Know when a vendor changes, between assessments
A questionnaire tells you where a vendor stood on the day they answered. Pistos watches what has changed since, shows you why, and leaves every decision to a person.
Included with the Growth and Enterprise plans.
What it watches
Three sources, all kept apart so you can see where each signal came from.
Their public footprint
- Email authentication: SPF, DKIM, DMARC and MTA-STS
- TLS certificate and how long it has left
- Web security headers and a security.txt contact
- New host names and certificate authorities in public certificate logs
- DNS entries that could be taken over
- Domain registration: expiry, registrar and name-server changes
Public records
- The CISA catalogue of known exploited vulnerabilities, matched to the products you list
- The US OFAC sanctions list, screened against a vendor's legal name
- SEC filings of listed companies: breach notices (Form 8-K Item 1.05)
- SEC filings that signal financial distress: bankruptcy, delisting, restatement, late reports
Your own records
- Vendor documents that are expiring or expired
- Findings past their due date
- Assessments and follow-ups that are overdue
- Incidents your team records itself: a call, a news story, a regulator's notice
From a signal to a decision
Monitoring finds leads. Your team decides what they mean.
Signal
Each check turns what it sees into a plain sentence with a severity, how sure it is, and the evidence. Nothing is a conclusion.
Level
Signals add up to a level for the vendor: points for severity, confidence and age, capped per kind of signal and judged more strictly for your highest-risk tier. You can open “why this level?” and see every point.
Triage
Acknowledge a signal, dismiss it with a reason (a dismissed signal stays dismissed), or confirm or reject a name match. Serious new signals reach the right people by email, and the rest arrive in a daily digest.
Act
Escalate a signal to a finding in the vendor's register, or ask for an early reassessment. Pistos never starts one for you.
Decide
Findings and the vendor decision work as they always do. Monitoring only gives you the reason to look sooner.
See it
Illustrative sample data.
Built to be fair to your vendors
A wrong accusation costs you a relationship. So the rules are strict.
Never intrusive
Only public information: DNS records, one TLS handshake and a few ordinary web requests per watched domain. No scanning of a vendor's systems.
A person confirms every name match
A company name is not an identity. Sanctions and SEC matches are shown as “possible” until someone confirms the company, or enters its SEC number. A rejected match is never raised again.
The vendor can reply
Before anyone acts, send the vendor a private one-time link. Its reply is kept with the signal and your decision. It changes no score by itself, and nothing is deleted.
Your assessment still rules
Monitoring never changes the assessed risk rating. It is a separate “what has changed lately” indicator.
Which plans
A vendor counts toward the monitoring limit once something is on its watch list. Prices and the full comparison are on the home page.
Questions
Which plans include monitoring?
Growth watches up to 25 vendors and Enterprise watches every vendor. Starter does not include monitoring. Sanctions and public-notice screening, the vendor right to reply and incident recording come with it.
What leaves Pistos when I watch a vendor?
A watched domain name is looked up with public services: certificate-transparency logs and domain-registration records. Sanctions screening and the product match against the CISA list happen inside Pistos, and only a listed company's public SEC number is sent to the SEC. No questionnaire answers, findings or documents are ever sent.
Will it flood my team with alerts?
No. Serious new signals can email the vendor's owner and your administrators straight away, everything else arrives in one daily digest, and each person can choose whether to receive monitoring emails. Many small signals cannot outweigh one serious one, because each kind of signal is capped.
Can I add things monitoring cannot see?
Yes. Record an incident yourself, such as a call from the vendor or a news story, and it is triaged and scored like any other signal. You close it when it no longer applies.
See what changed since the last questionnaire
Add a vendor’s domain and legal name and Pistos starts watching with the next daily run.
Start a free trial