Module
Third-Party Risk
The questionnaire says one thing. The open internet says another.
Each supplier score combines what they declare with what can be observed from outside. When the two numbers drift apart, that is the conversation.
Start a proof of conceptThe problem
A completed questionnaire is not a guarantee
The supplier self-assesses, attaches a two-year-old certificate and the file is shelved. Meanwhile their exposed surface changes every week.
Capabilities
Six capabilities, six artefacts
Every capability ends in something you can put in front of an auditor: a document, a dated status or a signature.
-
Onboarding and criticality
What service they provide, what data they reach and what happens if they go down. Criticality sets how deep the assessment goes.
Artefact: Supplier on file
-
External attack surface
Analysis of the supplier’s observable exposure, always with permission and inside the agreed scope.
Artefact: Observed exposure
-
Sector questionnaire
Templates per sector instead of a generic form nobody takes seriously.
Artefact: What the supplier declares
-
AI-assisted document checks
Certificates and reports reviewed automatically: validity, scope and consistency with what was declared.
Artefact: Verified evidence
-
Violet Score 0–1000
A checked score that keeps the declared and the observed explicitly apart, instead of averaging the two.
Artefact: A checked score
-
Monitoring and offboarding
Alerts when something material changes, and an orderly exit with access removal on the record.
Artefact: Relationship closed
The platform
The other modules
They switch on separately. They share the foundation, so adding one more means migrating nothing.
Proof of concept
Try it on your own audits
We stand up an environment with your real scope, your findings and your frameworks. No cost, no card, no commitment to continue.
- Dedicated, isolated environment, ready in 48 hours
- We import your scanner results and your history
- Technical support for the whole trial