Notes on connecting a third party's own cloud and SaaS accounts with read-only credentials, on how the Security Score is composed, on the fix-first remediation queue and on evaluating CIS, NIST 800-53, PCI DSS 4.0, ISO 27001, GDPR, DORA, FedRAMP, GxP and C5 without a single questionnaire. Every article ships with the real 1stone console screens.
A security rating reads what is visible from the public internet. A questionnaire reads what the third party is willing to write down. Neither one opens an account and checks a configuration. That is the gap an inside-out program closes.
Read article
Long-form material on how third-party risk is actually measured: the problem with outside-in signals, the architecture that replaces them and the operating cadence that keeps a third party's posture converging.
Every scan target follows the same pattern: the third party creates a role or service account scoped to read-only access, adds it as a scan target inside its workspace, and the platform takes it from there.
A single number is only useful if you can explain what moved it. The Security Score aggregates passed and failed controls, weighted by severity, across Cloud, Identity and SaaS, and is recalculated on every new assessment.
A backlog of a thousand open alerts is not a program. A queue that tells a third party which ten to close this week, ranked by severity and effect on the score, is.
Nine frameworks, one set of connected accounts. The same evidence collected from Cloud, Identity and SaaS is mapped to each framework's controls, so coverage is a pass/fail state instead of a self-reported answer.
A finding that never becomes a case is invisible to the program. A case without a service level never gets prioritized. The cycle exists to make sure neither of those failure modes happens quietly.
Once a scan target is connected, its resources appear in a single inventory: buckets, databases, instances, identities, networks — filterable by provider and category instead of scattered across provider consoles.
Underneath every framework is the same catalog of policies. Reading adherence at the policy level explains exactly which control failed and where, instead of stopping at a framework-level pass or fail.
Exposure here is not inferred by scanning the internet for the third party's assets — it is read directly from the connected accounts: which resources are public, which ports are open, and where they live.
A score is only as good as the last time it was recalculated. Assessments run on demand or on a recurring schedule, and every run is recorded with its duration, target and result.
Permissions and entitlements are usually where the largest gap between a third party's stated posture and its real posture lives — and it is only visible once an account is actually connected.
A grade tells you how a third party is doing. Risk Overview tells you what to look at first to change that grade — ranked by priority and cross-referenced with exposure.
A portfolio of dozens of third parties only stays manageable if every one of them sits in its own isolated workspace, with its own users, roles and audit trail.
A risk committee does not need raw findings. It needs the score, what changed since the last review, and whether remediation is moving in the right direction — in a document that is ready to print, not a dashboard someone has to interpret live.
A working session against your actual third-party portfolio: how workspaces are created, which accounts get connected first, and what the Security Score looks like in week one.
