Digital Risk Monitoring (DRM) scans a vendor's internet-facing infrastructure and shows you what an attacker could see from outside. It is the objective counterpart to the questionnaire: the questionnaire is what the vendor tells you, DRM is what their public footprint shows.
The scan is requested automatically when a vendor is added, using the vendor's company domain.
vendor:digital:view permissionThe scanner always works on the registered root domain. If a vendor is saved with a subdomain such as portal.example.com, the scan is run against example.com, but the Digital Risk tab looks for results under the exact domain saved on the vendor and finds none. The tab then stays empty.
Enter example.com, not www.example.com or portal.example.com. Country-code domains such as example.co.uk are treated as root domains.
The domain cannot be changed from the vendor's edit form. If a vendor was created with a subdomain, delete it and add it again with the root domain. See How to Add a Vendor.
Navigation: Sidebar → Vendors → [select a vendor] → Digital Risk
While the Digital Risk tab is open, a scan indicator appears in the tab bar next to the vendor's onboarding status. It is not shown on the other tabs.
| Indicator | Meaning |
|---|---|
| Scan Queued | The scan has been requested and is waiting to start |
| Scan In Progress | The scan is running |
| Scan Completed | The latest scan finished and its results are shown |
| Scan Failed | The latest scan did not finish |
Hover the indicator to see the scan's Progress and the Last Scan date.
To restart a scan:
easm:target:add permission.The top of the page has four cards:
| Card | What it shows |
|---|---|
| Risk Score | The calculated risk level for the vendor's assets, with a severity label |
| Likelihood of Exploitation | The estimated probability of the discovered vulnerabilities being exploited |
| Assets Inventory | Counts of discovered assets: Domain, Sub-Domains, IP Address, Active, Inactive, WAF Protected and WAF Exposed |
| Findings by Severity | A doughnut chart of findings split into Info, Low, Medium, High and Critical, with the total in the centre |
When no risk score can be produced, the card says why: Please add an asset to enable the calculation of the risk score. or No risk is detected for the added assets. The findings card has matching messages: Please add an asset to enable the detection of vulnerabilities. or No vulnerabilities detected for the added assets.
| Tab | What it shows |
|---|---|
| Overall Sections | Four summary cards — Exposed Ports, Technology Stack, Lookalike Domains and Exposed Cloud Findings — plus a deep risk correlation panel |
| Asset Wise Risk Breakdown | The discovered assets listed individually with their risk |
| Exposed Secrets Found | Credentials and secrets detected in the vendor's public footprint |
| Threat & Breach Intel | Threat and breach intelligence gathered for the vendor. It loads when you open the tab. |
| All Security Findings | Every finding with its Category, Findings name, Asset Count, Risk Severity and an Action column |
| Graph Analysis | A visual graph of the vendor's assets and how they relate |
| Card | What the category means |
|---|---|
| Exposed Ports | Ports that are exposed to external networks. These may pose security risks if misconfigured. |
| Technology Stack | The frameworks and platforms in use |
| Lookalike Domains | Domains that appear similar to the vendor's domain, often used in phishing |
| Exposed Cloud Findings | Exposed cloud services or data, highlighting improperly secured assets |
Navigation: Sidebar → Vendors → [vendor] → Digital Risk → All Security Findings
The finding becomes a risk on the vendor's Manage Risk tab with Risk Source shown as DRM. Its title is the finding's name and its exposure is taken from the finding, so it arrives with a severity already set. The vendor's assigned manager becomes the assignee and is notified by email.
From there it follows the same lifecycle as any other risk. See How to Manage the Vendor Risk Lifecycle.
Raising the risk needs the vendor:risk:add permission.
| Assessment type | Data source | Strength |
|---|---|---|
| Questionnaires | Vendor self-reported | Detailed internal controls and process information |
| Digital Risk (DRM) | External scanning | Objective view of the vendor's public exposure |
Use DRM to sanity-check questionnaire answers. If a vendor reports strong patching and DRM shows critical findings on their public estate, raise that gap in the assessment review.
Digital risk data can also be included in the vendor's Detailed report. See How to Generate Vendor Risk Reports.
The Digital Risk tab shows an access-denied screen → Three things gate this tab: you need vendor:digital:view, the vendor must have a company domain, and DRM is not available on on-premises installations.
The tab opens but every card is empty → Check the vendor's domain on the Profile tab. If it is a subdomain, results cannot be matched to the vendor — recreate the vendor with the root domain. If it is already the root domain, check the scan indicator: a queued or in-progress scan has nothing to show yet.
There is no scan indicator in the tab bar → It only appears on the Digital Risk tab, and only once a scan exists for the vendor's domain.
There is no Restart Scan icon → Restarting needs the easm:target:add permission, and the icon is hidden while a scan is in progress.
The indicator says Scan Failed → Restart the scan. If it fails again, contact support with the vendor's domain.
One tab is empty while others have data → Each tab is fed by a different kind of check. A vendor can have no exposed secrets while still having security findings.
I clicked Add Risk but cannot see the risk → Open the vendor's Manage Risk tab. If a status card is selected there, click All.
Add Risk fails → Raising a risk needs vendor:risk:add.
The risk score here differs from the vendor's compliance figure → They measure different things. This score comes from externally observed findings; compliance comes from assessment responses.
Need more help? Contact support@zeron.one