Your vendors' software is part of your attack surface, and most of it arrives with no inventory. Third Party Risk Manager is Safeguard's product for asking for one and keeping it current.
What it is
The page describes a way to request SBOMs, track vulnerabilities, demand fixes and hold vendors accountable. Vendors use a self serve portal to upload an SBOM, a security attestation and a SOC 2 letter, and the platform scores them against your policy. It checks CycloneDX and SPDX signatures with Sigstore and cosign and flags unsigned or malformed files.
Other features: a concentration risk heatmap of components shared across suppliers, stored contract commitments that are re-tested, per vendor evidence packets for DPDP, DORA, EO 14028 and NIS2, natural language search across vendor SBOMs, fix requests with SLA tracking, and alerts to Jira, ServiceNow, Slack and Teams.
Monitoring
The page says to rescan every vendor SBOM on a schedule you define, against feeds including NVD, OSV, EPSS, KEV and GHSA. Drift alerts fire when posture worsens or a new KEV match appears. The continuous scanning docs add that vendors are rescanned on SBOM upload and at SLA expiry, which is configurable.
How to use it
- Send your top vendors the intake link first.
- Set the rescan schedule to match the contract SLA.
- Review the concentration heatmap for components many vendors share.
- Keep the evidence packet with the vendor file.
What the page does not say
It does not describe a questionnaire feature. Questionnaire automation appears only as a linked use case.
Quick check
What file types can the intake portal verify signatures on?
CycloneDX and SPDX SBOMs, using Sigstore and cosign.
