third-party-risk

Phishable is a project that logs misconfigured DNS that can be exploited to conduct phishing attacks & spoof domains. Phishable helps orgs investigate phishing campaigns, gauge third-party risk & mitigate these risks. All orgs on the list are exposed to higher risk of threat actors gaining initial entry to their org, supply chain, and customers.

Professional Governance, Risk & Compliance Portfolio

Simple CLI script to assist GRC analysts with risk ranking vendors.

Discover Nth-party vendor relationships (3rd, 4th, and deeper) for a domain from public signals — DNS, certificate transparency, trust-center subprocessors, web traffic, and more. A fast, offline-capable GRC Engineering CLI in Rust.

Third-party vendor risk assessment template with questionnaire, scoring rubric, risk categories, and remediation tracking. For supply chain security and compliance programs.

Enterprise third-party risk assessment framework covering vendor security evaluation, inherent risk scoring, compliance mapping, and remediation governance.

A complete third-party vendor security risk-assessment framework — questionnaire, live scoring engine, and worked vendor assessments with approve/conditions/reject recommendations. Two-axis inherent×control residual-risk model mapped to NIST 800-161, ISO 27001 & SOC 2.

Practical governance, risk, compliance, audit, resilience, cloud-risk, privacy, third-party-risk, and regulatory-readiness manuals.

Prefill the DORA Register of Information from your infrastructure-as-code, and get a straight answer about what is still missing.

Auto-generate, distribute, and score vendor risk assessment questionnaires based on vendor service type, data access level, geography, and regulatory exposure.

8 hands-on CompTIA SecurityX labs covering enterprise security architecture, zero trust, IAM, PAM, federation, cryptography, PKI, data protection, vulnerability management, threat modeling, detection engineering, incident response, resilience, GRC, risk, compliance, third-party security, and exam review.

Transforming vendor risk management post-breach: from failed checklists to evidence-based assurance.

Claude plugins for second-line financial-services work: GRC, regulatory change, AI/model risk, third-party risk, compliance testing, risk reporting, financial crime, consumer compliance — across banking, insurance, capital markets, and payments/fintech.

Bitsight Security Ratings for Splunk App provides prebuilt dashboards, modular input collection, lookup-backed enrichment, workflow actions, setup pages, alert actions, additional functionality that is not found in the BitSight Security Ratings UI and documentation views for BitSight data in Splunk.

GRC project analysing risks of AI-driven compliance automation and false assurance in third-party risk management (SOC 2 / ISO 27001)

Spreadsheet-driven vendor risk assessment model — tiers third-party suppliers by risk exposure using a weighted scoring methodology

A comprehensive third-party risk management framework for a global media streaming platform. Focuses on vendor classification, content security, intellectual property protection, and compliance monitoring, delivering risk maps, due diligence checklists, and strategic recommendations

Top Third Party Risk Exchange 🌟 Star if you like it! 🌟

Conducted a proactive DPIA for a Nigerian fintech, identifying high-risk gaps in cross-border transfers and consent management.

Claude plugin for Bitsight Security Ratings — a zero-dependency MCP server wrapping the Bitsight REST API as 15 read-only tools, plus 16 skills that turn ratings into board packs, vendor decisions, remediation roadmaps, audit evidence and Indian regulatory incident notifications.