Sample vendor risk report
This is what a completed VendorBreach assessment looks like — the rating, the evidence behind it, and the remediation plan your vendor receives. Every figure on this page is illustrative and belongs to a fictional vendor.
Northwind Payments
northwind-payments.example · Payment processing · Critical tier · Assessed 24 August 2026
Valid cert, TLS 1.0 still enabled on one host
DMARC policy set to p=none — spoofing not blocked
DNSSEC enabled, no dangling records
RDP reachable on one edge host
2 disclosed breaches, 118 leaked credentials
SOC 2 Type II current, ISO 27001 expired
Score trend
↑ 4 since Aug 12
Categories and their weight
- Network SecurityExposed services, open ports and how internet-facing systems are configured.High
- Patching CadenceWhether known vulnerabilities on public systems are fixed promptly.High
- Application SecurityWebsite security headers, cookies and common web weaknesses.High
- DNS HealthEmail authentication (SPF, DKIM, DMARC) and DNS configuration.Medium
- Endpoint SecuritySigns of outdated or unsupported software on public systems.Medium
- IP ReputationWhether the company's addresses appear on abuse or compromise lists.Medium
- Information LeakExposed credentials and data tied to the company's domain.Medium
- CertificationsVerified security certifications such as SOC 2 and ISO 27001.Lower
- Hacker ChatterMentions of the company in places attackers discuss targets.Lower
- Social EngineeringHow easily staff could be impersonated or phished.Lower
How findings affect the score
- Critical findings cap the grade: a vendor with an open critical issue can't earn a top grade.
- Each finding lowers its category score according to its severity.
- Fixed findings stop counting at the next scan.
- Confirmed compromise, such as appearing on a ransomware leak site, lowers the overall score directly.
Letter grades
Prioritised findings
Each finding carries the evidence it was derived from and a concrete corrective action.
118 leaked credentials tied to the vendor domain
Credentials from two disclosed breaches (2024 and 2026) remain valid patterns against the vendor's SSO domain. 14 belong to accounts with administrative naming conventions.
Recommended action: Request forced password rotation and confirm MFA coverage on all administrative accounts.
DMARC policy is monitor-only (p=none)
SPF and DKIM are published and aligned, but the DMARC policy takes no action on failures, so spoofed mail from this domain is still delivered.
Recommended action: Ask the vendor to move to p=quarantine, then p=reject, with aggregate reporting enabled.
Remote Desktop exposed to the internet
TCP/3389 answers on an edge host with no visible gateway or IP restriction.
Recommended action: Require the service be placed behind a VPN or zero-trust gateway within 30 days.
Deprecated TLS version accepted
One public host still negotiates TLS 1.0, below the minimum required by PCI DSS 4.0.
Recommended action: Disable TLS 1.0/1.1 and confirm with a re-scan.
ISO 27001 certificate expired 3 months ago
The vendor's published ISO 27001 certificate lapsed and no renewal has been supplied.
Recommended action: Collect the renewed certificate or a written recertification timeline.
What ships with the report
PDF and CSV export
Board-ready PDF plus a machine-readable CSV of every finding.
Vendor remediation plan
The same findings, sent to the vendor with owners and due dates.
Evidence links
Every claim links to the raw source: certificate, DNS record, or breach disclosure.
Continuous re-scoring
The report is a snapshot; the score updates as the evidence changes.
Illustrative example only. Northwind Payments is fictional and the figures shown are not drawn from any real organisation or customer.
Run this on your own vendors
Check a single domain free, or start a trial and generate reports across your whole portfolio.