Third-party risk, without the spreadsheet ritual.
Replace annual questionnaires with continuous, evidence-based ratings of every vendor you depend on. Score every supplier and partner from their live public attack surface, and get told when one slips.
Third-Party Risk, step by step
Questionnaires age like milk
A vendor's answers were true the day they typed them. Their score today is anyone's guess.
Continuous observation
Every vendor rated from their live public attack surface, refreshed automatically, evidence attached.
Alerts before incidents
A critical vendor's score drops and you know before their own security team does, and before it becomes your breach.
Every vendor discovered and rated, grouped by risk tier so the ones that need attention stand out
Why vendor questionnaires stopped working
Third-party risk management still runs, at most organisations, on a document. A vendor receives two hundred questions, someone in their sales team fills it in with help from someone in their security team, it comes back six weeks later, and it is filed. The next time anybody looks at it is the following year.
There are three problems with that, and none of them are fixable by writing a better questionnaire. The answers are self-reported, so they describe what the vendor believes about itself. They are a snapshot, so they describe a moment that has already passed. And they are unverifiable, so a confident answer and an accurate answer are indistinguishable to the person reading it.
Meanwhile the thing you are actually worried about, a vendor's security posture degrading between reviews, happens continuously. Certificates lapse. A subdomain gets stood up for a campaign and never taken down. An acquisition brings in infrastructure nobody has inventoried. A CVE lands against something they run. None of that waits for your review cycle, and none of it appears on a questionnaire filed in March.
Continuous external ratings, from evidence rather than assertion
Security ratings invert the model. Instead of asking a vendor what their security looks like, you observe what they publish to the public internet, the same vantage point an attacker has, and score it. Domains, subdomains, exposed services, TLS configuration, mail authentication, cloud posture, breach-exposed credentials, brand impersonation.
The practical consequence is that you can rate a vendor without their participation. No NDA, no questionnaire, no scheduling, no waiting on their security team to have capacity. You supply a domain and a rating comes back. That changes third-party risk management from a process you run on your largest twenty vendors to one you can run on all of them.
It also changes the cadence. A rating that refreshes continuously tells you when something moves, which is the actual question. Nobody genuinely wants to know a vendor's posture in March. They want to know the week it gets worse.
Ratings and questionnaires answer different questions
External ratings observe what is externally observable. That covers a great deal (it is, after all, the same surface an attacker starts from) but it does not cover everything, and any vendor telling you otherwise is selling.
What an outside-in rating cannot see: internal network segmentation, whether backups are tested, how privileged access is governed, what their incident response plan says, whether staff receive security training, how data is handled once it is inside their environment. Those are real controls and they matter, and a questionnaire or an audit report is the right instrument for them.
So the useful model is not replacement: it is triage. Rate everything continuously, and spend your limited questionnaire and audit capacity on the vendors where the rating says something is wrong, or where the data they hold means you need assurance beyond what the outside shows. Most third-party risk programmes are capacity-bound rather than intent-bound; ratings are what let you allocate the capacity you have.
What a vendor risk programme looks like in the first quarter
Start with the vendors whose failure would actually hurt you. Not the longest list: the shortest one where a compromise reaches your data, your customers, or your ability to operate. For most organisations that is between ten and forty companies, and it is rarely the same list as the one procurement maintains.
Rate them, then read the outliers rather than the average. A portfolio-wide score is a board metric; the operational value is in the specific findings: the vendor with expired TLS on a payment subdomain, the one whose SPF record permits the whole internet to send as them, the one with credentials in recent breach data.
Then set the alert threshold and leave it running. The programme becomes valuable at the point where a score drops and somebody is told, without anybody having scheduled a review. That is the difference between third-party risk management as an annual compliance exercise and as a control that actually works.
Questionnaires vs continuous ratings
| Security questionnaire | External security rating | |
|---|---|---|
| Source | Vendor's own description | Observed public evidence |
| Frequency | Annual, at best | Continuous |
| Vendor effort | Weeks of their time | None, no participation needed |
| Time to first answer | 4–8 weeks | Within 24 hours |
| Verifiable | No | Yes, evidence attached to every finding |
| Covers internal controls | Yes | No |
| Scales to 200 vendors | Not realistically | Yes |
The two are complements. Ratings tell you where to spend questionnaire capacity, not how to avoid needing it.
“Our vendor review went from a quarterly spreadsheet ritual to a live dashboard.”
Where this connects
Provider concentration →
Fourth parties and shared-provider concentration risk across the whole portfolio.
Vendor onboarding →
Rate a supplier before the contract is signed, not after.
How scoring works →
The deterministic model behind every rating, and how to refute a finding.
Third-Party Risk | common questions
Put your vendors on the board
Start with ten vendors. Expand when the first alert pays for the year.