Run a vendor program that scales past the spreadsheet.
When manual reassessment cycles collapse and your spreadsheet stops keeping up, you need three-layer scoring, continuous external monitoring, and Posture Divergence Detection on every vendor, all the time.
Built for vendor programs that have outgrown spreadsheets.
Three-layer scoring on every vendor
Business criticality, assessed posture (questionnaire-based), and live external exposure (continuous monitoring): one unified score, three layers of context. Sortable, filterable, exportable.
- Criticality + Posture + Live Exposure
- Auto-tier suggestions on onboarding
- Bulk reassessment workflows
Posture Divergence Detection
When a vendor's assessed posture and live exposure diverge beyond threshold, the parent risk record updates and a remediation task is generated automatically. Severity tiered Minor / Moderate / Severe.
- Severity tiered alerts
- Auto-updates parent risk record
- Auto-generates remediation tasks
Concentration + cascading risk
Subcontractor Insights maps fourth-party dependencies, so concentration surfaces before an incident proves it. Example: spot when 247 of your vendors funnel through the same three sub-processors.
- Fourth-party concentration analysis
- Sub-processor disclosure tracking
- Cascading risk visualization
Frequently asked questions
How is a vendor's risk score calculated?
Each vendor is scored on three layers. Business criticality reflects how much you depend on the vendor. Assessed posture comes from the security questionnaires the vendor completes. Live external exposure comes from continuous monitoring of what is visible from outside. The layers are kept distinct, so you can see which one is driving a vendor's risk.
What happens when a vendor's questionnaire answers and live exposure disagree?
Posture Divergence Detection flags the vendor. The flag is tiered Minor, Moderate, or Severe, so a small gap is not treated like a serious one. Your team sees that the vendor's reported posture no longer matches what monitoring observes and can follow up through the vendor remediation workflow, with each step recorded in the audit trail.
How is this different from a ratings-only platform?
Ratings-only platforms score a vendor from outside signals alone. ThirdSentry keeps that outside view and sets it next to the vendor's own questionnaire answers and how critical the vendor is to you. Vendor records also sit on the same data model as your internal controls and risk register, so a vendor finding connects to your own program.
Do vendors answer assessments inside the platform?
Yes. You send security questionnaires to vendors from the platform, and vendor contacts respond through their own vendor-side accounts. Responses are collected, scored, and stored against the vendor record. Gaps are tracked as remediation items that the vendor works through, with an audit trail of each update. Completed assessments set the baseline that live monitoring is compared against.
Do we pay per user for the vendor risk team?
No. Pricing is a flat fee with unlimited users, so procurement, security, legal, and business owners can all work in the vendor program without seat charges. AI features are included on every tier. The pricing axis is the number of frameworks you run, across four tiers: Launch, Foundation, Professional, and Enterprise.