Hear it early, not weeks later
Attackers often post victims long before the official notice arrives. Hearing early is the difference between rotating credentials now and cleaning up later.
Vendor breach monitoring for TPRM, compliance and procurement teams
When a vendor gets breached, know first, with the response already written.
Cyber Pulse watches ransomware leak claims, regulator breach filings and security news for the vendors on your list. When one appears, you get an alert with the executive memo, the inquiry letter to the vendor, the controls to trigger and an audit evidence record, within minutes of it appearing in our data.
Public sources only, nothing installedSupports your SOC 2 / ISO 27001 vendor-monitoring evidenceNo third-party trackers
pulse://exampleillustration
- BreachExample Logistics GmbHTransportation · DE
- ExploitedExample VPN GatewayFlaw added to the exploited list
- ClaimSample Manufacturing Inc.Unverified extortion claim
- Zero-dayExample Firewall OSExploited before a patch existed
Fictional examples. See real activity on the live dashboard.
The incident brief
A vendor shows up in a report. This is what lands in your inbox.
With every vendor alert, Cyber Pulse writes the executive memo for leadership and the inquiry letter to the vendor, lists what to check and which controls to trigger, and keeps it all as an audit evidence record. You review, adjust and send.
INCIDENT BRIEF · SAMPLENorthwind Payroll Services · Reported · first seen Oct 27, 2026
Executive memo
Northwind Payroll Services: reported ransomware attack, our exposure under review
News outlets report that Northwind Payroll Services, our payroll processor, was hit by a ransomware attack on October 27, and a ransomware group claims to have taken data. Northwind has not yet confirmed what was accessed.
Northwind processes employee payroll records for Your Company, so personal data of our staff may be involved. We do not yet know whether our records were in the affected systems.
What we are doing: we have asked Northwind for a written account, rotated the API key used for payroll uploads and alerted finance to expect fake invoices.
Decision needed: whether to pause payroll file transfers until Northwind confirms containment.
Letter to the vendor
Subject: Security incident at Northwind Payroll Services: request for information from Your Company
Hello,
We have seen reports of a ransomware attack on Northwind Payroll Services. As your customer, Your Company needs to understand whether we are affected. Please answer in writing within 5 business days:
- Was any of our data, or any system or account connected to ours, affected?
- Was data taken, which data, and do you expect it to be published?
- Is the incident contained, and should we rotate credentials we share with you?
- Will you notify us formally under our contract?
[Your name]
[Your title]
Your Company
Exposure check
- Holds our customer or employee data?
- Connects to our network, SSO or APIs?
- Critical to our operations?
- Breach-notification deadline in the contract?
Controls to trigger
- SOC 2 CC9.2 · CC7.3–CC7.5
- ISO/IEC 27001:2022 A.5.19–A.5.22 · A.5.24–A.5.26
- NIST CSF 2.0 GV.SC-07 · GV.SC-08
- Your TPRM process event-driven reassessment
Audit evidence
A dated record with the facts, sources, memo, letter and controls, and a section for the vendor's answer and your decision. Print to PDF or download for your SOC 2 or ISO 27001 file.
Sample with a fictional vendor. The memo and letter are written by AI (Anthropic's Claude) from the public facts about the incident; the AI never sees your company's name, which is filled in on our server. The checklist and control references are standard, so your evidence is consistent.
Continuous third-party posture telemetry
For every vendor on your list: email and domain authentication as published (SPF, DMARC, MTA-STS, DNSSEC, CAA, registration lock), in one control verification matrix. Facts with sources, never a score.
Automated CISA KEV & zero-day supply-chain correlation
Flaws in your vendors' products and in the technology you run, matched against the CISA Known Exploited Vulnerabilities catalog and zero-day sources as they are published.
Zero-touch vendor security & email hygiene checks
Public records only: nothing installed, no scanning of your vendors, no questionnaires to chase. Each finding comes with a next action: act now, contact the vendor, or raise at the next review.
The blind spot
Your vendor’s breach becomes your incident. Often weeks later.
Most organizations learn a supplier was compromised from a notification letter or the news, long after attackers posted the data. Meanwhile the same groups are exploiting flaws in the firewalls and VPNs you run. The signals are public. They’re just scattered across dozens of sites nobody has time to watch.
Cyber Pulse watches them for you.
- Day 0Attackers post the victim on a leak site
The claim is public from that moment, if you know where to look.
- Days 1–10Security press and researchers pick it up
Reports, exploited CVEs and indicators start to surface.
- Weeks laterRegulator filing or customer notice
State attorneys general, SEC 8-K, the official letter.
- With Cyber PulseYou hear about it as soon as a public source tracks it
Usually within hours of a leak-site claim, clearly labelled unconfirmed until news or a filing confirms it.
Why you need it
Your vendors’ security is part of yours.
Every supplier, software vendor and service provider with access to your data or systems is part of your attack surface. Here’s what changes when you can see what’s happening to them.
Know what’s real
Every entry is labelled: an attacker’s claim, reported in the news, or confirmed by the company or a regulator. You act on facts and never escalate a rumour.
Fix what attackers actually use
Not every critical CVE matters this week. See the flaws exploited in the wild right now, how likely the rest are to be, and jump straight to the vendor’s fix.
Answer the hard questions fast
“Are we affected?” comes from leadership, customers and auditors within hours of a headline. Have the evidence, the timeline and the sources in one place.
One view instead of dozens of tabs
Leak trackers, government catalogs, regulator portals, vendor advisories and security news, merged and de-duplicated, so nobody on your team has to watch them all.
Third-party risk that keeps up
Annual vendor questionnaires go stale the day they’re filed. Continuous monitoring tells you when the answer changes.
How it works
Dozens of sources in. One signal out.
Each source is checked every 5 to 60 minutes, depending on how often it updates. How fast a breach shows up depends on the source: leak-site trackers usually within hours of a post, news within hours to days, regulator filings often weeks after the attack.
Collect
Leak-site trackers, regulator breach portals, government vulnerability catalogs, vendor security feeds and trusted security news, fetched on our servers, not in your browser.
Correlate
The same incident seen in five places becomes one record: de-duplicated, linked to news, tagged by industry and country, and labelled by evidence: claim → reported → confirmed.
Alert
When a match hits your vendor list, you get one clear email with the evidence and the next step. No noise, no repeats, and a new alert only when the status gets worse.
CISA KEVNVDENISA EUVDFIRST EPSSMicrosoft MSRCGoogle Project ZeroChrome ReleasesFortinet PSIRTZero Day InitiativeSEC 8-KState AG breach listsHave I Been PwnedRansomLookMITRE ATT&CKBleepingComputerThe Record+ more
Built the way you’d build it
Security people will inspect this. So we did first.
Privacy by design
No third-party trackers or ad scripts, and no cookies on the public pages. Your browser talks only to us, never to the feeds.
Hardened to OWASP
Strict Content-Security-Policy, HSTS, no third-party code, input escaping tested against thousands of injection payloads.
Responsible by default
Unconfirmed claims are labelled and their names held back, leak-site links are never published, and corrections are honoured.
Every claim sourced
Each entry links to where it came from, so you can verify before you act or brief.
Honest about coverage. Cyber Pulse only sees what is reported publicly. Many attacks are never posted, tracked or disclosed, so no match does not mean a vendor is safe. Use it alongside your vendor reviews, not instead of them.
Right now
See who’s been hit this month.
No sign-up, no email. Just the live picture.