Third-party risk management
Identify intelligence in third-party risk.
Know which suppliers put you at risk, and prove to your customers that you’re not one. We run third-party risk for you, or build the capability into your own estate.
Regulations
NIS2
DORA
UK NIS Regulations
Cyber Security and Resilience Bill
UK & EU GDPR
Art. 28
EU AI Act
EU Cyber Resilience Act
UK Critical Third Parties regime
PRA SS2/21
outsourcing
FCA SYSC 8
EBA Outsourcing Guidelines
Procurement Act 2023
Telecoms Security Act
CSDDD
supply chain due diligence
Modern Slavery Act
DEFCON 658
Def Stan 05-138
NHS DSPT
Standards and frameworks
ISO/IEC 27001:2022
A.5.19–5.23
ISO/IEC 27036
supplier relationships
ISO 28000
supply chain security
ISO 22301
continuity
ISO/IEC 27701
privacy
ISO/IEC 42001
AI management
NIST CSF 2.0
GV.SC
NIST SP 800-161
NCSC CAF
NCSC Supply Chain Principles
Cyber Essentials Plus
SOC 2
CSA STAR
PCI DSS v4.0
CIS Controls v8
CMMC / DFARS
Both directions
Risk runs both ways. So does our intelligence.
You rely on suppliers. Customers rely on you. We give you intelligence on the first and evidence for the second, so what you demand and what you can prove always line up.
YOUR SUPPLIERS
Can we trust them?
Cloud hosting
Monitored
Payroll provider
Verified
Logistics partner
Triaged
SaaS vendor
Verified
148
In scope
3
Need action
INTELLIGENCE IN →
Supply. Assured.
Intelligence in. Evidence out.
One view of both directions.
Intelligence-led tiering
Analyst triage
Evidence at source
Board-ready reporting
EVIDENCE OUT →
YOUR CUSTOMERS
Can they trust you?
Questionnaire
Answered
Customer audit
Scheduled
Assurance profile
Shared
Tender pack
Submitted
92%
Pre-answered
48h
Avg. response
Illustrative example
How we do it
Always-on intelligence.
We pair practitioner judgement with a curated library of leading third-party risk platforms. You get the outcomes, without buying, configuring or running another tool.
Always-on threat intelligence across your supply chain
Financial distress, sanctions and ownership changes, breaches, extortion claims and regional disruption, matched to your suppliers continuously. Our analysts triage every signal before it reaches you.
Live supplier signals
Illustrative
Financial
Credit downgrade at a single-source component maker
2m
Sanctions
Ownership change flagged at a freight forwarder
14m
Breach
Credential leak linked to a payroll provider
1h
Port disruption near a critical supplier site
3h
Extortion
Leak-site claim naming a tier-2 logistics subcontractor
5h
1,240
Signals screened this week
37
Triaged by our analysts
5
Escalated to you
See the suppliers your register misses
We build your supplier picture from your systems and spend, not just the procurement register, then show which relationships are live, which have lapsed and where risk concentrates.
On the procurement register
Found in your systems and spend
Your organisation
One flaw, four tiers deep
One vulnerable component cascades through sub-tiers to you. We trace who is exposed before it lands.
Exposed
Not affected
You
61
On register
312
Found
48
Lapsed
Controls checked at source
AI-assisted collection reads controls directly from supplier and internal systems and re-checks them continuously. Our assessors review and sign off every conclusion.
MFA enforced on admin accounts
Verified
Backups restored and tested
Verified
Encryption at rest
Verified
Incident response plan
Awaiting
Supplier access reviewed
Verified
Control coverage
80% verified
Risk, mapped to place
Supplier sites are geolocated and live events plotted against them, so disruption near a critical site is flagged early.
Port strike, 12 km from tier-1 site
High
Flood alert near a supplier depot
Watch
Sanctions widened to a sub-tier region
Review
One connected picture of risk
Suppliers, systems, data flows and controls sit in a single linked model. Every finding traces back to its evidence, so boards and auditors can see exactly why a decision was made.
TRACE
Board finding
Control gap
Evidence
Sub-tier supplier
9,400
Relationships mapped
100%
Findings traced to evidence
1 click
From board report to source
One assurance profile. Every customer.
When you are the supplier, a single verified assurance profile answers customer reviews faster and ends repeat questionnaires.
Assurance profile verified
Shared with your customers
ISO/IEC 27001 certificate
Current
Cyber Essentials Plus
Valid
Penetration test summary
Q3 2026
Security questionnaire
Pre-filled
What we do
Run for you. Built with you. Owned by you.
Three ways to work with us: a managed service, expert consultancy, or a capability built into your own estate that you own outright. Every engagement covers both directions of your supply chain.
RUN FOR YOU
Managed third-party risk.
Our analysts and assessors run the programme on a library of leading platforms. You get the outcomes without buying, configuring or running another tool.
01
Managed TPRM programme
Onboarding, tiering, assessment, monitoring, remediation and board reporting.
02
Audits and assessments
Remote and on-site audits of critical suppliers, scoped to risk tier.
03
Customer assurance
Evidence packs, questionnaire responses and audit readiness for your customers.
Explore managed services
BUILT WITH YOU
Third-party risk consultancy.
Senior practitioners who have run security and supply chain risk in defence, nuclear and critical national infrastructure, working alongside your team.
01
Maturity and readiness
Benchmark your programme against DORA, NIS2, ISO/IEC 27036 and your regulator.
02
Programme design
Policy, risk appetite, tiering model and contract clauses.
03
Due diligence
Third-party risk due diligence for M&A, outsourcing and critical procurements.
Talk to a consultant
OWNED BY YOU · TPRM-IN-A-BOX
Own the capability.
Not the licence.
A third-party risk capability built inside your own estate, on the enterprise AI platform you already run. You own it outright.
Built in your own tenancy
Your data, suppliers and evidence never leave your environment.
AI-assisted from day one
Tiering, questionnaire review, evidence analysis and board reporting, with a human in the loop.
No per-supplier licence
Handover, training and optional support. Scale your supplier base without scaling cost.
Ask about TPRM-in-a-box
Our method
Six stages. One continuous chain.
One lifecycle, whichever way the risk flows. Baselined once, then kept running.
01
Identify
Identify and categorise every supplier by criticality and security exposure.
02
Map
Trace dependencies through the sub-tiers to reveal cascading risk.
03
Assess
Test control effectiveness, in proportion to each supplier’s tier.
04
Defend
Apply resilient defence: remediation, clauses and continuity planning.
05
Measure
Track performance with live metrics and continuous monitoring.
06
Assure
Validate compliance and give your board and customers confidence.
Regulatory direction
From the UK’s Cyber Security and Resilience Bill to NIS2, DORA, ISO/IEC 27001 and the NCSC Cyber Assessment Framework, you are now accountable for the suppliers you rely on, and expected to prove it. The same eight expectations come up every time. Our method is built around all of them.
Continuous, not annual
Ongoing monitoring of supplier services replaces the yearly questionnaire.
DORA · ISO/IEC 27001 A.5.22
Deeper visibility
See beyond tier one. Regulators can now designate critical suppliers in their own right.
NCSC PRINCIPLES · CS&R BILL
Board-level accountability
The management body owns third-party risk, and can be held to account for it.
NIS2 ART. 20 · DORA ART. 5
Proportionate approach
Controls scaled to each supplier’s criticality, not one size for all.
NIS2 ART. 21 · DORA ART. 4
Resilience focus
Plan for supplier failure, with tested exit strategies, not just compliance.
DORA ART. 28 · ISO 22301
Evidence-based assurance
Outcomes you can demonstrate to an auditor or regulator, not self-attestation.
NCSC CAF · ISO/IEC 27001
Formal risk management
A documented strategy, a register of third parties and recorded treatment decisions.
DORA ART. 28 · ISO 28000
Incident reporting in hours
24-hour early warnings mean your suppliers must tell you fast, and you must act faster.
NIS2 ART. 23 · CS&R BILL