Skip to main content
Use case · Before signature

The questionnaire review closes the file in eleven weeks. The contract is signed on Friday.

“We need a defensible read on a supplier this week, not a spreadsheet they fill in next quarter.”

A supplier can be assessed from outside in 24 hours, from apex domains alone, with nothing asked of the supplier itself. The categories, the arithmetic and the grade bands are the ones ShadowMap already applies to your own estate, so the read you carry into the contract meeting sits on the same scale as your internal target. It arrives before the signature.

Request an exposure snapshot How to evaluate this
24 hours
Apex domain in, scored assessment out
Zero
Questions the supplier has to answer first
CERT-In
Empanelled security auditor since 2008
41 days

Average questionnaire turnaround in one mature programme

Median time to close a supplier file in the same programme: eleven weeks. That interval is the whole reason this job exists, and it is not a number we can improve: the supplier writes the answers at whatever pace it writes them, and no monitoring product controls that clock. What changes is whether the contract decision has to wait for it. Anonymised engagement, 2026.

The decision

The signature does not wait for the evidence

The contract meeting happens on a date somebody else set, and the security input either exists by then or it does not.

Procurement runs to a date the business set, and the security review is almost always the long pole in it. Two things tend to happen when the form has not come back. Either the deal proceeds on a conditional sign-off that nobody ever revisits, because the condition is discharged by the deal closing, or security holds it up on a general unease it cannot evidence, spending credibility it will need later for something real. Both are failures of timing. An outside-in read does not fix the parts of the review that genuinely need the form. What it can do is answer the observable half on the day you ask. That is also the half a questionnaire is worst at, because there the supplier is describing itself, from memory, about a moment that has already passed. The questionnaire still goes out; you simply know the observable half before you send it, and the form gets to spend its questions on what only a signature can establish.

Attested against observed

What the form will say, and what is already visible

Every row on the left is a standard questionnaire item. The columns beside it set what the response will say against what can be established from outside before you sign. The last column is the one that matters most at this stage: what a negotiator does with the difference.

Questionnaire itemWhat the response will sayWhat is observable before signatureWhat it changes at contractingWhere this is covered
Asset inventory "We maintain an inventory of our internet-facing assets and review it quarterly." Every hostname answering from the public internet across the apex domains you nominate, with the service and software version behind it, and whether an administrative interface is reachable with no second factor in front of it. An inventory obligation with a named refresh interval. An administrative interface answering unprotected becomes a disclosure the supplier makes before signature. Attack Surface Management
Apex domains are the only input. The estate resolved here is what every row below is attributed against. Everything in the assessment was discovered and attributed to this supplier first.
Credential hygiene "Credentials are rotated on a schedule and are never reused across services." Records attributed to the supplier domains in stealer-log and breach material, including how many entered the corpus in the preceding 90 days. That measures when you could have known, not when the supplier got round to saying so. A rotation obligation discharged before any account is issued on your systems, and a notification clause written against a dated fact. Dark Web Monitoring
Records on a candidate estate arrive observed and untested: we hold authorisation over your estate, not over a company you have not signed, and nothing on a supplier system is probed. Where an exposed identity maps to an account you are about to issue — a contractor remote-access portal, a shared tenancy — that account is your estate, and it is testable under your own authorisation once it exists.
Secrets and source control "Secrets are never committed to source control, and our repositories are private." Code, configuration and credential material published under the supplier name or by identifiable staff accounts, correlated back to the estate in the first row so a genuine leak can be told apart from a name collision. A secrets-handling obligation that names the repositories in question, and, where key material was published, a rotation the supplier performs before the integration is built. Data Exposure Monitoring
Publication is observable. Whether a published key still opens anything is a separate fact, and on a candidate estate it is one we deliberately do not establish, because establishing it would mean using the key.
Sub-processors "Our sub-processors are disclosed, assessed and listed in the annexe." The hosting, DNS, mail, certificate and authentication providers the supplier actually resolves to, and, once you are monitoring a portfolio, how many of your existing suppliers resolve to the same ones. A disclosure obligation with the known upstream providers already named in it, and notice rights over a change of hosting the annexe would otherwise never mention. Third-Party Risk Management
Concentration is architecture, not a vulnerability. At onboarding it is the cheapest finding in the assessment to act on, because a supplier will not argue with it and your continuity plan is the thing most likely to have assumed it away.
Ongoing posture "We will notify you of any material change to our security posture." A score on the published A–F bands, computed with the categories and the arithmetic used on your own estate, and benchmarked against comparable suppliers in the same sector so a first grade is interpretable before you have a portfolio to read it against. A threshold written as a number on a scale you already use internally, with a re-score date attached. The supplier no longer decides what counts as material. Security Ratings
At this stage a grade is a commercial control, not a security one. It decides whether the contract proceeds. A remediation schedule is written from the findings underneath it.
Regulatory expectations "We comply with all applicable regulations in the jurisdictions we operate in." The observable half a supervisor asks about: whether the supplier internet-facing estate is known, whether administrative access is exposed, whether credentials attributed to it are circulating, each carrying the date it was observed. Compliance itself needs the form. The outsourcing schedule is written against observations with dates on them, and the unobservable half is named as questions for the form. Banking and financial services
Indian outsourcing expectations place accountability on the regulated entity, not on the supplier. In an inspection, a dated observation is the strong position. This is the sector where the job comes up first and hardest.

Asset inventory

What the response will say
"We maintain an inventory of our internet-facing assets and review it quarterly."
What is observable before signature
Every hostname answering from the public internet across the apex domains you nominate, with the service and software version behind it, and whether an administrative interface is reachable with no second factor in front of it.
What it changes at contracting
An inventory obligation with a named refresh interval. An administrative interface answering unprotected becomes a disclosure the supplier makes before signature.
Where this is covered
Attack Surface Management

Apex domains are the only input. The estate resolved here is what every row below is attributed against. Everything in the assessment was discovered and attributed to this supplier first.

Credential hygiene

What the response will say
"Credentials are rotated on a schedule and are never reused across services."
What is observable before signature
Records attributed to the supplier domains in stealer-log and breach material, including how many entered the corpus in the preceding 90 days. That measures when you could have known, not when the supplier got round to saying so.
What it changes at contracting
A rotation obligation discharged before any account is issued on your systems, and a notification clause written against a dated fact.
Where this is covered
Dark Web Monitoring

Records on a candidate estate arrive observed and untested: we hold authorisation over your estate, not over a company you have not signed, and nothing on a supplier system is probed. Where an exposed identity maps to an account you are about to issue — a contractor remote-access portal, a shared tenancy — that account is your estate, and it is testable under your own authorisation once it exists.

Secrets and source control

What the response will say
"Secrets are never committed to source control, and our repositories are private."
What is observable before signature
Code, configuration and credential material published under the supplier name or by identifiable staff accounts, correlated back to the estate in the first row so a genuine leak can be told apart from a name collision.
What it changes at contracting
A secrets-handling obligation that names the repositories in question, and, where key material was published, a rotation the supplier performs before the integration is built.
Where this is covered
Data Exposure Monitoring

Publication is observable. Whether a published key still opens anything is a separate fact, and on a candidate estate it is one we deliberately do not establish, because establishing it would mean using the key.

Sub-processors

What the response will say
"Our sub-processors are disclosed, assessed and listed in the annexe."
What is observable before signature
The hosting, DNS, mail, certificate and authentication providers the supplier actually resolves to, and, once you are monitoring a portfolio, how many of your existing suppliers resolve to the same ones.
What it changes at contracting
A disclosure obligation with the known upstream providers already named in it, and notice rights over a change of hosting the annexe would otherwise never mention.
Where this is covered
Third-Party Risk Management

Concentration is architecture, not a vulnerability. At onboarding it is the cheapest finding in the assessment to act on, because a supplier will not argue with it and your continuity plan is the thing most likely to have assumed it away.

Ongoing posture

What the response will say
"We will notify you of any material change to our security posture."
What is observable before signature
A score on the published A–F bands, computed with the categories and the arithmetic used on your own estate, and benchmarked against comparable suppliers in the same sector so a first grade is interpretable before you have a portfolio to read it against.
What it changes at contracting
A threshold written as a number on a scale you already use internally, with a re-score date attached. The supplier no longer decides what counts as material.
Where this is covered
Security Ratings

At this stage a grade is a commercial control, not a security one. It decides whether the contract proceeds. A remediation schedule is written from the findings underneath it.

Regulatory expectations

What the response will say
"We comply with all applicable regulations in the jurisdictions we operate in."
What is observable before signature
The observable half a supervisor asks about: whether the supplier internet-facing estate is known, whether administrative access is exposed, whether credentials attributed to it are circulating, each carrying the date it was observed. Compliance itself needs the form.
What it changes at contracting
The outsourcing schedule is written against observations with dates on them, and the unobservable half is named as questions for the form.
Where this is covered
Banking and financial services

Indian outsourcing expectations place accountability on the regulated entity, not on the supplier. In an inspection, a dated observation is the strong position. This is the sector where the job comes up first and hardest.

The first day

What happens between the apex domain and the assessment

The order matters. Nothing is correlated that has not been discovered, and nothing is scored that has not been attributed: a finding that skips a step is a finding about somebody else.

  1. Hour 0

    You nominate, and that is the whole input

    Apex domains, and nothing beside them: no seed list, no scope file, no contact. Nothing is sent to the supplier, nothing is installed, and no credential of yours or theirs is used. Everything from this point on is already reachable from the public internet.

  2. Hours 0–6

    The estate is resolved from outside

    Hostnames that answer, the services and versions behind them, certificate, mail and DNS configuration, and the hosting and authentication providers the supplier actually depends on. Attribution happens here. An asset that cannot be attributed to the supplier does not enter the assessment at all.

  3. Hours 6–18

    Exposure is correlated back to that estate

    Credential records, published code and secrets, and domains wearing the supplier brand are matched against the estate resolved in the previous step, not against a name string. That is the difference between a finding and a coincidence, and at onboarding it decides whether anyone in the room believes the report.

  4. Hours 18–24

    The score uses your own methodology, unchanged

    The grade is computed and written up inside the window, so the number exists before the contract meeting instead of after it. Where it comes from is set out in the derivation below.

  5. Handover

    A written assessment, and a baseline you keep

    Each finding dated and evidenced, the unobservable half named as questions for the form, and a grade that can be carried into the contract meeting. If the contract proceeds, this same assessment is the baseline the supplier is monitored against from day one, and there is no separate onboarding scan whose results have to be reconciled afterwards.

Sourcing the read

What a 24-hour assessment covers, and what it cannot

A number that arrives in a day needs its derivation printed beside it. Here is the derivation, and then the list of things the method cannot tell you, which is what the form is for.

From apex domain to a defensible read As of August 2026
  • The 24 hours is the assessment interval, not a claim about the supplier. A larger estate produces a larger finding set in the same window. What varies is how much of it you get through before the meeting.
  • The categories, the sub-score arithmetic and the A–F bands are the ones applied to your own estate, unchanged. Nothing is substituted because the estate belongs to somebody else, and that substitution is what makes most vendor scores impossible to set beside an internal target.
  • A first assessment has no history behind it, so the grade is positioned against comparable suppliers in the same sector. A first grade shows where the supplier sits.
  • The assessment is produced by the same recurring scan cycle that would run afterwards. If the contract proceeds, it is simply the first cycle, so there is no onboarding result to reconcile against the monitoring that follows.
  • Every finding carries the date it was observed. That matters more at onboarding than anywhere else, because the question in a contract meeting is what was true on the day you asked.

Deliberately excluded

  • Nothing on the candidate estate is probed or tested. Our authorisation covers your estate and stops at the boundary of a company you have not signed. Continuous Automated Red-Teaming runs only where it is safe and authorised. Pre-signature findings arrive observed, dated and evidenced.
  • It establishes nothing about compliance, and it cannot see an incident-response plan, a background-check policy, a data-residency commitment or a sub-processor contract. Those need the form, and the form needs a signature behind it.
  • It is not a prediction. A clean assessment says what was observable on the day it was taken. It does not say the supplier will not be breached.

The contract meeting

One assessment, three people who want different things from it

The same document lands in front of procurement, security and whoever writes the schedule. Each of them does something different with it, and a report that satisfies only one of the three does not change the outcome.

What each reader takes from it

Friday, with the assessment on the table

Procurement
A defensible reason to proceed, to proceed with conditions, or to pause, arriving on the timetable the deal already runs to. Walking away is rare and everyone in the room knows it, so the useful output is a short list of conditions that can be attached to a signature this week.
Security
Findings with owners, dates and evidence, on the same scale as everything else in the register. A supplier sitting at C is argued about in the same vocabulary as an internal business unit sitting at C. That is the practical benefit of a methodology that does not change when the estate stops being yours.
Whoever writes the schedule
The security annexe stops being boilerplate. An observed exposure becomes a named remediation obligation with a date. An undisclosed exception becomes a disclosure clause. A concentration finding becomes notice rights over a change of hosting. None of that is available to a negotiator who is still waiting for a form.

What this job draws on

The capabilities behind it

Third-Party Risk Management The same outside-in methodology applied to your vendors, with the identical categories, maths and bands used on your own estate. Security Ratings A rating is an output, never the product. The findings underneath it are what you act on.

Where this job comes up most: Banking and financial services and Manufacturing and industrial groups .

Questions buyers ask

Before you evaluate this

Do you contact the supplier, or do they have to agree to this?

Neither. The assessment runs from apex domains you already hold in the procurement file, and everything it uses is already reachable from the public internet. That is also its limit: nothing on the candidate estate is probed or tested, so pre-signature findings are observations with dates on them, not test results. Whether you put the findings to the supplier is your decision, and there is a good case for it. An observed exposure with evidence attached is a considerably easier conversation than a questionnaire answer somebody has to defend.

Does this replace our questionnaire?

No. An attestation carries a signature and an observation cannot sign anything, so a regulator asking whether a supplier has a documented incident-response plan is not asking a question anything outside-in can answer. What changes is the order of work. You know the observable half before the form goes out, so the form spends its questions on the unobservable half, and "we follow industry best practice" stops being a passing answer to something you can already see for yourself.

What if the supplier is small, or barely has an internet-facing estate?

Then the assessment is short and says so, and a capability that found nothing attributable is recorded as zero. A four-hostname supplier with a marketing site and a mail domain produces a short assessment, and that is the correct result. A small estate is not the same thing as a low-risk supplier, though: the question that decides the tier is what access this supplier is about to be granted on your estate, and that is a finding about you.

How is this different from just buying a security rating for the candidate?

A rating is an output and it is genuinely good at what it is for — clearing a threshold, drawing a trend, travelling into a board pack. At onboarding it has no trend behind it, because nobody has been watching this supplier. What you need on Friday is the findings underneath the grade: the hostname nobody knew was answering, the credential record dated to last month, the administrative interface with nothing in front of it. Those are the things a clause can be written against. The grade is what you carry into the meeting; the findings are what you negotiate with.

Assess a supplier you are deciding on this quarter

Send the apex domains of one supplier currently in your pipeline. You get back what we would otherwise have handed you on day one of the contract: dated, evidenced, and with the questions the form still has to ask named explicitly.

Request a pre-signature snapshot See Pricing