Third-party risk
Ownership structure
Trace the organisation and its controlling owner.
Vendor exposure assessment
Know who really controls the technology you depend on.
A source-cited assessment of the organisations behind your cybersecurity and infrastructure vendors: ownership, jurisdiction, data locations and dependencies.
Your list stays in your browser unless you choose to send it.
View the sample report →Browse all vendorsClient Exposure Report
Sample · fictional data
Kestrel Mobile Security SA
endpoint security · importance: high
Client Exposure Index
25/ 100
Driven mainly by jurisdiction & control, supply chain dependency and operational resilience. Higher means more exposure for you.
1 area at maximum exposure: Jurisdiction & control
Sanctions exposure
Ownership transparency
Jurisdiction & control
Operational resilience
Cyber hygiene
Supply chain dependency
Financial stability
Regulatory alignment
HQ: Luxembourg · Ultimate owner: Hong Kong · Data: LU · SG · HK
See the full sample report →
The problem
Security reviews assess the product. We assess the organisation behind it.
A questionnaire tells you what the vendor says about itself. Ownership, jurisdiction, data locations and dependencies change after you approve a supplier, and your file rarely follows.
We trace each layer from public records, date it and cite the source.
The product
Endpoint security software
Controls, certifications, features, price
A traditional assessment stops here
Layer 1 · The company
Kestrel Mobile Security SA
Headquartered in Luxembourg
Layer 2 · Controlling owner
Silverreach Technology Holdings Ltd
Hong Kong · elevated-risk jurisdiction
Layer 3 · Top of the ownership chain
Founders’ vehicle
British Virgin Islands
Layer 4 · Where data and engineering sit
Data: Luxembourg · Singapore · Hong Kong
R&D: China 55% · Luxembourg 25% · Poland 20%
Sample · fictional data
Who controls your technology vendors?
Our 2-page briefing for risk, procurement and the board.
How it works
Same vendor, same findings, a different number for every organisation.
01
Context
Answer two questions per vendor, select your sector and choose your priorities.
02
Review & order
Add your organisation name, review your vendors and plan, then place your order.
Kestrel Mobile Security SA
Sample report context · fictional data
If it stopped tomorrow?
Serious disruption
Does it handle your sensitive or customer data?
Yes
Client Exposure Index
25 / 100
Context and weights change the index, not the findings. This is the sample report’s default context and assessed value.
What we assess
Eight areas of vendor exposure
Each area gets an exposure level for every vendor. A sanctions listing is shown as a separate legal status flag, so nothing can dilute it.
Exposure scale · fictional chart examples
LowModerateElevatedHigh
Sanctions exposure
Vendor, owners and key people against sanctions and export-control lists.
Ownership transparency
Who really owns and controls the vendor, and recent changes of control.
Jurisdiction & control
Which legal systems govern the vendor, its data and its engineering.
Operational resilience
Concentration, continuity planning and documented outages.
Cyber hygiene
The organisation’s security record: exploited flaws, breaches, certifications.
Supply chain dependency
Who the vendor depends on: cloud, subprocessors, components.
Financial stability
Signals the vendor may not be able to keep supporting you.
Regulatory alignment
Official warnings, regulatory actions and data-transfer arrangements.
Regulation
Facts for your third-party risk decisions.
Ownership, data location, sub-outsourcing and geographic concentration matter in third-party risk reviews. The report gives you the facts; it does not assess compliance.
Third-party risk
Data and engineering
Understand the locations behind the service you use.
Third-party risk
Dependencies
Document the providers and infrastructure behind the vendor.
Evidence
Every finding you can trace.
- Dated to the underlying event, not to the day it was found.
- Typed by source: primary record, technical, press, vendor statement.
- Source references retained with each finding.
- ‘Not found in the sources checked’, never ‘does not exist’.
Finding · Jurisdiction & control
Sample · fictional data
10 September 2026 · Vendor statement
Kestrel Mobile Security reports in its recruiting and engineering pages that about 55 percent of its engineers work in its development centre in Shenzhen, with the remaining engineering split between Luxembourg and Poland. [3, 4]
[4] Tech Ledger - Kestrel expands Shenzhen development centre · press, tier 2 · checked 29 October 2026
Check coverage
Is your vendor in the catalogue?
Your list stays in your browser unless you choose to send it.
Browse all vendorsSee the organisation behind one of your vendors.
Start with your vendor list — see the price before you pay, then receive the report for the vendors you order.