Why VCRI?
What The Value Chain Risk Institute is, the problem it exists to fix, and how to use what it has built.
Joshua Marpet and Cairn Viktor
Vendors are grading their own homework.
Questionnaires, annual audits and self-attestation decide whether we trust the companies we depend on. Those tools were designed for a world that no longer exists.
Three problems with vendor assessment today
Vendors self-report. Nobody checks. The incentive is to check every box, not to tell the truth.
An annual audit measures one moment. Attackers work continuously. The gap is measured in months.
Each customer sends its own form, so the same vendor answers the same questions again and again.
A neutral nonprofit
The motto: inside data, not guesses.
The Value Chain Risk Institute is a nonprofit and a neutral party.
Its purpose: a trusted clearinghouse for vendor security posture evidence.
“We grade evidence, we do not sell your data, and no vendor can buy a better result.”
Methods are open, so anyone can check how a result is reached.
The Cyber Assurance Matrix (CAM)
Trust, Identity, Privacy, Protection, Safety, Security.
From the TIPPSS framework (IEEE/UL 2933).
People, Processes, Technology, Data, Facilities, AI.
Adopted by the VCRI board on March 16, 2026.
Each of the 36 cells gets a level from 1 (Initial) to 5 (Optimizing).
Based on the Capability Maturity Model Integration (CMMI) scale.
The gap is the risk
Traditional risk asks you to guess likelihood and impact. CAM asks what is unverified.
How mature a vendor needs to be in each cell, given what you depend on it for.
How mature the evidence shows the vendor really is.
= risk signal
BeaconScore: check the arithmetic
Free, runs in your browser, licensed CC BY 4.0. Score a vendor, or yourself.
Six rubrics, one per PPTDF-AI asset class, each scored 0 to 5.
Every weight is public.
Grades A through F.
A very weak dimension caps the grade, so one strength cannot hide a failure.
Release notes record every rubric change and why, so results can be re-run and compared.
Beacon Collector (beta)
Open source. Beta scores use a draft method and are labeled that way.
Reads the security tools you already run: scanner results, SBOMs, identity-provider exports and more.
Your evidence stays with you.
Every item is hashed; the package carries one fingerprint and a signature. Change one byte and verification fails.
Scored against the open rubrics on a one-page results view.
Built to be used, not sold
Cyber Manual Builder, TARA Builder, and Context and Conditions of Use Builder.
Run in your browser; nothing uploaded.
Lists everything an AI agent depends on as a CycloneDX AI bill of materials.
Open source, Apache-2.0.
Can an AI system be trusted with what it reads, remembers and does?
7 dimensions, 40 questions.
Small businesses, small utilities, community banks and credit unions, rural hospitals.
Plus a plain-language glossary.
State of the Supply Chain
A quarterly report on open-source supply-chain risk, with methodology and data you can check.
open-source packages classified in the Q3 2026 issue, the entire published corpus.
how far the headline abandonment number moves between equally defensible definitions. The honest unit is a band.
Band table, watch list and verification evidence published with every issue, plus the mistakes caught along the way.
What to do Monday
- Score one vendor, or your own team, with BeaconScore at valuechainrisk.org/scorer.
- Take the two-minute Security Tools Poll, so the Beacon Collector learns the most-used tools first.
- Find your local security groups, or share a field kit, from valuechainrisk.org/community.
- Read a State of the Supply Chain report and send a correction if you find one.
- Reach the Institute at info@valuechainrisk.org.
Free to use, teach and share.
This deck is part of the VCRI Learn series. Use it in your class, your team meeting or your chapter, with credit to The Value Chain Risk Institute.
valuechainrisk.org/learn