# Third-Party Risk Management URL: https://www.deepinfo.com/solutions/use-cases/third-party-risk-management/ ## Assess Every Vendor on What It Exposes. A questionnaire records what a vendor believed about itself on the day it answered. [Third-Party Risk Management](https://www.deepinfo.com/platform/tprm/) runs each vendor as its own portfolio on the [External Attack Surface Management](https://www.deepinfo.com/platform/easm/) engine, with the discovery, scanning, issues and scoring your surface gets. [Request demo](https://www.deepinfo.com/request-demo/) ### A Questionnaire Is a Snapshot. Questionnaires answer governance questions well. They are a poor record of what a vendor exposes to the internet this week. Self-reported #### Answers, Not Observations A questionnaire tells you what the vendor believes. It can’t show you the staging server the vendor forgot about. Point in time #### Stale by the Next Review Certificates expire, ports open, software ages. None of it waits for the annual review cycle. Scale #### More Vendors Than Reviewers Deep reviews go to the largest vendors. The long tail gets a form, or nothing at all. ### All Vendors Sit on One Scale. A grade reads identically for each vendor and for your surface, so the one that falls stands out. ### Your Engine Runs on Each Vendor. Adding a vendor works like adding one of your domains, so the long tail of small suppliers gets the same scanning as the largest. #### [Vendor Discovery](https://www.deepinfo.com/platform/tprm/smart-third-party-discovery/) Start from a vendor’s primary domain and map its subdomains, IP addresses and related domains, then approve what belongs to the vendor. #### [Continuous Monitoring](https://www.deepinfo.com/platform/tprm/continuous-monitoring/) Scan every asset in each vendor portfolio across WHOIS, IP WHOIS, DNS, SSL, ports, web data and HTTP, with history per layer. #### [Vendor Risk Assessments](https://www.deepinfo.com/platform/tprm/comprehensive-risk-assessments/) Misconfigurations, weak TLS, expiring certificates, exposed services and known CVEs on vendor assets, each with evidence and a severity. #### [Vendor Risk Scoring](https://www.deepinfo.com/platform/tprm/automated-risk-scoring/) A security score per vendor, built the way yours is, with each CVE ranked by CVSS, EPSS and CISA KEV together. #### [Compliance Tracking](https://www.deepinfo.com/platform/tprm/compliance-tracking/) Vendor issues classified against OWASP Top 10 2021, PCI DSS 4.0 and 3.2, HIPAA, CWE, CAPEC and WASC. ### From Onboarding to the Annual Review. 1. **Add** Create a portfolio for each third party from its primary domain, before the contract or for vendors already in place. 2. **Map** Discovery proposes the vendor’s related assets. Your team approves what belongs to the vendor and ignores the rest. 3. **Watch** The notification rules that watch your assets cover vendor assets too: new and reappeared issues, score drops, certificate, WHOIS and DNS changes, new open ports. 4. **Engage** Take the evidence to the vendor. Each issue keeps its state, so the follow-up is on record until a rescan confirms the fix. 5. **Review** At renewal, the review starts from observed issues and score history. The questionnaire becomes the confirming document. ### Vendor Programs Running on Evidence. - [A major Türkiye-based bank](https://www.deepinfo.com/customers/financial-services-major-bank/) (Customer story): Continuous monitoring across 100+ third-party relationships in place of point-in-time vendor assessments. - [A defense manufacturer](https://www.deepinfo.com/customers/defense-manufacturer/) (Customer story): Tier-1 and tier-2 suppliers under continuous monitoring, next to subsidiary portfolios. - [Supply Chain Security](https://www.deepinfo.com/solutions/use-cases/supply-chain-security/) (Use case): Extend this watch past your direct suppliers. ### Use This Data in Your Tools Your tools can look up any company’s domains, subdomains and registration data through the API, from the index the Deepinfo Platform scans vendors with. - [Domain Detail API](https://www.deepinfo.com/data-api/apis/domain-detail/) - [Associated Domain Finder API](https://www.deepinfo.com/data-api/apis/associated-domain-finder/) - [Subdomain Finder API](https://www.deepinfo.com/data-api/apis/subdomain-finder/) - [Domain WHOIS API](https://www.deepinfo.com/data-api/apis/whois-lookup/) ### Questions About Third-Party Risk Management **Do we still need questionnaires?** Usually, yes, for contractual and governance questions that external scanning can’t answer, such as policies and internal controls. External evidence changes their role: they confirm what monitoring already shows instead of standing alone as evidence. **Does the vendor have to install anything?** No. Discovery and scanning read what the vendor exposes on the public internet: DNS, certificates, WHOIS, open ports and web responses. There is no agent and no login. **What can external scanning see about a vendor?** Everything the vendor exposes to the internet: domains, subdomains and IP addresses, DNS and certificates, open ports and services, web technologies and their known CVEs. It can’t see inside the vendor’s network. **How are vendors scored?** Exactly as your surface is. Each vendor portfolio gets its own security score, with vulnerabilities ranked by CVSS, EPSS and CISA KEV together. See [Vendor Risk Scoring](https://www.deepinfo.com/platform/tprm/automated-risk-scoring/). **How often are vendor assets rescanned?** On the schedule your surface gets. Vendor portfolios run on the engine that scans your assets, and there is no lighter schedule for vendors. **Will discovery find every host a vendor runs?** It finds what links back to the vendor in public data: a shared registrant, mail servers, name servers, IP addresses and certificate names. A service the vendor runs for you under your domain belongs in your inventory, and a host with no public link can be added to the vendor’s portfolio by hand. **Does Deepinfo certify vendors as compliant?** No. Vendor issues are classified against frameworks such as PCI DSS, HIPAA and OWASP Top 10, and your team and auditors use that as evidence for the review. It is not an attestation. **Can subsidiaries be tracked like this?** Yes. A group company runs as its own portfolio exactly like a vendor. See [Subsidiary Oversight](https://www.deepinfo.com/solutions/use-cases/subsidiary-oversight/). ### Score Your Vendors on Your Own Scale. Bring a short list of vendors to a demo and see their external posture scored next to yours. [Request demo](https://www.deepinfo.com/request-demo/)