Making how organisations rely on each other proven, not assumed.
Assessment is not an event. It is a cycle, with re-entry triggers at every stage when conditions change.
Nine dimensions. Each chosen because it reveals something about a vendor that their own answers would not.
Why: Attack surface is observable before an incident. Gaps in how a vendor maintains their own security boundary are signals, not speculation.
Why: Who ultimately controls a supplier. and through which jurisdictions. determines whether their compliance obligations and yours align.
Why: A vendor entering financial distress is an operational risk regardless of how well they patch their systems.
Why: Where a vendor operates, develops, and processes data shapes the risks they carry. risks that no questionnaire will surface.
Why: Patterns in public record. enforcement actions, litigation, regulatory attention. indicate how a vendor operates under pressure.
Why: How replaceable a vendor is, and how many of your critical processes they touch, determines the consequence of failure. not just its likelihood.
Why: Regulations evolve. Countries enter restricted lists. Technology categories fall under new export controls or supervisory frameworks. We track how the regulatory landscape shifts and flag when a vendor’s jurisdiction, product, or sector moves into higher-risk territory.
Why: When a single vendor. or a small cluster of vendors. underpins multiple critical processes simultaneously, the systemic exposure exceeds what any individual vendor assessment would reveal.
Why: The risk inside a vendor’s own supply chain. who they depend on, where their critical components originate. is rarely visible from the outside. We map it where it matters most.
Notice the gap between the two polygons on the regulatory dimension. It is almost invisible on questionnaires because vendors cannot self-report what they do not track.
After assessment and treatment, the tool maintains continuous background surveillance on every in-scope vendor. When a signal crosses a threshold, the alert escalates automatically. No quarterly review cycle catches what continuous monitoring does.
See the full monitoring layer →Two kinds of organisations have this problem.
Organisations investing primarily in documentation risk crowding out actual security improvements. The distinction matters more than most supply chain security programmes acknowledge.
Every TPRM process starts with a client-provided vendor list. The problem: you always begin with an incomplete picture. Operational data is more honest than memory.
A completed questionnaire is evidence that someone filled in a form. Regulatory review is beginning to understand the difference between documentation and demonstrable management.
The Quick Scan answers this. Half a day. No obligations.
Request the Quick Scan →