SUPPLY CHAIN MONITORING

Supply chain monitoring across your third parties

Your suppliers' exposure is your exposure. Monitor the external attack surface of the third parties who host, process or connect to your data, continuously and without needing their co-operation.

Create a free account Request a demo
  • No supplier co-operation needed
  • Continuous, not annual
  • Evidence for your framework
Hexiosec ASM supplier monitoring visualisation
WHAT ASM LETS YOU DO

Replace an annual belief with a continuous fact

Third-party risk sits with your board and your regulator, but most assurance still runs on a self assessment somebody filled in last year.

CONTINUOUS ASSURANCE

Know a supplier is exposed before they tell you

Questionnaires describe intent. Monitoring shows the estate as it is today, including the things nobody thought to mention.

Explore supplier risk →

MEET YOUR DUTIES

Evidence third-party oversight to a regulator

DORA, CAF and NIS2 all place duties on how you oversee suppliers. Show a repeatable process rather than a filing cabinet.

Explore compliance →

NEGOTIATE BETTER

Go into renewal knowing what you are buying

Objective posture data changes the tone of a contract conversation and gives you something specific to ask for.

Explore cyber insurance readiness →

ACQUIRE SAFELY

See the suppliers you inherit in a transaction

A target brings its own supply chain. Map it before completion rather than discovering it afterwards.

Explore M&A due diligence →
Who is it for

For the people who carry third-party risk

The vendor or procurement risk lead

You run the assessment cycle and know a questionnaire is a snapshot of what someone was willing to write down.

The CISO with regulatory duties

DORA or CAF puts named responsibility on you for oversight of critical suppliers.

The IT lead in a supplier-heavy estate

Most of your service is delivered by other people. Their exposure lands on your incident bridge.

The problem

Questionnaires tell you what a supplier believed last year

Annual self assessment is the default control in most supply chain security programmes, and it is the weakest evidence in the file.

Attackers use the weakest link

Your data is only as protected as the smallest supplier holding a copy of it.

Point in time is not enough

A clean assessment in January says nothing about an exposed service in June.

Regulators expect oversight

DORA, CAF and NIS2 all ask how you monitor third parties, not just how you onboard them.

PORTFOLIO VIEW

Every supplier, side by side

Add the suppliers that matter and see their external posture in one place, with comparable metrics rather than a number you cannot interrogate.

  • Supplier dashboard with comparable metrics
  • Side-by-side posture comparison
  • Grouping by criticality or contract
  • Trend over time as suppliers change
Comparing supplier scores with Hexiosec ASM
Comparing supplier scanning with Hexiosec ASM's own asset monitoring capabilities
THE SAME DEPTH

The same discovery you run on yourself

Each supplier gets full external discovery and risk assessment, so you see exposed services and real vulnerabilities rather than a summary grade.

  • Full asset discovery per supplier
  • Exposed services and known vulnerabilities
  • Certificate, mail and DNS hygiene
  • Changes flagged as they happen
EVIDENCE

Turn oversight into something you can show

Export supplier posture into the reports your risk committee, auditors and regulators expect to see.

  • Per-supplier and portfolio reporting
  • Evidence for third-party duties under DORA, CAF and NIS2
  • Specifics for remediation and renewal conversations
  • A defensible record of ongoing oversight
Exporting supplier scan results as varying report types
Under the hood

How supplier monitoring works

Everything here uses the same non-intrusive discovery engine that maps your own estate, pointed at the organisations you nominate.

No supplier involvement needed

Monitoring relies only on publicly available information, so it does not depend on a supplier agreeing to be assessed or returning a form.

The same engine, not a rating

You see the underlying assets and findings, not a score with no working shown.

Comparable metrics

Suppliers are assessed on the same basis, so differences between them mean something.

Change detection

New exposure on a supplier estate is surfaced as it appears rather than at the next review date.

Grouping and criticality

Organise the portfolio by contract, tier or business criticality so attention follows importance.

UK sovereign throughout

Assessment, storage and processing all happen in the United Kingdom, in the London region of Google Cloud.

Where it pays off

Where supplier visibility changes the outcome

This page covers the monitoring capability. For the wider programme, including how evidence is collected and acted on, see the supplier risk solution.

ASM + Transfer

Third-party & supply chain risk

Continuous supplier posture, with evidence collected securely through Transfer.

Third-party & supply chain risk
Explore supplier risk →

asm led

Achieve compliance

Produce the asset and vulnerability evidence your framework assessment depends on.

Achieve compliance
Explore compliance →

ASM + Transfer

M&A due diligence

Assess a target and the suppliers it brings with it, before completion.

M&A due diligence
Explore M&A due diligence →

ASM Led

Cyber insurance readiness

Show that supplier concentration and exposure are actively managed.

Cyber insurance readiness
Explore cyber insurance →
WITH HEXIOSEC TRANSFER

Monitor from outside, collect evidence from inside

External monitoring tells you what a supplier exposes. You will still need documents from them, and that is where Transfer takes over.

  • Encrypted forms to request assurance evidence from suppliers
  • File collection without exposing a shared mailbox
  • A workspace per supplier for ongoing remediation
  • UK-sovereign hosting across both products, so evidence never leaves the country
Explore Hexiosec Transfer →
Using Hexiosec Transfer to share supplier reports

Hexiosec delivers an exceptional experience, principally by enhancing our understanding of customers' digital assets. We've found the platform to be markedly superior to its market counterparts.

Jack S.

IT Director · Information Technology and Services

availability

Supply chain monitoring on every tier

Start with a single supplier on the free tier. The portfolio dashboard and comparable metrics arrive with Premium.

FREE

One supplier

Monitor a single third party alongside your own estate, with the same discovery and risk views.

Create a free account
Premium

Three suppliers

Up to three suppliers, with the portfolio dashboard and comparable metrics across them.

Start a free trial
ENTERPRISE

Five suppliers & up

From five suppliers, scaled to your portfolio, with portfolio reporting and a named account manager.

Book a demo
FAQ

Questions about supply chain monitoring

Do we need the supplier to agree?
No. Hexiosec ASM is designed to assess publicly accessible systems without requiring the supplier’s cooperation, credentials or software installation. Much of its discovery uses publicly available information, while any direct interaction uses non-intrusive requests similar to those of a typical visitor accessing services over the public internet. No action is required from the supplier to carry out an assessment.
Is this the same as a security rating service?
It works differently. Rather than a single score, you see the discovered assets and the specific findings behind them, so a supplier conversation can be about evidence.
How many suppliers can we monitor?
One on Free, three on Premium, and from five on Enterprise, scaled to the size of your portfolio.
What if a supplier disputes a finding?
Hexiosec ASM provides supporting evidence for its findings, allowing you to discuss specific issues with your supplier. As an external assessment, it may not be possible to identify every mitigation a supplier has in place, such as backported security patches or other internal controls. If a supplier provides additional information, you can review the finding in that context and, where appropriate, ignore or exclude the risk using the features available with your subscription. This helps ensure discussions are based on evidence rather than assumptions.
Does it cover their suppliers too?
Yes. You can monitor fourth parties (your suppliers’ suppliers). Hexiosec ASM does not automatically identify these relationships, but once you know who they are, you can add and monitor those organisations just like your direct suppliers.
How does this fit our existing assessment process?
It sits alongside it. Hexiosec ASM complements your existing assessment process. Questionnaires provide valuable insight into a supplier’s security practices and policies, while ASM provides independent visibility into their internet-facing assets and security risks. Together, they give you a more complete picture of supplier security.
Scan your suppliers

See what your suppliers expose

Add your first supplier on a free account, or talk to us about a larger portfolio.

Create a free account Request a demo