Third-party risk
Vendor risk management
Track third parties by criticality, send security questionnaires, and draft a vendor profile from its name and URL with AI on any paid plan.
| Vendor | Tier | Data access | Risk | Review |
|---|---|---|---|---|
| Cloud hosting | Critical | Customer data | High | Current |
| Payroll provider | Important | Employee PII | Medium | Due |
| Email delivery | Important | Contact data | Medium | Current |
| Design tool | Low | None | Low | Current |
The vendors you depend on are part of your attack surface and your auditor knows it. Keel gives you a real third-party inventory: rank each vendor by criticality, set review cadences so nothing goes unreviewed, draft a risk profile from a vendor’s name and URL with AI (included on every paid plan), and send security questionnaires that score themselves.
The problem
Your vendor list lives in three places and none are current
A procurement spreadsheet, a shared inbox of SOC 2 reports, and someone’s memory of “who we use for what.” When a vendor has an incident (or an auditor asks how you vet suppliers), there’s no single, current source of truth.
Capabilities
What Vendor risk management does
Inventory by criticality
Catalog every third party with a criticality tier and status, so the vendors that matter most get the scrutiny they deserve and the review cadence they need.
Review cadences
Set how often each vendor should be reviewed and Keel surfaces what’s due, turning “we’ll get to it” into a tracked, evidenced cadence auditors credit.
AI vendor profiles from a name and URL
Paste a vendor’s name or website and Keel drafts the profile for you to review: a category, a one-line description, the data they are likely to touch, and a suggested criticality tier with the rationale for it. The draft comes from what the model knows about the company rather than from scraping their site, and the tier it suggests is then floored by the sensitivity of that data — a fixed rule, not the model’s judgement, that can raise the tier but never lower it, so it never comes back implausibly low. For what a vendor publishes about itself, including the standards it claims, use the trust-centre lookup below, which does fetch the page.
Security questionnaires that self-score
Assemble a structured assessment from a curated library of 100+ questions, send it, and let Keel auto-score responses, consistent and on-brand, ready to send in a click.
Collaborative vendor portal
Vendors respond in a portal and can invite their own colleagues to help answer, so the security questionnaire isn’t bottlenecked on one contact.
Find and read their trust center
Point Keel at a vendor and it looks for their public trust or security centre, then extracts what they claim: which standards they hold, a one-line posture summary, and a security contact. Stored as their claims, marked unverified, because a trust page is a vendor asserting something about themselves and Keel will not launder that into a fact.
Turn a vendor into risks
Draft concrete, scored risks straight from a vendor profile and add the ones you choose to your risk register, closing the loop between third-party and enterprise risk.
A posture score from public signals
A questionnaire is a point-in-time snapshot the vendor fills in themselves. Alongside it, Keel computes a 0–100 health score from credential-free public signals — DNS email authentication (SPF and DMARC) and CISA Known-Exploited-Vulnerability exposure — that you can recompute any time you want a fresh read, with no questionnaire and no AI credits.
Monitor your own posture too
Point the same credential-free checks at your own domain to see the self-posture score a prospect or auditor could observe about you from the outside, and fix the gaps before they do.
Outcomes
Why it matters
- One current inventory of every third party and how critical it is
- Never miss a vendor review with tracked cadences
- Profile a new vendor in seconds instead of an afternoon of research
- Send and score security questionnaires without building them by hand
- Read a vendor’s public security posture without waiting on a questionnaire
Get audit-ready, and prove it
Vendor risk management is one module of a full GRC platform: controls crosswalked across every framework, so you collect evidence once and comply everywhere. Start free, no credit card, no sales call.
Frequently asked questions
Can vendors collaborate on a questionnaire?
Yes. The vendor portal supports multiple collaborators, so a vendor can invite colleagues to answer the sections they own instead of funnelling everything through one person.
How does the AI vendor profile work?
You paste the vendor’s name or URL and Keel drafts a profile — a category, a one-line description, likely data access, and a suggested criticality tier with its rationale — as an editable starting point you review before saving. The draft comes from what the model knows about the company, not from reading their website, and the tier is floored by the sensitivity of the data listed, so a vendor touching PHI or credentials cannot be suggested below high. The separate trust-centre lookup is the feature that fetches their page, and it is where the standards a vendor claims come from.
Do the questionnaires score themselves?
Assessments built from Keel’s question library are auto-scored as responses come in, so you get a consistent risk read without hand-grading every answer.
What is the vendor health score based on?
Public, credential-free signals only: the domain’s DNS email authentication (whether SPF and DMARC are published, and how strict the DMARC policy is) and a keyword match against the CISA Known-Exploited-Vulnerabilities catalog. Keel combines them into a 0–100 score and band you can recompute on demand. It is a best-effort external signal, not a guarantee or a penetration test — the KEV match is keyword-based and should be confirmed, and a category Keel can’t observe scores as “unknown” and earns no credit rather than being assumed to pass.
Does the health score replace a security questionnaire?
No — it complements one. The questionnaire is self-reported and point-in-time; the health score is observed from the outside and can be recomputed whenever you want a current read, so you get an external check between formal reassessments.
Can I check my own organization’s posture?
Yes. The same checks can run against your own claimed domain to give you a self-posture score — the SPF/DMARC and KEV picture the outside world can see — so you can close gaps before a customer or auditor notices them.
Does vendor risk connect to my risk register?
Yes. Draft risks directly from a vendor profile and promote the ones you pick into your central risk register.
Related features: Security questionnaire automation · Risk register · AI tools
Works with: SOC 2 · ISO/IEC 27001