Continuously monitor
Monitor the security posture of your third parties in real time with automated, objective security ratings. Set alerts to find out when your critical service providers expose vulnerabilities, and grant access to their IT security teams so they can engage with the assessment to improve their score. Generate regular reporting for your board, regulator and other stakeholders to demonstrate thorough, proactive oversight.
Have any questions?
Conduct a deep assessment
Use Orbit Diligence to access Thomas Murray’s library of digitised IT security questionnaires, with auto-scoring, in-platform vendor communication, document storage and reporting. Automate the issuance of questionnaires and leverage Orbit’s intuitive workflows to save both you and your third parties time and manual effort.
Take action
Escalate with a potentially high-risk third-party by providing full access to its security rating and threat intelligence assessment, automatically flagging high-impact remediation so that their IT security team can begin improving their score from day one. Thomas Murray’s cyber security analysts will engage with your third parties to help them understand, contextualise and implement their assessment – you only need to make the introduction.
Have any questions?
Have any questions?
Simplify your vendor risk
Automated
By combining automated “external” security ratings and digitised “internal” IT security questionnaire, you can establish a sophisticated monitoring programme without adding to budget or headcount.
Centralised
Orbit is the only solution which combines expert security ratings with deep due diligence capacities, meaning that you can centralise your third-party risk management on a single, easy-to-use platform.
Compliant
Orbit is designed to help lean teams meet stringent regulatory requirements. We help clients achieve compliance by demonstrating a proactive approach with deep assessments, tailored reporting and audit trails.
We safeguard clients and their communities
Petroleum Development Oman Pension Fund
“Thomas Murray has been a very valuable partner in the selection process of our new custodian for Petroleum Development Oman Pension Fund.”
ATHEX
"Thomas Murray now plays a key role in helping us to detect and remediate issues in our security posture, and to quantify ATHEX's security performance to our directors and customers."
Northern Trust
“Thomas Murray provides Northern Trust with a range of RFP products, services and technology, delivering an efficient and cost-effective solution that frees our network managers up to focus on higher Value activities.”
Manage
Attack surface discovery
- Automated discovery of digital assets.
- Eliminate false positives.
- Monitor for changes.
Security ratings
- Organisation security ratings.
- Domain security ratings.
- Benchmarking.
Attack surface reduction
- Breaches.
- Vulnerabilities.
- Misconfigurations.
Monitor
Reporting and benchmarking
- C-Suite reporting.
- Alerts and automated reports.
- Custom competitor analysis.
Enquiries and improvements
- Live enquiries tool.
- Access to expert analysts.
- Track organisation and domain scores.
Integration
- APIs.
Oversight
- Accounts and permissions.
- Historical scores.
- Account security.
Escalate
Third parties
- Provide free access for remediation.
- Monitor changes.
IT security questionnaires
- Issue and analyse.
- Manage and monitor.
- Assess and remediate.
Vendor due diligence and selection
- Standard and custom questionnaires.
- Track, report and benchmark.
Insights
Why Cybersecurity Due Diligence is Critical to Deal Completion
It’s a common story: after months of meticulous financial, operational, and market analysis, a critical finding emerges in the final weeks before deal closure – threatening what seemed like a near-certain transaction with a three-month delay.
DORA Compliance Checklist: Practical Guidance for Q4 and 2026
Our structured, expert-led checklist, will help you to prioritise and demonstrate readiness to supervisors and regulators.
Ransomware at Europe’s Airports: Case for Community-Driven Third Party Risk Management
The recent ransomware attack on Collins Aerospace’s Muse software, which brought chaos to airports across Europe, serves as a stark reminder of a critical gap in how organisations approach Third Party Risk Management (TPRM).
JLR Cyber Attack: What it Means for Private Equity, Credit, and Equity Investments
From the iconic E-Type Jaguar to images of the late Queen driving modern Range Rovers on her estate, JLR has long held a uniquely British place in the national consciousness, even under Tata ownership. The incident has affected the owners of the business, the supply chain, and customers, and offers learnings for the Private Equity (PE) industry.
Contact an expert
