the problem
A security rating can't tell you what a breach costs.
Traditional scoring platforms grade a supplier's own external posture.
Supply chain intelligence
Risk follows the connection.
ThingsRecon keeps a living map of your digital supply chain, from direct suppliers to the providers behind them, and scores each connection by how much of your business depends on it.
Every customer sees the same grade, whether the supplier hosts a forgotten microsite for you, or sits inside the platform that serves your biggest client. That connection is what decides the risk.
How it works
Four layers from a supplier to your bottom line.
TPRM platforms stop at the first layer. ThingsRecon maps the other three from the outside, without asking your suppliers to fill any questionnaires. We call the result Digital Proximity: a proprietary measurement of how close a supplier sits to your critical systems.
01
Supplier
The supplier's own posture, including cyber hygiene, financial status, geopolitical ties and compliance.
02
Connection
Embedded services, APIs, hosting, DNS and registrar footprints, and the business unit that uses it.
03
Dependency
The services, clients and share of your estate that rely on that relationship.
04
Business value
The contracts, service levels, and regulatory duties riding on those services.
ThingsRecon platform
Your digital supply chain, mapped and scored in one place.
Continuous discovery of your digital connections from the outside, including shadow suppliers
Generic and connected supplier scores, with financial and geopolitical ties built into the score
Fourth and fifth party paths to your services
An audit trail of every action taken in the application
Integrations that bring the scores into your vendor requests
Trusted by global enterprises
Ten evaluators compared the established rating platforms. Nine chose ThingsRecon.
9
of
10
evaluators chose ThingsRecon after a three-month pilot
5
days
to onboard a vendor, down from 6 weeks to 3 months
10
min
to answer "are we impacted?", down from about 2 weeks
70
%
of the vendor workflow is now automated
The biggest differentiator for me was the proximity.
How am I connected to this vendor? And how deep can I go to understand that connection?
Global Head of Product Security
|
ENTERPRISE CUSTOMER
ROI calculator
Estimate what one supplier exposure could cost you.
ThingsRecon shows which contracts depend on each supplier. Multiply a contract's value by the chance an open exposure loses it: that's the loss you avoid each year by fixing it.
Value of the contract that depends on the connection
$20M
Chance the open exposure costs you that contract within 12 months
10%
$20M
Lost if the contract goes
$2M
Expected loss removed per year
Run it on your data
See the complete map of your supply chain.
01
Schedule a working session with our product team
02
Run a pilot on your own domains and vendor lists
03
Compare it with what your current program reports, then decide
5x
When we scan an organization, we typically find two to five times more connected suppliers than its vendor list holds.
Frequently asked questions
What is a connected supplier score?
A score for the relationship between your organization and a supplier. It starts from the supplier's own posture, then weights each finding by how the supplier connects to you: which of your services run on it and what data it touches. ThingsRecon calls this Digital Proximity (patent pending).
How is it different from a vendor rating?
A vendor rating grades the supplier on its own, so every customer sees the same grade. The connected score uses the same evidence and adds your connection to it, so two customers of one supplier can get very different results. You can switch between both in the platform.
What do you need from me to start?
Your domains and, if you have one, your vendor list. We map the connections from the outside, with nothing to install and nothing for your suppliers to fill in.
What can't an outside-in view see?
Private routes such as a site-to-site VPN don't show up from the internet. Those links usually carry less exposure than public ones, and they tend to be documented already because someone had to configure them.