VendorLeak

VendorLeak is a web app (with optional lightweight desktop agent) that monitors your third-party SaaS vendors for early signs of compromise and risky behavior—without pretending it can “stop all breaches.” It continuously checks vendor security signals (status pages, breach disclosures, certificate changes, DNS/hosting shifts, suspicious login geographies, and public code/secret exposure tied to vendor domains). You map which vendors touch which internal systems and data types, then VendorLeak produces a practical risk feed: what changed, why it matters, and what to do next (rotate keys, restrict scopes, disable SSO tokens, notify legal, etc.). It also generates vendor-facing questionnaires that update dynamically based on observed signals, reducing the annual spreadsheet theater. The goal is faster detection and tighter response around the real weak link: third parties. It’s not a full GRC suite; it’s a focused early-warning and response tool.