Supplier risk management, without the headcount.

Supplier risk is the exposure created by depending on an organisation you do not control. It is usually discussed as a security question, but it arrives in four distinguishable forms, and programmes that conflate them tend to manage the easiest one well and the others not at all.

• Security risk. The supplier is compromised, and their access, their integration or your data goes with them.
• Resilience risk. The supplier fails, is acquired, or suffers an outage, and a service you depend on stops.
• Compliance risk. The supplier’s practices put you in breach of an obligation that is yours, not theirs — the effect of NIS2, DORA and the UK’s Cyber Security and Resilience Bill.
• Concentration risk. Many suppliers, one underlying dependency. Invisible one supplier at a time.

A note on vocabulary, because it matters for finding things: UK organisations generally say supplier where US organisations say vendor, and “supplier assurance” where others say “third-party risk management”. The disciplines are the same. If you are comparing tooling, note that most of the market is documented in the US vocabulary — our third-party risk management software page covers that side.

Every artefact a supplier assurance programme collects — questionnaire, certificate, audit report, penetration test — describes a moment. The questionnaire describes the day it was completed. The certificate describes the day of the audit. The penetration test describes the week it ran.

The decision you make on that evidence, though, is not about that day. It is about the following twelve months, during which the supplier will change hosting providers, ship new services, be acquired, lose staff, and inherit vulnerabilities in software they did not write. None of that generates a notification to you.

This is not an argument against questionnaires. Inside-out evidence tells you things no external view can — governance, policy, who is accountable, what happens at offboarding. It is an argument that inside-out evidence alone leaves you blind for everything except the assessment window, and that the fix is not a longer questionnaire but a second, continuous source of signal that requires no cooperation from the supplier to keep flowing.

• External attack surface. What of theirs is reachable from the internet, and does it look maintained? Expired certificates, unsupported software and forgotten subdomains are cheap to observe and strongly correlated with the rest.
• Patch discipline. Not whether they have a policy — whether observable services are current.
• Authentication. MFA on the systems that touch your data, including the SaaS tools bought outside their IT function.
• Access model. How their staff reach your environment, whether that access is time-bound, and who reviews it.
• Breach and disclosure history. Not disqualifying in itself — how an organisation handled an incident is often more informative than whether it had one.
• Their fourth parties. Who they depend on, and whether those dependencies concentrate with your other suppliers.

Five questions separate the two:

• Does it produce evidence, or only collect it? A tool that stores questionnaires is a filing system. Ask what it tells you that you did not put in.
• Does it pre-populate? If your team still types answers from a SOC 2 report into a questionnaire, the tool has not addressed the actual cost.
• Does it monitor between assessments? Point-in-time tooling inherits the limitation described above.
• Does it reconcile inside-out and outside-in? Holding both and never comparing them is the common case.
• Does it chase suppliers for you? Follow-up is where the calendar actually goes — not analysis.

RiskXchange’s answer to the last two is The Agency: NOVA runs the supplier conversation across email, WhatsApp and in-app chat and does the chasing; ARIA pre-populates questionnaires from documents against 157 universal controls and validates answers against evidence; REX watches the outside-in signal continuously and flags material change. Autonomy is set per supplier, so a critical one can require sign-off on every action while a low-risk one runs hands-off.