# Vendor Risk Scoring

URL: https://www.deepinfo.com/platform/tprm/automated-risk-scoring/

## Score Every Vendor on Your Own Scale.

A vendor score is only useful if it reads the same for all vendors and for you. Each third-party portfolio is scored by the engine that scores your surface, from the issues and vulnerabilities found on the vendor’s assets.

When a score drops, the findings behind it are listed with their evidence. Nobody has to trust a number they cannot open.

[Request demo](https://www.deepinfo.com/request-demo/)

### From Findings to a Comparable Score.

1. **Findings**

   The External Attack Surface Management engine raises issues and vulnerabilities on each vendor asset, each with a severity from Critical to Information.
2. **Asset score**

   Each vendor domain, subdomain and IP address gets its own security score.
3. **Domain score**

   Each vendor domain gets a score that covers its subdomains and websites.
4. **Vendor score**

   The portfolio gets an overall score, as your attack surface does, so each vendor sits on the scale you use for yourself.

### Find the Vendor CVEs Worth a Call Today.

A long list of CVEs on a vendor and one KEV-listed CVE on its login portal are different conversations.

Each CVE found on a vendor asset carries its CVSS score, its EPSS probability of exploitation in the next 30 days, and whether CISA lists it as known exploited.

Sort a vendor’s CVEs by all three and the top of the list is what to raise with the vendor now. A high CVSS with a negligible EPSS and no KEV listing can wait for the scheduled review.

### Scores That Move With the Evidence.

#### Score Timeline

A daily, weekly or monthly series for each vendor asset and domain, so a slow decline is as visible as a sudden drop.

#### Score Alerts

Notification rules on asset and domain score decreases or changes, delivered instantly or as a digest.

#### Score by Issue Type

Separate score timelines per issue type and per issue category show which kind of issue is pulling a vendor down.

#### Business Weight

Give the vendor systems that handle your data a higher business-importance weight (0 to 1000) than its marketing sites, and sort by it.

### Use the Score Where Decisions Happen.

Onboarding

#### Before the Contract

Add a prospective vendor as a portfolio and read its score and findings before it gets access to anything.

Renewal

#### At the Review

Bring the score timeline and the open issues to the renewal conversation instead of last year’s questionnaire.

Oversight

#### In Between

Score-decrease alerts go to the person on your team who owns the vendor, instantly or as an hourly to monthly digest.

### Scores Come From the Findings.

- [A major Türkiye-based bank](https://www.deepinfo.com/customers/financial-services-major-bank/) (Customer story): Vendor onboarding now gates on one score that procurement and risk read the same way.
- [Compliance Tracking](https://www.deepinfo.com/platform/tprm/compliance-tracking/) (TPRM): Vendor findings filtered by the frameworks your audits use.
- [Risk Scoring](https://www.deepinfo.com/platform/easm/complete-risk-scoring/) (EASM): The scoring engine underneath, run on your surface.

### Query This Data Through the API

Vendors are discovered and scanned from the index that holds your assets. Your tools can look up any vendor’s domains through the API.

- [Domain Detail API](https://www.deepinfo.com/data-api/apis/domain-detail/)
- [Associated Domain Finder API](https://www.deepinfo.com/data-api/apis/associated-domain-finder/)
- [Subdomain Finder API](https://www.deepinfo.com/data-api/apis/subdomain-finder/)
- [Domain WHOIS API](https://www.deepinfo.com/data-api/apis/whois-lookup/)

### Questions About Vendor Scores

**Is a vendor score the same kind of score as ours?**

Yes. One engine computes both from the same kinds of findings, which is the point: a vendor and your own surface can be compared directly.

**What pulls a vendor’s score down?**

The issues and vulnerabilities open on its assets. Score timelines per issue type and issue category show the reason for a particular vendor’s score in its own data. See [methodology](https://www.deepinfo.com/methodology/) for how the Deepinfo Platform collects, scans and scores.

**Can a vendor’s score change without the vendor changing anything?**

Yes. When a newly published CVE matches a version the vendor already runs, it lands as a new vulnerability on that asset and counts toward the score.

**What if a vendor disputes its score?**

Open the findings behind it. Each one carries the evidence that raised it, and if the vendor shows a finding is wrong, your team marks it as a false positive with the decision kept on record.

**How does a vendor improve its score?**

By fixing what was found. Once a rescan confirms a fix, the issue moves to verified resolved and the change shows up in the vendor’s next score snapshot.

### Score the Vendors You Depend On.

Bring your shortlist of critical vendors to a demo and compare their scores with yours.

[Request demo](https://www.deepinfo.com/request-demo/)