This guide is focused on orienting platform users on how to use Supply Chain Intel.

Just like other platform workspaces, a Vendor is an asset that must be added to monitoring before data collection begins.

To add a vendor, go to Settings → Monitoring settings → Asset management, open the Digital Risk tab, and click Add asset. From the asset type list, choose Vendor ("Gain visibility into your vendor ecosystem").

Following this flow, you will reach the screen below:

Type the name of the vendor you want to monitor and select one from the dropdown list that appears.

You can select multiple vendors at once for bulk addition.

If the desired vendor does not appear in the dropdown, it may not yet be in Axur's vendor catalog. In this case, click "Suggest a Vendor" and provide the vendor's name and domain. The SLA for new vendor inclusion is 24 hours.

Under Monitoring setup, keep the Supply Chain Intel → Vendor toggle enabled to monitor credential leaks, exposed infrastructure, and threat intelligence bulletins. Optionally, set the Critical bulletin categories that should be treated as critical for these vendors (e.g., Malware, Data Breach, Vulnerability, Ransomware, Zero Day, Supply Chain Attacks, Remote Code Execution, Denial of Service). This selection drives the Critical flag and the "Only critical" filter in the vendor's Threat Landscape. Finally, click "Save Asset" to add the vendors to your monitored list.

The vendor list consolidates all vendors added to monitoring. It displays global monitoring indicators and summarized data per vendor, with columns for Corporate Creds, Customer Creds, Dark Web, Bulletins (with a badge for critical bulletins), Vulnerabilities, Expired Certs, and Tags, plus filtering, sorting, and tag assignment capabilities.

In the Bulletins column, a badge next to the total shows the number of critical bulletins for each vendor, bulletins that match the Critical bulletin categories defined for it, so you can spot at-risk vendors at a glance directly from the list.

At the top of the list, you can view high-level indicators that aggregate data across all monitored vendors:

These values are affected by the active vendor filter.

To quickly find a specific vendor, use the search filter at the top-left of the screen. Type the vendor name and the list filters automatically.

The vendor filter also affects the values shown in the summary indicators above the list.

The vendor list can be sorted in ascending or descending order by any column. Click a column header to sort; click it again to reverse the order. This is useful for identifying the most critical vendors or those with the highest volume of findings in your portfolio.

Tags allow you to categorize and organize your monitored vendors. They are client-specific; one client's tags are not visible to other clients.

Clicking on a vendor in the list opens the Vendor Details page, which presents the full intelligence report organized in tabs: Overview, Threat Landscape, Attack Surface, Employee Credentials, Customer Credentials, and Dark Web. Use Export (top-right) to download the full report as a PDF. Across all sections, trend indicators show each key metric's variation, week-over-week (WoW) for Dark Web mentions, expired certificates and vulnerable assets, and month-over-month (MoM) for employee and customer credentials.

The top of the Vendor Details page displays general information about the vendor, including a brief description, website, market segment, and trust center contact (when available). This information is pre-loaded by Axur and maintained in the vendor catalog.

The Overview tab summarizes the vendor's current posture at a glance:

How to use it: Use the Overview as your first-stop triage, your command center for the vendor. Before onboarding a new vendor, start here for an instant read before going deep. When an alert fires, open this page first to understand the full picture before jumping to a specific tab. It answers the question, "Is this a vendor I should be worried about right now?"

This section provides a threat intelligence overview of the vendor based on Axur's CTI monitoring sources.

How to use it: When a ransomware group announces they've hit a supplier, it often shows up here before mainstream news. If a critical vendor appears with a data breach bulletin, assess your exposure: check what data or access that vendor holds, review your connections and integrations, and open an internal ticket for remediation or escalation. The signal is already vendor-contextualized; no need to filter irrelevant global noise.

This section maps the vendor's publicly exposed infrastructure and identifies exploitable weaknesses.

EASM data is refreshed weekly.

How to use it: Risk-based prioritization. Everything here is derived from passive fingerprinting — we never touch the vendor's systems; this is exactly what an attacker can see from the outside. If a vendor runs a critical integration with your environment and shows a high-severity CVE in an exposed service, treat it as active risk, not a compliance flag: bring the CVE and affected service to the vendor with a remediation timeline. It also informs your compensating controls, tightening internal network segmentation for that connection while you wait for them to patch.

This section shows corporate credentials belonging to vendor employees that have been found exposed in malware logs (infostealers) or third-party data breaches.

Employee credential leaks indicate a risk of unauthorized access to the vendor's own systems. This data is refreshed weekly.

How to use it: Treat a spike in employee credential exposure as a third-party compromise indicator. A significant volume of recent exposures, especially from infostealers, which means active malware rather than old breaches, warrants increased monitoring of traffic from that vendor's systems and a review of the access tokens or API keys shared between you. In incident response, one beta customer used this tab to check whether credentials from an Atlassian incident were recent or historical, which directly informed how they communicated the risk to their crisis team.

This section shows credentials of end-users captured by malware while they were accessing the vendor's applications or services.

Customer credential leaks indicate that users of the vendor's platform may have compromised devices. This represents a downstream risk that can affect your organization if it uses the same vendor applications. This data is refreshed weekly.

How to use it: Threat hunting and incident-response scoping. If you're investigating a potential compromise and a vendor's platform appears here with a high count of affected users, immediately check whether any of those credentials map to your organization's domain, the pivotal question is "were my people affected through this vendor?" Once you confirm exposure, initiate password resets, revoke active sessions, and audit what those users accessed on the vendor's side around the exposure date.

This section monitors the vendor's presence in cybercrime communities across the Dark Web, Telegram channels, and underground forums.

Dark Web data is refreshed up to 4 times per day.

How to use it: Your early-warning radar. By the time an attack makes the news, the planning has often been happening in these channels for days or weeks. The AI summary isn't just noise counting; it identifies what the conversation is about: someone selling access, an actor claiming a compromise, or coordinated discussion of exploiting a specific service. If a known ransomware group mentions your vendor in the context of unauthorized access or data exfiltration, respond immediately: escalate internally, alert the vendor, and, if your environment is connected to theirs, move to active threat hunting. This is the window where you can still contain the blast radius.

You can consume vendor intelligence in your own systems (SIEM, ticketing, SOAR). Integrations are managed under Settings → API & Integrations.

Configure automated alerts triggered by relevant changes in your monitored vendors. Alerts can be scoped per vendor and per event type (for example, new critical bulletins, expired certificates, new credentials, or Dark Web activity) so you focus on what matters and avoid alert fatigue. The Critical bulletin categories you set when adding a vendor determine which bulletins are treated as critical for alerting.

If you have any questions, feel free to contact us at [email protected] 😊