Most third-party risk programmes produce a spreadsheet of scores nobody acts on. Ours ends somewhere useful: when a supplier is breached, the same analysts already watching your estate go and find out whether it reached you.
Supplier compromise is now one of the most common ways into an organisation, and it is the route your own controls are least able to see.
The uncomfortable part is not that suppliers get breached. It is that the access they hold into your estate usually outlives the relationship that justified it, and almost nobody is watching it. A managed service provider with a standing admin account, a SaaS platform holding a copy of your customer data, an integration built three years ago by somebody who has left.
Meanwhile the assurance process most organisations run against that risk is an annual questionnaire, answered by the supplier, filed by you, and out of date within a month. It satisfies an auditor. It does not tell you that the supplier was compromised last Tuesday.
You decide the risk appetite and who is in scope. Everything after that is ours to run, and it runs continuously rather than once a year.
Who your suppliers are, what each one touches, and which hold access into your estate. Most organisations find this list is longer than the one procurement holds, and that is usually the first useful finding.
Ranked on the data they hold, the access they have and what breaks if they stop. A payroll provider and a stationery supplier do not get the same treatment, and pretending otherwise is why programmes stall.
Evidence gathered once and reused where we can, so your critical suppliers get a real assessment and your low-tier ones are not sent a 300-question spreadsheet nobody reads.
External posture, exposed services, breach disclosures and credential leaks, watched between assessments rather than at renewal. The year is where the risk changes.
A rating drop or a breach disclosure is triaged by our SOC the same way any other signal is, against the question that matters: does this touch this customer, and how?
Remediation chased, re-checked and evidenced, with reporting your board and your auditor can both use. A finding that stays open is reported as open.
The disclosure is public within hours and every rating platform will flag it. That is not the hard part, and it is not what you are exposed by.
The question that actually matters on the day is narrower and much harder: did it reach us. Answering it means knowing what access that supplier holds in your environment, going and looking for whether it was used, and doing that while the story is still moving.
A third-party risk platform cannot answer it, because it has no visibility inside your estate. A managed SOC usually cannot either, because nobody told it which suppliers matter or what they are connected to. We run both halves, so the supplier register and the detection estate are the same body of knowledge.
If a supplier of yours is compromised and it never touched you, that is worth knowing too, and worth having in writing when your customers ask.
The other three hundred and sixty-four are where a supplier’s posture actually changes, and almost nobody is looking at them.
Anything that moves materially is triaged rather than emailed. What reaches you is something we think you need to act on, with the reasoning attached.
Four things start a supply chain programme, and they want different first steps. Tell us which one you are and the scoping conversation is shorter.
Supplier oversight is now explicit in law for financial services and for essential and important entities. Both require a register, tiering, evidence and a process that demonstrably runs, not a policy that says it should.
First step: the register and the evidence trail.
Your own buyers are running the same programme on you, and their questionnaires now ask what you do about your suppliers. Answering that credibly is increasingly a condition of the contract.
First step: something you can put in front of them.
A supplier was compromised, somebody asked whether it reached you, and the honest answer took three weeks to assemble. That question is the one this service is built to answer in hours.
First step: what access each supplier actually holds.
Growth, acquisition or a few years of SaaS sprawl, and nobody can say with confidence who has access to what. Common, and usually discovered during one of the other three.
First step: find out who the suppliers really are.
There is a lot of software in this market and most of it gets sold to people who then discover they have bought a job rather than a service.
The tooling underneath is a specialist platform, operated by us as part of the service. You do not license it, administer it or learn it, and you are not the one chasing a supplier for the fourth time about an expired certificate. If you would rather run your own platform and have us work inside it, that is also fine and fairly common.
Behind it is an operation we have run since 2019: security operations centres in three countries manned around the clock, senior analysts accountable for every customer-facing decision, and triage procedures written by our own people. Your supplier register sits inside that operation. That is why a supplier breach here produces an investigation rather than an email.
What we will not do is sell you a dashboard of supplier scores and call it a risk programme.
Reporting is a deliverable here rather than a by-product, because most of the value of this programme is proving to somebody else that you run it.
The practice of knowing which suppliers can hurt you, how much, and whether anything has changed. It covers building a supplier register, tiering by consequence, assessing proportionately, monitoring continuously, and acting when something moves. The assessment half is common. The acting half is where most programmes stop.
A platform produces findings and hands them to you. This is a managed service: we operate the tooling, run the assessments, chase the remediation, and investigate what fires. The difference shows up on the day a supplier is breached, when a platform tells you it happened and we tell you whether it reached you.
We look at what access that supplier holds in your estate, hunt for whether it was used against the indicators from the incident, and come back with a verdict and the evidence. That is a SOC investigation, not a notification, and it is the part a risk platform on its own cannot do.
No. The platform is operated by us as part of the service, so you are not licensing it, administering it or learning it. If you already run your own tooling and would rather we worked inside it, we can do that instead.
Continuous monitoring scales across the whole register, so breadth is rarely the constraint. Assessment depth is tiered, because assessing every supplier to the same standard is how programmes stall. The split between the two is agreed with you during scoping.
It produces the artefacts they ask for: a current register, tiering rationale, assessment records with evidence, monitoring history and open findings. The supplier-management controls in ISO 27001, NIS2 and DORA are largely answered by those. We are not a certification body and do not audit you.
No. The service stands on its own. But the part that separates it - hunting in your estate when a supplier is compromised - needs visibility of that estate, so it is materially stronger where we also run detection and response. We will tell you plainly which half you are buying.
Building the register is the first piece of work and the pace depends on how well documented your supply chain already is. Continuous monitoring can be live across a known supplier list quickly; tiering and assessment are the parts that take real time, and we scope them before anything is signed.
The first piece of work is finding out who your suppliers really are and what they touch. That list is almost always longer than the one procurement holds, and it is useful on its own.
