Supply chain detection and response (SCDR) applies the logic of detection and response — continuous monitoring, alerting, triage, containment — to risk originating in an organisation's suppliers rather than inside its own perimeter.
The lineage is familiar. EDR watches endpoints. XDR correlates across endpoints, network, identity and cloud. Both stop at the boundary of what you own. SCDR extends the same posture outward, on the observation that a significant share of breaches now arrive through a third party — a compromised supplier, a sub-processor's incident, a fourth-party dependency nobody had mapped.
In practice it means treating vendor risk as an operational signal rather than a periodic assessment: continuous monitoring of supplier posture, breach and dark-web correlation, detection of material change while it still matters, and a defined response path when something fires — who is contacted, what is asked, what is escalated, and what gets reported. The difference from conventional TPRM is timing. An assessment tells you what a vendor looked like when you asked; SCDR is built around finding out that something changed before it becomes your incident.
Endpoint and network detection close two of the three doors. The third — your supply chain — is where ransomware operators and nation-state actors increasingly live, because nobody else is looking.
SCDR is a three-stage workflow: detect the supply-chain event, decide what it means, and act on it without waiting for someone to draft an email. The Agency runs all three.
The detection layer for everything outside your perimeter. REX continuously watches your vendors and their vendors — attack surface, breach signal, dark-web mentions, fourth-party exposure — and ranks every event by impact before it lands in your queue.
Decision logic on top of the detection feed. TARA decides what each event means for that vendor's tier and your regulatory posture, then opens an SLA-bound remediation track in your ITSM — so a critical-tier breach doesn't queue behind a low-tier banner grab.
Vendor-side action, on the channel they actually use. When the issue belongs to a vendor, NOVA reaches out across email, WhatsApp or in-app chat — subject to your autonomy mode — and tracks the response back into the same workflow.
SCDR turns the supply chain from the part of TPRM that gets reviewed quarterly into the part that's monitored continuously and actioned automatically.
REX watches every vendor in the portfolio (and their vendors) without a duty rota. Material events surface in real time, not at the next review window.
TARA decides what the event means against tier and regulatory framework, and opens the right ticket in the right place automatically.
NOVA tells the vendor on the channel they read. Your team stops drafting incident emails and starts reviewing the response.
Every detection-to-resolution loop links back to the originating signal. When the regulator or board asks "how did we respond to X?" the answer is already structured.
We had a leaked-credential dump matched to a Critical-tier vendor inside two hours of REX seeing it — and NOVA had the vendor's CISO on a call before our team had finished triaging it.
Where it sits relative to EDR and XDR, and what responding to a vendor event involves.
Book a 30-minute call and we'll have NOVA, ARIA and REX produce a complete posture report on one of your live vendors inside 24 hours.