Part of Defend, in progress — Threat Intel and Security are now part of Defend, not separate products. This area is still being built: some screens, menu names and actions described here may not be available yet, or may still show the older Threat Intel or Security names.
Overview
Legacy-capability note: the supply-chain vendor domain breach-cross-check described on this page reflects the retired standalone Threat Intel product (now part of Defend), which used a HIBP enterprise domain-search feed. The live dark-web / breach monitoring that ships today is Enzoic, and it is per-account by email only — it does not perform vendor-domain breach checks (Enzoic gates domain search behind domain-ownership verification, which the integration deliberately avoids). Treat vendor-domain supply-chain monitoring as a legacy/unbacked capability until re-verified against a live implementation.
Defend threat intelligence's supply-chain risk feature monitors the vendors your clients depend on for signs of compromise. It cross-checks each registered vendor's domain against breach data and opens an alert when a vendor has been found in a breach. This is a Complete-tier feature. MSP security analysts use it to identify third-party risk before vendor breaches translate into client incidents.
Note: Defend threat intelligence does not include CVE or vulnerability database scanning. The external-threat intelligence it provides is exposure-based — breach data, credential dumps, and domain impersonation — not vulnerability scanning of internal assets.
How Supply-Chain Risk Monitoring Works
Once you register a vendor and its domain, a background scanner runs three times per day and queries HaveIBeenPwned for the vendor's domain. If a breach is detected, Defend threat intelligence creates a vendor alert and emits a threatintel.supply_chain_alert bus event.
You can then open the alert and request a risk analysis, which provides a tailored assessment for that vendor based on the breach data found.
Registering a Vendor
- Go to Supply Chain.
- Click Add Vendor.
- Enter the vendor name and domain. The domain is required — HIBP breach checks run against the domain, not the name.
- Click Save.
The vendor enters the scanner queue and will be checked on the next scheduled run (up to three times per day).
Reviewing a Vendor Alert
- Open the vendor alert from the Supply Chain list.
- Review the breach data returned for the vendor's domain.
- Click Risk Analysis to view a tailored assessment of the risk this breach poses to your clients.
- Click Acknowledge or Resolve to update the alert status.
Interpreting the Risk Analysis
The risk analysis for a vendor is specific to the breach data found on that vendor's domain. It includes recommended actions based on the type of data exposed. Use this analysis to inform client conversations about whether to rotate credentials for vendor portals, audit integrations, or escalate to the client's vendor management process.
FAQ
A vendor alert says "domain not monitored" — what does that mean? The vendor was added without a domain, or the domain field was left blank. Go to the vendor record and add the domain. Without a domain, the HIBP breach check cannot run and the vendor will not be scanned.
Does this feature scan for unpatched CVEs in vendor software? No. Supply-chain monitoring checks whether the vendor's domain has appeared in known breach data — it is exposure-based, not vulnerability-based. It does not scan software or systems for CVEs.
How many vendors can I monitor? The source documentation does not specify a hard limit. If you encounter limits, contact your account administrator.