What the discipline covers
TPRM is the management of risk entering an organization through the suppliers, partners, and contractors it hires. It covers selection, contracting, monitoring during the relationship, and its termination.
The security part is one slice. Alongside it sit financial, continuity, regulatory, and reputational risk, and a program handling only the technical leaves half the account out.
Why the point-in-time questionnaire fails
Not through laziness on the answering side. By construction.
It measures an instant. The supplier answered in March, and the answer describes March. Configuration changes, the team changes, infrastructure grows, and the document stays filed saying what was true that month.
It is self-declared. The respondent is the party interested in passing, and almost nothing asserted gets verified.
And it does not scale. A company with three hundred relevant suppliers cannot review three hundred questionnaires a year with depth, so most become a checked box. The ritual happens, the risk stays where it was.
What external observation adds
A supplier's external posture is observable without their cooperation. An expired certificate, a service exposed without need, their corporate credentials in a public leak, a subdomain pointing at a decommissioned service.
None of that replaces contractual diligence. What changes is the frequency and the nature of the data: continuous instead of annual, observed instead of declared.
The combination that works is using observation to decide where to spend deep diligence. Three hundred suppliers do not get equal attention; the ones external observation shows deteriorating do.
The most common scoping error
Ranking suppliers by contract value.
The most expensive supplier is rarely the one exposing the most. Whoever integrates with your identity system, holds persistent access to your environment, or hosts your data matters more than invoice size, and that list rarely matches the list of largest contracts.
The criterion that orders better is access: what this supplier reaches if compromised. It is blast-radius logic applied outside the organization.
The digital supply chain embedded in your own assets is the extreme case of that exposure, because it runs in your customer's browser without anyone having signed a contract for it.