
Vendor risk snapshot
Illustrative findings, not real vendor assessments- 5
- 3
- 1
- 6
| Vendor | Overall | Brand | Apps | Network | Public | Dark web | Top finding | |
|---|---|---|---|---|---|---|---|---|
| Payments processor | D | B | C | D | C | C | D | Database port open to the internet |
| Cloud backup provider | C | B | B | B | C | C | D | Staff credentials found on the dark web |
| Collections agency | C | A | B | A | D | B | B | Email domain can be spoofed |
| KYC verification partner | B | A | C | A | A | B | A | Login page without MFA |
| HR and payroll platform | A | A | A | A | B | A | A | No major issues found |
- Overall D
Payments processor
Brand BApps CNetwork DEmail CPublic CDark web DDatabase port open to the internet
- Overall C
Cloud backup provider
Brand BApps BNetwork BEmail CPublic CDark web DStaff credentials found on the dark web
- Overall C
Collections agency
Brand AApps BNetwork AEmail DPublic BDark web BEmail domain can be spoofed
- Overall B
KYC verification partner
Brand AApps CNetwork AEmail APublic BDark web ALogin page without MFA
- Overall A
HR and payroll platform
Brand AApps ANetwork AEmail BPublic ADark web ANo major issues found
Suggested questions for your payments processor
- 1.Why is a database service reachable from the internet, and when will it be closed?
- 2.Which staff accounts appear in leaked data, and have their passwords been reset?
- 3.Is MFA enforced on every admin and remote-access login?
