Services · Third-Party Threat Hunt
A third-party threat hunt: find what is wrong with your critical vendors before an incident does.
Third Party Threat Hunting™ (TPTH™) runs third-party threat hunts for banks, credit unions and other regulated firms. A practitioner works your systemically critical vendors with a hypothesis, gathers evidence, validates what is real, and writes the vendor action that follows.
Definition
What a third-party threat hunt is
A third-party threat hunt is a fixed-scope, hypothesis-led search of your systemically critical vendors for evidence that something is wrong, or about to be: access that should have been removed, privileges wider than the job, incidents never reported to you, unsupported dependencies, and contract terms that leave you exposed.
It starts from what could hurt you rather than from a questionnaire, and it ends with something a vendor can act on: a named finding, the evidence behind it, and a specific request to the vendor. Everything is written for the examiner and the board, not the shelf.
Method
Hypothesis, hunt, validate, vendor action
Four steps, in order, on every hunt.
1. Hypothesis
A practitioner picks the few ways your critical vendors could most hurt you, from your own architecture, your regulator's expectations and what is happening in the market. Each is written as a testable statement.
2. Hunt
Automated sweeps and practitioner work gather evidence against each hypothesis across the vendors in scope: what is exposed, what access exists, what has changed.
3. Validate
A practitioner separates real exposure from noise. Each finding is rated and tied to its evidence, so nobody argues about whether it is real.
4. Vendor action
Each real finding becomes a specific written request to the vendor with an owner and a date, tracked to closure. The report ends with ranked actions for you.
Example
What a finding looks like
Illustrative example. A composite of the kinds of findings a hunt produces. It is not a specific client or engagement.
| Step | Illustrative example |
|---|---|
| Hypothesis | A vendor that holds remote access to our network may still have accounts for people who no longer work for it. |
| Hunt | Practitioner review of the access the vendor actually holds, compared with the people it says it employs, plus outside-in checks on the tools it uses to connect. |
| Validate | Several accounts have no current owner at the vendor. One has broader access than the contract describes. Evidence attached. |
| Vendor action | Written request: remove the unowned accounts, narrow the broad one, confirm in writing by a named date. Tracked to closure; the result is logged for the examiner. |
What you receive
Everything is written down
| Deliverable | What it gives you |
|---|---|
| Hunt report | Hypotheses tested, what was found, and what was ruled out |
| Ranked findings | Each finding rated, with the evidence behind it |
| Vendor action list | A specific request, owner and date for each vendor |
| Walk-through | A practitioner takes your team and leadership through it |
Every report ends with an offer of the matching managed tier, so the hunt becomes your baseline if you carry on. A hunt is also the first step before any managed tier, because it shows how things stand and sets the tier.
Scope and price
Fixed scope, fixed price
Up to 15 critical vendors
$9,500
One written scope, one report, one walk-through.
Up to 30 critical vendors
$14,000
Same method across a wider set of vendors.
Not sure which of your vendors count as critical? Start with the free eight-step vendor checklist →. Continuous hunting across the same vendors, month after month, is the managed service →.
Questions