The Vendor Monitoring page provides continuous visibility into vendor-related security events, compliance changes, and business risks. Risk signals are aggregated from multiple sources and presented in a unified timeline for review and action.

​
Signal Types

LowerPlane monitors 10 categories of vendor risk signals:
Data breach or security incident reported by the vendor. Example: vendor disclosed unauthorized access to customer data.
New vulnerability (CVE) affecting vendor software or infrastructure. Example: critical CVE found in vendor’s API library.
Material change in vendor’s financial status. Example: vendor’s credit rating downgraded.
Negative news coverage or public reports about the vendor. Example: vendor facing regulatory investigation.
SSL/TLS certificate or compliance certification approaching expiry. Example: vendor’s SOC 2 report expires in 30 days.
Change in vendor’s compliance posture or certifications. Example: vendor lost ISO 27001 certification.
Data handling incident such as leak, misuse, or unauthorized access. Example: vendor employee accessed customer data without authorization.
Vendor merger, acquisition, or ownership change. Example: vendor acquired by private equity firm.
Government or regulatory enforcement action against vendor. Example: vendor fined by ICO for GDPR violation.
Major service disruption or downtime event. Example: vendor experienced 12-hour global outage.

​
Signal Sources

Risk signals are collected from both automated and manual sources.

​
Security & Vulnerability Sources

​
News & Business Intelligence Sources

​
Compliance & Certification Sources

​
Operational Monitoring Sources

​
Connected Integration Sources

​
Manual Reporting

Team members can manually create risk signals for:
  • Findings from vendor security reviews and on-site audits
  • Audit observations and due diligence findings
  • Customer complaints about vendor performance or security
  • Internal risk assessments and pen test results
  • Information from vendor relationship managers

​
Signal Lifecycle

Each risk signal progresses through the following statuses:
1

New

Signal detected and awaiting review. Appears in the monitoring feed with severity badge.
2

Acknowledged

Reviewed by a team member. The reviewer is recorded along with the timestamp.
3

Investigating

Active investigation or remediation in progress. Impact assessment may be added.
4

Resolved / Dismissed

Resolved: Issue addressed and risk mitigated. Resolution notes are recorded. Dismissed: Signal determined to be non-applicable or false positive.

​
Severity Levels

​
Integration with Vendor Risk Management

  • Risk signals are linked to specific vendors in the vendor register
  • Critical signals can trigger automatic risk level re-assessment
  • Signal history is included in vendor risk assessment reports
  • Unresolved signals are flagged during vendor review cycles
  • Signal trends contribute to vendor overall risk scoring