Bitsight Third-Party Risk Management
Supplier assessments and continuous monitoring based on security ratings.
Supply Chain
Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
Addresses 82 stories in our coverage in the last 90 days 4 products that provide it
What it is
An inventory of suppliers ranked by how critical they are, security assessments before and during the contract, and monitoring for supplier incidents.
How to value it
Supplier breaches have caused some of the largest incidents of recent years, through software updates, payroll services and file transfer tools. NIS2 and DORA both make supply chain security an explicit duty, and DORA requires a register of ICT providers. Knowing your critical suppliers and watching them turns a surprise into a planned response.
Questions to ask a vendor
- 1Does it rank suppliers by criticality and data access, instead of sending everyone the same questionnaire?
- 2Does it monitor suppliers continuously for breaches and exposures?
- 3Can it produce the DORA register of information?
- 4How are our suppliers' own suppliers handled?
For your risk register
- Risk
- A breach at a critical supplier exposes our data or stops operations.
- Control
- Supplier inventory with criticality tiers, assessments and continuous monitoring.
- Owner
- Procurement together with the CISO.
- Measure
- Critical suppliers with a current assessment.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
OneTrust Third-Party Management
Supplier inventory, risk assessments and monitoring across privacy and security.
SecurityScorecard Ratings
Outside-in security ratings and monitoring of suppliers.
UpGuard Vendor Risk
Supplier security questionnaires, ratings and continuous monitoring.
Recent stories it addresses
324 stories in total- 17 Oct 2026Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Hackers use a stolen ConnectWise credential to access 173 Microsoft 365 tenants.
- 14 Oct 2026Ledger asks sellers across Asia to halt sales after supply-chain attack
Ledger halts sales in Asia after discovering tampered crypto wallets with spy chips.
- 13 Oct 2026$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant
Hardware implant in Ledger signers linked to $86M crypto heist.
- 12 Oct 2026Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports
Ledger pauses sales via CryptoBilis after reports of $86M fund theft linked to tampered hardware wallets.
- 12 Oct 2026iRhythm Data Breach Impacts at Least 360,000 People
iRhythm data breach exposes personal information of over 360,000 patients.
- 12 Oct 2026Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
Ransomware response expert Edward Dubrovsky arrested in US for alleged involvement in ShinyHunters attacks.
- 10 Oct 2026Canadian cybersecurity executive arrested in federal extortion case
Cybersecurity executive arrested for extortion conspiracy linked to ShinyHunters FBI breach.
- 9 Oct 2026FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack
FBI arrests a Canadian citizen in Pennsylvania linked to the ShinyHunters data breach.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.