A completed questionnaire tests the design at one moment, not whether it still works today. If it goes wrong at your supplier, you are the one standing before the board.
Key challenges
You send the list, get it back filled in, and file the certificate. That evidences due diligence, not whether it works today.
30%
of breaches come via a third party
The share of breaches that runs through a third party has doubled in two years. Your attack surface does not stop at your own edge; it carries on at parties you do not control yourself and that you test only once a year.
Verizon DBIR 2025, from 15 to 30 per cent in two years.
43%
use ratings to track third parties
Most organisations collect a certificate or questionnaire and stop there. Only a minority track third parties continuously; the rest miss what changes after the snapshot: a lapsed control, a new flaw, a change at the supplier.
ENISA NIS Investments 2024: 43 per cent use security-rating services; supply chain is the second-biggest concern (47 per cent).
32%
cannot fill their security roles
Security roles stay structurally unfilled and staffing has fallen for years. A supplier programme then runs on a handful of people with manual follow-up, while the number of parties to track keeps growing.
ENISA NIS Investments 2024-2025: 32 per cent cannot fill security roles; the security-FTE ratio fell to 10.6 per cent.
Regulators and leadership do not ask whether questionnaires have been sent. They ask whether it is demonstrable which critical suppliers exist, that they are being followed, and that the response is owned. That is the difference between a control that exists on paper and a control that works in practice.
The difference
Not whether the supplier completed the questionnaire, but which suppliers actually matter, and whether you would see it if one of them drifted.
The same questionnaire to hundreds of suppliers. Volume without priority, where the supplier that truly matters gets the same attention as the coffee supplier.
We decide which suppliers genuinely carry risk and scope the rest out sharply. Attention goes to where the exposure sits, not to the whole portfolio at once.
The supplier fills in the list themselves. You collect what they claim on a moment, and you wait weeks for accurate documentation before you can assess anything.
We harvest control evidence from what already exists: SOC 2 reports, ISO certificates, an SBOM. Not waiting for a completed list, but reading what the supplier has already demonstrated.
The annual cycle runs behind reality. A control lapses, an exploit appears within days, a supplier puts AI on a platform, and the list only comes back in eleven months.
We set up a cadence that sees drift: a lapsed certificate, a technical anomaly, a change, an incident at the supplier. Operating effectiveness, not a snapshot.
Success is measured in completed lists and collected certificates. Whether you acted with care when it goes wrong stays unanswered until it is too late.
We record the judgement: which supplier we carry, where we intervene, and on what grounds. A trail that holds up for the board and the regulator.
How it works
On the left, what comes in about your suppliers; in the middle, the order that chooses and follows; on the right, what you keep. Your existing contracts and certificates stay in place.
The distinction
The sharpest weakness in the usual programme: it measures coverage, how many lists are completed, and not whether it works at the suppliers that genuinely matter.
So Radian starts at the diagnosis: which suppliers truly carry risk, and where the exposure sits. Not a platform rolled out, but a test of where your supply-chain exposure sits, critical-first and operating effectiveness over attestation.
Your existing tools, ratings and certificates stay in place. We decide which suppliers actually matter, harvest the evidence from what already exists and follow whether it works. A means is a means, not an end.
You get our expertise without building a team and a method yourself. We run the cadence; the decisions on carrying, remediating or switching and the ownership stay with you.
The market delivers a report and leaves the hard supplier conversation with you. The same senior who decides who truly matters has that conversation and sets up the monitoring cadence.
Get started
Not a hundred-page vendor programme. One conversation in which we decide which suppliers in your portfolio actually matter, and whether you would see it right now when one of them changes.
Plan a conversation
