Services · Managed third-party threat hunting
Practitioners on your critical vendors. Automation on the rest.
Third Party Threat Hunting™ (TPTH™) runs it as your managed service provider. Our practitioners work your systemically critical vendors (what examiners call critical activities) as part of a zero-trust and resilience program. Automation watches the rest. Month to month, no platform license.
Managed tiers
Foundation, Resilience or Program
Every tier has two counts. Attended vendors are your systemically critical vendors, worked by a named practitioner; they set the price. Monitored vendors are the wider list, covered by automated checks.
Foundation
$2,500 / month
15 attended · 100 monitored
- Practitioner attention on your 15 most critical vendors
- Automated monitoring across 100 more
- Month to month
Resilience
$5,500 / month
30 attended · 150 monitored
- Practitioner attention on your 30 most critical vendors
- Automated monitoring across 150 more
- A monthly practitioner hunt across the attended set
- A quarterly program review
Program
From $14,000 / month, quoted
60 attended · 300 monitored
- 60 attended vendors, the top 30 at Resilience depth
- Automated monitoring across 300 more
- TPRM program ownership: policy, tiering, due diligence, resilience and exit plans, and board and examiner reporting
Extra attended vendors: $150–250 a month each. Setup fee: one month of the tier. Extending the program to AI vendors — NIST AI RMF and ISO/IEC 42001 assessments — is available with any tier. AI risk & agent training.
Start here
Two ways in before a tier
Not ready to commit to a monthly service? Start with a one-time hunt, or put a senior lead in the seat.
Third-Party Threat Hunt
$9,500 up to 15 critical vendors
$14,000 up to 30 critical vendors
A one-time practitioner hunt across your systemically critical vendors, delivered as a written report. Every report ends with an offer of the matching tier, so the hunt becomes the baseline if you carry on.
Fractional TPRM lead
$5,500 / month
A named senior lead who owns your third-party risk program without a full-time hire: policy, tiering, risk decisions, and the conversation with examiners and internal audit. Pairs with any tier when you also need the work done.
Fractional leadership →Month to month
What a cycle looks like
01
Week 1
Criticality refresh, new-vendor intake, monitoring alerts triaged.
02
Weeks 2–3
Practitioner work on the attended vendors, evidence collected, findings ranked.
03
Week 4
Remediation follow-up, metrics, evidence pack delivered and walked through.
Reporting
The monthly evidence pack
| Section | Contents |
|---|---|
| Program health | Vendor counts by tier, assessments due vs done, overdue items |
| Findings | New, open and closed findings with owners and dates |
| Monitoring | Alerts by severity and disposition |
| Regulatory map | Status against each clause of the guidance you're examined under |
| Attestation | Signed summary suitable for the audit committee |
The Evidence-First method
Four steps. The same practitioner from scope to hand-over.
Step 1
ScopeA 30-minute call, then a fixed-scope proposal. No paid discovery phase.Step 2
AssessDocument review, interviews and evidence testing against the framework you're examined under.Step 3
Close gapsRanked remediation with owners and dates, written for the board and the examiner.Step 4
Prove itRe-test, evidence pack and a hand-over your team can keep running.See it running
Try it before you talk to us
Both demos are live, public and need no sign-up. Every client, vendor name, rating and finding in them is an illustrative example, not a client's data.
The Lighthouse
The console we run your program from — vendors ranked worst-first, evidence weighted by how much we can prove, and findings closed with a signed record. Switch between three fictional clients, or see it as a client would.
Open the Lighthouse demo →Security Agent Mesh
Walk the four-agent architecture end to end — what each agent watches, what it hands on, and where a human signs off.
Open the architecture demo →Questions