VCRI
Value Chain Risk Institute
Inside data, not guesses.
The trusted neutral clearinghouse for vendor security posture data.
Learn How It Works
Inside data, not guesses.
The trusted neutral clearinghouse for vendor security posture data.
Learn How It WorksQuestionnaires. Annual audits. Self-attestation. The tools we use to assess vendor risk were designed for a world that no longer exists.
Vendors self-report. Nobody verifies. The incentive is to check every box, not to tell the truth.
Annual audits measure a single moment. Adversaries operate continuously. The gap is measured in months.
SolarWinds, MOVEit, and Change Healthcare all had clean audit reports. The audits didn't stop them from becoming catastrophic supply chain failures.
"Answer once. Share everywhere. Stop filling out 50 questionnaires a year."
Data is pulled directly from vendor security tools via API. The vendor doesn't choose what to export — reducing selection bias.
Actual telemetry is compared against the Secure Controls Framework — an objective, industry-standard baseline for what security should look like.
A 501(c)(3) board defines what gets collected, how it's scored, and who can see it. No vendor influence. No pay-to-play.
TIPPSS dimensions scored across six asset types at five maturity levels. The gap between actual and required level is the risk signal.
| TIPPSS Dimension | Devices | Applications | Networks | Data | Accounts | AI |
|---|---|---|---|---|---|---|
| Trust | 1–5 | 1–5 | 1–5 | 1–5 | 1–5 | 1–5 |
| Identity | 1–5 | 1–5 | 1–5 | 1–5 | 1–5 | 1–5 |
| Privacy | 1–5 | 1–5 | 1–5 | 1–5 | 1–5 | 1–5 |
| Protection | 1–5 | 1–5 | 1–5 | 1–5 | 1–5 | 1–5 |
| Safety | 1–5 | 1–5 | 1–5 | 1–5 | 1–5 | 1–5 |
| Security | 1–5 | 1–5 | 1–5 | 1–5 | 1–5 | 1–5 |
Each cell maps a TIPPSS dimension to an asset type with a CMM maturity level from 1 (Initial) to 5 (Optimizing).
The difference between a vendor's actual maturity and the required level produces a quantified risk signal tied to business impact.
Developed with Mitch Parker, CISO of Indiana University Health and IEEE standard co-chair.
Risk is expressed in dollars at risk per business process — not arbitrary scores or traffic-light dashboards.
VCRI's board brings decades of security leadership from government, healthcare, standards bodies, and critical infrastructure.
The global regulatory environment is moving toward exactly what VCRI provides: continuous, verified third-party risk monitoring.
The Digital Operational Resilience Act mandates continuous third-party ICT risk monitoring for financial institutions. Effective January 2025.
Continuous monitoring requirements for cloud service providers serving federal agencies. Moving beyond point-in-time assessments.
Hardware supply chain urgency. Banning foreign-manufactured routers highlights the need for verified hardware provenance across value chains.
We're building the foundational infrastructure for value chain security. Government agencies and strategic partners who want to be part of defining how this works at scale — reach out.