What a supplier looks like from outside, without them having to fill anything in
The questionnaire says what the supplier says about themselves. The external view shows what any attacker also sees: SPF, DKIM, DMARC and DNSSEC, certificates from transparency logs, technologies in use, similarly spelled domains, entries in public leak sources. From that comes a grade A to F per supplier, with history over time, as an independent and repeatable view next to the self-disclosure. Because the domains belong to a third party, the module distinguishes strictly between passive, active with consent and never, and the assignment of check steps is fixed in code: no setting can actively scan a supplier.
The passive profile makes no request to the supplier’s systems beyond one HTTP call per host: CT logs, DNS, domain security, certificates, technology detection, lookalike search, leak check. That makes the grade repeatable and legally uncritical.
Port scan, subdomain takeover check, library vulnerabilities, web spider, host enrichment and IP reputation run only once a documented consent of the supplier is on file: contract, DMS document or evidence, with its own permission. Without consent the gate stays closed.
Name guessing, vulnerability scan, cloud storage search, netblock discovery, full discovery and deep TLS inspection do not run against a supplier. Supplier scopes stay out of your own key figures and are not touched by the nightly full scan.
A grade per supplier that does not come from a questionnaire, and a boundary that sits in code rather than in a setting.
Schedule a no-obligation demo – we will show you the module with your own use cases.
