BEACON™ · Vendor AI risk framework
Six categories of AI risk every vendor should have to answer for.
BEACON™ is Third Party Threat Hunting™’s framework for assessing AI-specific risk in third parties. Six categories of AI-specific risk, run live with the vendor in under an hour, alongside the assessment you already run.
Free on-demand class
See BEACON in 55 seconds
A short preview of the free 19-minute class for executives and risk leaders: the six categories, a real case and three moves for the next 30 days.
Why a separate lens
Your questionnaire asks whether a vendor protects your data. It rarely asks what the vendor’s model does with it.
Standard due diligence was built for software that behaves the same way every time. AI doesn’t. It learns from what it’s given, its output can change without a release note, and when it gets something wrong the contract often doesn’t say who is responsible.
BEACON gives each of those gaps a name and an anchor question, so your team can ask about them, score them and follow up in a consistent way.
The framework
Six categories, one anchor question each
Each category is anchored to one question a vendor should be able to answer clearly and specifically. A vague, evasive or “we haven’t thought about that” answer is itself a finding.
B · Bias
“How do you test outputs for discriminatory or skewed results affecting our customers?”
What we look for: Specific test sets, protected-class analysis or fairness metrics the vendor monitors. A vendor without an answer talks about “quality” in general terms and never names a protected characteristic.
E · Explainability
“Can you document or justify how the model reached a given decision, for audit purposes?”
What we look for: A decision trail the vendor can produce after the fact. It matters most where the output affects a person: credit, employment, healthcare, eligibility. Without one, you are the one explaining it to a regulator.
A · Access & Data
“Does our data train your model? Is it segregated from other customers’ data, and what’s the retention and deletion policy?”
What we look for: Architecture rather than adjectives. This is the question most likely to expose a gap between marketing language like “enterprise-grade privacy” and how the product actually handles your data.
C · Contractual Accountability
“Who is liable when the AI produces a harmful or incorrect output, and what does the SLA actually say about AI-specific incidents?”
What we look for: Contract language written with model failure in mind. Most standard SaaS contracts never were, and it is better to find that out before an incident than after one.
O · Oversight
“Is there a human in the loop, and can we override or escalate a bad output?”
What we look for: What actually happens when something goes wrong, not whether a human is technically “available.” Full automation without an escalation path multiplies risk.
N · Non-determinism
“What’s your measured hallucination or failure rate, and how do you monitor drift over time?”
What we look for: A measured rate and a drift-monitoring practice. AI systems can change behavior after deployment without any code changing, and a vendor that measures this is fundamentally different from one that hears about it from customer complaints.
How a session runs
Under an hour, live, scored on specificity
In the room
Your risk or TPRM lead, ideally someone from the business unit sponsoring the vendor, and someone from the vendor who can speak to the model itself, not only sales. Run it live rather than as a written questionnaire: verbal answers are harder to script and easier to probe.
How it runs
Work through the six letters in order. Ask the anchor question, then one follow-up based on the answer. Record the response in the vendor’s own words, because vague language is itself the finding.
How it’s scored
BEACON is not pass/fail. Each category is scored Green, Yellow or Red on how specific and complete the answer is.
Two or more Reds trigger deeper review before sign-off, however well the vendor scored on the standard security questionnaire.
It slots in after your existing intake and before final sign-off, and applies only where the vendor’s offering includes an AI or ML component.
Where it fits
Assess at the door. Monitor after.
Point in time
BEACON™
Used at onboarding and re-assessment for any vendor whose product uses AI. It tells you whether to take on the AI risk, and on what contractual terms.
AI vendor risk assessments →Continuous
The Lighthouse
Ongoing monitoring after the contract is signed: scoring, alerts and the signal log behind every number.
Sits in front of
Not sure which vendors are using AI yet? Start with the six written questions →
We apply it to ourselves
Access & Data, in practice
On Sep 12, 2026 we withdrew an AI meeting assistant from our own sub-processor list because its terms did not exclude submitted content from model training. The change and the reason are on public record in our Trust Center.
Read the whitepaper
The full framework in three pages: the six anchor questions, how to run and score a session, and a worked example. Free to share with attribution.
Learn it live
The quarterly BEACON™ class
Half a day, online, taught by Greg: the six categories, how to run a vendor session and score it, and a worked exercise on a sample AI vendor. $249 a seat. Five or more from one organization? A team workshop on your own vendors is better value, and a seat fee counts toward one booked within 90 days.
| Course | Date | Time | Format | |
|---|---|---|---|---|
| BEACON™ Vendor AI Risk Class | Jan 21, 2027 | 12pm–4pm ET | Live online | Book · $249 → |
| BEACON™ Vendor AI Risk Class | Apr 15, 2027 | 12pm–4pm ET | Live online | Book · $249 → |
| BEACON™ Vendor AI Risk Class | Jul 15, 2027 | 12pm–4pm ET | Live online | Book · $249 → |
| BEACON™ Vendor AI Risk Class | Oct 21, 2027 | 12pm–4pm ET | Live online | Book · $249 → |
Have us run it for you
A fixed-scope BEACON™ assessment of a named vendor: scored report, contract asks and a readout in three weeks. From $3,500 per vendor; registered non-profits receive 25% off. Book a BEACON™ assessment →
FAQ
Questions about BEACON
What does BEACON stand for?
Does BEACON replace our existing vendor questionnaire?
How is BEACON different from the NIST AI Risk Management Framework?
Which vendors need a BEACON assessment?
How is BEACON different from The Lighthouse?
Can our team run BEACON without you?
BEACON™ is a framework of Third Party Threat Hunting LLC.
Related
Pairs with
Privileged access
The free VAULTS™ training: 31 minutes on privileged access review, with a worked review.
Get the free training →Which of your vendors are critical?
The free eight-step vendor checklist: sort your vendors into systemically critical, critical or ordinary.
Get the checklist →Have us run it
Managed third-party threat hunting: practitioners on your systemically critical vendors, automation on the rest.
See the managed tiers →