Supply Chain Security. Map the blast radius beyond your walls.

They are two layers of the same problem. Third Party Cyber Risk is the governance and advisory work: tiering vendors, reviewing contracts, and reporting to regulators. Supply Chain Security is the technical execution layer that maps the dependency graph and monitors every vendor's live posture. We run them together, so the judgment in the questionnaire is checked against what the signals actually show.

It is the risk from your vendors' vendors. A provider you trust may depend on a cloud region, a library, or a subprocessor you never see. When several of your vendors quietly share the same one, a single failure there hits you through multiple doors at once. Mapping fourth parties is how concentration risk becomes visible, and it is the part a standard questionnaire misses.

No. Questionnaires still capture useful intent and contractual commitments. We add the live layer around them: continuous external scoring, breach alerting, and the dependency map. When a vendor's answers and their real posture diverge, you see it, rather than trusting a form that was accurate the day it was signed.

Both place clear obligations on managing and documenting third party and ICT supplier risk, including concentration risk. The dependency map, vendor tiering, and continuous monitoring produce exactly the register and evidence those regimes expect, kept current rather than assembled in a rush before an audit.

We alert you with the context that matters: what data that vendor holds, what access they have, and which of your systems sit on the path. Where it becomes your incident, the signal feeds the iTDC and Incident Response steps in. The map means you are reacting with a clear picture rather than scrambling to work out your exposure mid-event.

A parts list for your software: every component and dependency, so when the next major vulnerability lands you can answer the only question that matters, are we exposed, in minutes instead of weeks.

Yes. Build integrity is half the practice: signed artifacts, protected pipelines, and provenance checks so what ships is what was built, by you.

New dependencies are checked on entry, existing ones are watched for new vulnerabilities and hijacks, and findings route to owners with context through the same triage discipline as everything else.

By repository and dependency footprint, starting with a fixed-scope software supply chain assessment.

Identify maps the components and build paths, Guard hardens them, Implement watches them continuously, and evidence reports through Enhance.