Third-Party Cyber Risk Management demo
Know a vendor's cyber risk before you sign. 1:15
What the demo shows
A workflow solution for security teams that scores OT and IT suppliers before purchase.
Every supplier is a row and every control area a column on one risk heatmap: identity, remote access, incident notice, vulnerability disclosure, software integrity, components and more. Agents read each questionnaire answer and every page the supplier attached, and mark the answers their own evidence contradicts: a supplier says MFA is enforced, its policy says MFA is optional, and the cell turns red with the page quoted beside it. The SBOM is matched to published vulnerabilities and end-of-life parts, gaps become follow-up questions and contract conditions mapped to CIP-013 R1.2, and the Director of Cyber Risk signs before procurement releases the order. Reassessments, certificate expiries and the 15-month plan review sit on one calendar.
Transcript
- Third-Party Cyber Risk Management checks suppliers' security answers against their own evidence.
- Every supplier answers yes, and few have time to check the proof.
- Each supplier is a row and each control area a column.
- Vanter's answers just arrived.
- The agents check them, and its row fills in.
- Kestrel sells 46 substation controllers, and five answers are read.
- Kestrel says MFA is enforced.
- Its own policy says optional, so the answer is flagged.
- Its firmware also carries an end-of-life encryption library.
- Tomas sends nine questions.
- For gaps become contract conditions.
- On its answers, Kestrel scored 85.
- On its evidence, 58.
- Priyanka signs before the order.
- Built on Botminds.
- Agents, data, screens, and governance on one platform.
Transcribed from the film’s narration. Captions are on the player.