Your vendor said they were secure. NorthIron checks
A questionnaire tells you what a vendor claims. NorthIron scores every vendor on three inputs: what they answered, what they can evidence, and what their external attack surface actually shows. You get a position you can defend to a regulator or a customer.
What this looks like today
Self-attestation is not assurance
The vendor fills in the questionnaire. Somebody files it. Nobody checks a single answer against reality.
Your inherited risk is invisible
You know your own posture. You have very little visibility into the posture of the suppliers holding your customer data.
Reassessment never happens
Vendors are assessed at onboarding and then never again, even though the risk changes the moment their environment does.
Score what is observable, not just what is claimed
Three-pillar scoring
Every vendor gets a composite score built from three weighted inputs. The third is the one most programmes skip, and it is the only one the vendor cannot write for themselves.
- Questionnaire responses, weighted at forty percent
- Submitted documents and certifications, weighted at thirty percent
- External attack surface data, weighted at thirty percent
Passive external attack surface mapping
NorthIron maps a vendor's internet-facing footprint passively, without touching their systems, and folds the exposed services and hygiene signals it finds into the score.
Trust centre ingestion
Where a vendor publishes a trust centre, NorthIron reads it and pulls in the certifications and posture data it finds, so you are not asking for a report that has been sitting on their public site for six months.
Assessment depth that follows the risk
Vendors are tiered by the risk they carry, based on what they access and how critical they are to you. The tier sets how deep the assessment goes and how often it is repeated, so the effort lands on the suppliers that warrant it.
Three inputs, and only two of them are the vendor's.
What the vendor says about itself, weighted at forty percent.
Certifications and reports they can actually produce, weighted at thirty percent.
What their internet-facing footprint shows, weighted at thirty percent.
A score the vendor cannot write for themselves
Most vendor modules are a questionnaire tool with a formula on top. Weighting observable external data as a third of the score changes what the number means. It stops being a record of what a vendor told you and becomes a measure of what can be seen.
What changes once this is running
- A composite vendor score built on evidence, not attestation alone
- External exposure data on every vendor, collected passively
- Assessment depth and reassessment cadence driven by tier
- A defensible answer when a customer asks how you assess your suppliers
- Third-party risk feeding directly into your own register
Questions we are asked about this
Do you scan our vendors' systems?
No. Attack surface mapping is passive and uses publicly observable data. Nothing is sent to vendor systems in a way that would need their authorisation.
What if a vendor refuses to complete a questionnaire?
You still get a partial score from documents and external data, and the gap itself is recorded. A vendor who will not answer is a finding, not a blank row.
Can we use our own questionnaire?
Yes. Custom questionnaires map into the same scoring model.
See it against your own programme
The call opens the product, not a deck. A practitioner walks you through this capability with your situation in front of them.