Introduction

Vendors adopt AI faster than questionnaires and contracts can track it. A vendor that handled your data last year may now pass it through a foundation-model API, a retrieval pipeline, or an AI agent, and nothing in an existing review process would show it.

This product assesses a vendor's AI use from the outside, starting with only the vendor's domain. It gathers public evidence of the AI each vendor runs, scores what it finds, and ranks your vendors so diligence effort goes where the risk is highest. It is built for teams responsible for third-party and vendor risk.

How Vendors Are Assessed

Each assessment draws only on publicly available evidence. Every finding is checked before it counts. Evidence must belong to the right company, weak sources must be corroborated, and repeated mentions of the same fact count once.

Some vendors also disclose their own AI bill of materials. A disclosure is kept separate from the outside-in assessment and clearly labeled, so you always know which findings rest on observation and which rest on the vendor's own statement.

What You Learn About Each Vendor

Each vendor receives five measures.

• Presence reflects how likely it is that the vendor uses AI.
• Footprint reflects how much AI the vendor runs and how it is built. Building and hosting models weighs more than buying AI through an API.
• Materiality reflects how much the vendor's AI could affect your data and operations.
• Exposure potential reflects how likely the vendor is affected by known, live risks in the AI components it uses. It is a screening signal, not a confirmed finding.
• Blast radius reflects how far a compromise of this vendor would reach across your portfolio, based on which other vendors depend on it.

Prioritizing Your Vendor Portfolio

The measures combine into one Onboarding Priority score from 0 to 100. Materiality, Footprint, and Presence set the base of the score. Exposure potential and Blast radius can raise it, but neither can dominate it. When a vendor looks material but its AI cannot be confirmed, priority rises, because uncertainty is a reason to investigate rather than to assume safety. Every score can be broken down to show which factor contributed what.

Understanding and Acting on Risk

Scores show which vendors to prioritize. DL Pathways show why. A pathway traces a concrete route from sharing data with a vendor to a possible loss event, such as a known vulnerability in a self-hosted component that could lead to data exfiltration. A pathway appears only when every step is supported by observed evidence.

A vendor can have thousands of individual findings. These are condensed into a short action list, grouped by who can act:

• Do: A concrete fix exists for the vendor.
• Verify: A control question to put to the vendor.
• Monitor: A risk owned by the vendor's AI provider, which is watched rather than raised with the vendor.

Full findings remain available behind every action.