Documentation

Platform overview

Vendor Vertex is an end-to-end TPRM platform that lets you manage third-party risk from a single place.

As supply chains grow, every vendor, partner and service provider a company works with introduces a new risk surface. Vendor Vertex continuously monitors and quantifies these risks, enabling security and compliance teams to make data-driven decisions.

All modules run on a shared organization and authorization layer, so teams access only the data their permissions allow.

What the platform addresses

• Continuously tracking a vendor's external security posture with the Security Scorecard.
• Collecting evidence-based attestations from vendors through Surveys.
• Reporting compliance against frameworks such as ISO 27001, SOC 2, GDPR and KVKK.
• Connecting risk events to existing GRC, SIEM and ticketing systems.

Account setup

Configure your account and organization profile to get the most out of the platform.

After signing in, the first step is to complete your profile information and review your security settings. A well-configured account ensures notifications reach the right people and audit records stay meaningful.

Recommended first steps

• Update your profile with your name, title and contact details.
• Set your organization's language and time zone preferences.
• Enable two-factor authentication (2FA) for account security.

Adding a vendor to the watchlist

Add the vendors you want to monitor and continuously track their security posture.

The watchlist is the starting point of third-party risk management. When you add a vendor, the platform automatically discovers its digital assets and begins calculating its security score.

We recommend reviewing your critical vendors more frequently and watching for score changes.

How to add a vendor

• Enter the vendor's name and primary domain.
• Tag the vendor by category or criticality level.
• Once the first scan completes, the system lists the score and findings.

Security scorecard

A continuous assessment tool that summarizes an organization's externally observable security posture in a single score.

The Security Scorecard measures the security maturity of any organization by analyzing its internet-facing assets. The assessment is entirely based on external observation, so the vendor does not need to install anything.

The score is calculated on a 0-100 scale; a higher score indicates a stronger security posture. As a rule of thumb, 80 and above is good, 50-79 warrants monitoring, and below 50 is considered high risk.

What the score consists of

• Network security: open ports, vulnerable services and misconfigurations.
• DNS and email health: correctness of records such as SPF, DKIM and DMARC.
• TLS/SSL: certificate validity and encryption configuration.
• Leaks and reputation: compromised credentials and blocklist entries.

Digital footprint

Discovery and inventory of all internet-facing assets belonging to an organization.

Digital footprint discovery is the foundation of attack surface management. To protect an asset, you first need to be aware that it exists.

Which assets discovery covers

• Domains and subdomains.
• IP addresses and IP ranges.
• TLS certificates and associated services.
• Internet-facing applications and technology fingerprints.

Assessments & surveys

Standardize your assessments by creating reusable question sets and sending them to vendors.

Survey templates keep the questions you ask vendors consistent. A template prepared once can be sent to different vendors repeatedly, and the results can be compared.

When you send a template to a vendor, they fill out the survey via the link they receive. All responses are collected on a single screen and their statuses are tracked.

When creating a template

• Group questions into logical sections.
• Use question types such as multiple choice, open ended and file upload.
• Make evidence (file) requests mandatory for critical questions.

Compliance reports

Create and score a control-based compliance report against the framework you choose.

A compliance report produces an overall compliance score by assessing the status of each control in a framework. The report can be used for both internal audit and vendor assessment.

Steps to create a report

• Select a compliance framework and, optionally, a vendor.
• Assess each control: met, partially met or not met.
• As progress increases, the compliance score updates automatically.

Roles and permissions

A flexible authorization model based on the principle of least privilege.

Permissions represent individual action rights on the platform. Roles are meaningful sets of these permissions. By assigning roles to users instead of direct permissions, you greatly simplify management.

How the model works

• Permission: individual rights such as 'view report' or 'invite user'.
• Role: a set that groups related permissions together.
• Permission matrix: shows which role holds which permissions on a single screen.