NewsCyb3r Operations raises $5.4m to tackle third-party risk blind spots

Read article
Cyb3r Operations
Sector · Technology & SaaS

Industry · Technology & SaaS

Fourth-party visibility and customer trust evidence for the firms shipping software.

Cyb3r Operations gives technology firms continuous evidence on their fourth-party estate, the SaaS embedded in their product, and the trust expectations their customers now require.

Discover your third-party ecosystem nowSee the regulatory map

From the field

“Our biggest customer's procurement team asked for current evidence on our top 20 suppliers. The trust pack went out in an afternoon. Two years ago that would have taken a quarter.”

Head of Trust & Compliance · Enterprise SaaS Vendor

What the technology & saas supplier estate looks like

200 to 500

critical fourth parties at a typical mid-market SaaS firm

10 to 20

third parties directly named in a typical enterprise DPA

1 per quarter

named supply-chain incidents touching the SaaS category

The problem

Your customers became your auditors. Their procurement teams are not waiting six months.

Technology and SaaS firms now sit at the intersection of two pressures: they are both the buyer of dozens of upstream suppliers and the seller answering their own customers' increasingly rigorous due-diligence demands. The supply chain breaches that hit the category (CodeCov, Log4j, Okta, Snowflake, MOVEit) have raised the bar on both sides.

Customer trust packs, security questionnaires from enterprise buyers, and SOC 2 / ISO 27001 evidence freshness now drive product velocity. The traditional once-a-year audit motion does not cover it.

Today's reality

  • ·Enterprise customers expect current fourth-party evidence on demand
  • ·Supply-chain attacks against dev tools and SaaS vendors recurring
  • ·SOC 2 and ISO 27001 continuous-monitoring expectations sharpening
  • ·EU AI Act + GDPR DPAs raising customer-disclosure expectations

Supply chain shape

What a technology firm's third-party graph actually looks like.

Cloud infrastructure plus the SaaS stack embedded in the product. Concentration sits in surprising places.

Cloud infrastructure

The foundation. Customer DPAs explicitly name these. Concentration with one provider common.

  • AWS
  • Microsoft Azure
  • Google Cloud

CI/CD and dev infrastructure

Source control, build pipelines, package registries. Supply-chain attacks (CodeCov, GitHub) hit here.

  • GitHub
  • GitLab
  • CircleCI
  • npm

Identity & customer auth

Workforce SSO plus customer-facing auth. A single failure is a customer-trust event (Okta).

  • Okta
  • Auth0
  • Microsoft Entra

Observability & security tooling

Datadog, Splunk, Sentinel, Snowflake all both hold and surface customer data.

  • Datadog
  • Snowflake
  • Splunk
  • Sentry

Embedded AI and ML providers

Foundation-model APIs and ML platforms embedded inside the product itself.

  • OpenAI
  • Anthropic
  • Google Vertex
  • AWS Bedrock

Embedded SaaS

Communication, billing, analytics, marketing SaaS embedded in customer-facing workflows.

  • Stripe
  • Twilio
  • Segment
  • Intercom

Threat landscape

Who is targeting technology firms right now.

Supply-chain attacks, credential theft, and customer-trust events.

Supply-chain attacks on dev tools

Recurring pattern

CodeCov, Log4j, npm package compromises, GitHub Actions compromises. Direct ingress into customer environments.

Lazarus, APT38

State-sponsored

Sustained targeting of crypto-exchanges, fintech platforms, and supply-chain pivots.

Scattered Spider

Financially motivated cybercrime

Social-engineering-led intrusions targeting SaaS providers and their identity supply chains.

Okta-style identity compromise

Recurring pattern

Compromise of identity providers cascading across customer environments.

Snowflake-style customer-data theft

Recurring pattern

Compromise of customer-data platforms via credential theft, hitting downstream customers at scale.

LockBit, Cl0p (SaaS campaigns)

Targeted ransomware

Increasing targeting of SaaS providers for ransom plus data extortion.

What changes

What technology firms get from Averro.

Fourth party evidence on demand.

Customer trust packs ready in minutes, with current evidence per supplier mapped to SOC 2, ISO, GDPR.

Supply-chain attack readiness.

When the next CodeCov or Snowflake happens, the exposure picture is already in place.

Continuous SOC 2 + ISO evidence.

Evidence freshness an auditor accepts. No more end-of-period scramble.

Customer due-diligence response.

Answer enterprise-customer security reviews with current evidence rather than the last questionnaire response.

AI fourth-party visibility.

Surface AI tools embedded in the product and the fourth parties behind them.

Plugs into the engineering and security stack.

Signals into Splunk, Sentinel, Datadog, ServiceNow, Jira, Slack. The risk evidence lives where engineering and security already do.

Regulatory map

Rules of the road for technology firms.

Attestation frameworks plus customer-led trust expectations.

Regulator

SOC 2

Jurisdiction

Global

Obligation

Trust services criteria including vendor risk management (CC9.2).

What we evidence

Continuous CC9.2 evidence and supplier audit packs.

Regulator

ISO 27001:2022

Jurisdiction

Global

Obligation

Supplier-relationships clauses A.5.19 to A.5.22 sharpened in the 2022 revision.

What we evidence

A.5.19 to A.5.22 evidence on demand without supplier engagement.

Regulator

GDPR + DPAs

Jurisdiction

EU, UK

Obligation

Fourth party disclosure, data-protection agreements with customers.

What we evidence

Fourth party risk evidence and data-class inference per supplier.

Regulator

EU AI Act

Jurisdiction

EU

Obligation

Provider and deployer duties for in-scope AI systems, determined by role and risk tier.

What we evidence

Inventory of the AI tools and model providers in your estate, so role and tier determinations rest on a real supplier list.

Regulator

FedRAMP

Jurisdiction

US (federal)

Obligation

Cloud security authorization including supply-chain risk management (SR controls).

What we evidence

SR-3 and SR-5 evidence with supply-chain protection trace.

Regulator

Customer-driven security reviews

Jurisdiction

Customer-led

Obligation

Enterprise customers' own security questionnaires, often increasingly rigorous.

What we evidence

Trust packs and DPA evidence generated on demand.

Sector scenarios

What this looks like in practice for technology firms.

Three short stories from the field, each anchored to a platform capability.

Scenario 01

Customer trust pack in an afternoon

An enterprise SaaS vendor's biggest customer asked for current evidence on the top 20 third parties named in their DPA, as part of a renewal. The Head of Trust & Compliance had the pack out the same afternoon, fully aligned to GDPR.

See the GRC persona page

Scenario 02

Supply-chain attack pre-positioning

When a CI/CD provider used by hundreds of SaaS firms disclosed a compromise, Cyb3r Operations customers already had the exposure picture mapped to their critical product paths. Customer communications went out within the hour.

See the Breach Early Warning use case

Scenario 03

AI fourth-party inventory for the EU AI Act

A SaaS product team adding AI features needed an inventory of the model providers and AI tooling behind their product. Averro produced it in a day across both direct foundation-model APIs and nested AI providers further down the chain.

See the Hidden Third Parties use case

The technology & saas buying centre

The roles that lead this in the sector.

Each persona reads the third-party picture slightly differently. Click through to the role-specific page for the full operating-model framing.

CISO

Pre-positions supply-chain incident response without disrupting product velocity.

Open the CISO page

Head of Trust & Compliance

Generates SOC 2, ISO, and customer DPA evidence on demand, without supplier engagement.

Open the Head of Trust & Compliance page

Procurement / Tech ops

Onboards new SaaS faster with risk evidence ready at shortlist.

Open the Procurement / Tech ops page

Sector questions

Questions technology firms ask in the first conversation.

Fourth party evidence is continuously refreshed and ready on demand. When a customer asks for current evidence in a DPA cycle, the pack goes out in minutes rather than weeks.

Yes. Evidence is timestamped, mapped to SOC 2 CC9.2 and ISO 27001:2022 A.5.19 to A.5.22, and is increasingly preferred over questionnaire responses by Big 4 auditors.

AI providers are surfaced from the environment. Foundation-model API usage, embedded AI tools, and the fourth parties behind them are all first-class in the inventory.

Yes. Native feeds into Splunk, Sentinel, Datadog, Snowflake, ServiceNow, Jira, Slack. Engineering and security teams stay in the tools they already use.

An outside-in scan of your top 50 suppliers runs in days. Most customers go from first call to a customer-trust-pack-ready posture in under 30 days.

Foundation-model APIs and embedded AI tooling are surfaced from your environment like any other supplier, including the providers behind them, which customer DPAs increasingly ask you to name. Under the EU AI Act your obligations turn on whether you are a provider or a deployer and which risk tier the system falls into. Averro gives you the supplier inventory those determinations rest on. It does not claim the Act imposes a disclosure duty it does not contain.

Read next

Where to go next.