GEN-TPRM: An OSINT-Driven Risk Assessment Model for Third-Party Organizations

Recently, organizations supplies many ingredients of their products from third-party organizations, where security of the third-party organizations is a crucial for the success of the product. This circumstance makes, the rapid risk assessment of the organizations a challenging task. This paper introduces GEN-TPRM, a third-party security risk assessment model that uses open-source intelligence (OSINT), LLM-based question answering, and scoring aligned with ISO/IEC 27001:2022 and Gartner risk thresholds. It integrates publicly verifiable indicators like breach disclosures, CVEs, and regulatory penalties into risk-specific directional QA replies and a standardized risk index. The model integrates a retrieval-augmented LLM layer with a logistic regression classifier trained on historical security cases. The approach was validated through a real-world case study of 100 well-known vendors. The model generates transparent outputs without requiring internal access to vendor environments, offering a lightweight, scalable solution for lifecycle-based third-party pre-risk management.