- contact@verticalserve.com
InsightVendors · agentic third-party risk
Every vendor reviewed properly. Without the six-week wait.
Someone asks for a tool in one sentence. Agents do the intake, find the tool you already pay for, read the SOC 2 report and the contract with the page for every finding, score the risk, run security, privacy, legal and finance reviews in parallel, watch the vendor afterwards and come back before the renewal with a recommendation. Your reviewers get a prepared decision — and stay the ones who make it.
- Every finding cites its page
- Reviews run in parallel
- Every risk score explains itself
Reads what vendors already have, works where your reviewers already are
SOC 2 & SOC 1ISO 27001 · 27701 · 42001Penetration testsInsurance certificates
DPAsMSAs & order formsSIG-Lite aligned questionnairesVendor portal
InsightPulse intelligenceInsightAssure evidence
The problem
Your vendors’ risks have become yours. Your review process has not caught up.
Breaches that start at a supplier, outages at a shared provider and AI tools that learn from your data now land on your desk, your regulator’s and your customers’. Meanwhile the review is still a form, a ninety-page PDF, a redline from scratch and an email chase — and the business waits.
Slow
The business waits weeks
Reviews run one after another, nobody owns the queue, and every lane starts from zero. So people buy on a credit card and the vendor never reaches review at all.
Shallow
Questionnaires instead of evidence
A vendor ticks “yes” to two hundred questions their SOC 2 already answers — or contradicts. Reviewers read the answers, not the report, and the exception on page 41 goes unseen.
Static
Reviewed once, then forgotten
The SOC report expires, the vendor is breached, a new subprocessor appears, the contract auto-renews. None of it reaches the person who could act until the renewal invoice does.
For procurement, risk and security leaders
Faster approvals, deeper reviews, a programme you can defend
Third-party risk is usually sold as a control and resented as a bottleneck. InsightVendors is built so the thorough path is also the quick one: agents do the reading, the chasing and the arithmetic, reviews run side by side, and every decision carries its evidence.
What comes out — who asked, what the vendor touches, what the documents prove, who approved and on what conditions, what changed since — is exactly what an auditor or a regulator asks to see.
The business case for agentic third-party riskOne sentenceis all a requester writes — the Intake agent fills in vendor, category, data, spend and the tool you may already have
In parallelsecurity, privacy, legal, finance, IT and the business owner review at once, each lane with an owner and an SLA
Page citedevery finding from a SOC 2, pen test, insurance certificate, DPA or contract quotes the text and names the page
Before noticerenewals arrive 90 days before the notice date with spend, risk trend, open findings and a recommendation
How it works
Ask → Triage → Review → Decide → Monitor → Renew
One lifecycle for every third party, from the first request to the exit. Agents prepare each step; people make each decision; everything lands in one record.
1
Ask
One sentence. The Intake agent names the vendor, the category, the data and systems it will touch and the spend — and warns when you already have something that does the job.
2
Triage
The Risk agent sets the tier and an inherent score from what the vendor touches. Routing rules add the review lanes and the documents each needs, and record why.
3
Review
Agents read the SOC 2, ISO certificate, pen test, insurance, DPA and contract, pre-fill the questionnaire and send the vendor only what is left, through a portal.
4
Decide
Each lane approves, approves with conditions, rejects or sends back — in the console or from a signed email link. Conditions become tracked findings.
5
Monitor
Breaches, financial news, expiring documents and silent vendors arrive as signals. The Monitoring agent sizes the reaction to the vendor’s tier.
6
Renew
Before the notice date, the Renewal agent recommends renew, renegotiate or offboard — with spend, risk trend and open findings to back it.
One-sentence intake
You may already have this
No forty-field form. And no second call-recording tool.
A requester writes what they need the way they would say it. The Intake agent turns it into a request, flags what it could not tell, and checks your vendor list and contracts first.
What the requester wrote“We want Gong for sales call recording, about 40 seats, roughly $60k a year, starting next month”
One sentence in the console.
What the Intake agent came back with“You may already have this — Callwave is an approved CRM & sales vendor”
Plus the vendor, title and category, and the five questions it could not answer: CRM integration, sensitive data in calls, internal owner, SSO, the DPA and data residency.
Agents that read the documents
The ninety-page report, reduced to the ten facts that matter — with the page for each
The Document agent reads what the vendor has already produced and the Contract agent checks every clause against your playbook. Reviewers check the findings against the quoted text instead of reading from page one.
Assurance reports
SOC 2 & SOC 1
Type, period, auditor, opinion, exceptions, complementary user entity controls you must operate, subservice organisations and the bridge-letter gap.
Certificates
ISO & insurance
ISO 27001, 27701 and 42001 scope and expiry; cyber, E&O and general liability limits checked against the minimum for the vendor’s tier.
Testing
Penetration tests
Date, tester, open critical and high findings, and whether a retest shows them fixed.
Privacy
DPAs
Subprocessors, breach-notification window, data location, transfer mechanisms and deletion. Subprocessors become your fourth-party map.
Legal
MSAs & order forms
Liability cap, indemnity, termination, auto-renewal, notice period and governing law — each deviation from your playbook with a proposed redline.
Financial
Financial health
Going-concern language and liquidity in statements, alongside financial signals such as layoffs and acquisitions.
Risk you can argue with
Inherent risk from what they touch. Residual risk from what they prove.
Deterministic arithmetic with weights you own, every point listed. The agent explains the score; it never invents it. Tier and residual risk decide how deep the review goes and how often it is repeated.
Stackforge · production hosting · Tier 1
Where the inherent score of 89 comes from, and what reduces it
- Handles credentials and two more data typessecurity+38
- Access to our production systemssecurity+20
- Business criticality: criticaloperational+20
- Annual spend $420,000financial+6
- Subprocessor of our customers’ personal datacompliance+5
- Current SOC 2 Type IIassurance−26.7
- ISO 27001 certificate in dateassurance−13.3
- Pen test in 12 months, no open criticalsassurance−7.1
- Insurance meets the tier’s minimumsassurance−4.5
- Then: open findings from those same documentseach one adds back, until it is closed+
From the demo organisation. A residual score that stays high after strong evidence is the signal to work the findings list: here, mostly insurance and pen-test details awaiting confirmation.
Assessments without the busywork
Ask the vendor only what nobody has answered yet
The Assessment agent picks the questionnaire the tier calls for — Core (SIG-Lite aligned), Privacy & DPA, AI vendor, business continuity, financial health — pre-fills every answer your documents already prove, marks where each came from, and prepares the invitation.
- A portal, not an account — the vendor answers and uploads through a signed link
- Held until you release it — every message an agent writes waits in the outbox
- Answers checked — weak, evasive or contradictory answers are flagged (“says Type II, uploaded a Type I”)
After the contract is signed
A signal is not an email. It is work, sized to the vendor.
Breaches, financial news, expiring reports and vendors that stop answering arrive as signals; the Monitoring agent decides between a note, a finding, a re-assessment or an escalation. Renewals arrive before the notice date with a recommendation.
Ten agents, one dial
Let agents do the reading and the chasing. Decide how far they go.
Intake, Research, Risk, Assessment, Document, Contract, Monitoring, Renewal, Remediation and Copilot. Each runs at the level you choose, every action is recorded with what it cited, and every message waits in the outbox until a person releases it.
- L1 Draft — prepares; a person does the work
- L2 Ask first — prepares the decision and waits
- L3 Act and tell — acts, tells you, lets you pull it back
- L4 Act — within a ceiling the deployment sets
- Grounded and model-optional — a number not in the source throws the answer away, and every agent has a rule-based path that works with no AI model at all
For the people accountable
Questions you can answer the day they are asked
Which vendors could hurt us?
Tier × residual risk heat map, critical findings, and the Copilot answering in plain words with links.
Where do requests wait?
Average days per review lane and what is open in each, so the bottleneck has a name.
What do we spend, and on what?
Spend under management by tier, duplicate tools caught at intake, and renewals with notice dates.
Will the regulator be satisfied?
Tiering, due diligence, contract terms, monitoring and exit — recorded per vendor, exported to InsightAssure.
Editions & trust
SaaS for most. Self-hosted for the regulated.
The same product either way. Vendor contracts and SOC reports stay where your regulator wants them.
SaaS
Hosted, ready today
We run it; you invite your reviewers and import your vendors. Shared monitoring and, as it arrives, the vendor network.
Self-hosted
Your cloud, our images
Docker Compose with your PostgreSQL and identity provider, and the AI model of your choice — or none.
Isolation
Tenants kept apart by the database
PostgreSQL row-level security on every tenant table, so a missed filter in code still returns nothing from another organisation.
Pricing
By vendors under management
Not by reviewer seat, so the whole business can request and approve. Ask us.