On 14 September 2026, Bitsight announced the general availability of Bitsight Beacon, a continuous monitoring solution that combines threat intelligence and exposure monitoring for critical vendors, together with Model Context Protocol and agentic capabilities that let AI workflows query its risk intelligence. The company framed the launch around a blunt claim: third-party breaches now account for almost half of enterprise breaches, a 60% increase on the prior year. That is a vendor statistic and should be read as such, but the direction it points is hard to argue with.
The product itself matters less than what the announcement says about where the market has landed. Security teams and third-party risk teams, historically separate functions with separate tools, are being pushed onto a single view of supply chain exposure, and that view is being opened to AI agents. For any enterprise still running vendor cyber risk through an annual questionnaire cycle, it is a useful moment to ask what that cycle can actually see.
Our answer at Crest.Digital is that supply chain cyber risk is turning into an intelligence problem: collecting many signals, judging which are material to the business, and turning the important ones into owned, evidenced action. The questionnaire is still part of the picture. It is no longer the centre of it.
Crest.Digital’s AI-powered TPRM platform combines vendor assessments with continuous monitoring signals and keeps an auditable evidence trail from alert to closure.
Explore the TPRM PlatformWhat the Bitsight Announcement Actually Signals
According to Help Net Security’s coverage, Beacon monitors critical vendors for vulnerabilities, malicious activity, intrusion attempts, stolen credentials and compromise, and connects that exposure data to active threat intelligence and business context. It maps assets, technologies, vulnerabilities, vendors and dependencies so a team can see how a given exposure would affect the organization. Bitsight also reported more than 400 customers signing up for early access to its agentic capabilities within the first month.
Three shifts sit underneath those details, and none of them depends on any one vendor’s product.
Three Shifts Worth Planning Around
- From periodic to continuous: Vendor risk is increasingly judged from external signals that change daily, not from attestations that change once a year.
- From separate to shared: Security operations and third-party risk teams are converging on one exposure view, because the same vendor weakness is both a threat and a governance issue.
- From human-only to agent-accessible: Risk intelligence is being exposed to AI workflows, which makes the quality, provenance and auditability of that intelligence a governance question in its own right.
Regulators are moving the same way. The US Cybersecurity and Infrastructure Security Agency has long treated ICT supply chain risk as a national resilience issue, and the European Banking Authority’s recently finalized third-party risk guidelines extend full-lifecycle oversight, including ongoing monitoring, well beyond ICT services. We covered that regulatory direction in our piece on how the vendor questionnaire is being challenged by continuous risk intelligence. This article goes one level further and asks how the intelligence should be organized.
Why the Questionnaire Cannot Carry the Load Alone
A security questionnaire has three structural weaknesses, and none of them is the fault of the people completing it.
It is a snapshot. The answers describe a vendor on the day they were written. A critical vulnerability disclosed the following week, a new subprocessor added in the summer, or a leaked credential set discovered in the autumn will not appear until the next cycle, which is often twelve months away. Our analysis of vendors who were approved and then changed shows how quickly an approved status can become stale.
It is self-reported. Vendors answer honestly in most cases, but they answer from their own understanding of their environment, which may not include shadow IT, inherited acquisitions or fourth-party dependencies. External evidence tests those answers rather than simply collecting them.
It does not scale. A programme with thousands of third parties cannot review thousands of lengthy responses in depth. Reviewers skim, tier by instinct and accept most answers, and vendors, facing multiple requests with overlapping questions, give less careful answers over time. That is why the questionnaire is the least interesting part of TPRM once the data and the decisions are properly separated.
None of this means abandoning questionnaires. It means changing their job. They establish a baseline, collect attestations and evidence, and satisfy regulators that due diligence took place. Continuous signals then decide when a vendor deserves a fresh look and what to ask, so reviewers spend their time on the vendors that changed rather than the vendors that merely came due.
The Supply Chain Risk Intelligence Stack
Supply chain cyber risk intelligence is the practice of combining independent signals about a third party with internal context about its criticality, so that findings arrive already ranked by consequence. The chain below shows how the pieces fit together, from the questionnaire baseline through to an alert with an owner and evidence.
Questionnaire and Attestation Baseline
Capture what the vendor says about its controls, certifications and subprocessors. This is the baseline, and it should be tagged with a date and an expiry so nobody mistakes it for a live view.
Vulnerability and Exposure Signals
Add external evidence of exposed services, unpatched software, leaked credentials and malicious activity linked to the vendor or its fourth parties. Our analysis of the vendor remediation gap shows why discovery speed now outpaces fixing speed.
Adverse Media and Financial Health
Layer in breach reporting, litigation, regulatory action and early financial distress. A vendor under severe cost pressure often cuts security spending before anything else, so financial signals are cyber signals too.
Geopolitical and Concentration Events
Overlay sanctions, conflict, export controls and regional outages against where the vendor and its infrastructure actually sit. See our note on geopolitical third-party risk for the horizon-scanning view.
Materiality Assessment
Combine each signal with vendor criticality, data sensitivity and the business process affected. This step converts noise into a ranked list and is where most programmes either gain or lose credibility with the business.
Alert, Action and Evidence
Route material findings to a named owner with a due date, a remediation requirement and a closure test. Keep an audit trail from signal to decision to evidence so the whole chain can be reviewed later.
Notice that the stack ends in action, not in a dashboard. A score with no owner is a number; an alert with an owner, a deadline and a closure test is a control. This is also where small suppliers deserve attention, since smaller vendors often hold meaningful access with limited security maturity, a pattern explored in our guide to tiering small suppliers by cyber risk.
Where Agentic AI Fits, and Where Humans Must Stay in Charge
The reason Bitsight’s agentic access matters is that the volume problem is real. A global enterprise may track thousands of vendors across dozens of signal types. Reading all of it, reconciling it with the vendor register and drafting a clear explanation of why an alert matters is exactly the kind of high-volume, rule-bound work that AI agents handle well.
Crest.Digital’s TPRM Agents cover vendor outreach, questionnaire intelligence, continuous monitoring and screening, with human-in-the-loop review. Agentic GRC extends the same approach to control testing and remediation tracking across the wider risk function.
In a well-designed workflow, agents ingest and de-duplicate signals, match them to the right legal entity and its fourth parties, draft the materiality rationale, request remediation evidence from the vendor and track it to closure. People retain the decisions that carry accountability: accepting a residual risk, escalating to a committee, changing a vendor’s tier or exiting a relationship. The agentic AI approach only works if that boundary is explicit.
There is a second governance point that the market is only beginning to address. If an agent queries an intelligence feed and acts on what it finds, the feed is now an input to a decision process. Provenance, freshness and error rates matter, and the agent’s actions need the kind of audit trail that internal audit would expect from any other control. Without it, faster triage simply becomes faster, less explainable decision-making.
A Practical Playbook for Moving to Intelligence-Led Vendor Cyber Risk
You do not need to replace your programme to make this shift. The sequence below layers intelligence over what you already run, starting where the consequence is highest.
Six Moves for CISOs and TPRM Leaders
- Tier by consequence first: Identify the vendors that touch critical processes or sensitive data. Start continuous monitoring there, not across the whole population.
- Define materiality before you buy signals: Agree how severity, vendor criticality, data access and compensating controls combine, so alerts are ranked consistently and defensibly.
- Resolve entities properly: Signals are only useful if they attach to the right company, subsidiary and fourth party. Entity matching is unglamorous and decisive.
- Shorten the questionnaire: Use signals to trigger targeted follow-ups, and retire questions that external evidence already answers.
- Assign owners and clocks: Every material alert needs a named owner, a remediation deadline and an evidence requirement, with escalation if either lapses.
- Report to the board in business terms: Show which critical processes are exposed, what is being done and what residual risk has been accepted, rather than a count of open findings.
Two cautions keep the approach honest. First, more signals do not automatically mean better decisions; without materiality logic, continuous monitoring just produces continuous noise, and the team learns to ignore it. Second, external signals show exposure, not intent or control effectiveness. They should prompt verification, and they should never be the sole basis for a punitive decision about a vendor without a human reviewing the evidence.
For regulated firms, one further benefit is audit readiness. When a supervisor or internal auditor asks how a particular vendor was monitored in the last twelve months, the answer should be a retrievable record of signals, decisions and closures, not a folder of annual questionnaires. That evidence trail is also what lets you demonstrate the proportionality of your approach. You can see how this connects to broader risk governance on our end-to-end vendor risk governance page, and the CISO’s view of vendor cyber risk covers the security-team perspective in more depth.
Crest Perspective
Cyber risk in vendor relationships is not uniformly distributed. The vendors that represent the highest exposure are rarely those with the longest questionnaire responses — they are the ones with privileged access to production systems, those processing unstructured data at scale, and those operating in jurisdictions with limited breach notification requirements. Risk tiering that reflects actual access and data flows is more predictive than vendor size or certification status alone.
Frequently Asked Questions
Supply chain cyber risk intelligence is the continuous collection and interpretation of external and internal signals about your third parties, such as exposed vulnerabilities, stolen credentials, malicious activity, adverse media, financial distress and geopolitical events, combined with business context about how critical each vendor is. Unlike a questionnaire, which records what a vendor said at one point in time, intelligence records what is observably true now and how it is changing. The output is not a score alone but a prioritized, evidence-backed decision about which vendor needs attention, why it matters to a specific business process and what action should follow.
Yes, but a narrower one. Questionnaires remain useful for onboarding, for collecting policies and control attestations, and for satisfying regulators who expect documented due diligence. What they cannot do is detect change. A vendor can answer accurately in March and be exposed to a newly exploited vulnerability in September. The practical model is to use the questionnaire to establish a baseline and to verify claims, then rely on continuous signals to trigger reassessment, shorter follow-ups and remediation only when something material changes. This reduces questionnaire fatigue for vendors and gives your team earlier warning.
On 14 September 2026 Bitsight announced the general availability of Bitsight Beacon, a continuous monitoring solution that combines threat intelligence and exposure monitoring for critical vendors, alongside Model Context Protocol and agentic capabilities that let AI workflows query its risk intelligence. Bitsight said over 400 customers joined early access to the agentic capabilities within a month. The significance for TPRM teams is directional rather than product-specific: major market participants are converging on the view that supply chain exposure must be monitored continuously, shared between security and third-party risk functions, and made accessible to AI agents. Any enterprise should assess its own programme against that direction regardless of which tools it uses.
Materiality comes from combining a signal with context. A vulnerability on a vendor that processes no sensitive data and supports a non-critical process is low priority, while the same finding on a vendor that hosts customer data or underpins a critical service is urgent. A practical approach scores each signal on severity and credibility, multiplies it by the vendor's criticality and data access, and checks whether a compensating control or a known remediation exists. Signals that cross a defined threshold create an alert with an owner, a due date and an evidence requirement. Thresholds should be reviewed regularly and every override should be logged for audit.
AI agents are well suited to the high-volume, repetitive work that overwhelms vendor risk teams: reading signals across many sources, matching them to the vendor register, drafting a concise summary of why an alert matters, chasing vendors for remediation evidence and tracking follow-up to closure. Humans stay in control of the judgements that carry accountability, such as accepting a risk, escalating to a board committee or terminating a relationship. Crest.Digital's TPRM Agents and Agentic GRC follow this human-in-the-loop model, with every agent action logged so that conclusions can be reproduced and defended in an audit.