# Vendor Risk Assessments URL: https://www.deepinfo.com/platform/tprm/comprehensive-risk-assessments/ ## Assess Vendors on Evidence You Can Check. A questionnaire tells you what the vendor believes. The vendor’s external surface tells you what is exposed: open services, failing certificates, unsupported software and the CVEs on it. Each finding comes with the scan data that raised it. [Request demo](https://www.deepinfo.com/request-demo/) ### What an Assessment Looks For. The detection engine that runs on your surface also runs on each vendor portfolio. Approved vendor assets are scanned, and nothing is self-reported. Configuration #### DNS and TLS Weaknesses Weak TLS settings and DNS misconfigurations on the vendor’s hosts and mail infrastructure. Certificates #### Expired and Expiring Certificates past or close to their end date, with the hostnames each one covers. Exposure #### Services and Login Pages Open ports, remote-access services, and login or admin pages reachable from the public internet. Software #### End of Life and CVEs Technology versions out of support, and the known vulnerabilities that match what is running. ### Every Finding Carries Its Own Evidence. Vendor issues have the same fields as the issues on your surface, so a reviewer already knows how to read them. - **Severity**: Critical, High, Medium, Low or Information - **Type and category**: What the issue is, where it belongs, a description and remediation guidance - **Asset**: The vendor domain, subdomain or IP address it was found on - **Evidence**: The scan data that raised it - **CVE context**: CVSS, EPSS probability, CISA KEV listing and CWE, when a vulnerability is involved - **Classification**: OWASP Top 10 (2021), PCI DSS 4.0 and 3.2, HIPAA, CWE, CAPEC and WASC - **State**: Where the finding stands now, with each change on record ### Findings Move From Detected to Verified. A vendor finding is never quietly deleted. The next scan verifies it resolved once the signal is gone, or sets it not applicable when it cannot tell; your team can accept it, ignore it or disprove it, and every decision stays on record for the next person who asks why. ### What a Reviewer Reads First. #### Open Issues by Severity Critical to Information, each with its current state. #### The Worst Assets The vendor hosts that carry the most active issues. #### Vulnerabilities That Matter CVEs on vendor assets, ranked by CVSS, EPSS and CISA KEV together. #### Software Past End of Life Technologies the vendor still runs after their support ended. #### Time to Fix How long the vendor’s issues stay open, and how long resolved ones took: a practical read on how fast the vendor acts. Questionnaires ask about patching. *The scan shows the CVEs.* Questionnaires still earn their place for what only the vendor can tell you: staff training, incident response procedures, internal access controls. For everything visible from the internet, the evidence is already in the portfolio. ### Assessments Feed the Score. - [Vendor Risk Scoring](https://www.deepinfo.com/platform/tprm/automated-risk-scoring/) (TPRM): Vendors on the scale you use for yourself. - [Compliance Tracking](https://www.deepinfo.com/platform/tprm/compliance-tracking/) (TPRM): Vendor findings filtered by the frameworks your audits use. - [Risk Detection](https://www.deepinfo.com/platform/easm/comprehensive-risk-detection/) (EASM): The detection engine underneath, run on your surface. ### Query This Data Through the API Vendors are discovered and scanned from the index that holds your assets. Your tools can look up any vendor’s domains through the API. - [Domain Detail API](https://www.deepinfo.com/data-api/apis/domain-detail/) - [Associated Domain Finder API](https://www.deepinfo.com/data-api/apis/associated-domain-finder/) - [Subdomain Finder API](https://www.deepinfo.com/data-api/apis/subdomain-finder/) - [Domain WHOIS API](https://www.deepinfo.com/data-api/apis/whois-lookup/) ### Questions About Vendor Assessments. **What does an assessment not cover?** Anything that cannot be seen from the internet: internal networks, endpoint controls, policies and people. The Deepinfo Platform assesses the external surface, which is the part of a vendor’s security you can check independently and the part an attacker sees first. **Which vendor findings should we raise first?** Start with CVEs listed in CISA KEV or with a high EPSS probability on the vendor’s internet-facing hosts, then the critical and high issues on the systems that handle your data. **What if the vendor disputes a finding?** Your team records the outcome. If the vendor shows a finding is wrong, mark it as a false positive; the decision stays in the issue’s state history and can be reverted later. **How do we know a vendor fixed something?** A rescan confirms it. When the signal is gone the issue becomes verified resolved, and if it returns later the issue reopens as reappeared. **Can we share findings with the vendor?** Yes. Each issue carries the evidence that raised it, and a filtered issue list exports in full, so the vendor works from the same data your team does. ### Assess Your Critical Vendors on Evidence. Name the vendors you depend on most. In a demo we add them as portfolios and walk through what their surfaces show. [Request demo](https://www.deepinfo.com/request-demo/)