Find every vendor. Prove what you can trust.

NetRisk discovers third parties from real network signals, verifies vendor claims against evidence and live systems, quantifies exposure, and keeps trust profiles current.

Start free security reviewSee the trust journeyJoin free beta

Free limited beta · Corporate-domain only · Decision-support software — validate critical findings before action.

Sample eventUnmanaged AI notetaker detected
Demo · sample event
Unmanaged AI notetaker detected
otter.ai · 14 users · 3 departments · not in vendor register
Demonstration: NetRisk identifies an unapproved AI notetaker among network domains and flags it as not in the vendor register.

Product demonstration: demo data, not live vendor analysis.

Detectshadow AI & vendors in real traffic
Scopethe product, data & usage at risk
Verifyclaims against evidence, not answers
Monitordrift & expiry, continuously
Trust journeyEvidenceAssessmentsExposure & riskVerification loopLive proofDependencies
Discovery Agent AI · detect & classify finds public & technical signals
Research Agent AI · read & extract reads docs, maps claims to controls
Reviewer human · approve accepts or rejects evidence
Monitoring Agent AI · watch & revalidate detects drift, expiry & new findings
DNSotter.ai
14users seen
3departments
2SOC 2 / DPA
Rretention docs
EEntra SSO
CCASB / DLP
Aauto-join policy
⟳Live re-check
Ot
Otter.ai
Detected
An unknown AI tool appears.
It’s Otter.ai — an AI notetaker.
It records your customer calls.
We request the evidence.
A human reviews it.
Controls make it safe.
Always watching.
Otter.ai
AI meeting notetaker · auto-joins calls
Detected
—
Trust confidence
◉
Otter.ai · notetaker
traffic + calendar invites
identified
◦
14 users · 3 depts
customer calls recorded
scoped
▤
DPA & security docs
requested from owner
requested
✓
Business plan, internal calls only
reviewer approved · limited
reviewed
⇄
SSO + DLP enforced
Entra + CASB · live
controlled
⇄
External calls excluded
auto-join policy · active
controlled
⟳
New AI domains & drift
watched continuously
live
Evidence review

A vendor answer isn't proof.
It becomes a claim we verify.

NetRisk never trusts an answer directly. Every answer becomes a claim — linked to its source, checked against scope, routed to a reviewer, and only then does the trust state move.

Claim under review "Meeting recordings are not used to train models." extracted by AI from Otter.ai business & privacy docs
01
Claim
Recordings not used for training
AI-extracted statement
02
Source
Business privacy terms
linked & cited
03
Scope
Business workspace only
not free accounts
04
Reviewer
Approved for managed plans
security + legal sign-off
05
Trust state
Verified · with conditions
profile updated
AI proposes the claim scope & conflicts surfaced reviewer sets the trust state A claim is only trusted when evidence, scope, and a reviewer agree.
Assessment intelligence

Stop sending 72 questions.
Ask the 8 that matter.

NetRisk pre-answers the questionnaire from observed evidence, documents on file, and live integrations — then asks the vendor only what is missing, stale, contradicted, high-impact, or decision-blocking.

72
72 generic template questions questions the vendor actually receives
missing stale contradicted high-impact decision-blocking

Every surviving question carries its reason for existing — and every pre-filled answer cites the evidence that answered it. Vendors stop dreading you; reviewers stop reading filler.

Vendor assessment · 72 questions
04Do you have an information security policy?SOC 2 on file
01Is SSO enforced for every workspace member?missing
09Do you encrypt data in transit?observed · TLS 1.3
11Do you maintain a business continuity plan?ISO 27001 cert
02Provide a current SOC 2 Type II — yours expired 92 days ago.stale
17Do you perform employee background checks?SOC 2 on file
03Docs state 30-day retention; your trust portal says 90. Which applies?contradicted
23Is multi-factor authentication available?observed · IdP
04Which subprocessor stores EU customer data, and where?high-impact
31Do you have a public privacy policy?doc on file
05Is customer data excluded from model training on the Business plan?decision-blocking
40Where is your company headquartered?public record
06Who is your breach-notification contact, and what is the SLA?missing
55Do you have a signed DPA available?DPA on file
07Is DLP enforced on files shared to the workspace?high-impact
61Do you conduct annual security awareness training?SOC 2 on file
08Confirm which meetings the notetaker may join and record.decision-blocking
+ 56 more generic questions 64 pre-answered from evidence · vendor effort ↓ 89%
Discover
Found in your real traffic
NetRisk discovered Otter.ai from traffic and calendar invites.
Node
Hover a node
verified / integration evidence live data flow missing evidence exposure path
€72k
annualized loss
High until scoped
Customer conversations recorded and stored through unmanaged Otter.ai use — no DPA, no enforced SSO, no retention policy.
14 users identified 3 missing controls customer calls recorded
Evidence basis
usage observed · controls missing
Confidence
Medium
Data at risk
Customer + IP
Risk level
High
Recommended treatment
Approve a managed workspace, enforce SSO, set retention, exclude external calls, and monitor new AI domains.
Otter.ai
AI meeting notetaker · 14 users
Live · revalidating
54
Trust status
Conditional
scopenotetaker usage
users14 · 3 depts
Evidence
Security docsverified
DPA statusverified
Admin controlsmissing
AI usage exposure
Risk exposure
levelHigh until scoped
data at riskcustomer + IP
Confidence
overall54 / 100
missingadmin, policy, owner
Next action
Reviewer decisionPending
Enforce SSORequired
Define data policyAssigned
Verification operating model

A controlled loop —
not blind trust in AI.

NetRisk runs one controlled verification loop: AI proposes → evidence validates → humans approve → systems re-check. Agents do the busywork; evidence and reviewers decide the trust state.

discovery
Discovery Agent
AI proposes

Looks at
Produces
→
Supports decision:

AI accelerates the review. Evidence decides the trust state. Agents discover, research, validate, trace, and monitor — but nothing is trusted or published on an agent's say-so alone.

Live proof layer

Documents start the review.
Live proof keeps it current.

Static evidence is a snapshot. NetRisk reaches higher confidence by connecting to the systems that operate identity, cloud, code, posture, and tickets — each one tied to a trust outcome.

Layer 1

Documents & questionnaires

self-attested & document-supported

2SOC 2 ISOISO 27001 DDPA SSubprocessors QQuestionnaire
Layer 2

Public & technical signals

inferred from the outside

DDNS / TLS HSecurity headers crtcrt.sh ShShodan CeCensys
Layer 3

Connected systems & logs

integration-verified

Identity OkOkta EEntra GGoogle WS Cloud aAWS AzAzure GGCP Code GiGitHub GlGitLab Posture WWiz SnSnyk TeTenable GRC VaVanta DrDrata
Layer 4

Continuous monitoring

change detection over time

SlSlack alerts TeTeams JJira SNServiceNow ⟳Freshness & drift
The result · a live change feed

When trust changes, the profile changes.

New AI domain detected
discovery · fireflies.ai seen in traffic
inferred
DPA evidence expired
Otter.ai · freshness lapsed
stale
SSO control missing
Entra ID · not enforced for AI app
risk
Data policy approved
reviewer · sensitive data blocked
verified
Claim moved: inferred → document-supported
no training on recordings · business terms
upgraded
Integration validated control
CASB · DLP policy confirmed active
verified
Notetaker joined an external call
access-path change · review opened
risk
Trust profile updated
confidence recalculated · v14
live
Live trust signal

Continuous validation turns vendor risk into a living signal.

Instead of a yearly questionnaire cycle, a trust profile reacts the moment evidence expires, a control drifts, a new finding appears, or a vendor submits fresh proof.

When a vendor's trust posture changes, NetRisk helps you see it, understand it, and act — before the next questionnaire cycle.

Integrations shown represent supported categories. Live validation applies where a connection is configured.

Next step

Have a specific question right now?

Describe it in your own words and get a preliminary assessment — free. Nothing is sent until you approve it.

Start free reviewRequest a pilot