Vendor Risk Assessments
Assess Vendors on Evidence You Can Check.
A questionnaire tells you what the vendor believes. The vendor’s external surface tells you what is exposed: open services, failing certificates, unsupported software and the CVEs on it. Each finding comes with the scan data that raised it.
The questionnaire, self-reported
Are internet-facing systems patched?
Yes (contradicted by the scan)
The scan, payroll
| Configuration | Weak TLS configuration | Medium |
|---|---|---|
| Certificates | Certificate expires in 5 days | Medium |
| Exposure | Remote-access port open | Critical |
| Exposure | Login page | Medium |
| Software | PHP 7.4 end of life | High |
| Software | CVE-2021-41773 · CVSS 9.8 · KEV | Critical |
Open issues by severity, counted from the 6 findings shown:
- 2 Critical
- 1 High
- 3 Medium
What an Assessment Looks For.
The detection engine that runs on your surface also runs on each vendor portfolio. Approved vendor assets are scanned, and nothing is self-reported.
Configuration
DNS and TLS Weaknesses
Weak TLS settings and DNS misconfigurations on the vendor’s hosts and mail infrastructure.
Certificates
Expired and Expiring
Certificates past or close to their end date, with the hostnames each one covers.
Exposure
Services and Login Pages
Open ports, remote-access services, and login or admin pages reachable from the public internet.
Software
End of Life and CVEs
Technology versions out of support, and the known vulnerabilities that match what is running.
Every Finding Carries Its Own Evidence.
Vendor issues have the same fields as the issues on your surface, so a reviewer already knows how to read them.
| Severity | Critical, High, Medium, Low or Information |
|---|---|
| Type and category | What the issue is, where it belongs, a description and remediation guidance |
| Asset | The vendor domain, subdomain or IP address it was found on |
| Evidence | The scan data that raised it |
| CVE context | CVSS, EPSS probability, CISA KEV listing and CWE, when a vulnerability is involved |
| Classification | OWASP Top 10 (2021), PCI DSS 4.0 and 3.2, HIPAA, CWE, CAPEC and WASC |
| State | Where the finding stands now, with each change on record |
Findings Move From Detected to Verified.
A vendor finding is never quietly deleted. The next scan verifies it resolved once the signal is gone, or sets it not applicable when it cannot tell; your team can accept it, ignore it or disprove it, and every decision stays on record for the next person who asks why.
Found
Open
The team can decide
Each scan checks
newly detected
orreappeared
unresolved
checked again on every scan
optional, kept on record
marked as resolvedrisk acceptedignoredmarked as false positive
verified resolved
the signal is gone: no one has to mark itnot applicablewhen a scan cannot tell
What a Reviewer Reads First.
Open Issues by Severity
Critical to Information, each with its current state.
The Worst Assets
The vendor hosts that carry the most active issues.
Vulnerabilities That Matter
CVEs on vendor assets, ranked by CVSS, EPSS and CISA KEV together.
Software Past End of Life
Technologies the vendor still runs after their support ended.
Time to Fix
How long the vendor’s issues stay open, and how long resolved ones took: a practical read on how fast the vendor acts.
Questionnaires ask about patching. The scan shows the CVEs.
Questionnaires still earn their place for what only the vendor can tell you: staff training, incident response procedures, internal access controls. For everything visible from the internet, the evidence is already in the portfolio.
Query This Data Through the API
Vendors are discovered and scanned from the index that holds your assets. Your tools can look up any vendor’s domains through the API.
Questions About Vendor Assessments.
What does an assessment not cover?
Anything that cannot be seen from the internet: internal networks, endpoint controls, policies and people. The Deepinfo Platform assesses the external surface, which is the part of a vendor’s security you can check independently and the part an attacker sees first.
Which vendor findings should we raise first?
Start with CVEs listed in CISA KEV or with a high EPSS probability on the vendor’s internet-facing hosts, then the critical and high issues on the systems that handle your data.
What if the vendor disputes a finding?
Your team records the outcome. If the vendor shows a finding is wrong, mark it as a false positive; the decision stays in the issue’s state history and can be reverted later.
How do we know a vendor fixed something?
A rescan confirms it. When the signal is gone the issue becomes verified resolved, and if it returns later the issue reopens as reappeared.
Can we share findings with the vendor?
Yes. Each issue carries the evidence that raised it, and a filtered issue list exports in full, so the vendor works from the same data your team does.
Assess Your Critical Vendors on Evidence.
Name the vendors you depend on most. In a demo we add them as portfolios and walk through what their surfaces show.