THIRD PARTY
THREAT HUNTING™

Platform demo

Security Agent Mesh

The four-agent architecture behind TPTH™’s own vendor risk monitoring — replacing static questionnaires with continuous, verifiable checks. An interactive walkthrough with illustrative examples; every agent is marked with what runs today and what is roadmap.

See the architectureTalk to TPTH

01 · The problem

The static security crisis

Two structural flaws impair traditional vendor risk management, and neither is a tooling gap — they are a velocity gap.

Death of the questionnaire

Static security questionnaires and periodic vendor risk assessments are functionally obsolete the moment they are completed. They capture a single snapshot in time, while cloud infrastructure, codebases and third-party dependencies evolve continuously, every day.

The velocity gap

Zero-day vulnerabilities move at machine speed — exploits spread globally within minutes to hours of public disclosure. Manual compliance teams and email-based vendor queries take weeks to respond, leaving large windows of exposure.

02 · The architecture

Four agents, each with one job

Each card states what TPTH runs in production today and what belongs to the wider architecture, because the difference matters more than the diagram.

01

Continuous discovery

Recon Agent

Monitors repositories, dark web forums, paste bins and vulnerability feeds in real time to catch early proof-of-concept leaks. Continuously indexes shadow IT and unmapped cloud endpoints on the perimeter.

Runs today: Daily TLS, DNS, SPF and DMARC posture checks, a breach and sanctions news sweep, and an OFAC list match across the portfolio.

Roadmap: Repository, paste-bin and dark-web monitoring.

02

Contextual filtering

Triage Agent

Reasons over new CVE disclosures against your exact software bill of materials. Checks exploit reachability and environment criticality before triggering any downstream action.

Runs today: Severity scoring across four weighted dimensions, alerting on a 10-point score drop or a certification expiring inside 60 days.

Roadmap: SBOM ingestion and exploit-reachability analysis.

03

Real-time verification

Interrogator Agent

Replaces slow, manual vendor questionnaire emails with programmatic API queries. Executes lightweight, non-destructive probes to verify whether a vulnerable library is loaded in active runtime memory.

Runs today: Live API verification against infrastructure TPTH owns and holds credentials for — cloud account posture and device telemetry.

Roadmap: Third-party probing, which requires each vendor’s own cooperation, and runtime memory inspection.

04

SOC hand-off

Orchestrator

Aggregates findings from Recon, Triage and Interrogator into a single incident dossier — impacted hosts, severity, runtime proof and pre-formatted patch scripts — routed to the team that fixes it.

Runs today: Composite scoring, an open-alert log and email notification.

Roadmap: Slack, Jira and PagerDuty routing, and generated patch scripts.

03 · The payoff

Response velocity: traditional vs the mesh

Response metricTraditional responseSecurity Agent Mesh
Threat detection3–7 days (blogs, advisories)Seconds (Recon repository scanning)
Impact analysis14 days (manual questionnaires)Minutes (Triage SBOM analysis)
Active verificationWeeks (manual vendor email chains)Real-time (Interrogator API probes)
Remediation actionUnstructured tickets and manual reviewAutomated incident dossier and hand-off

Read this as the architecture’s design targets, not as measured TPTH results. The right-hand column describes what the mesh is built to achieve when every agent is fully deployed against an environment you control. TPTH’s own deployment runs on a daily cycle; the agent cards above say which parts are live today.

04 · Worked example

Zero-day neutralisation in under ten seconds

An illustration of the fully deployed architecture, from first detection to a patch-ready dossier. A worked example of the design, not a recorded TPTH incident.

  1. 00:00:01DetectionRecon detects a zero-day exploit repository published publicly.
  2. 00:00:03TriageTriage queries the internal SBOM and verifies reachability.
  3. 00:00:05InterrogationInterrogator executes API verification probes against exposed clusters.
  4. 00:00:08OrchestrationOrchestrator generates the incident dossier with patch recommendations.

05 · See it in action

The mesh applied to a sample vendor portfolio

How TPTH’s own dashboard scores a vendor list, shown with illustrative names and example findings so the mechanics are visible without exposing any real risk posture.

Illustrative data. Names, scores and findings below are representative examples, not a real client’s results. The Interrogator stage is live for infrastructure TPTH itself owns — where we hold the API credentials, active verification is authorized. For third-party vendors it stays illustrative, because active probing would need that vendor’s own cooperation. That boundary is deliberate, not a limitation we are hiding.

Anchor DomainsDomain registrar
96
1 · ReconSSL grade A, valid SPF and DMARC, no negative news in 12 months.
2 · TriageNo signals cleared the severity threshold — nothing escalated.
3 · InterrogatorIllustrative only — would require this vendor’s own API cooperation, not available to an outside party.
4 · OrchestratorComposite 96, no alerts generated.
Ledger PayPayment processor
96
1 · ReconSSL grade A, SPF present, DMARC policy set to p=none (monitor only).
2 · TriageDMARC monitor-only logged as low severity, not alert-worthy alone.
3 · InterrogatorIllustrative only — would require this vendor’s own API cooperation, not available to an outside party.
4 · OrchestratorComposite 96, no alerts generated.
Meridian MeetVideo conferencing
75
1 · ReconSSL grade B, SPF/DMARC clean, workforce-reduction news this quarter.
2 · TriageTwo medium signals cleared threshold — surfaced to the alert log.
3 · InterrogatorIllustrative only — would require this vendor’s own API cooperation, not available to an outside party.
4 · OrchestratorComposite 75, 2 medium alerts routed to the daily digest.
Northwind SuiteProductivity software
98
1 · ReconSSL grade A+, SPF and DMARC enforced (p=reject), no negative news.
2 · TriageClean pass — nothing escalated.
3 · InterrogatorIllustrative only — would require this vendor’s own API cooperation, not available to an outside party.
4 · OrchestratorComposite 98, no alerts generated.
Harbor CloudEmail and cloud storage
95
1 · ReconSSL grade A, SPF present, DMARC record missing entirely.
2 · TriageMissing-DMARC signal logged as medium — surfaced to the alert log.
3 · InterrogatorIllustrative only — would require this vendor’s own API cooperation, not available to an outside party.
4 · OrchestratorComposite 95, 1 medium alert routed to the daily digest.
Fjord VPNConsumer VPN
45
1 · ReconSSL grade C, certificate expiring within 9 days, SPF/DMARC present.
2 · TriageTwo high-severity signals cleared threshold — escalated immediately, not held for the daily digest.
3 · InterrogatorIllustrative only — would require this vendor’s own API cooperation, not available to an outside party.
4 · OrchestratorComposite 45, 2 high alerts sent immediately — a 10+ point single-cycle drop also trips a score-drop alert.
Company cloud environmentOwned infrastructure
92
1 · ReconPassive posture check on the account’s public surface — nothing exposed.
2 · TriageOne low-severity configuration gap logged; nothing alert-worthy.
3 · Interrogator LiveRoot account MFA confirmed, zero unused access keys, monitoring credentials confirmed scoped to read-only via a real permissions probe.
4 · OrchestratorComposite 92 — the only scores here backed by a live, active credential check rather than passive signals alone.
Company device fleetOwned infrastructure
78
1 · ReconFleet-management platform corporate posture checked — clean.
2 · TriageOne device-level configuration gap flagged as low-medium severity.
3 · Interrogator Live2 of 2 enrolled devices reporting; disk encryption verified on both; one device flagged for its firewall configuration.
4 · OrchestratorComposite 78 — live device telemetry, not a self-reported questionnaire.

06 · Integration

Ecosystem and APIs

The mesh is an overlay, not a rip-and-replace — it plugs into the stack you already run.

SIEM integration

Pulls internal context and asset telemetry to answer the question that decides everything else: do we even run this software version in production?

GRC platforms

Automates audit-trail creation by logging agent verification proofs directly into the compliance system of record.

Vendor ecosystems

Connects through partner APIs to query upstream supplier security portals programmatically rather than by email.

These three integrations are architectural: designed for, and built per engagement against the systems a client already runs. TPTH’s own deployment currently routes to email rather than to a SIEM or GRC platform, because a one-person firm has nothing to route into.

Ready to see this running against your own vendor list?

Book a 30-min call