Live · scanning 24/7

The vendors you trust are your attack surface now.

Periphery keeps a live map of every third-party you depend on and every AI tool your team quietly signs up for. One dashboard, one score, one story you can tell your board.

· No credit card· No agents on your network· Free forever tier
stripe.comacme.iocloud-xchatgpthubspots3.awsyour.co
Live signal feed● streaming
  • highacme.io — DMARC missing, spoofable
  • mediumvendor-x.co — new subdomain admin-beta.
  • criticalbilling.corp — TLS cert expires in 2d
  • lowchatgpt.com — first seen from marketing
  • highs3.aws — public bucket referenced in CT log
61%
of breaches now trace back to a third-party or SaaS vendor
200+
AI tools the average SMB team touches in a quarter
$0
to start — free tier stays free, we never bait-and-switch
How it works

Three steps. No install. No agents.

01

Add a domain

Drop in a vendor's URL — Stripe, your CRM, your bank. We start pulling public signals in seconds. No API keys, no integration calls.

02

We watch, quietly

Every few hours we re-check certificate transparency logs, DNS, DMARC, breach feeds, and (Pro) shadow-AI usage from the extension.

03

You get one signal

A single explainable score per vendor, alerts to Slack when it moves, and a PDF report your client or insurer will actually read.

Everything a fractional CISO would set up — without the fractional CISO.

Vendor posture

Cert expiry, new subdomains, SPF/DKIM/DMARC gaps, breach mentions — refreshed on autopilot.

Shadow AI

A browser extension flags AI tools your team signs up for. Domain + timestamp only. Never content.

Explainable score

Every 0–100 breaks down into the exact signals behind it. No black boxes to defend.

Instant alerts

Slack, email, or your own webhook — the second a vendor's posture slips.

Board-ready PDFs

One click. A vendor posture report you can hand to an auditor, insurer, or a nervous customer.

Built for MSPs

Multi-tenant from day one. Run every client's perimeter from a single workspace.

Turn the lights on.

One domain. Sixty seconds. Then decide if it's worth another minute.