RiskHub FAQs

RiskHub is CTM360's Third-Party Risk Management (TPRM) platform. It gives you continuous, outside-in visibility into the security of your vendors, suppliers, partners and subsidiaries.

Your security is only as strong as the vendors connected to you. A weak spot at a supplier can become a way into your organization, so knowing their security posture is part of knowing your own.

Traditional TPRM leans on questionnaires filled in once a year, which tell you what a vendor believes about itself. RiskHub adds continuous external monitoring, so you see real, observable risks as they appear, not only at assessment time.

RiskHub combines automated vendor security assessments using questionnaires mapped to 190+ compliance frameworks with continuous external risk monitoring, identifying vulnerabilities, misconfigurations, exposures, and providing compliance scores and standardized security risk ratings.

No. RiskHub uses externally available intelligence, so vendors don't need to install anything or grant access to their systems.

Vendors, suppliers, business partners, service providers, subsidiaries and any other organization in your extended network.

Each vendor gets a risk score based on what's visible externally and how they answered your assessment. Sorting by score shows which suppliers need attention now and which can wait.

RiskHub helps manage existing vendors through automated compliance assessments, continuous external risk monitoring, cybersecurity risk scoring, and vendor benchmarking. It enables organizations to track security posture, identify emerging risks, and prioritize vendors based on criticality.

Yes. You can build configurable questionnaires and assessment workflows around your own requirements and compliance frameworks. Results sit next to the external findings, so answers can be checked against evidence.

No, it makes them more reliable. Vendors may not know about, or may not report, every issue. RiskHub's external view catches observable risks that a self-assessment can miss, giving you something to check their answers against.

Yes. Vendors can be grouped into portfolios, for example by category or business unit, and compared with each other, with their industry, and with peer groups.

Before you sign, RiskHub shows a prospective vendor's external security posture, so risk becomes part of the buying decision instead of something discovered afterwards.

Where the information is available, yes. RiskHub can shed light on your vendors' own dependencies, the fourth parties you may never deal with directly but still rely on.

Both teams see the same vendor risk data. Security gets the technical detail, procurement gets a clear risk picture, and conversations start from shared facts.

External-first means RiskHub starts with what an attacker can see, not with what a vendor says about itself. Questionnaires still matter, but evidence comes first. It's the same outside-in approach CTM360 applies to your own organization, extended to your suppliers.