7 Critical Sources of Third-Party Risk Intelligence

Holistic third-party risk management (TPRM) programs combine periodic, inside-out assessments of internal vendor controls with continuous, outside-in monitoring of their external threats. By complementing vendor assessment results with a stream of outside intelligence, you’ll gain a more complete understanding of each vendor’s potential risk to your business.

When building monitoring into your third-party risk management program, be sure to tap sources of vendor intelligence that are both broad and deep. This post will get you started by outlining a use case for continuous monitoring and revealing key sources of third-party risk intelligence. It will also share best practices for success along the way.

A Use Case for Continuous Monitoring

Informing your vendor risk assessment activities with real-time cyber and business monitoring intelligence will make your TPRM program more continuous and less reactive. For example, you can use monitoring to scan the dark web for a vendor’s vulnerabilities, breaches and leaked credentials. You can then correlate this data with information gathered from vendor assessment questionnaires to reveal inconsistencies in password and/or patch management controls.

A strong TPRM solution not only handles this analysis, but also includes rules and automations that trigger follow-up assessments. This approach closes the loop on third-party risk and transforms point-in-time assessments to continuous risk monitoring.

Third-Party Risk Intelligence Sources

Making sound, risk-based decisions means consuming and normalizing data from many disparate sources. It’s easy to spend a lot of time finding, centralizing, and making sense of the data behind your vendor security posture. That’s why it’s important to consider a TPRM solution’s ability to aggregate and report on third-party intelligence in an actionable way.

Whether you’re evaluating risk monitoring solutions or taking a manual approach, be sure to look into these sources of third-party risk intelligence:

1. Public Sources

Common sources of publicly available – and likely free – third-party threat intelligence provide general industry news, trends and breach updates:

• Data breach sites review the impact of recent breaches (e.g., Data Breach Today)
• Corporate websites share press releases that could indicate potential risks (e.g., layoffs, financial news, etc.)
• Product and company review websites provide insight into customers’ thoughts on a company’s products (e.g., G2)
• Job boards and employee review websites expose how a company operates and indicate potential disruptions (e.g., Glassdoor)
• Trade publications and industry sites review trends that can impact a company’s operations (e.g., Manufacturing Today)
• Blogs and social media posts provide updates on company news, including security incidents (e.g., Recorded Future)
• Certification sites that indicate a company’s level of security (e.g., SOC)
• News feeds provide continuous headlines

2. Private Sources

Private sources of third-party risk intelligence include fee-based data services and websites that may be difficult to find or dangerous to navigate. These sources can provide more detailed business and cyber risk intelligence about your third-party vendors.

• Credit reporting agencies provide a score indicating the financial health of a potential partner (e.g., Experian)
• Financial review sites discuss earnings and risks (e.g., Motley Fool)
• Legal action sites review lawsuits that can negatively impact a vendor's business relationships and ability to execute (e.g., ClassAction.org)
• Threat feeds provide continuous updates on vulnerabilities and exposures (e.g., ThreatConnect)
• Paste sites include code that can be used to exploit a company’s defenses (e.g., Pastebin.com)
• Code repositories are similar to paste sites (e.g., Bitbucket.org)
• Hacker forums where cybercriminals are discussing attack targets and sharing information illegally*
• Dark web forums where you can find leaked credentials and other damaging company information*

Reliable providers of this intelligence feature a global research team that continuously searches for vendor exposures, utilizing multiple risk intelligence partners. This approach can deliver analytical insights that are particularly broad and deep.

*Monitoring hacker forums and dark web sites is best left to professional security researchers!