# Third-Party Risk Management

URL: https://www.deepinfo.com/platform/tprm/

## Your Vendors’ Exposures Are Yours Too.

Third-Party Risk Management assesses the cyber risk that vendors, suppliers and partners bring into your organization. Deepinfo runs its External Attack Surface Management engine on each third party: every vendor becomes a portfolio with its own asset inventory, scanned and scored like your surface, without waiting for a questionnaire to come back.

[Request demo](https://www.deepinfo.com/request-demo/) · [Datasheet (PDF)](https://www.deepinfo.com/downloads/deepinfo-tprm-datasheet.pdf)

### Vendor Risk Changes Between Reviews.

A questionnaire tells you what a vendor believes about itself. *A scan shows what an attacker sees.*

The usual third-party program runs on annual questionnaires and certificates collected in spreadsheets. The answers describe one moment, written by the party being assessed.

Between two reviews a vendor can let a certificate lapse, expose a remote desktop port or fall behind on a CVE that CISA has listed as exploited. None of that waits for the next questionnaire.

### Discovery to Compliance Across Your Vendor Portfolio.

#### [Vendor Discovery](https://www.deepinfo.com/platform/tprm/smart-third-party-discovery/)

Start from a vendor’s primary domain and map what it runs on the internet: the subdomains, IP addresses and related domains no questionnaire lists.

#### [Continuous Monitoring](https://www.deepinfo.com/platform/tprm/continuous-monitoring/)

Scan the assets in each vendor portfolio across the data layers used for yours, and keep each layer’s history so you can see what changed.

#### [Vendor Risk Assessments](https://www.deepinfo.com/platform/tprm/comprehensive-risk-assessments/)

Misconfigurations, weak TLS, expiring certificates, exposed services and known CVEs on vendor infrastructure, each with evidence and a severity from Critical to Information.

#### [Vendor Risk Scoring](https://www.deepinfo.com/platform/tprm/automated-risk-scoring/)

A security score for each vendor, built like yours, with every CVE ranked by CVSS, EPSS and CISA KEV together.

#### [Compliance Tracking](https://www.deepinfo.com/platform/tprm/compliance-tracking/)

Vendor findings classified against the frameworks your issues use, from OWASP Top 10 2021 to PCI DSS 4.0 and HIPAA.

### Your Vendors on One Scale.

Each third party is its own portfolio, scored by the engine that scores your surface, so a weak vendor stands out against the rest and against you.

### Your Scan Engine Runs on Vendors Too.

A portfolio holds one organization’s assets: its own inventory, its own scans, its own issues and its own score. Adding a vendor works like adding a new part of your surface.

Because the engine is shared, a vendor finding looks exactly like one of your own. The severity scale, the issue states, the evidence and the CVE ranking are identical, so the two can be compared line by line.

- **Data layers**: WHOIS to HTTP, per vendor asset
- **Issue states**: The lifecycle your issues use, with the history of each change
- **Severity**: Critical, High, Medium, Low, Information
- **Frameworks**: OWASP, PCI DSS 4.0 and 3.2, HIPAA, CWE, CAPEC, WASC

### Scan Layers Read as Vendor Risk.

The layers are the ones EASM scans on your assets. What changes is the question you ask of them.

- **WHOIS**: which registrar holds the vendor’s domains, and when each registration expires
- **IP WHOIS**: which networks, owners and countries the vendor’s services run on
- **DNS**: how its name servers and mail exchangers are set up, and when records change
- **SSL**: expired and expiring certificates, their issuers, and the host names each one reveals
- **Ports**: services open to the internet over TCP and UDP, such as remote access or databases
- **Web data**: technologies in use, login pages and screenshots
- **HTTP**: response headers and status codes for each host it exposes

### What Each Source Can Tell You.

Questionnaires still matter for what only the vendor knows. External scanning covers what anyone on the internet can already see, and keeps covering it between reviews.

External scanning compared with a vendor questionnaire

| Capability | External scanning | Questionnaire |
| --- | --- | --- |
| Visible from the internet |  |  |
| Expired or expiring certificates | Yes | Self-reported |
| Open ports and exposed services | Yes | Self-reported |
| Known CVEs on internet-facing technology | Ranked by CVSS, EPSS and KEV | Self-reported |
| Changes between review cycles | Yes | No |
| Needs the vendor to take part | No | Yes |
| Known only inside the vendor |  |  |
| Security awareness training | No | Yes |
| Incident response procedures | No | Yes |
| Internal access controls | No | Yes |

### Where It Fits in Your Vendor Program.

Before signing

#### Onboarding

Add a prospective vendor’s primary domain as a portfolio and review its external posture before the contract is signed.

During the contract

#### A Continuous Watch

The notification rules that watch your assets cover vendor assets too: new and reappeared issues, score drops, certificate, WHOIS and DNS changes, new open ports. Instant, or as an hourly to monthly digest.

At review time

#### Evidence on Record

Each vendor issue keeps its evidence, its state history and its framework classification, so a review starts from records instead of a request for answers.

### More on Third-Party Risk.

- [A major Türkiye-based bank](https://www.deepinfo.com/customers/financial-services-major-bank/) (Customer story): Continuous monitoring across 100+ third-party relationships, in place of point-in-time vendor assessments.
- [Third-Party Risk Management](https://www.deepinfo.com/solutions/use-cases/third-party-risk-management/) (Use case): How vendor risk teams run the program on external evidence.
- [External Attack Surface Management](https://www.deepinfo.com/platform/easm/) (EASM): The engine every vendor portfolio runs on.

### Query This Data Through the API

Vendors are discovered and scanned from the index that holds your assets. Your tools can look up any vendor’s domains through the API. The index holds 400M+ domains, 2B+ subdomains, 200B+ DNS records and 30B+ SSL certificates.

- [Domain Detail API](https://www.deepinfo.com/data-api/apis/domain-detail/)
- [Associated Domain Finder API](https://www.deepinfo.com/data-api/apis/associated-domain-finder/)
- [Subdomain Finder API](https://www.deepinfo.com/data-api/apis/subdomain-finder/)
- [Domain WHOIS API](https://www.deepinfo.com/data-api/apis/whois-lookup/)

### Questions About Third-Party Risk Management

**What is Third-Party Risk Management?**

Third-Party Risk Management is the continuous assessment of the cyber risk introduced by vendors, suppliers and partners with access to your data, systems or brand. What a third party reports about itself and what an attacker can observe are two different pictures, and a program needs both. Deepinfo TPRM supplies the second one, from external evidence.

**What does Deepinfo monitor for each third party?**

The same data layers the platform runs on your surface: WHOIS, IP WHOIS, DNS, SSL, open TCP and UDP ports, web data and HTTP. Findings are scored and ranked like yours too, with CVSS, EPSS and CISA KEV on each CVE.

**How is it different from security questionnaires?**

Questionnaires are point-in-time and self-attested. Tools that inspect a vendor’s cloud configuration need access the vendor has to grant. Deepinfo TPRM works entirely from external observation, continuously, and needs nothing from the vendor.

**What is the workflow for adding a new vendor?**

Add the vendor as a portfolio, starting from its primary domain. The platform discovers related assets for your team to approve, scans the approved ones layer by layer and scores them. From then on the vendor is monitored exactly like your own surface.

**Where should we start with our vendor list?**

With the providers your own surface already names. External Attack Surface Management groups your assets by registrar, name server, mail server, network and SSL issuer, and that list, read next to procurement’s vendor list, points to the first portfolios. See [Vendor Discovery](https://www.deepinfo.com/platform/tprm/smart-third-party-discovery/).

**Does it replace our vendor risk program?**

No. It gives the program evidence. Questionnaires and contracts still cover what only the vendor can tell you, such as training, incident response and internal access controls, while the platform covers what is visible from the internet, continuously.

**How is TPRM priced?**

Pricing depends on the scope you monitor. See [pricing](https://www.deepinfo.com/pricing/) for how it works, or talk to us for a scoped quote.

### See Your Vendors’ Attack Surfaces.

Bring a short list of vendors to a working demo and see their external posture scored on the same scale as yours.

[Request demo](https://www.deepinfo.com/request-demo/)