Breach Risk
External observability of each vendor's attack surface — prober telemetry, CVE and KEV signals, incident disclosures, and certificate events, all grounded in agent-produced, cited claims.
What it is
Breach Risk — in detail.
Breach Risk is TrustVendor's outside-in observability layer. Where Vendor Risk reads what vendors publish in writing, Breach Risk reads what their infrastructure broadcasts: DNS records, TLS certificate events from Certificate Transparency logs, HTTP security headers, open port behaviour, and vulnerability disclosures from NVD and CISA KEV. Every data point is stored as an agent-produced claim with a predicate, an object, a source artifact, and the extractor version that produced it — the same structure as any other claim in the evidence graph.
CVE and KEV signals are normalized and matched to vendor-specific software stacks extracted from trust centres and job postings. When CISA adds a CVE to the Known Exploited Vulnerabilities catalogue, Breach Risk identifies which vendors in your portfolio use the affected component, scores materiality against your integration depth, and routes a signal to your team within the severity SLA. The signal carries the CVE ID, the CISA advisory artifact ID, and the claim that linked the CVE to the vendor's stack — your team can open the evidence drawer and see exactly how the connection was made.
Incident disclosures — breach notifications published on vendor trust centres, SEC EDGAR 8-K filings, and post-mortems — are processed by the Extractor agent within hours of publication. Unlike external scanning tools that infer a breach from telemetry, TrustVendor reads what the vendor actually said: affected data classes, affected time window, remediation steps. This is complementary to telemetry-based scoring, not a replacement — you can ingest a Bitsight or SecurityScorecard score as a signal inside TrustVendor rather than choosing between them.
How it works
Three steps,
fully auditable.
Prober agents run on a per-vendor schedule: DNS resolution, TLS handshake, HTTP header collection, and CT log subscription. Every probe result is stored as an immutable artifact keyed by SHA-256 content hash and timestamped to the millisecond — the basis for all change detection.
CVE and KEV feeds from NVD and CISA are ingested continuously. A Go matching layer maps CVEs to vendor software stacks using claims extracted from trust centres, job postings, and public repositories. Matches produce breach-risk claims with full citation chains back to both the vulnerability source and the stack evidence.
Material changes produce signals routed to your Vendor Risk workspace. Severity is a deterministic output of the Triage agent against your relationship context — a KEV match for a vendor processing PHI is critical; the same match for a vendor sharing only telemetry is high. SLA clock starts from the source event timestamp.
What you get
Built for teams that
have to prove things.
Prober telemetry on every monitored vendor
DNS, TLS, HTTP headers, and CT log events run on a continuous schedule. Every result is a stored artifact — the basis for diff-based change detection and the evidence trail for any finding your team needs to cite.
CVE and KEV matching with evidence chains
NVD and CISA KEV are ingested continuously. Matches to vendor stacks produce cited breach-risk claims — your team sees which CVE, which vendor component, and which evidence linked them.
Incident disclosure extraction
Breach notifications, 8-K filings, and post-mortems are processed by the Extractor agent within hours of publication. You read what the vendor said, not what telemetry implied — with the source text span cited.
What the agents will never do
Agent guarantees,
in plain terms.
Agents produce claims, never numbers. Scoring is deterministic Go arithmetic over those claims — models never run in the scoring path.
Every claim cites a hashed, immutable snapshot span. No claim is written to the database without an artifact_id and a validated quote hash.
Extractor agents are prompt-versioned. Every claim records the prompt file, model, and schema version that produced it. A regression is a rollback, not a data loss.
The Analyst agent's system prompt forbids it from asserting a fact it cannot cite. Warnings surface in the response envelope when tool results are incomplete — the answer is never silently filtered.
Sample
What it looks
like in practice.
Common questions
Answered plainly.
How is Breach Risk different from Bitsight or SecurityScorecard?
How quickly do KEV signals reach my workspace?
What sources does the prober cover?
Can I integrate Breach Risk signals with my existing SIEM?
How do I know a CVE match is accurate and not a false positive?
See it live
Breach Risk
on your vendors.
Book a 30-minute demo. We’ll run it live on vendors from your register — not demo data.