Your vendors change daily.
Your due diligence should too.

One number hides the thing you most need to know.

A single rating cannot tell you how much you actually know about a supplier. Risk says how they look on the evidence held. Confidence is the weakest-link reliability of that evidence. Coverage is how much of the required diligence actually ran — so a gap shows as a gap, never as a clean pass.

• Risk, Confidence and Coverage scored separately, so “low risk” and “low risk, but we could not check much” never look the same.
• NATO Admiralty grading on every row — source reliability A–F against information credibility 1–6.
• The company behind the company. A nightly-rebuilt corporate ownership graph resolves the real parent and ultimate beneficial owners behind every third party — not just the name on the invoice — with Companies House identity resolution and Cyber Essentials verified against the official certification registry.
• Hard stops, not footnotes. Sanctions and PEP screening, credit checks, insolvency monitoring and Modern Slavery / ESG registry checks per company — a confirmed insolvency notice or sanctions hit blocks the vendor and raises an urgent alert within hours.
• Passive by design. Fifteen probes observe a vendor's public attack surface — DNS, TLS, email posture, security headers, exposed technologies, subdomains, open ports — each in its own evidence panel with a full AI-written analysis per scan. Nothing intrusive is ever run.
• A response portal without the password reset. Send an assessment by magic link; the third party answers without an account and the responses flow straight into the dossier.
• An append-only, hash-chained register, so you can show the record exactly as it stood on any past date.
• Your judgement stays private. The evidence corpus is shared infrastructure; your approvals, assessments and business context are not.