The NDA is signed. The deal is moving fast. Does anyone actually know who this vendor is?
VendorMark is a managed screening service. Submit a vendor name, address, and website — our analysts run 24+ data sources across four risk layers and deliver a documented report in 5 business days. One you can attach to the file, show your auditor, and reference before you sign.
Built inside the Fortune 100. Delivered for teams like yours.
Our team has architected, built, or led vendor risk, TPRM, and supply chain compliance programs at companies like these — Fortune 100 enterprises, global financial institutions, and high-growth technology firms. VendorMark is what we learned, productized for teams without an enterprise security org.
Shown above are enterprises where our team has held prior vendor risk, TPRM, supply chain, or security leadership roles. Logos represent prior professional engagements and do not constitute client relationships, endorsements, or current affiliations with Miles Brothers Consulting, LLC.
Your third-party vendor risk is larger than you think.
And most of it is unscreened.
Not the scary new ones. All of them. The SaaS tools your IT team approved in 2021. The accounting firm your CFO went to college with. The offshore dev shop your CTO "vouches for." The payroll processor you've been using for six years and nobody has thought about since.
Every one of those relationships is a potential regulatory violation, a business continuity failure, or a security incident waiting to be discovered. The question isn't whether you need vendor screening. The question is why you've been running blind this long.
Any third party with access to your systems, data, finances, or operational continuity. If they can touch your stuff — or fail in a way that breaks your stuff — they're a vendor.
Underwriters are asking about your vendor oversight program at renewal. If your answer is "we look them up on LinkedIn," that's a premium increase or an exclusion — and after a claim, it's potentially a coverage denial.
Vendor management is a required control in every major framework. Your auditor will ask for your vendor inventory, your assessment process, and your documentation. "We trust them" is not a control.
Every enterprise customer sending you a security questionnaire wants to know who your vendors are. Their procurement team and their lawyers are asking if you've screened the parties that touch your — and by extension, their — data.
Ignorance of a sanctions hit is not a defense. OFAC enforcement doesn't require intent — it requires a transaction. If you paid a vendor on the SDN list, you have a problem regardless of whether you knew. The fine is real. The reputational damage is worse.
General Counsel has been carrying the risk of undocumented vendor relationships for years. When the breach happens, when the vendor goes bankrupt, when the audit flags the gap — GC needs documentation that the company exercised reasonable diligence. "We didn't know" doesn't close the loop.
Directors have fiduciary duty over third-party risk. One supply chain incident, one sanctions violation, one financially distressed vendor taking your critical process down with them — and the board will ask why there was no oversight program. Have an answer ready before the question comes.
The vendors you "know and trust"
are the ones you should be most worried about.
New vendors at least get a second look. The ones who've been in your vendor list for three years? Nobody has touched them since the original contract. But things change. Ownership changes. Financial position deteriorates. Key people leave. A quiet acquisition puts a hostile actor in your supply chain. The relationship you have is with a version of that vendor that may not exist anymore.
SolarWinds was a trusted vendor to 18,000 organizations — including the US Treasury, Homeland Security, and Fortune 500 companies — right up until their software update was pushing nation-state malware. In 2025, nobody at the hundreds of companies using Drift thought of it as a vendor risk — it was just a chat widget integrated into Salesforce. Until attackers used its OAuth tokens to walk straight into their CRM and email. Qantas didn't get breached. Their call center vendor did. 5.7 million customers' data walked out the door anyway. Trust is not due diligence. It's the absence of it.
Trusted network monitoring vendor. Compromised software update reached 18,000+ customers — including US Treasury and Homeland Security. Attackers were inside for 9+ months before discovery.
Trusted MSP platform. REvil ransomware hit a zero-day and encrypted 1,500 downstream businesses in a single weekend. Many had no idea Kaseya was in their supply chain.
A zero-day in a trusted file transfer tool used by payroll processors, government agencies, and healthcare systems. One vulnerability. 2,600+ downstream organizations breached — including the US Department of Energy, Shell, and British Airways. None of them were the target. They were just customers of the customer.
Trusted identity provider for thousands of enterprises. Attackers accessed Okta's support system and stole session tokens belonging to Okta customers — including 1Password, Cloudflare, and BeyondTrust. Okta is how you log in to everything. When it's compromised, everything downstream is at risk.
Trusted real estate vendor under enterprise contracts with thousands of companies. Filed Chapter 11 with no warning. Long-term agreements became worthless overnight.
Attackers didn't breach Salesforce — they went through Drift, a chat widget integrated via OAuth. Stolen tokens exposed CRM records and email data across hundreds of organizations. Nobody considered a chat plugin a vendor risk.
Not Qantas's systems — a third-party call center vendor. 5.7 million customer records exposed. Qantas had no visibility into how their vendor was secured. The breach wasn't theirs to control. The fallout was.
One of the world's largest IT distributors — hit by ransomware. Order systems went offline. Downstream supply chain disruption across a global customer base. When your procurement vendor goes down, your procurement goes with it.
Ransomware froze claims processing across thousands of healthcare providers. Final count: 192.7 million individuals impacted — more than half the US population. Still the largest healthcare data breach on record. Vendors that "just handle payments" don't feel like a risk until they take down an entire industry.
Civil penalty up to $1M+ per transaction. Criminal referral possible. No "we didn't know" defense.
Your breach, not just theirs. You own notification obligations, regulatory exposure, and customer fallout — even though it happened on their systems.
Critical process goes down with them. You had no early warning, no backup plan, and now you're negotiating with a bankruptcy trustee for data access.
Export control violation. Potential criminal liability. Enterprise customer terminates contract for cause. Reputational damage with US government relationships.
Finding in audit report. Enterprise customer procurement puts deal on hold. Remediation required before certification renewed. That's the quarter you missed.
No documented program = premium increase, sub-limit, or exclusion. After a claim that traces to a vendor? Coverage dispute at the worst possible time.
VendorMark is a managed vendor due diligence service.
Not a platform. Not a dashboard.
VendorMark is a managed screening service. You submit a vendor. We do the work. You get a report. The people running the screen have spent decades doing this — in enterprise security, supply chain risk, and third-party compliance programs at companies far larger and more complex than yours. That's the product.
You don't need a dashboard. You need a decision. VendorMark gives you a report signed off by an analyst who knows what the findings mean — not an alert in an empty portal.
CISA
These are not VendorMark's prices. This is what it costs to build and operate an equivalent vendor due diligence capability in-house — the tools, the platforms, and the qualified person you'd need to run them.
Cost ranges are illustrative estimates based on publicly available pricing, analyst research, and industry benchmarks as of 2026. Actual licensing costs vary significantly by contract terms, organization size, user count, data volume, and vendor negotiation. Some platforms do not publish list pricing and quote on a custom basis. These figures are intended to convey order-of-magnitude investment — not represent a specific vendor quote or binding price reference.
Four-layer vendor screening.
One report. Every vendor, before you commit.
No single database covers the full picture. VendorMark runs four independent screening layers across 24+ data sources and consolidates findings into one structured report.
Digital Exposure — Cybersecurity Risk
What can an attacker see from outside your vendor's perimeter? This layer surfaces observable cyber risk before it becomes your problem.
- Open ports & exposed infrastructure scanning
- SSL/TLS certificate health & expiry
- Email security posture — SPF, DKIM, DMARC
- Technology stack identification
- Historical breach exposure & domain threat intelligence
Compliance Clearance — Regulatory & Legal Risk
Are you prohibited from doing business with this vendor? Missing a sanctions hit is a compliance failure — and increasingly, an insurance coverage issue.
- OFAC SDN & all active country sanction programs
- BIS Denied Persons, Entity List, Unverified, MEU
- EU, UN, UK HMT consolidated lists
- State Dept. nonproliferation lists
- SAM.gov federal debarment & exclusion check
- PEP (Politically Exposed Persons) screening
- Supply chain ethics — conflict minerals, forced & child labor screening
Financial Standing — Financial Risk
Is this vendor a stable counterparty? A vendor in financial distress is a business continuity risk — and a renegotiation you didn't plan for.
- Business credit score & payment behavior
- Bankruptcy, insolvency & distress signals
- Federal litigation history & court filings
- SEC EDGAR disclosures (public companies)
- Legal entity & good standing verification
Origin & Ownership — Reputational & Geopolitical Risk
Where is this vendor truly from, and who ultimately owns it? Country of incorporation doesn't always tell the full story — especially for software, hardware, and data-handling vendors.
- Country of incorporation & HQ location
- Country bribery risk & rule-of-law scoring
- Foreign state-linked ownership flags
- Adverse media — fraud, settlement, enforcement actions
- Reputational review — BBB, G2, Trustpilot
- OFAC country program cross-check
How the pre-contract vendor screening process works.
We designed VendorMark for the realities of pre-contract workflows — no lengthy questionnaires, no required EIN, no delay waiting on vendor cooperation.
Submit Vendor Details
Provide the vendor's name, address, and website. That's it. VendorMark is designed to work from publicly available information — no EIN, no access to vendor systems required.
We Run the Screen
Our analysts run all four layers against 24+ data sources — structured, consistent, and documented. Standard turnaround is 5 business days. Rush delivery (72-hour) available.
Receive Your Report
You receive a formatted PDF report with findings by layer, a risk summary, and documented sources. Ready to file, share with counsel, or reference in contract negotiations.
The vendor due diligence report —
structured for your vendor file.
Every VendorMark report follows a consistent structure — one document covering all four screening layers, with a clear risk summary and documented sources. Formatted to attach to a vendor file, reference in contract negotiations, or present to an auditor.
No adverse findings identified for this subdomain at the time of screening. A PASS does not guarantee the absence of risk — it means the check returned no material flags.
One or more findings of potential concern identified. A FLAG does not automatically disqualify a vendor — it indicates an area that warrants further review before engagement proceeds.
No flags returned across any screening layer. The vendor cleared all available checks at the time of screening. Periodic re-screening is still recommended.
One or more flags identified but do not on their own preclude engagement. Proceeding is contingent on internal review of flagged findings and completion of any recommended next steps.
Findings across one or more layers present a level of risk that requires formal internal review before engagement proceeds. Legal, compliance, and relevant business stakeholders should evaluate whether and under what conditions engagement may be appropriate.
Reports are point-in-time informational screening documents intended to support internal decision-making. They do not constitute legal advice, a legal opinion, or a compliance certification. See full disclaimer below.
Who uses VendorMark for third-party risk management.
VendorMark is designed for professionals who need documented vendor intelligence — not a SaaS dashboard built for a 500-person security team.
General Counsel & Legal Operations
You're being asked to approve vendor contracts faster than ever. VendorMark gives you documented screening you can attach to the file — sanctions clearance, litigation history, entity verification — before the ink dries.
VP Supply Chain & Procurement
Your vendor network is your risk surface. VendorMark flags financially distressed counterparties, restricted party hits, and geopolitical exposure before they become contract renegotiations or regulatory problems.
Compliance Officers & Risk Teams
SOC 2 auditors, cyber insurers, and enterprise customers are all asking about your vendor oversight process. VendorMark gives you a consistent, documentable answer — reports you can produce on demand.
Vendor screening questions, answered.
What information is needed to run a vendor due diligence screen?
Just three things: the vendor's legal name, their address, and their website. VendorMark is designed to work from publicly available information. No EIN required, no vendor cooperation needed, no questionnaire sent to the other party.
How is VendorMark different from a standard vendor background check?
A Google search won't check 130+ global sanctions lists, federal debarment databases, federal court records for litigation, or your vendor's exposed attack surface. VendorMark runs structured checks across 24+ data sources and produces a documented report — not a search results page.
Does a VendorMark report satisfy vendor due diligence requirements?
No. VendorMark reports are informational screening documents intended to support your internal decision-making process. They are not legal opinions, legal advice, or audit certifications. For regulated industries, we recommend using reports in conjunction with your legal and compliance counsel.
How long does a pre-contract vendor screening take?
Standard turnaround is 5 business days from the time we receive your vendor information. Rush delivery (72-hour) is available subject to analyst capacity — we'll confirm availability when you submit your request.
Can we run batch third-party vendor screening for multiple vendors?
Yes. We work with teams that screen vendors in batches — new supplier onboarding cycles, annual re-screens, or M&A due diligence workflows. Contact us to discuss volume pricing and turnaround options.
What add-ons are available for deeper supply chain due diligence?
A full add-on menu is available across six categories: Attestation & Certification Review (SOC 2 Type II, ISO 27001/27701, Pen Test summary, PCI DSS AOC); Scheduled Rescreening (6-month or 12-month queued rescreens); Contract & Legal Clause Support (vendor security clause review, recommended contract language package, MNDA/NDA risk flag review); Enhanced Due Diligence (our proprietary Cyber-Focused TPRM Assessment questionnaire, managed end-to-end); Delivery & Compliance Options (rush delivery, portfolio summary report); and Additional Consulting for anything outside a defined scope. Ask about add-on options when you request your sample.
See the report before you order one.
Request a sample report and see exactly what your team receives — structure, findings format, and risk summary.
Every VendorMark report reflects conditions as of the date the screen was conducted. Vendor circumstances change — financial standing deteriorates, ownership structures shift, sanctions lists are updated, and cyber postures evolve. A report generated today does not represent the state of a vendor in six months. VendorMark does not provide continuous monitoring or real-time alerts of any kind.
VendorMark reports are derived from third-party data sources, public records, and commercial databases. We do not independently verify the accuracy of underlying source data and cannot guarantee that all findings are complete, current, or free of error. Data providers may have coverage gaps, reporting delays, or inaccuracies that are beyond our control and visibility.
Nothing in a VendorMark report constitutes legal advice, a legal opinion, a compliance determination, or a certification of any kind. Reports are informational screening documents intended to support your internal decision-making process. Regulated industries and high-stakes vendor relationships should involve qualified legal counsel and compliance professionals.
A clean VendorMark report does not mean a vendor is without risk — it means no significant adverse findings were identified at the time of screening using the data sources available. Vendor screening reduces exposure and supports documentation; it does not eliminate risk or guarantee that a vendor will perform as expected, remain financially stable, or remain compliant with applicable law.
VendorMark findings are intended to inform — not replace — the judgment of qualified legal, compliance, procurement, and security professionals within your organization. Material vendor decisions should incorporate your organization's own due diligence standards, contractual requirements, and risk tolerance.
Standard screens cover the four layers documented on this page. They do not include state-level civil litigation, insurance certificate verification, deep beneficial ownership tracing, or foreign-language source review unless explicitly purchased as add-ons. No screen covers every possible risk category, and the absence of a finding in an uncovered category should not be interpreted as clearance.
VendorMark is a service of Miles Brothers Consulting, LLC. Use of VendorMark reports is subject to our Terms of Service. Reports are provided for informational purposes only and do not create a professional services relationship beyond the scope of the screening engagement.