The Supply-Chain Governance Log

Field research for CISOs and assurance engineers.

Assurance EngineeringOct 16, 2026·8 min read

Deterministic Risk Scoring vs. Opaque Black-Box Grades During External Audits

Why CISOs and external auditors reject unexplainable 0-to-100 vendor scores, and how version-pinned rule trees keep every tier assignment reproducible.

By Maren Solberg, Head of Rules Engine EngineeringRead dispatch →

Assurance Engineering·Oct 4, 2026

Mapping Fourth-Party Concentration Risk Across 400 SaaS Sub-Processor Lists

Your approved vendors rely on an overlapping web of auth, analytics, and inference providers. Here is how automated sub-processor diffing catches hidden single points of failure.

Lukas Vetter · 6 minRead →

Field research for CISOs and assurance engineers.

Deterministic Risk Scoring vs. Opaque Black-Box Grades During External Audits

Mapping Fourth-Party Concentration Risk Across 400 SaaS Sub-Processor Lists

Ready to retire 240-row security spreadsheets?