Supply Chain Intel

As with other workspaces on the platform, a Vendor is an asset that must be added to monitoring before data collection begins.

To add a vendor, go to Settings > Monitoring settings > Asset management, open the Digital Risk tab, and click Add asset. From the list of asset types, select Vendor ("Gain visibility into your supplier ecosystem").

Following this flow will take you to the screen below:

enter the name of the vendor you want to monitor and select an option from the drop-down list that appears.

You can select multiple vendors at once for bulk addition.

If the desired vendor does not appear in the drop-down list, it may not yet be in Axur's vendor catalog. In this case, click Suggest a vendor and provide the vendor's name and domain. The SLA for adding a new vendor is 24 hours.

In Monitoring settings, keep the Supply Chain Intel > Vendor toggle enabled to monitor credential leaks, exposed infrastructure, and threat intelligence bulletins.

Optionally, define the Critical bulletin categories that should be treated as critical for these vendors (for example, Malware, Data Leak, Vulnerability, Ransomware, Zero Day, Supply Chain Attacks, Remote Code Execution, and Denial of Service).

This selection determines the Critical label and the Critical only filter in the vendor's Threat Landscape.

Finally, click Save asset to add the vendors to your monitored list.

The vendor list consolidates all vendors added to monitoring. It displays global monitoring indicators and summarized data by vendor, with columns for Corporate Credentials, Customer Credentials, Dark Web, Bulletins (with a badge for critical bulletins), Vulnerabilities, Expired Certificates, Phishing, Lookalike Domains, and Tags, as well as filtering, sorting, and tag assignment features.

In the Bulletins column, a badge next to the total shows the number of critical bulletins for each vendor—those that match the Critical bulletin categories defined for that vendor—so you can quickly identify vendors at risk directly from the list.

At the top of the list, you can view high-level indicators that aggregate data from all monitored vendors:

These values are affected by the active vendor filter.

To quickly find a specific vendor, use the search filter in the upper-left corner of the screen.

Enter the vendor's name, and the list is filtered automatically.

The vendor filter also affects the values displayed in the summary indicators above the list.

The vendor list can be sorted in ascending or descending order by any column.

Click a column header to sort; click it again to reverse the order. This is useful for identifying the most critical vendors or those with the largest volume of findings in your portfolio.

Tags allow you to categorize and organize your monitored vendors. They are customer-specific—one customer's tags are not visible to other customers.

Creating tags: Users with a Manager or Expert profile can create custom tags directly in the vendor list by interacting with the tag cell in any vendor row.

Assigning tags: Click a vendor's tag cell to add or remove tags. Multiple tags can be assigned to the same vendor.

Filtering by tag: Use the tag filter at the top of the vendor list to display only vendors associated with a specific tag. This helps you group vendors by risk level, business unit, contract status, or any custom category you define.

When you click a vendor in the list, the Vendor Details page opens, presenting the complete intelligence report organized into tabs: Overview, Threat Landscape, Attack Surface, Employee Credentials, Customer Credentials, Dark Web, and Phishing & Lookalike Domains. Use Export (upper-right corner) to download the complete report as a PDF.

Across all sections, trend indicators show the change in each key metric—week over week (WoW) for Dark Web mentions, expired certificates, and vulnerable assets, and month over month (MoM) for employee and customer credentials.

The top of the Vendor Details page displays general information about the vendor, including a brief description, website, market segment, and Trust Center contact (when available). This information is preloaded by Axur and maintained in the vendor catalog.

The Overview tab quickly summarizes the vendor's current security posture:

How to use: Use Overview as your first triage stop—your command center for the vendor. Before onboarding a new vendor, start here for an instant read before going deeper. When an alert is triggered, open this page first to understand the full picture before going to a specific tab. It answers the question, "Is this a vendor I should be concerned about right now?"

This section provides an overview of the vendor's threat intelligence based on Axur's CTI monitoring sources.

How to use: When a ransomware group announces that it has breached a vendor, this often appears here before it reaches the traditional press. If a critical vendor appears with a data-leak bulletin, assess its exposure: check what data or access this vendor has, review its connections and integrations, and open an internal ticket for remediation or escalation. The signal is already contextualized by vendor, with no need to filter out irrelevant global noise.

This section maps the vendor's publicly exposed infrastructure and identifies exploitable weaknesses.

Collection is non-intrusive and performed from the outside: we open ordinary connections to services that the vendor itself has already published on the internet and read what they return. We never inject code, run exploits, or attempt authentication. Vulnerabilities are inferred, not tested: we compare the software version reported by the service with vulnerabilities publicly cataloged as CVEs (Common Vulnerabilities and Exposures). We never attempt to exploit or confirm a vulnerability—even known ones.

How to use: Risk-based prioritization. Everything here is what an attacker can see from the outside, without privileged access. If a vendor maintains a critical integration with your environment and has a high-severity CVE in an exposed service, treat it as an active risk, not as a compliance checkbox: bring the CVE and affected service to the vendor with a remediation deadline. This also guides your compensating controls—reinforce internal network segmentation for this connection while you wait for the fix.

This section shows corporate credentials belonging to the vendor's employees that were found exposed in malware (infostealer) logs or third-party data leaks.

How to use: Treat a spike in employee credential exposure as an indicator of third-party compromise. A significant volume of recent exposures—especially from infostealers, which indicates active malware rather than old leaks—warrants closer monitoring of traffic from this vendor's systems and a review of access tokens or API keys shared between you. During incident response, a beta customer used this tab to check whether credentials from an Atlassian incident were recent or historical, which directly guided how it communicated the risk to its crisis team.

This section shows end-user credentials captured by malware while they were accessing the vendor's applications or services.

Customer credential leaks indicate that users of the vendor's platform may have compromised devices. This represents a downstream risk that may affect your organization if it uses the vendor's applications. This data is updated weekly.

How to use: Threat hunting and incident-response scoping. If you are investigating a potential compromise and a vendor's platform appears here with a high number of affected users, immediately check whether any of these credentials match your organization's domain—the central question is, "Were my people affected through this vendor?" Once the exposure is confirmed, begin resetting passwords, revoke active sessions, and audit what those users accessed on the vendor's side around the exposure date.

This section monitors the vendor's presence in cybercrime communities on the Dark Web, Telegram channels, and underground forums.

How to use: Your early-warning radar. When an attack reaches the news, planning has often already been underway in these channels for days or weeks. The AI summary is not just a count of noise: it identifies what the conversation is about—someone selling access, an actor claiming a compromise, or a coordinated discussion to exploit a specific service. If a known ransomware group mentions your vendor in the context of unauthorized access or data exfiltration, respond immediately: escalate internally, alert the vendor, and—if your environment is connected to theirs—begin active threat hunting. This is the window in which you can still contain the blast radius.

This section monitors lookalike domains (lookalike/typosquatting) and phishing pages impersonating the vendor's brand—signals that the vendor is being used as bait in attacks that may reach your organization.

This data is updated every 6 hours.

How to use: Impersonation of the vendor's brand is a sign of an attack in preparation—often against its customers and partners, including you. Prioritize by Risk score and threat indicators: a domain with active MX, login page, and SSL is already armed to capture credentials, while a newly registered domain is still only a potential exposure. When you find an active campaign impersonating a critical vendor, escalate internally, alert the vendor, and use View all to track the campaign's evolution in Threat Hunting.

You can consume vendor intelligence in your own systems (SIEM, ticketing, SOAR).

Integrations are managed in Settings > API and Integrations.

Event types include: new bulletins, new critical bulletins, expired certificates, top threat actors, new corporate credentials, new customer credentials, and new lookalike domains (phishing and lookalike domains).

Feeds can be filtered by assets, customers, and sections (deep-dark-web, attack-surface, bulletins, critical-bulletins, corporate-credentials, customer-credentials, lookalike-domains).

Configure automatic alerts triggered by relevant changes to your monitored vendors.

Alerts can be scoped by vendor and event type (for example, new critical bulletins, expired certificates, new credentials, Dark Web activity, or new lookalike/phishing domains) so you can focus on what matters and avoid alert fatigue. The Critical bulletin categories defined when adding a vendor determine which bulletins are treated as critical for alerts.