Cyber posture
Externally observable posture expressed as an A to F grade and score.
Fort Bridge
Control third-party cyber risk through the full vendor lifecycle.
Understand which third parties introduce risk and whether that risk is being controlled through criticality, validated evidence, continuous monitoring, remediation and auditable decisions.
Four distinct measures
External posture and relationship risk answer different questions.
A good external score does not automatically make a business relationship low risk. Fort Bridge keeps each measure explicit and evidence-based.
Inherent relationship risk
Risk before controls, based on criticality, data, access, service and fourth parties.
Validated control effectiveness
The share of applicable controls supported by current, reviewed evidence.
Residual relationship risk
The customer-specific risk remaining after validated controls, posture and unresolved exposure are considered.
Vendor lifecycle
Keep every decision connected from intake to offboarding.
Risk acceptance remains visible, owned, approved, time-bound, reviewable and auditable; it does not remove the underlying exposure.
01Intake
02Review
03Assess
04Evidence
05Validate
06Remediate
07Renew / offboard
Lifecycle capabilities
Assurance, monitoring and remediation in one vendor record.
Vendor Portfolio & Vendor 360
Filter large vendor estates by risk, trend, owner, lifecycle and monitoring state, then open posture, assessments, evidence, findings, dependencies, contracts, incidents and history.
Risk-based onboarding
Criticality, data, privileged and API access, cloud use, regulation, fourth parties and service context determine inherent risk, Tier 1 to 4, reviewers, assessment scope and gates.
Assessments & evidence
Dynamic questions apply where relevant. Assertions move through evidence request, submission, validation, expiry and revalidation; not-applicable answers require approval.
Risk & remediation
Findings have severity, due dates and customer and vendor owners. Responses are validated before closure, with disputes, extensions and improvement plans in the same workflow.
Continuous monitoring
Fort Surface, Fort Shadow and Fort Intel contribute attack-surface, credential, session, threat-relevance and posture-change context.
Vendor collaboration
Invited vendor users see assigned information, answer assessments, upload evidence, respond to remediation and dispute findings through permission-scoped access.
Supply chain & incidents
Map fourth-party dependencies and concentration risk. Validate potential exposure and link security, privacy or availability incidents to Ace Automate response.
Renewal & offboarding
Review renewal, revoke access and accounts, return or delete data with evidence, capture a final risk snapshot and decide whether monitoring continues.
Continuous monitoring
Observed exposure sits alongside assessment and assurance.
Large third-party estates can be scanned in processing batches while findings remain consolidated against the responsible vendor and portfolio. Current processing supports up to 25 domains per batch.
Third-party dark web
Bring credential, session and dark-web exposure into the vendor's risk context.
Domain scanning
Assess large estates across batches while preserving vendor and portfolio relationships.
Potential exposure
Validate provider events and business impact rather than assuming compromise.
Connected response
Move confirmed incidents into Ace Automate, then update the Fort Bridge risk context after response.
Permission-scoped collaboration
Collaborate without exposing internal security context.
Vendor users may see their score and selected factors, answer assessments, upload evidence and respond to assigned remediation. They cannot see other vendors, internal comments, score weights, raw intelligence, Ace Automate notes or unrestricted customer information.
Third-party risk briefing
Bring us one real vendor relationship.
We’ll map onboarding, inherent risk, assessment, evidence, monitoring, remediation, renewal and offboarding through Fort Bridge.