Rate your suppliers before they become your risk

Frequently asked questions

What is a supplier risk rating?

A supplier risk rating is a security rating of a company you depend on, measured from the outside, the way an attacker sees it. blacklens.io checks nine areas: software patching, application security, web encryption, breach events, network filtering, system reputation, email security, DNS security and system hosting. The result is a grade (A, B, C, D or F), a score from 0 to 100 and a list of findings with remediation guidance. If too little can be measured, the grade shows N/A.

What does the supplier have to do?

Nothing. The rating runs entirely from the outside, without access to the supplier's systems, without installation and without approval; questionnaires and self-assessments are not part of it. You only enter the supplier's domain. blacklens.io also accepts a URL or an email address and reduces it to the registrable domain. Each domain can be added once per workspace, and the first rating starts automatically after you add it.

How often is a supplier re-rated?

Every seven days, automatically and on a fixed cadence. The detail view shows the date under “Next rating”; there is no on-demand re-rating. A ransomware listing also reaches the Breach events area with the weekly rating. To learn sooner that a supplier appears on a leak site, add it to the ransomware watchlist as well; its sources are polled about every 30 minutes.

When does blacklens.io raise an alert?

The alert “Supplier risk increased” fires when a new rating is worse than the last one: for complete ratings through a grade drop, new known-exploited vulnerabilities (CISA KEV, verified or inferred) or new critical findings, and through any new ransomware listing. The first rating is a silent baseline, and a lower score without a grade change raises no alert. Delivery runs through your notification policies by email, mobile push or integrations; the alert contains only the supplier's domain.

What is the difference between supplier ratings and the ransomware watchlist?

Supplier ratings show risk before an incident: grade, score and findings, refreshed every week. The ransomware watchlist reports a supplier after an attack, when it appears on a ransomware group's leak site; those sources are polled about every 30 minutes. Both run side by side, and a domain on both lists can raise both alerts. “Monitor in Supply Chain” hands watchlist entries over to the rating, where they count towards the supplier licence.

How many suppliers can I have rated?

Five suppliers per workspace are included in the licence, and the 14-day trial includes supplier ratings too. Like Sentry assets, suppliers are a licensed count of their own: if you need more, your blacklens.io partner or our sales team extends the supplier licence of your workspace. Larger lists can be imported in bulk, for example as a CSV file from procurement, with a preview before anything is added. Suppliers you hand over from the ransomware watchlist count towards the licence as well.

Does the supplier risk rating help with NIS2 and DORA?

NIS2 Art. 21 (2) d requires entities to address supply chain security, and DORA Art. 28 to 30 govern risk from ICT third-party service providers. The supplier risk rating provides a technical, documented view of every supplier, with history and reports as evidence. It does not replace contracts, audit rights or your own risk assessment. Our supply chain monitoring solution page describes how it fits into a NIS2 or DORA process.

Which reports cover suppliers?

The Supplier Report summarises one supplier on demand: score anatomy, open findings, attack surface, track record and finding register. The Supply Chain Report covers the portfolio over the last 30 days with what changed, where risk concentrates and what needs attention, one-off or scheduled with recipients. As soon as one supplier is monitored, the Executive Report gains a supply chain chapter. All reports are generated as PDFs in English.