Vendor Analysis is an AI-generated briefing on a vendor, built by ZIN from publicly available information about the vendor's domain. It is background research — useful before onboarding, or as context when reading a questionnaire. It is not drawn from the vendor's own answers and it does not change the vendor's risk score.
vendor:add permission, which is what the analysis checks. View-only access to vendors is not enough.Navigation: Sidebar → Vendors → [select a vendor] → Vendor Analysis
The analysis starts as soon as the tab opens. There is nothing to click.
An AI Analysis in Progress card steps through what it is doing:
Leave the tab open until the report appears. A first-time analysis is allowed up to five minutes before it gives up.
A finished analysis is kept for 30 days per domain. Opening the tab again within that time shows the stored report almost immediately instead of researching the vendor again. After 30 days the next visit generates a new one.
There is no refresh or re-run button. You cannot force a new analysis from this tab.
The report opens with a note: The following content has been generated using ZIN. Please independently verify the information before making any decisions based on it. Take that seriously — this is research material, not an audited finding.
Each section below appears only if the analysis returned something for it, so a low-profile vendor shows fewer of them.
| Section | What it covers |
|---|---|
| Financial Stability | The vendor's financial standing |
| Business Continuity | Their resilience and continuity position |
| Incident History | A summary of past incidents affecting the vendor |
| Cyber Attacks & Incidents | Individual incidents, each with a date, a description, an Impact note and a View Source link to the original reporting |
| Data Privacy Compliance | Their data privacy and regulatory position |
| Third Party Dependencies | Who the vendor themselves depends on |
| Key Strengths | What the vendor does well |
| Key Risks | What to be cautious about |
| Market Position | Where they sit in their market |
| Security Posture | Their overall security maturity |
| Recommendations | Suggested next steps |
When the analysis also returns technical observations about the vendor's domain, a row of cards appears above the business sections. Any of these may be missing.
| Card | What it shows |
|---|---|
| Security Score | An overall grade for the domain |
| SSL Rating | The grade of the domain's SSL configuration |
| Exposed Services | Services found reachable from the internet |
| Security Headers | The status of the site's security headers, with Security Headers Details listing missing and present headers |
| Vulnerabilities | Known vulnerabilities, each with a severity |
| Exposed Endpoints | Endpoints found exposed |
| DNS Security | SPF, DMARC and DKIM status, with the records where found |
| SSL Certificate | Rating, Issuer, Subject, Valid From, Valid Until, Days Until Expiry, Status and Cipher Suite |
| Domain Information | IP address, DNS records and domain age |
These cards are a quick outside-in snapshot. For continuous external monitoring with findings you can turn into risks, use the Digital Risk tab. See How to Monitor Digital Risk (DRM).
Vendor Analysis is read-only. It does not create risks, it cannot be edited, and there is no export or download button. Anything you decide to track should be added as a risk on the vendor's Manage Risk tab. See How to Manage the Vendor Risk Lifecycle.
The Vendor Analysis tab shows an access-denied screen → Vendor Analysis is not available on on-premises installations.
The tab stays blank and the analysis never starts → The analysis runs against the vendor's company domain. Check on the Profile tab that the vendor has one.
The analysis fails or a colleague cannot run it → Running it needs the vendor:add permission. Someone with view-only access to vendors cannot run it.
The analysis is taking a long time → A first-time analysis can take up to five minutes. If it ends without a report, reload the page and open the tab again; a report that finished in the meantime is shown straight away.
The report is very thin or only shows the note at the top → The AI works from public information. Small or privately held vendors, and vendors with little web presence, produce less material, and sections with nothing to say are hidden.
The technical cards are missing → They only appear when the analysis returned technical observations for the domain. Their absence does not mean the vendor has no exposure; check the Digital Risk tab.
The report looks out of date → Reports are reused for 30 days and cannot be regenerated on demand. A new one is produced the first time the tab is opened after that.
Something in the report looks wrong → Follow the View Source link where one is given, and verify independently before making a decision.
Need more help? Contact support@zeron.one