Third Party Risk Manager (TPRM) Advanced: Vendor Risk Modelling, Monitoring and Escalation

AdvancedFree5 modules · 13 lessons · ~2 min

About this course

For practitioners who already run TPRM and need to scale it across hundreds of vendors. You will design exposure-based tiers and measurable SLAs in Vendor Management, model the 0 to 100 vendor Risk Score through EPSS and CISA KEV, run the SBOM request pipeline as a production system with coded rejections, route and escalate the four alert types, analyse supplier artifacts independently, and leave audit-grade evidence behind. Every lesson is grounded in the documented TPRM surface and teaches the operating decisions the platform leaves to you.

What you'll learn

Program Architecture for the Consumer Role

The Consumer Role at Scale: What a Mature Program Owns
Designing Vendor Tiers, Contracts and SLAs in Vendor Management
Mapping Vendors to the Org Hierarchy, Products and the Self-Service Vendor Portal

The Vendor Risk Score, Modelled

Score Direction and the Four Dimensions
EPSS and KEV as Score Movers
Thresholds per Tier and Executive Briefing

SBOM Intake at Scale

Bulk Requests, Templates and the Status Pipeline
Validation Criteria and the Rejection Playbook
Receiving Published and Shared Products, VEX and Mitigations Done by Others

01Program Architecture for the Consumer Role3 lessons

The Consumer Role at Scale: What a Mature Program Owns
Designing Vendor Tiers, Contracts and SLAs in Vendor Management
Mapping Vendors to the Org Hierarchy, Products and the Self-Service Vendor Portal

02The Vendor Risk Score, Modelled3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Monitoring, Routing and Escalation

Alert Types, Channels and the Routing Matrix
Escalation Ladders, Gates in TPRM, Webhooks into SecOps and Review Cadences

Deep Analysis and Governance

Deep Analysis: Independent Scanning, Version Comparison, Concentration Risk and the KEV Runbook
Exceptions, Audit Evidence, Regulatory Drivers and Offboarding

Score Direction and the Four Dimensions

EPSS and KEV as Score Movers

Thresholds per Tier and Executive Briefing

03SBOM Intake at Scale3 lessons

Bulk Requests, Templates and the Status Pipeline
Validation Criteria and the Rejection Playbook
Receiving Published and Shared Products, VEX and Mitigations Done by Others

04Monitoring, Routing and Escalation2 lessons

Alert Types, Channels and the Routing Matrix
Escalation Ladders, Gates in TPRM, Webhooks into SecOps and Review Cadences

05Deep Analysis and Governance2 lessons

Deep Analysis: Independent Scanning, Version Comparison, Concentration Risk and the KEV Runbook
Exceptions, Audit Evidence, Regulatory Drivers and Offboarding2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.