GovernanceVendor & Third-Party Risk

Vendor & Third-Party Risk

A vendor register with AI-generated risk assessments, so third-party risk is scored and tracked instead of remembered.

Every tool you connect to your business is a piece of your attack surface and a line item in your auditor's third-party risk requirement. Aegis manages vendors as a first-class part of the program.

The vendor register

Aegis seeds your vendor register from the tools you named in the interview, your identity provider, source control, cloud, HR, analytics and so on, and you add the rest. Each vendor carries:

  • A category (cloud, identity, HR, security, analytics…).
  • An assessment status (in progress, assessed).
  • A residual risk band, the exposure the vendor represents after its own controls.
  • An owner.
  • Tasks, the follow-ups a given vendor requires.

A vendor's Tasks tab also shows Linked tasks: the compliance tasks connected to that vendor, each with its assignee, frequency and status. Open one to add its evidence. Tasks are linked to a vendor when they are created for it, including through the API (vendorId).

AI risk assessments

For each vendor, Aegis performs a risk assessment rather than leaving you a blank form. It considers the vendor's profile and the data and access it has, and produces a scored assessment with a residual risk band. A newly added vendor is assessed automatically, so the register is populated with real analysis, not "not assessed" placeholders.

This turns third-party risk from an annual fire drill into a maintained list: the assessment exists the moment the vendor does, and you review and confirm rather than starting from zero.

As with the risk register, an AI assessment is a first draft for a human to confirm. It gives you a defensible starting position, scope, data access, residual band, that you validate against what you know about the relationship.

Why it satisfies auditors

Vendor and third-party risk management is a named requirement across SOC 2, ISO 27001 and the other frameworks Aegis supports. A register where every vendor is categorized, assessed, scored for residual risk, owned and tracked is exactly the evidence those requirements ask for, and it is kept current instead of assembled for the audit.

Next steps

Risk Management

Enterprise risk, assessed and mapped the same way.

Integrations

The vendors you connect become automated evidence sources.

Questionnaires

Answer the security questionnaires your own customers send you.

Capabilities

The full feature reference.

Contact us

Was this page helpful?