Your security includes everyone you’re connected to
Count the tools your team signed into this week: email, file storage, chat, CRM, accounting, HR, design tools, AI assistants, and the integrations connecting them. Each vendor holds some of your data or some access to your systems. Attackers know that one weak vendor can open the door to all of its customers.
What we do
- Vendor inventory. Discover the SaaS tools, integrations and AI services in use, including the ones nobody formally approved.
- Risk tiering. Rank vendors by the data they hold, the access they have and how critical they are.
- Security reviews. Assess critical vendors using their SOC 2 reports or ISO certificates, security questionnaires and public information.
- Access review. Check the permissions each integration really has and remove what it doesn’t need.
- Contract checks. Flag missing security, breach-notification and data-handling terms.
- Ongoing monitoring. Re-review on a schedule and when a vendor reports a breach or changes how it handles data.
Risk tiers
| Tier | Typical vendors | Review depth |
|---|---|---|
| Critical | Email, file storage, identity provider, payment and HR systems | Full review and annual reassessment |
| High | CRM, finance tools, AI services with data access | Standard review and periodic check |
| Low | Tools with no sensitive data or system access | Lightweight check at onboarding |
The process
Discover
Build the vendor list from sign-in logs, app consents, expenses and a quick team survey.
Tier
Rank each vendor by data, access and business impact.
Assess
Review critical and high-risk vendors and record findings.
Monitor
Track changes, breaches and renewals, and keep the evidence audit-ready.
Connected to the rest of your program
Start with a third-party risk assessment of your most critical vendors, then keep them covered here. Vendor risk is required evidence for compliance readiness, overlaps with shadow AI discovery for AI tools, and pairs with SaaS security posture management, which checks how connected apps are configured.