We build Agents. You build the Future.
● B2B offer — InsuranceThird-party cyber risk — Insurance: suppliers registered, evidence checked
Assurances Malvoie delegates underwriting and loss adjusting to two hundred and sixty agents, seventy-four of whom have no current agreement, and its claims platform is shared with six competitors. The agent reads the agent register, the underwriting tool and the claims platform: it links each act to its agent, measures sector concentration and prepares the missing agreements. The risk director decides; the executive committee accepts. You arbitrate on dated facts: every file arrives with its factors, its counted unknowns and the document that will lift them — and the signature stays yours, handed back in minutes rather than in committee.
Updated on
Fictional simulation — not a client result
Each file carries its unknowns and the date of its most recent evidence.
⛓ Sourced · supplier register, contract vault, access register
The request pack is ready — statement of applicability and scope annex — and goes out as soon as you approve it.
✎ Framework · a certification covers its scope and its period
For an organisation established outside the European Union, the law of its own country applies; at its request, we put equivalent safeguards in place (human review before any action, a log of the criteria, information for the people concerned).
A Blue Lemon Agent third-party cyber risk agent registers the supplier relationship, derives criticality from the functions supported, checks evidence against its scope and period, unfolds the subcontracting chain, measures concentration across the aggregate of services and prepares treatment and exit plans. It runs on local inference or is hosted in France, with an architecture designed to reduce exposure to extraterritorial laws, location alone not guaranteeing immunity.
Reference points describing our offer, not results measured at a client. The gain on your supplier portfolio is confirmed by a pilot, on your own files.
Indicative estimate, to be confirmed by a pilot on your real files (general terms of sale, article 4).
One plan, one agent
A third-party cyber risk agent — eleven modules included — installed and operated for you. Prices excluding VAT, annual subscription. The twenty sector variants share this price: they change the content, never the engine or the price.
Setup + controlled subscription
- Installation, configuration and training for your teams
- Operation, human oversight, updates and support
- Hosting in France, a dedicated and isolated resource
All inclusive, no setup fee
- Setup included (installation, configuration, training)
- Operation, human oversight, updates and support
- Hosting in France, managed end to end
On site, you own it
- Hardware installed on your premises (you own it)
- French / European AI models run locally
- Secure remote maintenance (Pro support included)
What does the agent actually do?
Eleven modules included in the core, plus sovereign AI; a single state machine, with links to neighbouring agents. The agent carries out by itself what you authorise it to do; the decision stays with your authorised managers, who set what it does on its own and what it submits to them.
Third-party and service register
Records the supplier, group, service, contract, sub-processors, countries, data, access, owners, dates and relationship status.
Business criticality and data
Links the service to the functions it supports, target recovery times, volumes, data categories, privileges and substitutability.
Boundary: qualifies data to size the security risk and the dependency. Lawfulness of the processing, its legal basis and the record of processing activities belong to the DPO/GDPR support agent, billed separately.
Adaptive questionnaires
Selects questions by criticality and applicable framework, reuses answers still in date, asks for justification and tracks non-responses.
Evidence collection and checking
Checks period, scope, issuer, signature, qualifications, exceptions, corrective plans and the consistency of the attestations provided.
Boundary: checks SECURITY evidence — scope, period, issuer. Documents already held by the DPO/GDPR support agent are reused as they are: the same supplier is neither re-surveyed nor billed twice.
Exposure and authorised vulnerability review
Aggregates security advisories, public incidents and the expressly authorised surface, with no intrusive testing and no unproven attribution.
Risk scenarios
Structures feared events, sources, paths through the third party, existing measures, severity, likelihood and residual risk.
Explainable scoring
Computes separate dimensions with their factors, weights, unknowns and confidence; keeps the score before and after the supplier’s rebuttal.
Contracts and requirements
Compares clauses on security, notification, audit, location, subcontracting, continuity, reversibility and deletion.
Boundary: carries security, reversibility and notification requirements into the contract. Drafting the Article 28 clauses and the data processing agreement remains the work of the DPO/GDPR support agent.
Treatment plans
Turns each gap into a measure, with owner, deadline, expected evidence, any exception and a motivated temporary acceptance.
Monitoring and incidents
Tracks changes, evidence deadlines, relevant vulnerabilities, declared incidents, service commitments and reassessments.
Exit, evidence and steering
Prepares alternatives, extraction, transition, revocation, deletion and tests; keeps decisions, versions and indicators.
Sovereign AI
The hosting and confidentiality foundation the agent runs on.
Compliance of the processing itself — lawfulness, record of processing activities, impact assessments — and the drafting of Article 28 clauses are NOT part of this core: they are carried by the DPO/GDPR support agent, billed separately. This core handles third-party security, dependency, concentration and exit; it unfolds the subcontracting chain to rank 1 for every relationship and to the declared rank 2 for critical ones. Unfolding “rank 3 and beyond” and preparing the DORA register of information submission file are options. The supplier’s identity and the evidence common to both agents are reused: they are not collected twice, and they are not billed twice.
Extend this agent's capabilities
These capabilities are layered onto the SAME agent, not another one. They are billed per grid tier, not at the price of an agent.
Extends the unfolding of the subcontracting chain beyond tier 2: mapping of tier 3 and further tiers, concentration measured across that whole chain, and exit plans that take it into account. Anything not named stays recorded as unknown, with the question asked and its date. Option chosen in the checkout, set-up then monthly.
+ 500 € excl. VAT set-up, then 35 € excl. VAT / month — chosen in the checkout Choose my add-ons →Need to go further?
These agents handle a different business process, with their own owner and their own price. They are added to this one.
End-to-end contracts
Carry into the contract the clauses the assessment calls for, then track renewals and notice periods.
End-to-end contract management agent from 362 € excl. VAT / month Discover the agent →Procurement and suppliers
Run the consultation and compare offers; the cyber opinion joins the file, it does not decide it.
Purchasing / supplier agent (quotes, follow-ups) from 259 € excl. VAT / month Discover the agent →Cybersecurity and logs
Correlate and qualify your INTERNAL alerts. This core assesses third parties: the scopes do not overlap.
Cybersecurity agent (log analysis) from 311 € excl. VAT / month Discover the agent →DPO / GDPR support
Lawfulness of the processing and Article 28 clauses. This core handles security, dependency, concentration and exit: the third party’s identity and the shared evidence are reused, never collected or billed twice.
DPO / GDPR support agent from 343 € excl. VAT / month Discover the agent →In 30 minutes we identify the most relevant agent — without oversizing the project.
See the agent at work
5 everyday situations, taken from those that come up most often. Pick one: the exchange unfolds as it would in your organisation.
A scripted demonstration. These exchanges show how the agent behaves — its sources, its refusals, what it leaves to your teams. Nothing is sent from this page, no model is queried here, and the matters named are fictional. That is precisely what we promise your data. The behaviours shown here — monitoring, automation rules, routing and reminders — are configured with you during deployment, from your tools, your rules and your thresholds. The architecture points named in these exchanges — location, local execution, isolation, encryption, role-based access, logging — are not a guarantee attached to the demonstration: they are those of the architecture set out in your quotation, and verified before commissioning.
The company in this demonstration
Fictional companyAssurances Malvoie — fictional insurer, property and liability
- Sector
- Insurance company — property damage and liability, broker distribution
- Headcount
- 680 employees, 5 in compliance and 3 in security
- Who is served
- 410,000 policies, 1,900 distributing brokers
- Order of magnitude
- 410,000 policies, 14,000 claims per month, 260 active agents
- Tools in place
- Underwriting tool, claims platform, broker extranet, agent register
- Who decides
- The risk director arbitrates; the executive committee accepts
- Improvement points
- 260 agents, 74 without a current agreement; the claims platform is shared with 6 other insurers
Assurances Malvoie delegates underwriting and loss adjusting to two hundred and sixty agents, seventy-four of whom have no current agreement, and its claims platform is shared with six competitors. The agent reads the agent register, the underwriting tool and the claims platform: it links each act to its agent, measures sector concentration and prepares the missing agreements. The risk director decides; the executive committee accepts.
This company, its figures and the exchanges that follow were invented for the demonstration. They illustrate a common situation; they describe no real client.
Fictional simulation — not a client result
Registering, here, means linking each supplier to the SERVICE it provides and to the FUNCTION that service supports. Without that link no criticality can be computed — and that link was missing everywhere.
The first file I put on the table: The claims platform, a critical function.
· State opened: assessment in preparation, priority P2, on the fact “criticité et substituabilité visibles”.
· 10 of 12 controls are not compliant, and I tell you which and why, one by one.
· 0 unknown factor(s) — displayed confidence drops to 100%, and the score does not rise by a single point for it.
What I propose: I show you how this ranking recomputes from your own data, factor by factor, with no opaque score in between. parc-recense_relations-et-services.pdf4 business objects linked, each to its owner
⛓ Sourced · supplier register, contract vault, directory
For this file the fact retained is “criticité et substituabilité visibles”, and it comes from your inputs, not from an opinion: criticalFunction = yes, substitutability = low, evidenceFresh = yes.
The score is kept before AND after the supplier’s rebuttal. It never has the last word: it opens a review. The risk director arbitrates; the executive committee accepts.
And the next step, if you want it: I run the same reading across the whole portfolio and hand you the ordered list, each line with its factors and its date. fiche-relation_facteurs-visibles.pdf6 dimensions, their weights, their factors and the confidence
✎ Framework · the score opens a review, it decides nothing
· Third-party and service register — Records the supplier, group, service, contract, sub-processors, countries, data, access, owners, dates and relationship status.
· Business criticality and data — Links the service to the functions it supports, target recovery times, volumes, data categories, privileges and substitutability.
· Adaptive questionnaires — Selects questions by criticality and applicable framework, reuses answers still in date, asks for justification and tracks non-responses.
· Evidence collection and checking — Checks period, scope, issuer, signature, qualifications, exceptions, corrective plans and the consistency of the attestations provided.
· Exposure and authorised vulnerability review — Aggregates security advisories, public incidents and the expressly authorised surface, with no intrusive testing and no unproven attribution.
· Risk scenarios — Structures feared events, sources, paths through the third party, existing measures, severity, likelihood and residual risk.
· Explainable scoring — Computes separate dimensions with their factors, weights, unknowns and confidence; keeps the score before and after the supplier’s rebuttal.
· Contracts and requirements — Compares clauses on security, notification, audit, location, subcontracting, continuity, reversibility and deletion.
· Treatment plans — Turns each gap into a measure, with owner, deadline, expected evidence, any exception and a motivated temporary acceptance.
· Monitoring and incidents — Tracks changes, evidence deadlines, relevant vulnerabilities, declared incidents, service commitments and reassessments.
· Exit, evidence and steering — Prepares alternatives, extraction, transition, revocation, deletion and tests; keeps decisions, versions and indicators.
· Sovereign AI — the hosting and confidentiality foundation all of this rests on: local inference or an isolated resource hosted in France.
All eleven are included, at no extra cost: security, traceability, human validation and the demonstrators are never sold as options. modules-mobilises_onze-modules-du-socle.pdfthe eleven core modules and what each brings
✎ Framework · eleven modules included in the core, at no extra cost
Fictional simulation — not a client result
What I observed: incidentNoticeClause = no, personalData = yes.
What the rule concludes: clause manquante — state treatment plan, priority P2.
What I propose, already written out: the measure goes out with its owner, its deadline and THE EXPECTED DOCUMENT named in advance — that document, and only it, will close the measure. Remediation closed on a promise stays open in my file. ecart_valeurs-observees-et-regle.pdfobserved values, rule applied, rule version
⛓ Sourced · documents received, contract in force, internal policy
If the supplier is right, the measure closes on their document — dated, signed, with its scope. If they bring nothing, the gap stays in the file with the date of the request: silence closes nothing.
Either way you gain the same thing: The risk director arbitrates; the executive committee accepts — and you arbitrate on dated facts instead of an impression. plan-traitement_mesure-proprietaire-echeance.pdfmeasure, owner, deadline, expected evidence
✎ Framework · the rebuttal is kept, it erases nothing
Fictional simulation — not a client result
State opened: treatment plan, priority P2, fact retained “concentration agrégée”.
0 unknown factor(s) in the file, and here is what they do — and what they do not: displayed confidence moves to 100%, the score does not move a point. An unknown is neither an automatic failure nor an implicit pass.
The protocol is already drafted: the exact question, the recipient, the expected document and the follow-up date. It goes out as soon as you approve it. inconnue_protocole-de-levee.pdfquestion asked, recipient, expected document, follow-up date
⛓ Sourced · questionnaire, register, observed flows
What I bring you meanwhile, depending on nobody: what your own records already say — the contract, the observed flows, the access history. The file advances on what is verifiable, while waiting for what is not yet.
And a comparison that clarifies: a relationship reviewed with two named unknowns can be decided; a relationship showing no unknowns at all does not prove there are none — it proves nobody looked for them. journal_questions-posees-et-dates.pdflog of questions, follow-ups and non-responses, with their dates
✎ Framework · a non-response is a dated fact, not a blank
Fictional simulation — not a client result
State opened: decision reserved for the manager, priority P1, fact retained “preuve d’un autre client inaccessible”.
What the file already contains: the observed values, the rule applied and its version, the 12 non-compliant controls with their justification, the score and its factors, the 0 unknown(s), and the measured effect on the services supported.
Who signs, and why that is an advantage: The risk director arbitrates; the executive committee accepts. The decision is yours — and I hand it back to you in minutes: a complete, quantified, reasoned file. You decide on dated facts instead of convening a committee to gather the papers. dossier-de-decision_complet-chiffre-motive.pdfvalues, rule, controls, score, unknowns, effect on services
✎ Framework · the act commits the organisation, the file is ready
A plan never tested remains a hypothesis — so I propose the exercise that makes it credible, with its date, its scope and the gap measured against the recovery time you target.
What you end up with: exit plans tested rather than declared. Approve the exercise and it is scheduled this week. plan-de-sortie_alternatives-et-exercice.pdfalternatives, extraction, transition, revocation, deletion, success criterion
⛓ Sourced · documented alternatives, extraction format, reversibility exercise
Fictional simulation — not a client result
What I establish: images of property and people created outside any system, a filing on average 19 hours after the shot, an adjusting agreement describing the deliverable but not the collection, and 260 active appointees.
This case had not yet been taken into account in your configuration: your rule says data collected on site leaves the information system before entering it, and it describes exactly what happens; what it does not say is how long the data may live there, nor who deletes it. So I settled nothing on my own, and the review carries on with what is already verifiable.
Three ways of doing it. Require a dedicated collection application from all your appointees: the data is born inside your perimeter and never exists anywhere else, but 260 appointees to equip and train, and some will refuse an imposed tool. Tolerate the personal device with an attested undertaking to delete within forty-eight hours: nothing to deploy, and the out-of-perimeter window becomes bounded and written down, but deletion is self-declared, and an attestation per claim is hard to sustain across 14,000 files. Dedicated application for on-site adjusting, personal device tolerated for desk adjusting only: the effort goes where the data is sensitive, and your exception already provides for it, but two regimes to maintain, and the adjusting type has to be qualified before the visit.
I recommend the third. your exception already separates desk adjusting, which collects nothing on site; tying the regime to a distinction your agreements already carry avoids inventing a new one.
You can also define another one — for instance: the dedicated application for adjusting involving people only, and the deletion undertaking for property adjusting.
Shall I remember it for the next cases of this kind? Of your 260 active appointees, 112 carry out on-site adjusting, and 38 file their images more than twelve hours after the visit. If you approve, I will flag every out-of-window filing as claims come in.
⛓ Sourced · adjusting agreement, collection protocol, time stamps of filings on the claims platform
The rule, in one sentence: an adjuster collecting on site files the images within forty-eight hours and attests to their deletion from the device; the undertaking applies to every on-site adjusting, with no prior qualification of the file — your correction, because the nature of the loss is discovered on site — and the file stays open in the register while the attestation is missing.
What I found while reviewing this file, and it is worth more than the rule: of your 260 appointees, 74 have no up-to-date agreement, and I looked at what they handle: 51 of the 74 work on the claims platform you share with six other insurers.
What it is worth: the collection clause can go into the platform’s rules of use rather than into 51 agreements: it then binds every appointee who connects, including future ones. Your up-to-date-agreement indicator moves from 186 to 237 out of 260 with one clause instead of 51 amendments, and the other 23 are handled individually.
The decision is yours: it is your relationship with the platform, and the executive committee accepts it. I give you the 51 appointees concerned, the clause wording the rules of use can take and the 23 who will stay outside its reach. I change nothing before you have written it, and the rule is withdrawn in one line.
✎ Rule approved · written under its name, with its date and the file that gave rise to it — reversible in one line
Your case is not here? That is exactly what a 30-minute conversation is for. Discuss your project →
The stages of your AI agent project
Audit & scoping
30 minutes to target the use case with the best return.
Quote or direct sign-up
A catalogue offer is bought online; a specific need gets a costed quote.
Design
We design the agent and its guardrails.
Integration & testing
We connect your tools to the agent, which is itself hosted in France.
Rollout
Going live and training your team.
Operation
Continuous supervision and improvement.
What does an AI agent bring to supplier assessment?
A relationship that is registered, quantified and dated is arbitrated in minutes; a file scattered between a contract, an attestation and three emails has to be rebuilt from scratch.
! The stake
Assessing a supplier means gathering what can be verified and naming what cannot. That reconciliation work is systematic and lends itself to automation; deciding to accept a risk commits the organisation.
✓ Our answer
Your managers arbitrate across the whole portfolio rather than the suppliers someone remembers to check — and each file arrives already registered, quantified and dated. Every score keeps its factors, before and after the supplier’s rebuttal: your conclusion holds up in front of them, and it corrects itself when they produce the document. Data hosted in France on an isolated resource; the AI model is called at its publisher, except with the Sovereign model option. With the 100% Sovereign package, your audit reports and dependency maps do not leave the organisation.
Audit reports, contracts and dependency maps: sovereignty & separation
The evidence your suppliers entrust to you describes their weaknesses as much as your dependencies: its confidentiality is a security matter in itself.
Local inference
With the 100% Sovereign package, the agent runs on a machine in your organisation: no audit report, contract or dependency map leaves the network.
Hosted in France
Otherwise, with the Agility and Serenity packages, a dedicated, isolated resource hosted in France, under French law: data hosted in France; the AI model is called at its publisher, except with the Sovereign model option.
Strict tenant separation
A report filed by one client is never readable by another, whoever issued the document. Sharing across tenants requires written, traceable permission.
Reduced extraterritorial exposure
For your audit reports and dependency maps, the architecture aims to reduce exposure to extraterritorial laws; location alone does not by itself guarantee immunity.
Named human gates
Accepting a risk, starting an exit, escalating an incident: three states only an authorised manager can open, with reason and timestamp.
Tamper-evident log
Every transition carries its evidence, actor and timestamp; refusals are logged just as passages are.
What depends on the architecture chosen These points are not general guarantees: they are settled deployment by deployment, in the quotation.
- The applicable location is that of the architecture set out in the quotation and verified before commissioning.
- Local execution is announced only for the configuration explicitly described and accepted in the quotation.
- The applicable isolation depends on the deployment mode set out in the quotation; no dedicated isolation is presumed.
- The events logged, their content, their retention period and who may access them are defined for the deployment chosen.
How many relationships can a team review?
By taking on registration, evidence reconciliation and file assembly, the effort moves to arbitration. The size of the gain depends on your portfolio and remains to be confirmed by a pilot.
Four guarantees that matter here
Related resources
Your questions, our answers
Which regulatory framework governs the assessment of your ICT providers?
Does the agent certify that a supplier is safe?
How does it check a certification or audit report?
Can it scan a supplier without their agreement?
How does it handle fourth-party suppliers?
How does it compute criticality and concentration?
Can the score automatically block a purchase?
How does it track remediation and its evidence?
How does it prepare an exit plan that can actually be tested?
What drives the price of keeping the register, and how far is the chain unfolded?
Other agents for security and procurement
Let us size the potential on your supplier portfolio
30 minutes to scope your services, evidence and managers — hosted in France, supervised, no commitment.