Start from your problem.
Shadow AI, vendor risk, assessments, exposure and supply chain — and how NetRisk supports the frameworks you report against.
You can't manage the vendors you can't see.
Most programs start with a vendor list someone typed into a spreadsheet, then chase stale questionnaires. The real risk lives in the gaps.
Shadow IT you never approved
Teams adopt SaaS and AI tools faster than security can track. The vendors handling your data often aren't on any list.
Questionnaires you can't verify
A vendor saying “yes, we encrypt data” isn't evidence. Answers go stale, conflict with reality, and rarely get checked.
Exposure you can't trace
You don't see a vendor's real attack surface, which subprocessors touch your data, or the path an incident would actually take.
Pick your problem. Watch it get solved.
Each one opens the live demonstration of the part of NetRisk that handles it.
Shadow IT & shadow AI
Teams adopt SaaS and AI tools faster than security can track.
Watch one get detected →Use caseThird-party risk
Annual forms and stale attestations nobody checks against reality.
See a claim get verified →Use caseVendor security assessments
Generic questionnaires, slow answers, no link to evidence.
See 72 questions become 8 →Use caseAttack surface monitoring
External posture drifts between review cycles.
Trace an exposure path →Use caseSupply chain risk
Risk accumulates across shared providers and subprocessors.
Map the concentration →Use caseCyber risk management
Security, risk and procurement each see a different version of the risk.
See the verification loop →Single point of trust. Every SSO-gated vendor inherits a compromise here.
A region incident degrades 5 customer-facing products at once.
Appears in 9 of your vendors' subprocessor lists — one breach, nine exposures.
Observed from DNS & TLS — no questionnaire required.
One dependency down.
How much goes with it?
Your vendors share clouds, identity providers, and subprocessors. NetRisk maps the dependencies behind the vendor list — so one outage or breach can't surprise you nine times.
Concentration risk is invisible vendor-by-vendor. It only appears when the whole dependency graph is mapped — which is why questionnaires never find it.
Evidence for the frameworks you answer to.
NetRisk supports evidence and workflow. It does not certify compliance or replace legal and audit advice — mappings are indicative.
Support DORA’s ICT third-party risk expectations with a current register of providers, evidence behind each one, and a record of decisions.
“Which evidence do we need from our cloud provider for DORA?”
| Area | How NetRisk helps | Where |
|---|---|---|
| ICT third-party risk | Vendor discovery, criticality and a maintained register | Vendor profiles · ownership |
| Register of information | Providers, services and dependencies kept current | Dependency map · subprocessors |
| Concentration risk | Shared providers across critical services | Concentration view |
| Ongoing monitoring | Change in exposure and evidence between reviews | Signals · evidence expiry |
Map NIS2 supply chain and risk-management measures to evidence you hold about each supplier.
“Which evidence do we need from our cloud provider for NIS2?”
| Area | How NetRisk helps | Where |
|---|---|---|
| Supply chain security | Supplier risk assessed on evidence, not attestations | Evidence states · reviews |
| Risk analysis | Risks drafted, owned and tracked | Risk register |
| Incident readiness | Know which suppliers an incident affects | Dependency map |
| Effectiveness | Re-verify controls before closing actions | Remediation evidence |
Support supplier-relationship controls with assessments, evidence and monitoring tied to each supplier.
“Which evidence do we need from our cloud provider for ISO 27001?”
| Area | How NetRisk helps | Where |
|---|---|---|
| Supplier relationships | Security requirements and assessment per supplier | Targeted assessments |
| Supplier service monitoring | Changes in exposure and evidence | Monitoring · signals |
| ICT supply chain | Subprocessors and shared providers | Dependency map |
| Risk treatment | Owned actions and accepted exceptions | Risk register · remediation |
Use NetRisk evidence across the supply chain risk-management outcomes in NIST CSF 2.0.
“Which evidence do we need from our cloud provider for NIST CSF?”
| Area | How NetRisk helps | Where |
|---|---|---|
| Govern · supply chain | Supplier criticality, ownership and requirements | Vendor profiles |
| Identify | Discover suppliers and dependencies from signals | Discovery · dependency map |
| Protect / Detect | Verify supplier controls; watch for drift | Evidence states · monitoring |
| Respond / Recover | Know affected suppliers; track remediation | Remediation · register |
Checking a single change?
Security Review handles one-off questions — a proposed change, a configuration, a vulnerability — without onboarding a vendor.