HodeiShield®

See which vendors you are exposed to, and who goes down with them.

Each vendor gets a 0 to 100 score, its dependencies sit in a graph, and the concentrations no single vendor reveals come into view. Questionnaires, CVEs (published vulnerabilities) and decisions share one record.

For: Vendor and TPRM managers, and the CISO who answers for the supply chain to the board and the regulator.

Request a demoRead the concepts in the docs (opens in a new tab)
  • You declare the dependencies; propagation reaches 3 hops
  • Scans are periodic and use external sources, not real time

Dependency mapPortfolio

Sample data
Concentration (HHI)
3,420 / 10,000
Blast radius
3 vendors within 3 hops

Vendor C

Composite score71 / 100High

  • External scan2 open findings
  • QuestionnaireValidated by an analyst
  • Known CVEs1 in KEV
Sample data: the vendors, scores and figures are fictional.

Where it sits in the cycle

This solution walks all four phases, with the vendor as the unit of work.

  1. SENSE · collect evidence

    External vendor scanning, questionnaires through a portal and a daily CVE sync.

  2. PREDICT · quantify and simulate

    0 to 100 score, FAIR/ALE exposure in euros with its simulated uncertainty band (uncalibrated), scenario simulator and HHI concentration.

  3. ACT · propose and approve

    HodeiAI proposes an entry in the risk register and a person with a write role approves it. Alerts are routed to your own systems.

  4. ATTEST · prove it to third parties

    The Trust Center summarises your maturity per framework; it never exposes scores, amounts or vendor detail.

From onboarding to decision: a vendor's life

The same path for vendor number 5 and vendor number 500. Every step leaves its trace on the record.

  1. You onboard the vendor and set its criticality

    Each vendor lives in a register isolated per organisation. Its criticality (critical, high, medium, low) multiplies its score and sets how often it is rescanned.

  2. You declare who it depends on

    You declare the dependencies (critical, operational, support, sub-processor, reseller). HodeiShield propagates risk by weight, finds single points of failure, and computes concentration (HHI) and blast radius.

    Scope. Nth-party discovery from SBOMs exists but is not scheduled: it is not an automatic map.

  3. It is scored from different signals

    The composite score combines the external scan, the questionnaire and known CVEs, then adjusts for access level, propagation and concentration. Every finding links to its evidence.

    Scope. Scan data comes from Shodan and Have I Been Pwned orchestrated with n8n: periodic, not real time.

  4. The vendor answers through a portal

    It receives a single-use link, answers without creating an account and uploads its evidence. Reminders go out automatically, and an analyst validates or challenges each answer.

    Scope. Until an analyst validates it, an answer is the vendor's self-assessment.

  5. A new CVE shows up on the vendor

    The CVE sync is daily (NVD, CISA KEV and EPSS, the likelihood of exploitation). Actively exploited CVEs weigh more in the score and raise an alert if you have a routing rule.

    Scope. The email notice to the vendor is triggered manually.

  6. You decide and it is on record

    Onboarding, renewal, post-incident review, periodic review or offboarding: each decision moves through defined states, with who made it and what evidence backed it.

    Scope. It is an auditable record; it does not replace your procurement process or act as a legal signature.

What it does, with its proof and its scope

Each claim carries, in the margin, where to check it and where it stops. The phases are the cycle's; here, seen from the vendor.

Source of proof

  • Public documentation
  • Open source
  • In the demo

Scope: what the claim does not cover

SENSE · collect evidence

Signals about the vendor from three sources: what shows from outside, what it answers itself and the vulnerabilities that affect it.

  1. External scanning of every vendor for exposed ports, CVEs and known breaches, using Shodan and Have I Been Pwned data.1

    Docs · Risk engine (opens in a new tab)

    Scope. Periodic rescans according to the vendor's criticality. Not an in-house scanner and not continuous monitoring.

  2. Questionnaire portal on a single-use link: the vendor answers without an account, uploads evidence and an analyst validates each answer.2

    Docs · Vendor guide (opens in a new tab)

    Scope. A questionnaire that has not been validated is the vendor's self-assessment.

  3. Daily CVE sync (NVD, CISA KEV and EPSS, the likelihood of exploitation) against each vendor's declared assets.3

    In the demo · vendor card

    Scope. Flags actively exploited CVEs; it does not email the vendor unless you trigger it.

Applies inSupply chain and SBOMEndpoint security

PREDICT · quantify and simulate

Turns the signals into risk you can compare across vendors, in points and in euros, over your dependency graph.

  1. A composite 0 to 100 score per vendor, with its severity band and the findings that explain it, each linked to its evidence.4

  2. FAIR/ALE exposure in euros per vendor and for the portfolio: a parametric point estimate with a simulated uncertainty band (uncalibrated).5

    Docs · Risk engine (opens in a new tab)

    Scope. Uses the model's sector parameters, not your loss data. The portfolio adds up expectations; there are no portfolio percentiles.

  3. A deterministic simulator with 7 scenario types: it propagates impact through the graph and returns affected vendors, score deltas and paths.6

    Docs · Simulator (opens in a new tab)

    Scope. Returns score changes, not euros. No AI: the natural-language scenario is a keyword matcher.

  4. HHI concentration and a 3-hop blast radius over the dependencies you declare, with single-point-of-failure detection.7

    In the demo · concentration view

    Scope. It only sees declared dependencies; it does not discover your whole chain by itself.

Applies inMulti-framework complianceDORA: concentration and ICT providers

ACT · propose and approve

Turns the decision into a recorded fact, with a person responsible for every step.

  1. HodeiAI proposes an entry in the risk register; only a person with a write role creates it, through a single-use, 15-minute approval bound to the proposal's hash.8

    In the demo · proposal and approval

    Scope. It is the only executable action today. It does not isolate hosts, contact vendors or open tickets.

  2. Alerts are routed to ServiceNow, Jira, Slack, Teams, email, a signed webhook, SIEM, PagerDuty and Opsgenie according to your rules.9

    Docs · Connectors (opens in a new tab)

    Scope. It notifies or creates the ticket in your system; it does not remediate.

  3. A vendor decision register with types (onboarding, renewal, review, offboarding), defined states and the evidence that backed each one.10

    Docs · Decision register (opens in a new tab)

    Scope. It does not replace your procurement process or act as a legal signature.

Applies inHodeiAI

ATTEST · prove it to third parties

What you can show outside without showing your vendor portfolio.

  1. The Trust Center issues, on demand, an ML-DSA-65 signed attestation of your maturity per framework that anyone can verify offline.11

    Open source · ATTEST verifier (opens in a new tab)

    Scope. Per-framework bands only: never scores, euro amounts or vendor detail. It proves integrity, origin and time, not truth, and it does not replace an audit.

Applies inTrust Center and ATTEST

SENSE feeds PREDICT; PREDICT prioritises what ACT proposes; ATTEST proves it to third parties.

What it does not do

So you decide with the exact scope in front of you.

  • It is not an in-house scanner and does not monitor in real time: vendor data comes from external sources with periodic rescans.
  • It does not draw your whole chain on its own: dependencies are the ones you declare, and SBOM-based discovery is not scheduled.
  • The FAIR uncertainty band is simulated and uncalibrated; it is not a breach probability.
  • It does not replace the questionnaire: it runs it and ties it to the score and to the decision register.
  • It does not contact your vendors on its own or run remediations.

How it connects to the other solutions

The vendor is the crossing point: the other solutions start from it or end at it.

Questions from whoever runs the vendors

The usual objections, answered as they are.

Does it replace my vendor questionnaire?

No. It runs it (delivery by link, reminders, evidence and analyst validation) and ties it to the vendor's score and to the decision register. You can keep using your own questions.

Does it scan my vendors in real time?

No. External scanning uses sources such as Shodan and Have I Been Pwned orchestrated with n8n, with periodic rescans according to vendor criticality. The CVE sync is daily. HodeiShield has no in-house scanner.

Does it discover my vendors' vendors on its own?

Not automatically. Concentration and blast radius are computed over the dependencies you declare. Nth-party discovery from SBOMs exists but is not scheduled yet, so we do not present it as a complete map.

How is the exposure in euros calculated?

With FAIR/ALE: a parametric point estimate in euros of annualised loss expectancy, plus a simulated uncertainty band (uncalibrated) that is reproducible. It uses the model's sector parameters, not your loss data. The band helps compare vendors and prioritise; it does not predict a breach.

What can HodeiAI do with a vendor?

Propose an entry in the risk register. A person with a write role approves it (single-use, 15-minute approval bound to the proposal's hash) and only then is it created. It performs no other action today.

Does this help with DORA and NIS2?

Yes, on the third-party side: vendor register, concentration, evidence and decisions. Being audit-ready depends on your evidence, not on the tool. See each regulation's use case for the detail.

See your vendors on the map

In the demo we walk the graph, the score and the decision register on one vendor from your portfolio.

The concepts, the risk engine and the simulator are in the public docs.

Request a demoRead the documentation (opens in a new tab)