# Major Bank

URL: https://www.deepinfo.com/customers/financial-services-major-bank/

Customer story · Financial services · Türkiye

## A Major Bank Moves Vendor Risk to Continuous Monitoring.

A Türkiye-based universal bank serving more than 10 million customers needed monitoring that doesn’t stop between annual vendor assessments. Its regulators expect continuous evidence of vendor posture, and a questionnaire program could not produce it.

[Request demo](https://www.deepinfo.com/request-demo/)

### A Universal Bank With 100+ Vendor Relationships.

A Türkiye-headquartered universal bank with retail, commercial, capital markets and asset management business lines. Its 10M+ customers are spread across the country and selected international markets.

Its third-party program covers 100+ vendors across tiers: payment processors, core banking platforms, customer-data partners and regional service providers. Each was assessed once a year, through a questionnaire that took weeks per cycle.

- **Revenue**: €5B+ a year
- **Employees**: 30,000+
- **Customers**: 10M+
- **Vendors**: 100+

### Yearly Evidence for Daily Risk.

A questionnaire records what a vendor said on the day it answered. Vendor risk kept moving between answers.

Evidence

#### Paperwork Without Posture

Annual questionnaires produced documents. The bank’s regulators expected continuous evidence.

Detection

#### The News Arrived First

Risk events between cycles reached the bank through public news. The vendor-management program did not surface them.

Impact

#### Compromise Before the Next Window

When a tier-1 vendor was compromised, operations felt it before the next questionnaire was due.

### Vendors Are Scanned at First-Party Depth.

Third-Party Risk Management replaced the questionnaire as the primary evidence source. Each of the 100+ vendors became a portfolio, scanned across the data layers the Deepinfo Platform applies to a first-party surface: WHOIS, IP WHOIS, DNS, SSL, ports, web data and HTTP.

Findings carry their compliance classifications, so audit pulls framework-mapped evidence when it needs it. Procurement reads the same vendor score at onboarding.

- [Continuous Monitoring](https://www.deepinfo.com/platform/tprm/continuous-monitoring/) of each vendor asset, with history per layer
- [Compliance Tracking](https://www.deepinfo.com/platform/tprm/compliance-tracking/), with findings classified against compliance frameworks, PCI DSS 4.0 among them
- [Vendor Risk Scoring](https://www.deepinfo.com/platform/tprm/automated-risk-scoring/) as the procurement gate

### From the Tier-1 Set to Every Vendor.

- ~25 vendors monitored before: the tier-1 set, reviewed once a year
- 100+ vendors monitored now: all vendors in the program, continuously

### The Questionnaire Stays. Its Job Changed.

The annual cycle still runs, as a confirmatory and contractual exercise. The evidence now comes from somewhere else.

The bank’s vendor risk program before and after continuous monitoring

| Capability | Now | Before |
| --- | --- | --- |
| Primary evidence | Continuous external monitoring | Annual questionnaire |
| Time to detect a vendor incident · Measured against public breach disclosures by vendors in the portfolio | Hours | Months |
| Where vendor incidents surface | In the vendor scans | In public news |
| Compliance evidence | Minutes, exported on demand | Weeks of quarterly collection sprints |
| Procurement gate | One Deepinfo score per vendor | Questionnaire review |
| Role of the questionnaire | Confirmation and contract | The evidence itself |

### Other Teams With Other Surfaces.

- [A defense manufacturer](https://www.deepinfo.com/customers/defense-manufacturer/) (Customer story · Defense): Subsidiaries and supplier tiers on one platform, with a tier-2 compromise caught first.
- [An industrial conglomerate](https://www.deepinfo.com/customers/industrial-conglomerate/) (Customer story · Industrial): 30+ subsidiary brands, each a portfolio, scored on one scale.
- [A national telecom operator](https://www.deepinfo.com/customers/telecommunications-national-operator/) (Customer story · Telecommunications): Discovery, scanning and threat intelligence at carrier scale.

### Monitor Every Vendor From Tier 1 Down.

Book a demo and we’ll scan your domain before the call. Third-Party Risk Management runs the same scans on each vendor you add.

[Request demo](https://www.deepinfo.com/request-demo/)