Prioritizing suppliers requires a comparable criterion.
Supplier questionnaires depend on who answers them, arrive months after the request, and describe stated intent. Public signals require no cooperation, are collected across the entire portfolio in the same window, and describe observable exposure. The two instruments are complementary, but only one of them supports a comparable ranking across suppliers.
Deciding where to spend limited deep-dive capacity (audit, detailed questionnaire, contractual clause) inside a supplier portfolio too large to treat in full.
What is at stake
Collection observes only what an external actor would also observe: no credentials, no installed agent, and no change to the supplier's environment.
- Source
- GWK public collection infrastructure
- Date
- October 7, 2026
- Population
- 80,182 companies in the publication used by the products
- Coverage
- Public layer only: DNS, TLS, PQC readiness, headers, infrastructure, and observable subdomains.
Limitation. A supplier's public surface neither proves nor disproves its internal posture. A high result indicates where to look, not what to conclude.
Today, the same collection and the same IEQ apply equally across the whole portfolio, in the same window, for a point-in-time assessment.
Public signals for any domain, with no dependency on access or cooperation.
The same ruler applied to every supplier in the portfolio.
Ranking, grouping by band, and identification of outliers in the portfolio.
Recurring monitoring of the portfolio over time. Product direction, not contractable scope.
A ranked queue with a justification per position, which is what lets you defend why supplier number forty was not audited this cycle.
What you receive
- A public score for each supplier in the portfolio, in the same window.
- Ranking by exposure, with the contributors behind each position.
- Grouping by band, to handle the portfolio in blocks.
- Comparison of each supplier against its own sector cohort.
- A prioritized list of who deserves a deeper look, and why.
- Coverage per supplier: where the readout was blind.
See the method's limits, the dependencies and where measurement ends
What a third party's surface tells you
An external readout prioritizes investigation and does not produce a conclusion about the supplier. That holds when the result is high, too.
Observed
Public collection saw
- Cryptographic configuration exposed by the supplier.
- Surface of reachable domains and services.
- Announced post-quantum readiness signals.
Calculated
The IEQ engine derived
- Structural exposure per supplier, on the same scale.
- Each supplier's position within the portfolio and the sector.
Inferred
The model estimated
- The supplier's sector, when not declared.
- Shelf-life prior applicable to the kind of data it processes.
Out of scope
Other evidence decides
- The supplier's internal security posture.
- Whether a migration program is under way inside or not.
- That the supplier poses contractual risk or should be replaced.
- Any conclusion about data it processes that is not exposed.
What it depends on
- A supplier list with the corresponding domains.
- Authorization or a legal basis to assess third-party domains: collection is external, but the decision to assess is yours.
- An internal criticality criterion, to cross exposure with contract importance.
Boundary
Measurement ends at the technical change in the environment. Measuring exposure does not reduce it: reduction requires changing configuration, replacing certificates, switching negotiation policy, or migrating libraries. That work is carried out by the organization's own teams and suppliers. After the change, GWK re-collects public signals and recalculates IEQ on the same ruler, when contracted to do so.
Why measuring does not reduce exposureStart from a real portfolio
Bring the supplier list and the criticality criterion you already use. The exposure readout enters as a second dimension of the queue, not as a replacement for the first.