Third-Party Risk Management for enterprises

Over 60% of breaches now originate through a third party. Most enterprises have no continuous visibility into supplier security at all: they have a folder of completed questionnaires, a spreadsheet of criticality ratings, and an honest belief that both were accurate on the day they were written. A vendor's defences can collapse in a week. The question is whether you find out from a monitoring alert or from the vendor's breach notification.

Why questionnaires fail

Not because vendors lie. Because the instrument has three structural defects that no amount of diligence corrects:

1. It is self-reported. The vendor assesses itself, and the assessment is rarely verified against anything observable.
2. It is point-in-time. It records a belief held on the day the form was completed, and nothing updates it afterwards.
3. It is rarely re-read. Completed questionnaires are filed as evidence of process, not consulted as sources of risk information.

Continuous external monitoring inverts all three: independently observed, recalculated daily, and pushed to you as an alert instead of waiting to be looked up. Our guide on third-party risk management for Indian BFSI works through what a tiered programme looks like in practice.

What TPRM gives you

• Continuous monitoring across 40 million+ companies. Most of your vendor portfolio is already rated on the day you start, so there is no waiting period while vendors are onboarded.
• Real-time alerts on posture change. The signal that matters is not a vendor's absolute score but its movement — a supplier sliding forty points in a month is telling you something a static rating never will.
• Dark and deep web intelligence. Coverage across 1,000+ underground forums for credentials and data associated with your suppliers.
• Fourth-party visibility. Your vendors' vendors, and the concentration risk you inherited without contracting for it.
• AI-assisted assessment. Pre-filled vendor profiles and automated questionnaire analysis, for the cases where a questionnaire is still contractually required.

Tiering: the part that determines whether it works

Monitoring two hundred vendors equally produces two hundred alerts and no action. Programmes that work tier the portfolio first, set a different threshold and a different response per tier, and assign a named owner to each. Axis Max Life Insurance — whose Bitsight rating of 810 is among the highest in Indian financial services — adopted an ABCD tiered framework in which critical vendors must hold a B or better, and replaced 100% of manual vendor questionnaires with continuous monitoring.

RBI, SEBI, IRDAI and CERT-In expectations

Indian regulators have moved decisively toward requiring boards to evidence oversight of outsourcing and supply-chain risk rather than assert it. Every current instrument carries a third-party chapter — the RBI Directions of 31 July 2026 and the separate outsourcing Directions they preserve, SEBI's CSCRF, and IRDAI's 2026 Guidelines, which require third parties to be classified and overseen by risk tier. Which instrument binds you sets out the full picture.

Continuous monitoring produces that evidence as a by-product of operating: a dated, independently calculated record of each critical vendor's security performance over time, a documented tiering model, and an auditable alert-and-response trail. That is a materially stronger position at examination than a folder of self-assessments.

Packages and vendor bands

TPRM comes in two packages, each banded by the number of vendors monitored (1–50 vendors, 51–100 vendors, 101–500 vendors, unlimited).

The practical difference is whether you need the workflow layer. Continuous Monitoring gives you visibility and alerts; adding Vendor Risk Management gives you intake, assessment, remediation tracking and governance reporting — the machinery that turns an alert into a closed action. Pricing is quoted in INR against scope; see the pricing page for what moves a quote.

Where to start

Point the instrument at yourself first. The complimentary Cyber Risk Rating Report shows you exactly what your vendors will see when you start rating them — which is both a useful calibration and, in our experience, a considerably more persuasive internal business case than a slide about supply-chain risk. If your own estate is the priority, Security Posture Management applies the same continuous measurement inward. Both run on the same Bitsight platform and the same rating.