Supply chain monitoring: detect partner risk early

Frequently asked questions

What is supply chain monitoring?

Supply chain monitoring is the regular observation of a company's digital dependencies: IT service providers, cloud providers, software vendors and technical subcontractors whose compromise directly affects your own security. The goal is to see weaknesses at partners before an incident and to learn about an incident from your own alerting system, not from the press. NIS2 (Article 21(2)(d)), DORA (ICT third-party risk) and ISO 27001 (A.5.19 to A.5.22) demand exactly this view of the supply chain.

Does blacklens.io rate the security of my suppliers?

Yes. blacklens.io rates every supplier from the outside, the way an attacker sees it: with no access to its systems and nothing for the supplier to install or approve. The result is a grade from A to F with a score from 0 to 100 across nine rating areas, from outdated software through TLS and email security to leaked credentials and ransomware listings. Every rating shows its findings with remediation guidance. More on the supplier risk rating page.

How often is a supplier rated?

Every seven days, automatically. The first rating starts right after you add a supplier and serves as the baseline, so it raises no alert. Every later rating is compared with the previous one: if the grade drops or a known-exploited vulnerability, a critical finding or a ransomware listing appears, the alert "Supplier risk increased" follows. There is no on-demand re-rating. The ransomware watchlist, by contrast, checks leak sites about every 30 minutes.

Which suppliers should we monitor?

All partners whose compromise affects you directly: IT service providers with remote access, software vendors with update mechanisms, cloud and hosting providers, logistics and production partners with system integration, and consultants with access to confidential data. Start with the supplier list from procurement as a CSV. Criticality (Low to Critical) marks which partners matter most; a "Supplier risk increased" alert on a supplier with criticality Critical gets severity High.

Where does the ransomware victim data come from?

From the public leak sites of ransomware groups, where victims are listed and extorted with the publication of data, supplemented by threat intelligence feeds. blacklens.io polls these sources about every 30 minutes and stores company, sector, domain, actor, country, link and screenshot per entry. They are matched against the domains on your ransomware watchlist, which you maintain via CSV.

How does this support NIS2 and DORA?

Both require you to manage risk in the supply chain: NIS2 in Article 21(2)(d), DORA in Articles 28 to 30. Rating history, Supply Chain Report, alert history and activity log document that you check your suppliers regularly and react to changes. An outside-in view does not replace a contractual or questionnaire-based supplier assessment. Security requirements in contracts and supplier audits remain the job of procurement, legal and your ISMS.

What happens when a supplier's risk increases?

If a supplier's rating gets worse, for example through a grade drop or a new known-exploited vulnerability, you receive the alert "Supplier risk increased". A watchlist match raises "Ransomware threat discovered" with actor, sector, country, post and screenshot. Sensible next steps: contact the supplier, rotate the partner's credentials and tokens, and temporarily restrict remote access. Notification policies route alerts by email, push, Teams, Slack, Jira or ServiceNow to the responsible team.