Reduce cyber risk across your suppliers, vendors, and partners

Over 85% of cyberattacks now originate at endpoints or through third-party vendors. Our Supply Chain Defense services (Third-Party Risk Management) continuously monitor the security practices of your partners and suppliers, ensuring that a vulnerability in their system doesn’t become a breach in yours.

A ratings platform ends roughly where this begins. It gives you a score per supplier; this adds the work that actually lowers risk — analysts who curate each supplier’s digital footprint so the findings belong to the right company, escalation governed by thresholds you set rather than by a vendor’s default, a portal your suppliers can use themselves, and, in the directed tier, analysts who do the chasing instead of your team. Your own organisation is assessed and scored the same way, which is usually the first useful thing a client sees.

Nothing goes out that you have not approved. The announcement is written to go out under your name, not ours: you have engaged continuous external monitoring, it changes nothing they are already doing, it is an additional set of eyes, and you are paying for it. Many clients prefer to send that introduction themselves and say that we will be in touch from then on. After that a supplier gets access to their own portal, a named contact, and findings with recommended fixes — never a bill and never a demand. We write to Hungarian and German suppliers in their own language.

Then the finding stays open, and we would rather tell you that now than after you sign. The service commits to identifying, validating and escalating — it cannot commit to what a third party chooses to do, and the contract says so plainly: resolution depends on the supplier’s own engagement, and nobody can guarantee that a third party will respond or resolve anything. What the programme does is put a validated finding and a specific fix in front of the right person, chase it, and show you exactly where it stalled. Beyond that the lever is your commercial relationship, and for an unresponsive supplier you may have to use it.

No, but you do have to name the critical ones, and that is a week of work rather than a project. A list of company names and primary domains is enough to begin; identifying the critical group, grouping suppliers into portfolios and setting the escalation thresholds takes a few hours of your time, and the tuning continues after go-live rather than blocking it. For the tail you cannot triage yet, High Volume Monitoring returns a single risk level per company from little more than a domain, and you promote individual suppliers into the full service as you learn which ones matter. If the tiering itself is the problem, that is a workshop we run.

Two mechanisms, and they address the two ways it usually goes wrong. Attribution: each supplier’s footprint is built automatically and then curated by analysts, and re-checked against the finding whenever one is escalated, so assets that turn out not to be theirs come off rather than generating another argument. Validation: every finding escalated to you has been manually reviewed first, and the two classic false-positive sources — guest networks and the supplier’s own security appliances, which look like malicious infrastructure from the outside — are detected and suppressed automatically.

Your contract is with Spirity. BlueVoyant works underneath us and provides the monitoring platform and the Risk Operations Center analysts, and the platform, the findings and the analyst content are in English. Localisation, client success and the local expert bench are ours — so you and your Hungarian- or German-speaking suppliers have a Spirity contact who works in their language, and supplier correspondence goes out in Hungarian or German where that is what the supplier reads. Where local-language contact with suppliers is a firm requirement, we scope the engagement so that the outreach sits with us rather than with the analyst centre.

The number of suppliers you monitor — and, unusually for this market, nothing about how big those suppliers are. Pricing does not move with a supplier’s size, its number of IP addresses or domains, and their access to the portal carries no seat limit. So the variables are how many suppliers, which service tier each one sits in, the term, and whether you add questionnaire management. The practical consequence is the one that matters: a forty-person supplier costs what a forty-thousand-person supplier costs, which is what makes monitoring the long tail affordable at all.