Reviews are point-in-time attestations about a supplier’s posture, while internet intelligence is live observation of exposed assets and changes in the supplier’s external footprint. Reviews tell you what was true at a moment in time. Continuous intelligence tells you what is true now, which is the only state that matters during active exposure.
Why third-party risk reviews and continuous internet intelligence answer different questions
Third-party risk reviews are a governance snapshot. They tell you whether a supplier looked acceptable at a specific point based on questionnaires, attestations, and evidence that may already be stale by the time you read it. Continuous internet intelligence asks a different question: what is the supplier exposing now, and what changed since the last review?
The practical difference is that reviews are inward-facing and scheduled, while internet intelligence is outward-facing and continuous. A review can confirm declared controls, ownership, and policy maturity. Continuous observation can reveal live assets, new subdomains, exposed services, certificate changes, leaked credentials, or other externally visible shifts that never make it into a quarterly packet.
This is why the two are complementary rather than interchangeable. A supplier can pass a review and still accumulate new exposure the next day. Equally, live internet signals can show risky changes without proving the underlying control environment is weak. The strongest programmes use both: review for stated posture, intelligence for present-day reality.
What changes when you move from attestation to live observation
Third-party reviews are best at answering accountability questions. Who owns the service, what controls exist, and what has the supplier committed to maintain? They are useful for baseline due diligence, contract onboarding, and annual reassessment. Their limitation is temporal: the evidence reflects the moment it was collected, not the current attack surface.
Continuous internet intelligence is best at answering exposure questions. What is reachable from the public internet, what is newly deployed, and what has changed since yesterday? That makes it valuable for detecting shadow infrastructure, forgotten hosts, misconfigured services, and sudden changes in the supplier’s external footprint. It does not replace governance evidence, because visibility alone does not tell you whether internal controls are well designed.
For practitioners, the real difference is decision timing. Reviews support accept, reject, or condition decisions. Continuous intelligence supports monitor, validate, and intervene decisions when the supplier’s external posture drifts away from what the review said. Top 10 NHI Issues is a useful reminder that visibility gaps and unmanaged access become more dangerous as environments change faster than governance cycles can track.
How to use both in a third-party programme
A mature programme should treat review findings as the baseline contract with the supplier, then use live intelligence to test whether that baseline still holds. If a review says the supplier has a narrow footprint but intelligence shows broad internet exposure, the follow-up question is not whether the questionnaire was complete. It is whether the supplier’s actual operating state still matches the agreed risk profile.
That creates a useful operational split. Reviews are strongest for onboarding, annual due diligence, and control assertions that require human explanation. Continuous intelligence is strongest for drift detection, external exposure monitoring, and rapid triage when a supplier’s public-facing attack surface changes. The two together close the gap between declared security and observable security.
For supplier-heavy environments, this is especially important where exposed assets can become an access path into broader services. Supply-chain incidents often begin with a small externally visible weakness and then expand through tokens, APIs, support tools, or other trusted relationships. NHIMG’s Salesloft OAuth token breach and JumpCloud breach 2023 both show how one supplier issue can become a downstream access problem. For broader context, DORA reflects the same operational idea in regulatory form: third-party dependency must be managed as a living risk, not a one-time file review.
Risk and Threat Considerations
The main risk is relying on stale assurance while exposure is changing in real time. That creates a blind spot where a supplier can remain “approved” on paper while its external footprint has already expanded, shifted, or become easier to exploit.
Failure mechanism: Review cycles miss drift between attestations, so newly exposed assets, changed DNS records, leaked tokens, or misconfigured services stay unnoticed until an incident or external report surfaces them.
Impact: Attackers gain a better chance to find reachable systems, abuse trusted integrations, or pivot through the supplier into downstream environments before the organisation can react.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.RA-01 — Risk Identification | Compares supplier risk review evidence with current external exposure. |
| GV.SC-04 — Cyber Supply Chain Risk Management | Third-party reviews and continuous monitoring are both supplier-risk controls. | |
| Recommendation — Compare declared supplier posture with live exposure signals to update risk decisions. Continuously assess supplier exposure and update supplier-risk requirements when drift appears. | ||
| NIST SP 800-53 Rev 5 | SR-6 — Supplier Assessments and Reviews | Directly aligns with point-in-time third-party reviews and supplier assurance. |
| Recommendation — Require periodic supplier assessments and retain evidence supporting the review outcome. | ||
| CIS Controls v8 | CIS-15 — Service Provider Management | Third-party review and ongoing monitoring are core service provider management tasks. |
| Recommendation — Maintain a current inventory of suppliers and monitor their exposure between formal reviews. | ||
| ISO/IEC 27001:2022 | A.5.22 — Monitoring, review and change management of supplier services | Captures the need to review suppliers and track changes over time. |
| Recommendation — Monitor supplier services for changes and review them against contractual security expectations. | ||
Practitioner Guidance
What to verify: Treat review evidence and live intelligence as different evidence classes. Verify that the supplier can explain control ownership and also account for current external exposure, because one without the other creates a false sense of assurance.
Decision rule: If the review is clean but the live footprint is growing or inconsistent with the declared scope, escalate for immediate validation rather than waiting for the next formal reassessment. If both sources agree, you have a much stronger basis for accepting the risk.
What practitioners underestimate: Continuous intelligence is not just an incident tool. Its real value is detecting drift early enough to prevent the next review from becoming a post-incident explanation.
Practitioner takeaway: Use third-party reviews to establish declared posture, but use continuous internet intelligence to decide whether that posture is still true enough to trust.
Related resources from NHI Mgmt Group
- What is the difference between using threat intelligence for threat hunting and using it for third-party risk management?
- What is the difference between third-party risk management and NHI governance?
- How should security teams handle third-party risk when vendor posture changes between reviews?
- Who is accountable when third-party cyber risk changes between reviews?