A software bill of materials (SBOM) that lists every component inside the application.
THIRD PARTY RISK MANAGEMENT
Castler proves that your critical vendors' software can be rebuilt and run without the vendor. Every verified release gets a signed Proof of Recovery, so your third-party software security evidence stays current.
Core banking
Core banking vendor
Payment switch
Payments vendor
Risk and fraud
Risk technology vendor
KYC
Identity vendor
Lending origination
Lending platform vendor
Treasury and reconciliation
Treasury vendor
Third party risk management covers every stage of a vendor relationship: selection, contract, monitoring, incident response and exit. It answers one question: what happens to the business if a vendor fails, is acquired, drops support or is attacked?
Regulators now expect third party risk management to include tested exit and recovery plans, not only vendor questionnaires. The effort matters most for critical vendors, because a failure there stops operations. For software, third party risk management has one extra requirement: the institution must be able to run the software without the vendor.
Selection
Contract
Monitoring
Incident response
Exit
Third-party software security means checking that vendor software is complete, buildable, safe and recoverable. Third-party software security evidence must be tied to the exact release running in production. Castler produces this evidence for critical vendors on every verified release.
A full check includes:
A software bill of materials (SBOM) that lists every component inside the application.
Vulnerability severity and licence exposure for those components.
A cryptographic inventory (CBOM) of the stack.
Checks for hidden dependencies, such as private vendor repositories or a vendor-hosted licence server.
Critical vendors supply software that your core operations cannot run without. A vendor is critical when its failure would stop a regulated service, break a customer commitment or trigger a regulatory report. Regulators use terms such as critical or important functions and material service providers for the same idea.
Vendor size does not remove the risk. Large critical vendors still get acquired, discontinue products, ship faulty updates or suffer attacks. In a bank or NBFC, critical vendors typically supply:
Core banking
Payment switch
Risk and fraud
KYC
Lending origination
Treasury and reconciliation
Castler's incident tracker lists five causes, each with a real case:
Synapse (2024) left $265M frozen and affected 10M+ users.
After Broadcom bought VMware (2023), AT&T was quoted a renewal increase of 1,050%.
Nirvanix (2013) gave customers such as National Geographic and Fox two weeks to move petabytes of data.
CrowdStrike (2024) affected 7,000 Delta Air Lines flights and cost about $500M.
Jaguar Land Rover (2025) halted 5,000 suppliers, cost £1.9B and caused a five-week shutdown.
Each case is a third party risk management event. In each one, the software from critical vendors stopped and losses grew until recovery.
Castler handles third party risk management for critical vendors in four steps:
The vendor deposits source code, build scripts, runtime configuration and documentation into Castler's secure cloud custody. Every release is captured and versioned.
AI agents rebuild, deploy and replicate the application in a clean environment. No vendor involvement and no documentation are required.
A named Castler engineer reviews the evidence and signs it.
You receive a numbered, signed pack for that exact release.
Verification takes 6 to 18 hours per codebase, compared with 2 to 4 weeks. Cost is about 90% lower than the current verification cost. When a vendor ships a new release, a new cycle produces a new Proof of Recovery, so third-party software security evidence follows the software in production.
6–18 hrs
Castler verification
2–4 wks
Traditional human-led verification
Castler maps its evidence to 17 mandates across 9 jurisdictions. In India:
Globally:
Across all of them, third party risk management and third-party software security for critical vendors now need current, testable evidence.
$2,000
per application per year
Secure custody and a deposit report.
$3,500
per application per year
Adds build verification, SBOM and CBOM for third-party software security.
$7,500
per application per year
Adds independent rebuild, deployment, run and a signed Proof of Recovery.
Bundles for up to 10 applications: $7,500, $15,000 and $45,000 respectively.
There is no setup fee. Start with one of your critical vendors and expand across the estate.
FAQ
Third party risk management is the process of identifying, assessing and controlling the risks that come from vendors. For software, it includes proving that critical vendors' software can be recovered if the vendor fails.
Third-party software security is the work of making sure vendor software is complete, safe, current and recoverable. It covers the SBOM, vulnerabilities, licences, cryptography and a tested rebuild.
Critical vendors are the vendors whose software your core operations cannot run without. Examples include core banking, payment switch, risk and fraud, KYC, lending and treasury software.
Rebuild and run the software in a clean environment without the vendor. Castler does this with AI agents, and a named engineer signs the evidence as a Proof of Recovery.
Castler verification takes 6 to 18 hours per codebase. Traditional human-led verification takes 2 to 4 weeks.
An escrow agreement covers custody of the code. Regulators also expect evidence that the code can be recovered, so Castler adds a signed Proof of Recovery on top of custody.
Yes. Each Proof of Recovery includes an SBOM, a build report and a replication report. Standard Verification also adds a CBOM, with vulnerability severity and licence details. Together they give you third-party software security evidence for each release.
Start with the vendors whose failure would stop a regulated service, such as core banking, payment switch, risk and fraud, KYC, lending and treasury.
Yes. You can begin with one critical application and expand verification across the whole software estate as vendors and releases are added.
THIRD PARTY RISK MANAGEMENT
Book a 15-min Demo. We will map your critical vendors, name the regulation that applies to you and show you a real signed Proof of Recovery.
Book a 15-min Demo