How to Solve Vendor Outreach During Security Crisis Events

Written by: Jason McLarney

You wake up one morning to a news alert: A new Zero-Day vulnerability is emerging, and it’s already being exploited in the wild. You race into the office and sit down at your computer to…write and send generic emails to each of your 1,000 vendors. “Have you been breached? If so, to what extent? Is our data exposed? What’s your plan to respond to it?” 

Radio silence. At best, you get a trickle of responses, but most of your emails go unanswered because your vendors are busy figuring out what happened and how to mitigate fallout. 

Organizations must immediately kick into high gear to mitigate damages or business disruptions when a Zero-Day event or other time-sensitive third-party threat occurs. A key step in this process is contacting vendors to communicate risk intelligence and ensure they take remedial action.

However, this process is easier said than done — especially when vendors are getting inundated by hundreds of frantic and panicked customers.

Most organizations make the mistake of sending vague “hunches” that a vendor is impacted by an incident, followed by a generic security questionnaire. In other words, they’re sharing no new information. In fact, it can come off as hostile policing. This is, obviously, not very motivating for a vendor and typically results in low, delayed, or nonexistent responses. This means risk is not being reduced, either for you or the vendor. 

We built the Black Kite Bridge™ with exactly these challenges in mind. It offers the first end-to-end vulnerability response tool for: 

• risk identification and scoping
• intelligence sharing
• vendor communications
• real-time reporting

Third-party risk management (TPRM) teams can now share trusted, vetted Black Kite intelligence directly with their vendors. This information is far more specific and actionable, leading to proven vendor engagement. 

4 Ways Black Kite Revolutionizes Vendor Collaboration

Since its inception, Black Kite has been focused on providing the most accurate, transparent, and timely risk intelligence on the market, empowering customers to take control of their third-party risk.

As a result, customers organically started sharing that intelligence and asking for more ways to give their vendorstm access to it to improve their own cyber risk postures. We heard their feedback, so we built the Black Kite Bridge™ to enable TPRM professionals to:

1. Confidently Narrow the Scope of the Outreach

One of the most significant challenges in responding to an emerging Zero-Day event is knowing which vendors are impacted and what type of data to share with them. 

Instead of casting the net wide and contacting vendors that may or may not pose a risk to your company, customers can leverage Black Kite to:

1. Identify those vendors that have a material impact on your business.
2. Narrow the scope of outreach into a manageable list based on known exposures or susceptibility to attacks.

We arm you with insights, such as:

• Tags highlighting known impacted vendors in your cyber ecosystem through FocusTags™, to give you confidence in your actual exposures.
• Real-time risk quantification for all vendors, enabling you to make decisions based on potential financial impact if a threat were to impact a particular vendor.
• Actionable, asset-level evidence and recommended remediation steps rooted in a common language, like MITRE and NIST. Rather than asking generic questions, we provide you with targeted evidence to share, so a vendor can take immediate and appropriate action.

When you can share this information directly with a vendor through the Black Kite Bridge™, it gives you both a clear way forward. Instead of saying, “We think you were affected by X event — tell us if you were and what you’re doing to remediate it,” you can approach the vendor with clear evidence of what happened and hard recommendations to fix it. 

2. Communicate and Remediate in a Central Location

Vendor communications about risk and the risk intelligence itself should live in the same location. 

Why? Organizations already struggle with the sheer volume of vendors they rely on. If they need to communicate with all of them through one-off channels like email and without embedded context, this can easily become too complex and error-prone to scale. 

Today, the relevant intelligence often lives in a separate tool from vendor communications (e.g., a GRC or VRM tool). Or worse yet, it lives in long email threads and offline spreadsheets. When TPRM is handled manually like this, progress becomes impossible to track, details slip through the cracks, and, ultimately, risk is not reduced.

A better way:

• Black Kite Bridge™ centralizes intelligence sharing and vendor communications in one location. 
• Now vendors can access and view the same findings our customers see through a self-serve portal. 
• As the vendor remediates issues, their risk ratings change in real time (versus the weeks it typically takes for traditional SRS solutions to update). 
• This gives the vendor confidence they are doing the right things. 
• The process becomes far smoother, and the vendor relationship becomes far more frictionless.

3. Report in Real Time

Since communications and intelligence live in one tool, reporting becomes a breeze. Your CISO wants a status update on that Zero-Day event? No problem.

With out-of-the-box reporting, you can immediately measure an incident’s initial exposure, vendor response rates, remediation progress, mean time to remediate (MTTR), and more across all vendors. Say goodbye to time-consuming, manual tracking in spreadsheets.

4. Achieve Higher Vendor Engagement & Partnership

The Black Kite Bridge™ lets customers share unprecedented, ungated access to the intelligence they trust and rely on with their third-party vendors. Our customers have seen huge improvements in response rates and better relationships as a result of the benefits their vendors receive:

1. Timely access to incident details, prioritized list of findings, and remediation steps.
2. Real-time updates to ratings for closing out risks.
3. Visibility into responses, which means less private messages, questionnaires, or emails to track, and more time back in your day (and your vendors’).

Bridge the Communication Gap with Black Kite

For large organizations with hundreds or thousands of suppliers, scaling vendor engagement processes and TPRM can feel impossible. With the Black Kite Bridge™, responding to emerging cyber incidents becomes a breeze. Learn more about the challenges and opportunities of vendor outreach in our latest ebook, Chaos to Collaboration: Transforming Third-Party Risk Response for Zero-Day Events. And learn more about Black Kite with a personalized demo.