- Home
- Assessments & Advisory
- Supply chain risk
Your vendors hold your data,
so check what they expose.
We inventory and tier your vendors by the access they have, check what each one actually exposes on the internet and the darknet, design and review the questionnaires, write the contract requirements and keep watching the vendors that matter.
A questionnaire is a vendor's opinion of itself.
Supply chain attacks reach you through someone you trusted: a software update, a managed service provider, a file transfer tool, a SaaS platform holding your customer records. Most organizations send a questionnaire at onboarding and never look again. Self-assessment is not verification.
We start by finding out who your vendors are and how much access each one has, then tier them so effort goes where the risk is. For the vendors that matter, we check what their estate actually exposes from the outside, look for their credentials and data on darknet and leak sites through our threat intelligence team, and keep monitoring after onboarding, so you hear about a vendor breach from us, not from the news.
- A vendor inventory tiered by access to your systems and data
- External attack-surface and darknet-exposure checks on each critical vendor
- Questionnaire design and expert review, aligned to SOC 2, ISO 27001 and NIST CSF
- Contractual security requirements: notification windows, audit rights, minimum controls
- Continuous monitoring of the vendors that matter, with alerts on breaches and leaks
- Software dependency visibility through SBOM and composition analysis, where you ship or run critical software
Four steps, inventory to monitoring.
Inventory
We find every vendor with access to your systems or data, including the ones procurement did not route through security.
Tier
Vendors are ranked by access, data sensitivity and business dependency, so the deepest checks go to the vendors that could hurt you most.
Verify
Questionnaires and SOC 2 reports are reviewed, then checked against what each critical vendor actually exposes from the outside and on the darknet.
Contract and monitor
Security requirements go into the contract, and critical vendors are monitored continuously, with re-assessment on a schedule or after an event.
Mapped to what your regulator expects.
- SAMA Cyber Security Framework and MAS TRM third-party risk management
- NIST SP 800-161 supply chain risk
- SOC 2 and ISO 27001 supplier controls
- CSA STAR for cloud providers
- UAE PDPL and Saudi PDPL accountability for data held by processors
- NCA ECC third-party cybersecurity controls
Who it is for
Any organization with regulated data held by suppliers: financial institutions answering to the CBUAE, SAMA or MAS, health organizations sharing patient data, and anyone whose customers ask how their vendors are vetted.
- Threat intelligence, the exposure data behind vendor checks
- Darknet & leak-site monitoring, watch for vendor leaks continuously
- M&A cyber diligence, the same scrutiny applied to a target
- GRC & compliance, Forseti, run the vendor programme as part of compliance
What buyers ask.
We send vendors a questionnaire.
Self-assessment is not verification. We check what their estate actually exposes, from the outside and on the darknet, and compare it with what they told you.
We have hundreds of vendors. Where do we start?
With tiering. Most of your risk sits with a small number of vendors that have deep access. We find them first and put the effort there.
Will vendors cooperate?
The outside-in checks need nothing from the vendor. For the rest, contractual requirements and a clear, proportionate questionnaire get far better response rates than a hundred-question spreadsheet.
What happens when one of our vendors is breached?
Continuous monitoring tells you early, and the notification terms we put in the contract make sure the vendor tells you too. If you are affected, our incident response team is available 24/7.
Find out which vendors are real risk.
Start with an inventory and a tiered assessment of your critical suppliers. We will scope it with you, no charge.