A security rating grades a supplier's own security posture, so every customer sees the same score. Third-party risk depends on how each organization connects to that supplier and what runs on it. ThingsRecon's connected score ranks suppliers by business impact and shows what each issue could cost.
Two companies can use the same supplier and carry very different risk because each one is connected to that supplier differently. One runs a campaign microsite on it. The other runs its client platform on it. A vendor score or security rating grades the supplier on its own, so it hands both companies the same answer.
I've sat in a lot of customer meetings this year, and the same moment keeps coming back. A supplier gets breached, the vendor risk report shows a B, and someone in the room asks the question the board will ask next: what does this cost us? The security rating can't answer that. It was built to describe the supplier, and the cost lives somewhere else, in how that supplier is wired into your business.
That gap is why we built ThingsRecon Supply Chain Intelligence around one idea we kept hearing from customers: that risk follows the connection.
What does a vendor security rating measure?
That's still useful information, and we kept the generic score in our own platform for that reason. What a grade can't tell you is whether the finding behind it sits on a forgotten marketing site or inside the API your biggest client logs into every morning.
Those two findings look identical on a scorecard. They are very different conversations with your CFO. We wrote about the breach version of this problem in Your supplier got an A, so why were you breached?
What are the four links between a supplier and your bottom line?
There are four. The supplier itself, the digital connection between you, the services and clients that depend on that connection, and the business value riding on those services, such as contracts and the service levels written into them. Security ratings platforms stop at the first link. Knowing what a finding could cost you takes all four.
The supplier link is the familiar one: cyber hygiene, financial status, geopolitical associations, compliance.
We map the last three from the outside, without asking your suppliers to fill anything in. The result is a measure of how close a supplier sits to what matters in your business, which we call Digital Proximity. The longer story of why we had to invent it is in Digital Proximity: the metric we had to invent to assess risk.
How can the same supplier carry different risk for two companies?
Take a hosting provider we'll call Larkfield, graded B. One company, Orveda Group, uses it for a campaign microsite with no client data on it. Another company, Brightwater Retail, runs its client platform on Larkfield, and Brightwater's biggest client depends on that platform. Both see the same security rating “B”. Orveda's connected risk is low, and Brightwater's is high.
These companies are made up, but I see the pattern in real customer estates all the time. Orveda should keep Larkfield on its normal review cycle and spend its time elsewhere. Brightwater should start a full assessment this week and ask Larkfield for evidence on the services its platform relies on. Its account team should also know that a key contract now has a supplier exposure attached to it.
Our guide to Digital Proximity prioritization goes deeper on how teams use it.
How do you put a number on a finding?
Multiply the value of what depends on the connection by the chance that an open exposure costs you that value within a year. A $20 million contract with a 10% chance of being lost carries $2 million of expected loss. Close the exposure, and that's the return you can show.
The numbers here are illustrative, and I'll be honest about the hard part. ThingsRecon gives you the connection and the dependency, which is the piece most teams have never had. The probability has to come from you: your incident history, risk appetite, and the terms of the contract itself. We set the thresholds with you during a working session.
Once those numbers exist, the report to finance gets a lot more useful: “one open exposure puts $2 million of a key contract at risk, and here is what it takes to close it.” Try your own figures in our supplier risk cost calculator.
What changes when you score the connection?
Your supplier list reorders itself. Suppliers embedded in live services move up and suppliers hosting a forgotten microsite move down, so review effort goes where a breach would hurt. In ThingsRecon you can switch between the generic score and the connected score for every supplier, and look at what moved.
A few other things show up once you look at connections instead of names. Suppliers nobody onboarded appear, along with the business unit that uses each one. The providers behind your suppliers become visible, so a fourth party running underneath a critical service stops being a surprise.
Due diligence still matters, and the connected score tells you where to spend it. When a regulator asks why one supplier got a full assessment and another got a light review, you have a documented reason based on what depends on each of them. If you want a checklist of the places teams most often look past, start with 5 things most supply chain risk teams overlook.
See how you're connected to your suppliers
If you'd like to see this on your own estate, just let us know your domain. We'll map your digital connections from the outside and show you which suppliers your business actually runs on, before any contract. Run it on your own data.
