ThingsRecon Supply Chain Intelligence is a continuously updated map of the suppliers, assets and digital connections surrounding an organisation. It uses external discovery to identify known and unknown suppliers, including relationships visible through DNS, certificates, scripts, APIs, shared infrastructure and other technical signals. The platform enriches those relationships with cyber hygiene, business, financial, geopolitical and compliance context. Digital Proximity then measures how closely each supplier is connected to critical systems, helping teams distinguish a weak supplier with limited relevance from a deeply embedded dependency that could create significant operational impact. The result supports supplier prioritisation, incident response and evidence-based reporting without relying only on questionnaires or static inventories.

Yes. ThingsRecon can identify supplier relationships that are visible in an organisation’s external digital ecosystem even when those suppliers are absent from procurement or vendor inventories. Evidence may include DNS records, certificates, embedded scripts, APIs, redirects, shared infrastructure, web technologies and other observable connections. A discovered connection does not automatically prove that a supplier is approved, critical or currently contracted. ThingsRecon attaches evidence and confidence context so the organisation can validate the relationship and decide how it should be classified. Once confirmed, the supplier can be monitored and prioritised using cyber hygiene, business intelligence and Digital Proximity, helping teams close the gap between the supply chain on paper and the one operating online.

Yes. ThingsRecon can surface indirect supplier relationships where externally observable evidence connects a known supplier to additional providers, infrastructure or technologies. These fourth-party relationships may include hosting providers, SaaS services, scripts, certificate authorities, shared platforms and other dependencies that sit beyond the organisation’s direct contract. External evidence cannot reveal every contractual or operational dependency, so discovered relationships should be validated with the supplier or internal owners. The value is in exposing plausible indirect connections that may otherwise be absent from traditional TPRM records. Mapping these relationships supports concentration-risk analysis, incident response and prioritisation when a widely used provider or shared technology is disrupted.

ThingsRecon prioritises risk by combining technical exposure with business and relationship context. Findings can be assessed using cyber hygiene, vulnerability severity, asset visibility, supplier intelligence, concentration and Digital Proximity, which shows how closely an asset or supplier connects to critical systems. This avoids treating every high-severity issue or low supplier score as equally urgent. A moderate weakness on a public-facing system that supports a critical service may deserve faster action than a severe issue on an isolated, low-value asset. The platform provides evidence and context for the decision, while the organisation retains control over business criticality, risk appetite and remediation priorities. In practice, teams should record the supporting evidence, confirm ownership and business criticality, and connect the finding to an accountable workflow. This prevents a useful observation from becoming another isolated score or dashboard alert.

Supply chain intelligence software pricing varies according to supplier volume, discovery scope, monitoring frequency, data enrichment, integrations and reporting. A platform that only scores a supplied vendor list is not directly comparable with one that discovers unknown and fourth-party relationships. Organisations should define the outcomes and coverage they need before comparing cost. ThingsRecon provides tailored pricing based on the required digital ecosystem and monitoring scope. In practice, teams should record the supporting evidence, confirm ownership and business criticality, and connect the finding to an accountable workflow. This prevents a useful observation from becoming another isolated score or dashboard alert. In practice, teams should document scope, ownership, supporting evidence and the action expected when the answer changes. This turns the definition into a repeatable part of security and risk management rather than a one-off explanation.