Third-Party Security Review Agent

Before a new supplier gets your data, security must review it, but questionnaires take weeks and answers are often accepted without checking evidence. This agent sends the right questionnaire based on the data the vendor will handle. It reads the answers and attached evidence such as certifications and test reports, and checks that the evidence supports each answer and is current. It also checks public sources for past breaches. Gaps produce specific follow-up questions to the vendor contact. After follow-up it checks again. If answers are still weak, it rates the risk and suggests contract terms to cover the gap. You approve the final risk rating and any exception. Edge case: an expired certificate is treated as no certificate until the vendor provides the new one.