Third-Party Risk Screening: Vetting Vendors with OSINT

Third-party risk screening is how an organization decides whether a vendor, supplier or partner is safe to onboard, on what terms, and how closely to watch them afterward. It assesses cyber, financial, legal and integrity risk from open sources, because a third party's weaknesses become the organization's own the moment they get access or data.

What Is Third-Party Risk Screening?

Third-party risk screening is the assessment of the risk a vendor, supplier or partner introduces, before onboarding and throughout the relationship. It draws on open-source and licensed data to check exposure across cyber, financial, legal and integrity dimensions, and it feeds a decision: onboard, onboard with conditions, or decline. Done well it is continuous rather than a one-time gate.

It overlaps with due diligence but has a different center of gravity. Classic due diligence asks whether a counterparty is legitimate and creditworthy for a deal; third-party risk screening asks, additionally, whether connecting them to your systems and data is safe, and keeps asking after they are onboarded. If you are coming from the deal side, our due diligence OSINT checklist and OSINT due diligence guide cover the counterparty foundations this builds on.

Why Vendors Became a Primary Attack Surface

The reason third-party risk moved up the agenda is simple: attackers go through the weakest connected party. Verizon's 2025 Data Breach Investigations Report, which analyzed over 22,000 security incidents including 12,195 confirmed breaches, found that third-party involvement in breaches doubled year over year to 30%, covering software supply chain compromises and weak practices at service providers. In the same dataset, credential abuse (22%) and exploitation of vulnerabilities (20%) remained the leading initial vectors, both of which a vendor can drag into your environment.

The damage does not stay contained either. A single vendor compromise routinely cascades to many downstream customers, which is why one supplier's incident can become a headline affecting dozens of organizations. That cascade is the whole argument for screening: you are not only judging a vendor's own security, you are judging how their failure would propagate to you. Where those compromised credentials end up circulating is covered in our guide to dark web OSINT.

What to Actually Screen For

A useful screen covers five distinct risk areas. Collapsing them into one "is this vendor okay" question is how programs miss the specific exposure that later becomes an incident. Each area answers a different question and draws on different sources.

The ownership row is the one people underweight. A vendor can pass every cyber and financial check while being ultimately controlled by a sanctioned party or a competitor, and that only surfaces if you trace beneficial ownership. The same technique used in recovery work applies here; our guide to asset tracing covers following ownership through shells and nominees.

The OSINT Signals Behind Each Risk

Each risk area maps to concrete open-source signals you can actually collect. This table is the working bridge between the abstract risk and the search that reveals it.

Notice that two of the most decisive signals, breach appearance and infostealer credentials, never show up in a questionnaire, because the vendor either does not know or does not disclose. The domain and IP posture is reachable with ordinary reconnaissance; our guide to domain investigation covers pulling a vendor's external footprint.

Tiering: Not Every Vendor Earns the Same Depth

Screening every vendor to the same depth is both wasteful and dangerous, because it burns effort on a stationery supplier while giving a data processor the same shallow pass. Tiering fixes that by matching scrutiny to the access and data a vendor holds. Decide the tier first, then the depth follows.

• Critical: deep access to systems or sensitive data. Full five-area screen plus continuous monitoring, and named-contact credential checks.
• Important: meaningful data or operational dependence. Full screen at onboarding, periodic re-screening.
• Standard: limited access, replaceable. Cyber, sanctions and adverse-media screen at onboarding.
• Low: no data access, easily substituted. Sanctions and basic legitimacy check.

The tier is not fixed for life. A standard vendor that later gains data access should be re-tiered upward, and a common failure is onboarding a vendor at low risk and never revisiting the tier when the relationship deepens.

From Point-in-Time to Continuous Monitoring

The single biggest weakness in vendor programs is treating screening as a gate rather than a process. A vendor that was clean at onboarding can be breached the following quarter, change ownership, or have staff credentials harvested by an infostealer next week. A point-in-time check has nothing to say about any of that.

Continuous monitoring closes the gap for the tiers that warrant it. The goal is not to re-run a full investigation constantly, it is to watch for change: a new breach appearance, a fresh batch of leaked credentials, a sanctions listing, a sudden shift in external infrastructure. When one of those fires, you learn about the exposure while you can still rotate access, tighten the contract or offboard, instead of reading about it in an incident report. The credential side of this is exactly what breach and infostealer monitoring is built for; see how to check for a data breach for the individual-account version of the same idea.

The Credential-Exposure Blind Spot

The signal most vendor programs never look at is the one attackers use first: valid credentials for the vendor's own people. Infostealer malware harvests saved logins, session cookies and autofill data from infected machines, and those logs circulate in the same markets as breach dumps. If an employee at a critical vendor is infected, working credentials to systems that touch your data may already be for sale, and no questionnaire will mention it.

This is why credential intelligence belongs inside third-party screening rather than beside it. Checking whether a vendor's domain and named contacts appear in breach and infostealer datasets converts a vague "they seem fine" into a specific, actionable finding: rotate these accounts, require multi-factor authentication, or reconsider the access entirely. It is also the exposure that most directly predicts the account-takeover path a supply-chain attack actually takes.

Screening Lawfully and at Scale

Vendor screening with open sources is standard and defensible, but two disciplines keep it that way. The first is consistency: apply the same criteria and depth to every vendor in a tier, because ad hoc screening invites both blind spots and discrimination claims. Document the criteria, the sources and the decision, so a screen can be justified later.

The second is data handling. A vendor's staff are people, so their personal data falls under privacy law such as GDPR in the EU and the LGPD in Brazil, which means purpose limitation and proportionality apply even to public information. Screen for risk relevant to the relationship, not for everything discoverable, and rely on lawful sources rather than intrusive or deceptive collection. Our overview of whether OSINT is legal works through those boundaries, and OSINT for KYC and compliance covers the regulated-program version.

Vendor Exposure in One Search, With espectrosint

Because the decisive vendor signals, breach appearance and live credential exposure, sit outside any questionnaire, a screen is only as good as the data behind it. espectrosint puts that data in one place: it takes a vendor's domain, an employee email, or a company name and correlates it across 200+ public sources plus a proprietary breach and infostealer-log dataset, returning exposure in context rather than as scattered lookups.

Being clear about scope: espectrosint is not a full governance, risk and compliance suite, and it does not replace contracts or questionnaires. What it does is the intelligence layer that tells you what is actually exposed about a third party.

1. Screen the vendor's domain for breach appearance and exposed infrastructure.
2. Check named contacts and employee emails against breach and infostealer datasets.
3. Use company name and linked entities to map ownership and siblings.
4. Pivot on phone, username and IP to connect contacts and confirm identity.
5. Read the connection graph and timeline to see how exposure clusters.
6. Export to PDF, CSV or JSON so the screen is dated and audit-ready.

For teams building the broader stack, our roundup of the best OSINT tools for fraud investigation places credential and identity intelligence next to the ratings and questionnaire tools it complements.

Conclusion

Third-party risk screening earns its place because the numbers are no longer arguable: vendors are a leading path into breaches, and a supplier's failure propagates straight to you. The programs that work do three things the weak ones skip. They screen five distinct risk areas instead of one vague impression, they tier the depth to the access a vendor holds, and they keep watching the critical ones instead of filing a clean onboarding form and moving on.

So build the screen around exposure the vendor cannot self-report, especially breach and infostealer credentials, and make monitoring automatic for the tiers that matter. To go deeper on the counterparty foundations, continue with the due diligence OSINT checklist, and for the ownership tracing that reveals who really controls a vendor, continue with asset tracing.