Vendor risk scoring, a number is a summary, not an argument

Three inputs, weighted differently by every methodology. Inherent riskfactors — data, access, dependency, jurisdiction — which are about exposure rather than security. Assessment results — questionnaire responses and the documents supporting them. And outside-in observation — what the vendor's external estate reveals about patching, exposure, certificate hygiene and breach history.

A score built from only one of the three is narrower than it looks. Security ratings that read the external estate alone say nothing about access management or staff vetting. Questionnaire scores alone are self-assertions. The composite is better, provided the weighting is published — an unexplained number is not evidence, it is a claim.

Use it for what it is good at: ranking a portfolio, spotting movement, and deciding where to spend the assessment budget this quarter. A drop of forty points at a critical vendor is a genuinely useful signal, and no human review would have caught it that week.

Do not use it as the decision. Two vendors on the same score can carry entirely different exposures — one holds no data, the other holds your customer base — and a score that ignores inherent risk weights them identically. The defensible pattern is score for triage, tier for effort, and evidence for the decision that actually gets recorded.