next point-in-time reassessment forward, instead of waiting for the date your policy sets.
RelatedAttack surface monitoring Data breach alerts Financial distress alerts
How it all fits: the TPRM guide
FAQ

Frequently asked questions

What is continuous vendor monitoring?

Continuous monitoring watches for changes in a vendor’s risk between scheduled assessments. It is the outside-in half of the VendRisk360 360 approach: the vendor’s external attack surface, shadow infrastructure, indicators of compromise, breaches and security incidents, adverse news and litigation, regulatory and enforcement actions, and sanctions screening.

How does monitoring relate to vendor assessments?

An assessment is an inside-out, point-in-time review of the vendor’s controls based on evidence such as SOC reports and penetration tests. Monitoring is the outside-in view that runs continuously between those reviews. Both land on the same vendor record, so a confirmed signal can raise a finding or bring the next reassessment forward. Together they give 360-degree coverage between and across assessments.

What is shadow infrastructure?

Internet-facing assets linked to a vendor that are unknown or unmanaged, such as forgotten hosts, stray subdomains or services outside the footprint the vendor declared. They are often less well maintained than the vendor’s known systems, which makes them a common entry point.

Who triages the signals?

With managed monitoring turned on, the VendRisk360 team triages confirmed signals, follows up with the vendor where needed and records the outcome on the vendor record, where your team sees it. If you run the Vendor Lifecycle Management Platform yourself, confirmed signals can instead be routed straight to your vendor owner.

Is the monitoring done by AI?

No. Monitoring relies on automated collection and scanning of external sources, and signals are matched and confirmed before they alert. Triage and any decision about a vendor are made by people: the VendRisk360 team for services customers, or your own vendor owner on the platform.

What does confirmed-only alerting mean?

A raw signal is not sent to your team until it has been matched to the correct vendor and confirmed. That filters out name collisions, duplicates and stale news, so analysts spend their time on real events rather than triaging noise.

What is the vendor attack surface score?

It summarizes the security posture of a vendor’s internet-facing footprint, such as TLS, web and email configuration, exposed services and known vulnerabilities, into an A to F grade across eight risk categories, with the trend. It is an outside-in indicator that complements, and does not replace, the inside-out, evidence-based assessment.

Can a monitoring signal lead to a reassessment?

Yes. A confirmed signal is recorded on the vendor record, where your team, or ours with managed monitoring turned on, can raise a finding or bring the next reassessment forward, for example after a disclosed breach or an enforcement action.

Is monitoring the same for every vendor?

No. How often each vendor is checked is set for your program, from every few hours to weekly, so the vendors that matter most can be watched most closely. A common pattern is the full signal set for Tier 1 Critical vendors and lighter coverage for lower tiers.

Which regulations expect ongoing monitoring?

The US Interagency Guidance on Third-Party Relationships, the EBA Guidelines on outsourcing, DORA, APRA CPS 230, MAS and RBI outsourcing requirements all expect ongoing monitoring proportionate to risk. VendRisk360 is aligned to these expectations; each organization remains responsible for its compliance.

Get started

See VendRisk360 on your own vendors

A tailored walkthrough with a third-party risk specialist, built around your program, your regulators and your vendors.

Book a demoTalk to sales