The risk you cannot assess from outside

A third party is now involved in 48% of breaches, up from 30% the year before, according to the 2026 Verizon Data Breach Investigations Report. The tools most organizations use to manage that risk were built to assess it rather than detect it: a questionnaire records what a vendor tells you about its controls, and a rating estimates how exposed that vendor looks from the outside. Neither of them can tell you that your drawings are sitting on a contractor’s open server tonight.

  • Your documents on a vendor’s server
    Files, drawings and contracts exposed on unprotected servers belonging to vendors, partners and contractors.
  • The evidence to act
    The server, the protocol, the volume, what is inside the files and who they belong to.
  • An alert when a vendor is named
    When a vendor you have named is targeted or claimed as the victim of an attack, you hear about it.
  • Takedown
    Fileserver takedowns are included on every package, and we work the case until the exposure is removed.

What this looks like in practice

Three detections from real customer cases, each one a set of files belonging to our customer, found sitting on a server owned by one of their vendors.

10,051 files Aerospace manufacturer

Found on a vendor’s RSYNC server in France, including engine drawings.

170,000+ documents Energy company

Exposed through an FTP server in Kazakhstan.

2,500 documents Engineering services firm

Sitting on an NFS share in Hong Kong.

Ratings estimate the risk. We show what has already happened.

Security ratings look at a vendor from the outside and estimate how likely that vendor is to be breached, which makes them useful for deciding who to assess first and in what order. What they cannot do is tell you that your drawings are already sitting on that vendor’s open server.

CybelAngel starts where the rating stops, finding your data where it should not be and showing you what it is, where it sits and who put it there. On Core and Elite we go a step further and test whether that exposure can actually be used against you, so the question stops being how risky a vendor looks and becomes what has already left the building.

Estimate, detect, test

  • Estimate

    A rating tells you how a vendor looks from the outside, which helps you work out who to assess first.

  • Detect

    We show you what has already leaked, with your files located and counted on a server that should never have held them.

  • Test

    We check whether the exposure can be exploited, so you know which vendor to call first, on demand with Core and included with Elite.

What each package covers

Detection of your own data runs on every package, wherever that data has ended up, and vendor monitoring itself starts with Core.

  • Every package
    Your data is detected on exposed servers, including a vendor’s, and fileserver takedowns are included.
  • Core adds
    An alert when a vendor you name is targeted or claimed as a victim, a map of your vendors’ exposure, and vendor security testing on demand.
  • Elite adds
    Your vendors’ exposed credentials and data, dark web monitoring on your vendors, and vendor security testing included.

What you receive

Every detection arrives as a documented incident rather than an alert to investigate, carrying the evidence your team needs to go to the vendor the same day.

  • Where it is: the server, the protocol and the location.
  • How much: the volume of files exposed, counted rather than estimated.
  • What is inside: the files are read for their contents, so you know whether it is a parts list or a set of drawings.
  • Whose it is: the data is attributed to your organization before it reaches you.
  • A route to action: fileserver takedowns are included on every package.
image

Frequently Asked Questions

Vendor exposure is your organization’s data sitting outside your own perimeter, on systems belonging to the vendors, partners and contractors you work with every day. You cannot patch it, you usually do not know it is there, and an attacker who reaches it never has to touch your network at all.

A rating is an outside-in assessment of how a vendor looks, which estimates how likely that vendor is to be breached and is genuinely useful for deciding who to assess first. We do not produce a score at all. We find your data where it should not be and hand you the server, the volume and the contents, so you can go to the vendor with evidence rather than an estimate.

Questionnaires, audits and security ratings tell you how a vendor says it manages risk. CybelAngel shows what has actually happened: your data on a vendor’s exposed server, with the evidence to act. Use it alongside your TPRM tool, not instead of it.

Documents, drawings, contracts and configuration files left on unprotected FTP, SMB, NFS or RSYNC servers, open web servers and public file-sharing platforms, attributed to your organization.

For vendor alerts you do, because you name the vendors you want covered. For data detection you do not, since we look for your data on exposed servers and file shares across the internet, which is how exposures turn up at vendors you would never have thought to put on a list.

You get a documented incident containing the server, the protocol, the volume and what the files actually contain, all attributed to your organization before it reaches you. Fileserver takedowns are included on every package, and we work the case until the exposure is removed.

It gives you evidence of real exposure at your vendors to feed those assessments. It does not make you compliant on its own.

Detection of your own data runs on every package, wherever that data has ended up, including on a vendor’s server. Vendor monitoring itself starts with Core, and Elite adds deeper coverage of your vendors.