Vendor risk management
Track third parties by criticality, send security questionnaires, and profile a vendor from just its URL with AI.
| Vendor | Tier | Data access | Risk | Review |
|---|---|---|---|---|
| Cloud hosting | Critical | Customer data | High | Current |
| Payroll provider | Important | Employee PII | Medium | Due |
| Email delivery | Important | Contact data | Medium | Current |
| Design tool | Low | None | Low | Current |
The vendors you depend on are part of your attack surface and your auditor knows it. Keel gives you a real third-party inventory: rank each vendor by criticality, set review cadences so nothing goes unreviewed, draft a risk profile from the vendor’s own website with AI, and send security questionnaires that score themselves.
Your vendor list lives in three places and none are current
A procurement spreadsheet, a shared inbox of SOC 2 reports, and someone’s memory of “who we use for what.” When a vendor has an incident (or an auditor asks how you vet suppliers), there’s no single, current source of truth.
What vendor risk management does
Inventory by criticality
Catalog every third party with a criticality tier and status, so the vendors that matter most get the scrutiny they deserve and the review cadence they need.
Review cadences
Set how often each vendor should be reviewed and Keel surfaces what’s due, turning “we’ll get to it” into a tracked, evidenced cadence auditors credit.
AI vendor profiles from a URL
Paste a vendor’s website and Keel drafts the risk profile: what they do, the data they touch, their certifications and sub-processors, so your inventory fills itself in instead of starting blank.
Security questionnaires that self-score
Assemble a structured assessment from a curated library of 100+ questions, send it, and let Keel auto-score responses, consistent and on-brand, ready to send in a click.
Collaborative vendor portal
Vendors respond in a portal and can invite their own colleagues to help answer, so the security questionnaire isn’t bottlenecked on one contact.
Turn a vendor into risks
Draft concrete, scored risks straight from a vendor profile and add the ones you choose to your risk register, closing the loop between third-party and enterprise risk.
A posture score from public signals
A questionnaire is a point-in-time snapshot the vendor fills in themselves. Alongside it, Keel computes a 0–100 health score from credential-free public signals — DNS email authentication (SPF and DMARC) and CISA Known-Exploited-Vulnerability exposure — that you can recompute any time you want a fresh read, with no questionnaire and no AI credits.
Monitor your own posture too
Point the same credential-free checks at your own domain to see the self-posture score a prospect or auditor could observe about you from the outside, and fix the gaps before they do.
Why it matters
- One current inventory of every third party and how critical it is
- Never miss a vendor review with tracked cadences
- Profile a new vendor in seconds instead of an afternoon of research
- Send and score security questionnaires without building them by hand
- Read a vendor’s public security posture without waiting on a questionnaire
Get audit-ready, and prove it
Vendor risk management is one module of a full GRC platform: controls crosswalked across every framework, so you collect evidence once and comply everywhere. Start free, no credit card, no sales call.
Start freeFrequently asked questions
Can vendors collaborate on a questionnaire?
Yes. The vendor portal supports multiple collaborators, so a vendor can invite colleagues to answer the sections they own instead of funnelling everything through one person.
How does the AI vendor profile work?
You paste the vendor’s URL and Keel drafts a profile (what they do, the data they handle, certifications and sub-processors) as an editable starting point you review before saving.
Do the questionnaires score themselves?
Assessments built from Keel’s question library are auto-scored as responses come in, so you get a consistent risk read without hand-grading every answer.
What is the vendor health score based on?
Public, credential-free signals only: the domain’s DNS email authentication (whether SPF and DMARC are published, and how strict the DMARC policy is) and a keyword match against the CISA Known-Exploited-Vulnerabilities catalog. Keel combines them into a 0–100 score and band you can recompute on demand. It is a best-effort external signal, not a guarantee or a penetration test — the KEV match is keyword-based and should be confirmed, and a category Keel can’t observe scores as “unknown” and earns no credit rather than being assumed to pass.
Does the health score replace a security questionnaire?
No — it complements one. The questionnaire is self-reported and point-in-time; the health score is observed from the outside and can be recomputed whenever you want a current read, so you get an external check between formal reassessments.
Can I check my own organization’s posture?
Yes. The same checks can run against your own claimed domain to give you a self-posture score — the SPF/DMARC and KEV picture the outside world can see — so you can close gaps before a customer or auditor notices them.
Does vendor risk connect to my risk register?
Yes. Draft risks directly from a vendor profile and promote the ones you pick into your central risk register.
Related features: Security questionnaire automation · Risk register · AI tools
Works with: SOC 2 · ISO/IEC 27001