Bitsight Third-Party Risk Management
Supplier assessments and continuous monitoring based on security ratings.
Supply Chain
Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
Addresses 136 stories in our coverage in the last 90 days 4 products that provide it
What it is
An inventory of suppliers ranked by how critical they are, security assessments before and during the contract, and monitoring for supplier incidents.
How to value it
Supplier breaches have caused some of the largest incidents of recent years, through software updates, payroll services and file transfer tools. NIS2 and DORA both make supply chain security an explicit duty, and DORA requires a register of ICT providers. Knowing your critical suppliers and watching them turns a surprise into a planned response.
Questions to ask a vendor
- 1Does it rank suppliers by criticality and data access, instead of sending everyone the same questionnaire?
- 2Does it monitor suppliers continuously for breaches and exposures?
- 3Can it produce the DORA register of information?
- 4How are our suppliers' own suppliers handled?
For your risk register
- Risk
- A breach at a critical supplier exposes our data or stops operations.
- Control
- Supplier inventory with criticality tiers, assessments and continuous monitoring.
- Owner
- Procurement together with the CISO.
- Measure
- Critical suppliers with a current assessment.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
OneTrust Third-Party Management
Supplier inventory, risk assessments and monitoring across privacy and security.
SecurityScorecard Ratings
Outside-in security ratings and monitoring of suppliers.
UpGuard Vendor Risk
Supplier security questionnaires, ratings and continuous monitoring.
Recent stories it addresses
400 stories in total- 13 Nov 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents
City of Osaka discloses breach affecting 1M email addresses via compromised third-party platform.
- 13 Nov 2026Trezor confirms crypto-stealing implants in three wallets, releases fix
Trezor confirms crypto-stealing implants in three Safe 5 wallets sold by CryptoBilis.
- 13 Nov 2026TSMC confirms employee data breach tied to cloud service provider
TSMC confirms employee data breach via cloud service provider, impacting current and former employees.
- 13 Nov 2026Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases
Trezor confirms implants in crypto wallets sold by CryptoBilis can steal recovery phrases.
- 13 Nov 2026NCSC – CERT-SE veckobrev v.46
Swedish cybersecurity agencies issue weekly brief highlighting recent cyberattacks and phishing campaigns.
- 12 Nov 2026Rogue remote-access campaign spread through ScreenConnect add-on, researchers say
Rogue ScreenConnect add-on used to spread malware to managed endpoints.
- 12 Nov 2026ConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations
ConnectWise investigates ScreenConnect breaches linked to RMM+ extension exploitation.
- 12 Nov 2026Notion Customer Data Compromised in Fireworks AI Hack
Notion AI chat transcripts accessed in Fireworks AI hack affecting less than 1% of workspaces.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.