Abnormal Security VendorBase Vendor Risk Assessment

Overview

Abnormal Security's VendorBase provides AI-driven vendor risk assessment by analyzing email communication patterns between your organization and its vendors. It detects compromised vendor accounts, assesses vendor risk levels, and alerts on suspicious vendor behavior. This is critical for protecting against supply chain email attacks where a trusted vendor's account is taken over and used to send malicious emails.

Vendor Risk Levels

Risk Factors

Vendor Field Reference

Core Fields

Compromise Indicators

Communication Profile

MCP Tools

Tool Usage Examples

List high-risk vendors:

{
  "tool": "abnormal_vendors_list",
  "parameters": {
    "filter": "riskLevel eq 'High' or riskLevel eq 'Critical'",
    "pageSize": 25
  }
}

Get vendor risk details:

{
  "tool": "abnormal_vendors_get",
  "parameters": {
    "vendorDomain": "example-vendor.com"
  }
}

Get threats from a vendor:

{
  "tool": "abnormal_vendors_threats",
  "parameters": {
    "vendorDomain": "example-vendor.com"
  }
}

Vendor Investigation Workflows

Compromised Vendor Investigation

1. Review compromise indicators:
   • What triggered the detection?
   • When was the compromise detected?
   • Which of your users are affected?
2. Analyze recent emails from vendor:
   • Check for unusual content or requests
   • Look for financial redirect requests
   • Review authentication results (SPF/DKIM/DMARC)
3. Assess blast radius:
   • How many users received emails from the compromised vendor?
   • Were any emails acted upon (links clicked, attachments opened)?
4. Remediate:
   • Quarantine suspicious emails from the vendor
   • Block vendor domain temporarily if active compromise
   • Notify affected users not to respond or act on recent vendor emails
5. Vendor notification:
   • Contact the vendor through a verified channel (not email)
   • Inform them of the suspected compromise
   • Request confirmation when they have secured their accounts
6. Unblock:
   • Once vendor confirms remediation, unblock and monitor

Vendor Risk Review Workflow

1. List all vendors by risk score - Start with highest risk
2. Review risk factors - Understand why each vendor is rated as it is
3. Check for new vendors - First-time vendors warrant extra scrutiny
4. Compare historical risk - Has risk score increased recently?
5. Generate report - Summarize vendor risk posture for stakeholders

Payment Redirect Detection

1. Filter vendor emails with financial keywords - "bank details changed", "new account", "updated payment"
2. Cross-reference with vendor risk - Is the vendor flagged as compromised?
3. Verify through side channel - Call the vendor to confirm payment changes
4. Block if fraudulent - Quarantine and block sender if confirmed BEC

Error Handling

Common API Errors

Best Practices

1. Review critical vendors weekly - High-risk vendors need regular attention
2. Act immediately on compromises - Compromised vendor emails are highly convincing
3. Verify payment changes via phone - Never trust payment redirect requests via email
4. Monitor new vendors closely - First-time vendors lack behavioral baseline
5. Track risk score trends - Rising scores indicate emerging risk
6. Correlate with threat data - Vendor risk and threat detections complement each other
7. Document vendor communications - Maintain a log of verified vendor contacts

Related Skills

• Abnormal Threats - Threat detection and analysis
• Abnormal Account Takeover - Account takeover detection
• Abnormal API Patterns - API authentication and usage