You add the web addresses of the suppliers you want to monitor. The platform checks them automatically on a schedule and shows the weaknesses it finds, called findings. Each finding is explained, and everything is collected in reports you can pass on.
You start with the supplier's web address, such as company.com. If you also have the addresses of their servers (IP addresses), you can add those too. The checks run in your own separate environment, and the results are stored in your own database. Hosting can be adapted to your requirements.
Can someone send e-mail that looks as if it came from the supplier? The platform checks that the protections are in place and strict enough.
Technical terms: SPF, DKIM and DMARC
Checks that the website's certificate is valid and when it expires. The certificate gives the padlock in the browser. Old, insecure encryption versions are flagged too.
Technical terms: TLS and certificates
Shows which entry points to the supplier's servers are open to the internet and what sits behind them. Every open entry point that isn't needed is a possible way in for an attacker.
Technical term: open ports
Checks that visitors always end up on the encrypted version of the site, and that the site has the settings that protect against known types of attack.
Technical terms: HTTPS and security headers
Finds forgotten web addresses, such as test.company.com, by searching public certificate records. Such addresses are often less well looked after. You choose which ones to monitor.
Technical terms: subdomains and Certificate Transparency
Every finding is graded by how serious it is. Together the findings become a cyber score that shows where the supplier stands.
By default, the cyber score makes up a quarter of the supplier's overall Risk Score. You can change how much it counts.
The picture shows a check. Each block is an address, and a sweep of light passes over them. What needs fixing rises and is marked with an exclamation mark, higher the more serious it is. Finally the report is ready. Scroll through the steps, or click one.
A finding only helps if someone understands it. That is why every finding has an explanation and stays on the list until it is fixed. The history shows when it was fixed.
Findings are listed per supplier and address, with type, description and the technical details the person fixing it needs. You can choose to show only the most serious.
In Cyber risk – Basic, every type of finding has a short explanation of what it is. With the Cyber risk – Advanced add-on (see below) you also see what the finding can mean for the business and how to fix it, step by step.
Once the supplier has fixed the problem, the finding disappears at the next check, and the history shows what happened. If you like, the supplier can request a new check itself in the vendor portal.
One report per supplier, to download or send by e-mail. Every version is kept.
Findings and reports can also be fetched automatically into other systems you use. How the platform connects to your systems
Cyber exposure comes in two levels. Cyber risk – Basic gives you the checks, the findings, the cyber score and the reports. The Cyber risk – Advanced add-on gives you the full knowledge base and reports with your own logo. Both together make up the Cyber Exposure bundle.
Everything needed to see and follow up the suppliers' weak spots in websites, e-mail and servers.
For those who want to give suppliers concrete steps to fix the problems, in reports with your own logo.
The vendor portal is part of the core platform. There you can show the supplier its own addresses, findings and reports, so it can fix what is needed. You choose what is shown.
Simplified view of the settings.
Four views: the findings, the knowledge base, the reports and the supplier's page.
All findings from the checks. Filter by severity, type, supplier or address.
Screenshots from a demo environment with made-up suppliers.
A demo takes 30 minutes. We show how you find and follow up weak spots at your suppliers, and work out a price that fits you. If you want to add a module, you can try it with your own data first.