What is supply chain monitoring?

Supply chain monitoring is the continuous observation of a company's digital dependencies: IT service providers, cloud providers, software vendors and technical subcontractors whose compromise directly affects your own security. The goal is to learn about an incident at a partner from your own alerting system, not from the press. NIS2 (Article 21(2)(d)), DORA (ICT third-party risk) and ISO 27001 (A.5.19 to A.5.22) demand exactly this view of the supply chain.

Which suppliers belong on the watchlist?

All partners whose compromise affects you directly: IT service providers with remote access, software vendors with update mechanisms, cloud and hosting providers, logistics and production partners with system integration, and consultants with access to confidential data. The CSV import makes it easy to start with the supplier list from procurement.

Where does the ransomware victim data come from?

From the public leak sites of ransomware groups, where victims are listed and extorted with the publication of data, supplemented by threat intelligence feeds. blacklens.io polls these sources about every 30 minutes and stores company, sector, domain, actor, country, link and screenshot per entry.

Does blacklens.io rate the security of my suppliers?

No. blacklens.io does not issue security grades for third parties. The platform monitors concrete threat signals: leak site entries, dark web findings, new CVEs in shared technologies and partner access in your own attack surface. That is less abstract than a score and directly actionable. Every match lands in your workflow as a finding with status and comments.

How does this support NIS2 and DORA?

Both require ongoing monitoring of the supply chain and evidence of it. The watchlist, the alert history and the activity log prove that you observe your suppliers continuously and have reacted to incidents. The contractual side, such as security requirements for suppliers, remains the job of procurement and legal.

What happens on a match?

You receive the alert "Potential Supply Chain Ransomware Threat" with actor, sector, country, post and screenshot. Sensible next steps: contact the supplier, rotate the partner's credentials and tokens, temporarily restrict remote access and check whether unusual access took place in recent weeks. You document the case directly on the finding. Forwarding to Teams, Slack, Jira, ServiceNow, Microsoft Sentinel or Elastic makes sure the alert reaches the responsible team.

Solutions

Supply chain monitoring: detect partner risk early

Supply chain monitoring continuously observes your company's digital dependencies. blacklens.io matches your suppliers against ransomware leak sites, the dark web and new CVEs.

Start free trial Book a demo

Supplier watchlist12 suppliers

Logistik Partner GmbHListed on a ransomware leak site, 30 min agoCritical

Software Zulieferer AGSoftwareNo hits

Muster SteuerberatungTax advisoryNo hits

Challenges in modern supply chains

No view of third-party assets

Which domains and login points of a partner connect to your systems is rarely known in full.

Compromised providers with access

A provider with remote access whose accounts are traded on the dark web leads straight into your network.

Late information

Whether a partner is compromised, you often learn weeks later from the supplier itself.

Regulatory requirements

NIS2, DORA and ISO 27001 require documented, ongoing monitoring of the supply chain.

How blacklens.io monitors your supply chain

Concrete threat signals instead of abstract security grades for third parties.

Compromised identities3 new hits

m.hu•••@beispiel-gmbh.atStealer log, 2 h agoEmployee

Microsoft 365 session cookieStealer log, 5 h agoEmployee

k.wa•••@gmx.atCombolist, 3 days agoCustomer

Early warning47 min ago

CVE-2024-21762FortiOS SSL-VPNCritical

CVE published08:12
2 assets in your inventory affected09:00
Confirmed by PoC scan09:26
Alert sent to Microsoft Teams09:27

Newly discovered assets+4 since yesterday

beispiel-gmbh.atRoot domain

vpn.beispiel-gmbh.atFortiGate SSL-VPN 7.0.12Critical

dev-old.beispiel-gmbh.atGitLab 15.2Shadow ITHigh

mail.beispiel-gmbh.atExchange Server 2019Medium

203.0.113.24OpenSSH 8.9NewInfo

Lookalike domainschecked daily

beispiel-gmbh-login.comImpersonation

beispiel-gmbh.coSuspicious

beispiel-gmbh.shopParked

Abuse report ready5 of 5 criteria

Integrationsalerts, tickets, cloud

Jira
Microsoft Teams
Slack
GitHub
GitLab
Elastic
AWS
Microsoft Azure
Google Cloud
Cloudflare
Hetzner
Webhook

REST API250+ endpoints

Visuals show sample data.

A monitored supply chain in three steps

1
Import suppliers
Import name and domain of your suppliers via CSV, for example straight from procurement.
2
Continuous matching
Leak sites of ransomware groups are polled and matched about every 30 minutes.
3
Alert with all details
"Potential Supply Chain Ransomware Threat" with actor, sector, country, post and screenshot.

Example from practice

Machinery manufacturer secures its supplier platform

blacklens.io found a partner's publicly reachable development environment with a valid access token for production APIs, plus a leaked IT service provider account on the dark web.

Result: The customer reacted within hours, before any damage occurred.

Evidence for NIS2, DORA and ISO 27001

Watchlist, alert history and activity log prove that you monitor your suppliers continuously and react to incidents.

See NIS2 requirements

Evidence for auditors and insurersas PDF

Supplier watchlistNIS2 Art. 21 (2) devery ~30 min

Matches on findingsDORA Art. 28on every match

Activity logISO/IEC 27001 A.5.22continuous

Frequently asked questions

: Supply chain monitoring is the continuous observation of a company's digital dependencies: IT service providers, cloud providers, software vendors and technical subcontractors whose compromise directly affects your own security. The goal is to learn about an incident at a partner from your own alerting system, not from the press. NIS2 (Article 21(2)(d)), DORA (ICT third-party risk) and ISO 27001 (A.5.19 to A.5.22) demand exactly this view of the supply chain.
: All partners whose compromise affects you directly: IT service providers with remote access, software vendors with update mechanisms, cloud and hosting providers, logistics and production partners with system integration, and consultants with access to confidential data. The CSV import makes it easy to start with the supplier list from procurement.
: From the public leak sites of ransomware groups, where victims are listed and extorted with the publication of data, supplemented by threat intelligence feeds. blacklens.io polls these sources about every 30 minutes and stores company, sector, domain, actor, country, link and screenshot per entry.
: No. blacklens.io does not issue security grades for third parties. The platform monitors concrete threat signals: leak site entries, dark web findings, new CVEs in shared technologies and partner access in your own attack surface. That is less abstract than a score and directly actionable. Every match lands in your workflow as a finding with status and comments.
: Both require ongoing monitoring of the supply chain and evidence of it. The watchlist, the alert history and the activity log prove that you observe your suppliers continuously and have reacted to incidents. The contractual side, such as security requirements for suppliers, remains the job of procurement and legal.
: You receive the alert "Potential Supply Chain Ransomware Threat" with actor, sector, country, post and screenshot. Sensible next steps: contact the supplier, rotate the partner's credentials and tokens, temporarily restrict remote access and check whether unusual access took place in recent weeks. You document the case directly on the finding. Forwarding to Teams, Slack, Jira, ServiceNow, Microsoft Sentinel or Elastic makes sure the alert reaches the responsible team.

Ransomware readiness

Close entry points in your own company.

NIS2

Evidence supply chain security under Article 21.

DORA

ICT third-party risk for financial entities.

Dark Web Monitoring

Compromised identities and devices, matched daily.

Which of your suppliers was on a leak site yesterday?

Import your supplier list as CSV and see within 24 hours which partners are affected.

Try free for 14 days Book a demo

14 days free, all features
No credit card required
We walk you through your first findings