Managed program
Drafted by VectraIQ, signed off by your cyber expert.
Every company assessment and vendor review follows the same route: your team or the vendor answers, the AI does the first read, your cyber expert reviews it, and you see the report only after that.
Example Payroll Co
Critical vendor
- Questionnaire answered
- Done
- Documents received
- 6 of 7
- Draft report
- Ready
- Expert review
- In progress
Not shared with you until your cyber expert publishes it.
Two kinds of assessment
One for your company, one for each vendor you depend on.
Company risk assessment
- Done at baseline, against the frameworks you chose.
- VectraIQ drafts the findings and scores them. Your cyber expert reviews the draft and the priorities before you see them.
- Findings become issues and risks in your register, each with an owner.
Vendor review
- Starts with the vendors that matter most to you, then works outward.
- Built from the vendor’s own answers and documents and public information.
- Ends in a report your cyber expert publishes, and the vendor stays under passive checks afterwards.
The step-by-step platform flow lives under third-party risk, and company assessments under risk assessments. This page is about who does what in the managed program.
Worked example
What your cyber expert changed in the Example Cloud Hosting draft.
Illustrative findings.
- High
Example Cloud Hosting - SOC 2 report not provided
Raised automatically from the missing document. Kept by your cyber expert; a request goes to the vendor.
- Moderate
Example Cloud Hosting - Incident response plan is a draft
Drafted by VectraIQ from the vendor’s own document. Kept.
- Moderate
Example Cloud Hosting - Penetration test summary not provided
Drafted by VectraIQ. Deleted by your cyber expert: the vendor had published the summary on its trust page.
What you do
- Tell us which vendors matter most, so the order of reviews matches your risk.
- Introduce us to a contact at each vendor, or tell us where your own relationship sits.
- Decide what to do with the result: accept the risk, ask the vendor to fix it or change the vendor.
What is not included
- ×Testing inside the vendor’s own systems. The review relies on its answers, its documents and public information.
- ×Reviews beyond the agreed scope. Those are agreed with you first.
- ×Negotiating with the vendor on your behalf. Your cyber expert tells you what to ask for.
How often vendors are checked afterwards is on the scanning page. Findings from a review follow the route on the remediation page.
Inside a vendor review
Third-party risk reviews, run by your expert team.
Four steps, and one person reads it before you do.
- 1Vendor
Answers and documents
The vendor answers a security questionnaire inside the platform and uploads the documents it asks for, such as a SOC 2 report.
- 2VectraIQ
Scores it and turns gaps into findings
Answers are scored the same way for every vendor, so two vendors are comparable. A required document that is missing becomes an issue and a risk against that vendor.
- 3VectraIQ
Drafts the report and starts monitoring
An executive summary, a vendor profile and a check of each document. The vendor is also enrolled in passive checks, on the schedule on the scanning page.
- 4Your cyber expert
Reviews, edits, publishes
Your cyber expert reads the draft, edits anything AI-written, deletes any finding that is wrong and publishes. Only then does the report reach you, as a page in the platform and a PDF.
Questions, answered.
When do we see a vendor report?
After your cyber expert has reviewed it and published it. Until then it is a draft that only your expert team sees. Once it is published you can open it in the platform and download it as a PDF.
Does the AI decide a vendor’s risk score?
Scores follow defined scoring rules applied to the vendor’s answers. VectraIQ drafts the narrative around them. Your cyber expert can edit any AI-written text and delete any finding before the report is published.
Do you review every vendor we have?
Reviews start with the vendors that matter most and the number covered follows the scope agreed with you, so the scope is always yours to approve.
Are vendors reviewed once and then forgotten?
No. A reviewed vendor stays under passive checks, and the platform schedules the next assessment for you. By default that is a year after the last one.
Next in the program
Keep going through the program.
Start with the vendors and risks that worry you.
Tell us which vendors matter most and a lead expert will show how the review would run.