Your own estate
Scanned daily, so your own posture is as current as the suppliers you are judging.
UK rail · Supplier risk
The supplier risk platform built for UK rail.
One platform for every rail supplier and every team. Most tools do one part of the job — a questionnaire, a rating, a spreadsheet of evidence. RiskXchange does every part, and it already runs inside UK rail.
A demo runs against your own supplier list, not a sample one.
Three partial answers become one score per supplier, from 0 to 900, that every team is looking at.
Proven in UK rail
Already running supplier risk inside UK rail.
RiskXchange runs supplier risk for a UK rail industry body and more than 40 member companies: one shared view of the suppliers they have in common, a preferred supplier list built from live risk scores, and senior teams managing supplier risk as it changes rather than as it was at the last review.
The shared view is what makes it work. In rail, members are assessing the same suppliers as each other — so assessing one of them once, properly, is worth more than assessing it forty times in forty spreadsheets.
40+
member companies working from one shared view
1
preferred supplier list, built from live risk scores
Shared
a single view of the suppliers members have in common
Why RiskXchange
Every other tool does part of the job.
Here is what a rail supplier risk platform has to do, and who actually does it.
| What you need | Questionnaire tool | Ratings tool | Spreadsheet | RiskXchange |
|---|---|---|---|---|
| One view of a supplier for every team | No | No | No | Yes |
| Checks a new supplier straight away, with no sign-up needed | No | Yes | No | Yes |
| Joins what a supplier says with what can be seen, in one 0–900 score | No | No | No | Yes |
| Keeps checking between reviews | No | Yes | No | Yes |
| Sees the suppliers that never sign up | No | Partly | No | Yes |
| Maps the suppliers behind your suppliers | No | Partly | No | Yes |
| Takes a finding through to a fix | Partly | No | No | Yes |
Scroll the table sideways to compare every column.
No sign-up requiredYou Third party Fourth party
Your suppliers’ suppliers, whether or not they have an account.
Most platforms can only show you the companies that joined them. RiskXchange scores a company from the outside, so what you can see is not limited to who signed up — and it does not stop at the supplier whose name is on your contract.
The supplier you contracted with
Scored 0–900 from the outside before anyone asks them for anything. Signing up is how they reply, not how they get assessed.
Their supplier, and the one behind that
Found from technical evidence rather than disclosure — so the hop your supplier never mentioned is still on the map.
Found from evidence, not from disclosure
A fourth party is your supplier’s supplier — whoever they depend on to deliver to you. You will not find them by asking, because the supplier filling in your questionnaire often has not mapped their own chain either. They are visible in technical evidence instead, which does not require anyone’s cooperation to read.
This is also how concentration becomes visible. The moment you can see that a large share of a rail supplier list terminates at the same hosting provider or the same maintenance contractor, you are having a different conversation from the one the individual scores suggest — see supply chain risk and supply chain detection and response.
- DNS and CNAME records — who hosts or fronts their services
- Mail exchanger records — who carries their email
- CDN and WAF fingerprints — whose edge their traffic crosses
- TLS certificate issuers — who they trust to vouch for them
- Third-party scripts loading on their web properties
For your teamSecurity Compliance and assurance Procurement IT
One view, whatever your role.
The same supplier record, read four different ways. Nobody has to ask another team what they are looking at.
One view of risk, not three partial ones.
Every supplier checked from the outside with no sign-up needed, joined with what the supplier tells you — so the assessment and the evidence agree before you act on either.
One current record for every supplier.
Reports built from live data rather than assembled quarterly, ready on the day the board or an auditor asks rather than three weeks after.
Review answers instead of chasing them.
Questionnaires typically arrive more than 70% pre-filled from evidence already on file, so the work is checking what came back, not getting it back.
One platform instead of three tools.
Unlimited user seats on every plan, so bringing another team onto the same view is a decision rather than a licence negotiation.
Why rail, why now
In rail, one supplier rarely serves one company.
A supplier new to one operator can reach systems shared across many. Questionnaires in one tool, ratings in another and evidence in a spreadsheet cannot follow a dependency like that — each one holds a different part of the answer, and none of them holds the chain. Supply chain risk in rail is concentration risk by another name.
The operating estate makes it sharper. Signalling, depot and telemetry systems put supplier access next to operational technology, where a change is harder to make and a compromise is harder to contain than in corporate IT.
And the duty is tightening. The Cyber Security and Resilience Bill — the UK’s domestic successor to the 2018 NIS Regulations — places supply chain duties on operators of essential services, rail included. When it lands, being able to show supplier risk, not just record it, becomes the standard.
What you are getting
The platform underneath the rail view.
5 million+
companies already scored — none of them had to sign up
Weekly
rescan of every supplier, checked nightly for material change
70%+
of questionnaire answers typically pre-filled
Unlimited
user seats on every plan
Questions
What rail teams ask us.
Does RiskXchange already work with UK rail organisations?
Yes. RiskXchange runs supplier risk for a UK rail industry body and more than 40 of its member companies, who share one view of the suppliers they have in common and a preferred supplier list built from live risk scores.
How do you assess a rail supplier that will not fill in a questionnaire?
Externally, and without their participation. Every supplier is scanned from the outside for its exposed estate — domains, subdomains, services and certificates — and scored 0–900 before anyone is asked for anything. A questionnaire adds what cannot be seen from outside; it is not the starting point. See security ratings and attack surface management.
Do you only cover companies that already use RiskXchange?
No. Coverage is not a customer list. More than five million companies are already scored, and any company with an internet presence can be assessed wherever it is in the world, whether or not it has ever heard of RiskXchange. An account is how a supplier replies to you — it is not how they get assessed, and it is not a condition of being visible to you.
Can you see the suppliers behind our suppliers?
Yes. A fourth party is your supplier’s supplier — whoever they depend on to deliver to you. They are found from technical evidence rather than disclosure: DNS and CNAME records, mail exchangers, CDN and WAF fingerprints, TLS certificate issuers and the third-party scripts loading on their web properties. Nobody has to declare the relationship for it to appear.
What happens between formal supplier reviews?
Every supplier is rescanned weekly and each score’s time series is checked nightly for material change and new breach signal, so a posture drop surfaces at the next check rather than at the next review cycle.
How does this relate to the Cyber Security and Resilience Bill?
The Bill is the UK’s domestic successor to the 2018 NIS Regulations and places supply chain duties on operators of essential services, rail among them. It is a separate instrument from NIS2 and on its own timetable — our explainer on what it means for suppliers covers the detail.
We already use RiskXchange. Does the rail view cost extra?
No. Every plan includes unlimited user seats, so bringing procurement, compliance and IT onto the same supplier view does not change what you pay. See platform pricing.
How long does it take to see our own suppliers in the platform?
A demo is run against your real supplier list, so you see your own estate rather than a sample one. Webhook integration into an existing procurement or GRC workflow is typically under a day — see integrations.
Book a demo
Bring your supplier list. We will score it.
Thirty minutes, run against your own rail suppliers rather than a sample set. You will see the scores, the fourth-party hops behind them, and the ones that have never answered a questionnaire.
- No preparation needed — a supplier list is enough to start.
- Nothing is asked of your suppliers to run it.
- You keep what we find, whether or not you go further.
See it on your own rail suppliers.
Your estate, your suppliers, the hops behind them, and the ones that never answered a questionnaire — on one view, scored on one scale.
Already on RiskXchange? Every plan includes unlimited user seats — bring every team onto the same view.