# Continuous Monitoring URL: https://www.deepinfo.com/platform/tprm/continuous-monitoring/ ## Notice a Vendor Slipping Before Renewal Comes Around. An annual questionnaire records what a vendor believed on the day it answered. Third-Party Risk Management rescans each vendor portfolio across the layers your own surface gets, keeps each layer’s history, and raises an issue when something changes for the worse. [Request demo](https://www.deepinfo.com/request-demo/) ### Each Vendor Asset Is Watched on Every Layer. A vendor asset is scanned exactly like one of yours. This is what a change looks like in each layer. - **WHOIS**: A new registrar, a new expiry date, a registrant change where published - **IP WHOIS**: A host moving to another network, ASN or country - **DNS**: Records added, changed or removed, including MX and NS - **SSL**: A reissued, expiring or expired certificate, and the names it covers - **Port scan**: A TCP or UDP port that is newly open, and the service behind it - **Web data**: New technologies and versions, new login pages - **HTTP**: Different status codes and response headers ### The Changes That Reach Your Team. Notification rules work on vendor assets with the same events as on yours. Each rule delivers instantly, hourly, daily, weekly or monthly. #### New Issue A finding that was not there before appears on a vendor asset. #### Reappeared Issue Something the vendor fixed has come back. The original issue reopens instead of a new one starting. #### New Open Port A port that was closed on a vendor host is now answering. #### New Vulnerability A CVE now matches a technology version running on a vendor asset. #### Certificate, DNS or WHOIS Change The SSL certificate, DNS records or registration record of a vendor asset changed. #### New Asset Discovery found another asset that belongs to the vendor. #### Score Decrease The security score of a vendor asset or domain dropped. ### Every Layer Keeps Its Own Record. When a vendor says a certificate was replaced in March, the scan history can confirm it. The Deepinfo Platform keeps snapshots per asset for DNS, HTTP, IP DNS (PTR), IP WHOIS, port scan, SSL, web data and WHOIS. Security score, issue severity, vulnerability severity and open ports are kept as timelines too, readable by day, week or month. A vendor’s trend becomes a chart your team can put in front of the vendor at the next review. - **Snapshots**: One history per layer, per asset - **Each snapshot**: Stamped with its check date - **Timelines**: Score, severity, open ports - **Rescan**: On demand, per vendor ### From Vendor Claim to Verified Resolved. Vendor findings follow the issue lifecycle your team already uses. A fix counts once a scan confirms it. 1. **Detected** The issue opens on the vendor’s portfolio as newly detected, with the scan evidence that raised it. 2. **Shared** Your team sends the vendor the finding and its evidence, or an exported list of everything open. 3. **Marked resolved** When the vendor reports a fix, your team marks the issue resolved. 4. **Verified** The next scan checks the signal. Gone, and the issue becomes verified resolved; back later, and it reopens as reappeared. ### Monitoring Feeds the Assessment. - [A major Türkiye-based bank](https://www.deepinfo.com/customers/financial-services-major-bank/) (Customer story): From about 25 monitored vendors to 100+, with questionnaires kept as a confirmatory layer. - [Vendor Risk Assessments](https://www.deepinfo.com/platform/tprm/comprehensive-risk-assessments/) (TPRM): Vendor findings with severity, evidence and state. - [Continuous Scanning](https://www.deepinfo.com/platform/easm/continuous-scanning/) (EASM): The scanning engine underneath, run on your surface. ### Query This Data Through the API Vendors are discovered and scanned from the index that holds your assets. Your tools can look up any vendor’s domains through the API. - [Domain Detail API](https://www.deepinfo.com/data-api/apis/domain-detail/) - [Associated Domain Finder API](https://www.deepinfo.com/data-api/apis/associated-domain-finder/) - [Subdomain Finder API](https://www.deepinfo.com/data-api/apis/subdomain-finder/) - [Domain WHOIS API](https://www.deepinfo.com/data-api/apis/whois-lookup/) ### Questions About Vendor Monitoring. **How often are vendor assets rescanned?** On the continuous scanning your own surface gets. There is no lighter schedule for vendors. When a vendor reports a fix, your team can start a rescan of the affected asset on demand instead of waiting for the next pass. **Can a change slip through between two scans?** It shows up at the next check. Monitoring is periodic, and each layer’s history records when each check ran, so the date a change was first seen stays on record. **Can we see what a vendor asset looked like before a change?** Yes. Each layer keeps its past snapshots, each with its check date, so your team can open the certificate, DNS records or open ports a vendor asset had on an earlier date and compare them with today’s. **Who gets alerted when a vendor changes?** Whoever your notification rules name. A rule picks an event, can narrow it by conditions such as asset, severity or tag, and sets how often the team members on it are emailed. **Will the vendor notice the scans?** It may see them in its logs: scans run from infrastructure Deepinfo operates and make no attempt to hide. They are non-intrusive, with no authenticated scans, no exploit attempts and no load tests, and they reach only what the vendor already exposes to the internet. ### Watch Your Vendors Between Reviews. Bring the vendors you worry about most to a demo and see what their external surfaces show today. [Request demo](https://www.deepinfo.com/request-demo/)