The whole program on one screen.
Active engagements, approvals waiting, overdue go-lives, unassigned work, open critical issues — the health of your third-party program in a single view, with the pipeline broken down by workflow stage.
- SLA metrics, escalations, and program-health tabs
- Every tile drills straight into the underlying records
Every vendor, scored and tiered.
One list for the entire portfolio, with inherent and residual risk shown side by side and tier assigned by rules — not by whoever filled in the spreadsheet last. Filter, sort, choose your columns, export the whole thing.
- Customizable columns, saved per user
- Full CSV export across every filter
Inherent and residual risk, computed.
Each vendor's score rolls up from the findings against it — inherent across all time, residual from what's still open — on a 0–10 scale you can defend in an audit. Recalculated automatically as issues open and close.
- Shows exactly which findings drive the number
- Assessment schedule, breach intel, and contracts on their own tabs
The fourth parties behind your vendors.
The AI reads vendor documentation and questionnaire responses, pulls out the tech stack and every fourth-party subprocessor, and assembles a live graph of use cases, data types, business teams, and providers — the dependencies a spreadsheet would never surface.
- Each extracted party is classified and confirmed by an assessor before it counts
- Re-runs the extraction when new documents land, and shows which vendors share a provider
Intake to sign-off, one thread.
Requester, manager approval, vendor assessment, assessor review, legal review, completion — every stage on one progress bar, with an AI summary at the top so anyone picking it up is caught up in a sentence.
- Tasks auto-generated from templates per stage
- Legal review runs in parallel, not as a blocker
The AI drafts the impact analysis.
From the intake context, the AI writes a first-pass CIA impact assessment — confidentiality, integrity, and availability, in plain language — ready for your team to review and adjust instead of starting from a blank page.
- Feeds automatic tier assignment and control mapping
- Every AI capability has its own prompt, model, and data policy
Describe the assessment; the AI builds it.
Write what you need in a sentence or two — framework, data types, vendor tier, where to weight the depth — and the AI assembles a sectioned questionnaire. Drop in a spreadsheet of existing questions and it structures those instead.
- Eight question types with conditional logic
- Rules engine assigns the right template to each assessment
Ask the assessment anything — cited to the source.
Every document and questionnaire response in an assessment is indexed. Ask a plain-language question and the AI answers from the vendor's own material, with a Sources list pointing to the exact file and page — so you can verify it, not just trust it.
- Scope a question to one document, or across the whole assessment
- Alongside per-question notes, vendor flags, and one-click issue creation in the review screen
Findings on an SLA, with AI remediation.
Every issue gets a due date derived from the go-live date and its severity band, a bar-raiser approval when it's critical, and an AI-drafted set of compensating controls and remediation language aligned to your playbook.
- Due dates recalculate automatically when dates change
- Close as remediated or cancelled — and reopen if it comes back
Every finding scored by the AI, with the math shown.
New issues land unscored and the AI rates them in the background — combining how likely the weakness is to be exploited, the business impact inherited from the use case, and whether it matches a known attack pattern, on the same 0–10 scale as the vendor score. Each rating comes with a written rationale, not just a number.
- The full calculation is visible, so any score can be defended in an audit
- Assessors can override any AI rating with a note, and revert to the AI value in one click
The AI checks whether the fix actually happened.
When a vendor says an issue is fixed, the AI reads the comment thread and the evidence they uploaded and compares it to the remediation that was required. You get a verdict, a confidence level, and the reasoning — so assessors start from what the evidence shows instead of re-reading every attachment.
- Re-checks automatically when new evidence is attached, or on demand with one click
- Advisory only: the verdict never changes the issue's status — a person still closes it, and it also surfaces as a column in the issue list
Known exploited vulnerabilities, matched to the stack.
The AI extracts every technology and fourth party from your vendors' documentation, then matches CISA's Known Exploited Vulnerabilities catalog against them — so a new CVE in a component three layers down surfaces on the technology's own page the day after CISA publishes it.
- NVD and CNA severity scores on every match; ransomware-linked CVEs flagged
- A live threat feed pairs this with breach data matched to vendor domains
The numbers your board actually asks for.
SLA attainment, the issue backlog cut by severity and team, every policy exception, and the health signals that predict trouble — all on the same program dashboard your team runs the day from, across a date range you pick. No spreadsheet assembly the week before the review.
- Escalations and per-assessor load live on their own tabs alongside these
- Every figure exports to CSV, and every record carries a full audit trail
Everything connected, from vendor to data element.
Every vendor, use case, subprocessor, technology, dataset and data element is linked as you work — no separate diagramming exercise. Start from any one of them and follow the lines: which use cases a vendor serves, which fourth parties each one relies on, and exactly which data flows through them.
- Ask the hard question in one click: if this subprocessor has an incident, which vendors, use cases and data are in the blast radius?
- Maps are built from confirmed assessment data, so they stay current as vendors and subprocessors change
- Drag, zoom or go full screen; click any node to jump straight to its record
Your vendors get a portal, not an inbox.
Vendors sign in to their own workspace to answer questionnaires, respond to assessor questions on subprocessors, and work the findings assigned to them — each with the same lifecycle your team sees. Evidence and answers land on the record, not in an email thread.
- Strictly scoped: a vendor sees only its own engagements, assessments, and issues
- Two-factor sign-in available, with a full attestation history for every vendor