External scanning services usually live in a separate console, disconnected from your vendor records and risk models. In Fair TPRM, dual SRS integrations are built into the platform — scores flow directly into FAIR™ analysis, vendor profiles, and the Cyber Todo dashboard.
Fair TPRM connects to the UpGuard API to pull comprehensive external security ratings across four key categories, giving you a validated outside-in view of your vendors' security posture on a 0–950 scale.
Fair TPRM connects to the Shodan API to perform deep internet intelligence scanning, applying a built-in five-category scoring system that evaluates vendor infrastructure from the attacker's perspective.
Vendors are automatically rescored on a schedule matched to their risk tier.
| Vendor Tier | Risk Level | Rescore Interval | Typical Vendors |
|---|---|---|---|
| Tier 1 | Critical | Every 30 days | Cloud infrastructure, payment processors, core SaaS |
| Tier 2 | Standard | Every 90 days | HR platforms, CRM systems, collaboration tools |
| Tier 3 | Low-Risk | Every 365 days | Marketing tools, office supplies, non-data vendors |
Every signal is tunable. Every threshold is configurable. The monitoring engine adapts to your risk appetite, not the other way around.
Exclude specific findings per subdomain when a risk is accepted or represents a false positive. Waivers include documented reasons and are tracked in the audit log.
Green (80%+ positive), Yellow (50–80%), Red (<50%) at-a-glance ratings make it easy for non-technical stakeholders to understand vendor security posture.
Trigger immediate rescans via the Shodan API when you need fresh data outside the automatic schedule. Results are available within minutes with full finding detail.
Admin-customizable point values per scoring category let you tune the Shodan-powered scoring engine to match your organization's risk appetite. Weight TLS compliance higher than email security, or prioritize vulnerability exposure over network hardening — it's your call.
Chart.js-powered visualizations show score history over time. Identify improving or degrading vendor security postures at a glance with trend lines.
The Shodan API's vulnerability data detects known CVEs on vendor infrastructure, with scaled penalties based on CVSS severity. Maximum penalty for CVSS 9.0+.
The Shodan API integration intelligently handles vendors behind web application firewalls and content delivery networks, avoiding false positives from infrastructure that doesn't belong to the vendor.
Every organization has different security priorities. A financial institution may weight TLS compliance and vulnerability exposure heavily, while a healthcare provider focuses on data leak monitoring and email security. Fair TPRM lets you configure exactly which signals carry the most weight in your scoring model.
In a unified platform, continuous scoring feeds directly into vendor onboarding, FAIR analysis, and annual reviews — no integrations required.
Explore Vendor Lifecycle