Early access for risk teams at regulated institutions
See every risk a third party brings, not only the cyber ones.
Thirdline assesses each vendor across 14 enterprise risk dimensions, reads the due-diligence evidence for you, and rolls the results into your risk appetite, register, and key risk indicators.
Most programs stop at a security questionnaire. The guidance does not.
Risk is wider than cyber
A vendor can pass a SOC 2 review and still fail you on financial health, concentration, sanctions exposure, or a change of control.
Evidence piles up unread
SOC reports, pen tests, financials, and DPAs arrive as PDFs. Exceptions, carve-outs, and fourth parties hide on page 40.
Results never reach the board
Vendor scores live in a spreadsheet, apart from the appetite statements and enterprise risks they should inform.
Coverage
Fourteen dimensions, four pillars, one score you can defend.
Every third party gets a likelihood × impact score on each dimension, inherent and residual. The taxonomy is aligned to COSO ERM, ISO 31000, and the 2023 U.S. interagency guidance on third-party relationships.
Strategic
- Strategic
- Reputational
- ESG & Sustainability
- Geopolitical & Country
Operational
- Operational
- Cybersecurity & Information Security
- Business Continuity & Resilience
- Technology & AI / Model
- Concentration & Fourth-Party
Financial
- Financial Viability
Compliance
- Compliance & Regulatory
- Data Privacy
- Legal & Contractual
- Financial Crime & Conduct
How it works
From intake to decision, with the reasoning written down.
-
Intake sets inherent risk
Criticality, data types, system access, offshore work, AI use, payments, and substitutability score each dimension, then set the tier and review cadence.
-
Evidence is read, not filed
Upload SOC reports, pen tests, financials, DPAs, or model cards. Each is checked for opinion, period, scope, exceptions, user-entity controls, and subservice organizations. Every gap becomes a finding mapped to a framework.
-
Questionnaires fit the risk
Vendors answer through a private portal link, with questions only for the dimensions in scope. A “No” on a key control opens a finding automatically.
-
Residual risk is computed
Answers and document ratings set control effectiveness, minus open-finding penalties. Analysts can override a dimension, with the rationale recorded.
-
Appetite, register, decision
Breaches of board-set appetite show on the vendor, the portfolio, and your KRIs. Third parties link to the enterprise risks they drive, and a memo recommends a decision.
Continuous screening
Screened against public sources, with no data license to buy.
Every monitoring run checks free government and open data. Hits become alerts you can escalate to findings, and every result, clear or not, is written to the audit trail.
Monitoring also tracks expiring evidence, contract renewals, and overdue reviews.
- U.S. Consolidated Screening ListOFAC SDN, BIS Entity List, and 10 more export and sanctions lists
- UN Security CouncilConsolidated sanctions list
- HHS-OIG LEIEHealth care program exclusions
- SEC EDGAR8-K material events
- GLEIFLegal entity status and ultimate parent
- CISA KEVKnown exploited vulnerabilities in vendor products
- Have I Been PwnedBreaches tied to vendor domains
AI and audit
AI that does the reading, and an off switch your examiners will like.
Claude reads the evidence
Document analysis, assessment memos, and adverse-media scans for breaches, enforcement, litigation, distress, sanctions, and ESG controversies.
A rules engine runs offline
Without an AI key, a deterministic rules engine runs the same workflow. The same input gives the same score, every time.
Every step is on the record
Overrides carry a rationale. Screening results, decisions, and evidence changes land in a full audit trail, with a printable report and CSV export.
See it on your own vendor list.
We are working with a small group of risk and compliance teams. Tell us about your program and we will set up a walkthrough.