A structured framework for technology vendor exposure.
Every assessment applies the same framework to every vendor. This page explains how findings are established, how they are organised into eight areas, and how your own context and priorities turn them into the number in your report.
Principles
Evidence-based
Every finding rests on identifiable information, never on opinion or rumour.
Source-backed
Each finding names the type of source it comes from and carries a reference to the source list in your report.
Repeatable
The same framework is applied to every vendor, so results are comparable inside your own files.
Traceable
Your report shows what drives each exposure index and where each finding comes from, so your own team can check it.
Reviewable
Findings carry their date and source type so that you can question or challenge them. If you believe a finding is wrong or out of date, contact us.
Dated
An assessment reflects information up to a specific date and says so on every report.
Eight areas of vendor exposure
Sanctions exposure
We check whether the vendor, its owners, subsidiaries and key people appear on official sanctions and export-control lists. A listing is reported as a separate legal status flag next to your exposure index, so other results cannot dilute it.
Ownership transparency
We establish who owns and controls the vendor, how clearly that can be seen in public records and whether control has recently changed. Opaque structures and changes of control matter for who can influence the product.
Jurisdiction & control
We map the legal systems that govern the vendor: where it is headquartered and owned, where its research and development takes place and where your data may be processed. Your answers show which of these matter for your use.
Operational resilience
We look at how well the vendor can keep operating: dependence on single locations or suppliers, continuity planning and documented outages.
Cyber hygiene
We review the vendor's own security record: known exploited vulnerabilities, how quickly fixes follow, reported breaches and the certifications it holds. This describes the organisation's track record; it is not a test of the product.
Supply chain dependency
We look at who the vendor itself depends on: cloud providers, subprocessors, open-source components and hardware sources.
Financial stability
We look for signals that the vendor may struggle to keep supporting you: financial reporting, funding events, restructuring or a sale process.
Regulatory alignment
We note official warnings, regulatory actions and data-protection arrangements that bear on using the vendor, such as representation in the EU and data-transfer mechanisms. The report documents findings; it does not certify compliance with any law.
Facts and signals
A fact is a finding that has been confirmed: it rests on an official or primary source, or on more than one source that is independent of the vendor. Facts count towards your exposure index. A signal is an early lead that has not been confirmed. Signals are recorded for context but do not count towards your exposure index. Findings are dated to the underlying event, not to the day we found them.
Where the information comes from
We use public information: official company registers and filings, government and regulator publications, sanctions and export-control lists, technical databases and advisories, the vendor's own documents and established news reporting. Where the public record is limited, the report says so and the area is treated conservatively rather than filled with assumptions.
Assessment perspective
Loading…
How your context and priorities shape the number
Your answers about how you use a vendor change how much a given type of finding matters for you. They never remove a finding. The weights you set decide how much each of the eight areas counts towards your exposure index. Areas you leave out are marked as not included in your report; fewer points simply means an area counts less. A legal status flag, such as a sanctions listing, appears in the summary at the front of your report and is not weighted.
A point-in-time assessment
Your report reflects the sources checked up to the date stated in it. The underlying data is fixed when the report is prepared, so later developments do not change a report already issued. If something important changes, you can order a new assessment.
Independence
We do not resell vendors' products and receive no referral fees from any vendor. The assessment is prepared for the organisation that orders it.
What an assessment is not
- Not a security audit or penetration test of the product.
- Not a prediction of incidents or breaches.
- Not a recommendation to keep or replace a supplier.
- Not legal, compliance or investment advice, and not a statement that a vendor complies or does not comply with any law or standard.
Full methodology text to follow.