Synthetic vendor risk assessment dataset

What you can build and check

• Populate vendor-assessment tables and review screens without using customer assessment files.
• Check ingestion and filtering by assessment type and risk rating.
• Experiment with extracting remediation deadlines and verification steps from narratives; assess outputs yourself.

These are suggested uses to validate in your own prototype. No integration with a specific vendor product or model-performance improvement is claimed.

One actual preview record

This record comes from the public preview. Names, companies, and identifiers are fictional.

{
  "vendor_name": "Shepherd, Hayes and Marks",
  "assessment_type": "SOC 2 Type II Review",
  "findings_risk_score": "High",
  "remediation_plan": "On 2026-02-03, the storage policy export for Shepherd, Hayes and Marks identified unencrypted customer-data backups affecting support-case attachments. 48 affected components are assigned to cedar-392, including support-case attachments; testing of other resources is pending. Assign the supplier control owner to remove plaintext copies from secondary storage; the written remediation deadline is 21 days after this assessment. Retesting covers the affected resource inventory: the assurance lead must check object metadata against the approved key identifier. This is an open High exception, requiring reassessment if affected scope or customer-data exposure changes.",
  "ticket_id": "SECU-2026-39686005"
}

Browse the preview file · Read the full dataset card

Try it locally

1. Download the 10K preview as demo.jsonl.
2. Download inspect_preview.py into the same folder.
3. Run this command with Python 3. It uses the standard library, makes no API calls, checks fields and unique IDs, and exports the same records to a CSV you can inspect or import.

python inspect_preview.py --dataset third_party_vendor_risks --file demo.jsonl --csv demo-cases.csv

The printed summary shows the loaded count, fields, findings_risk_score counts, and first record. This is a format and inspection example, not a model benchmark. Free-preview use remains subject to its existing non-commercial license.

Schema and scenario coverage

The free and paid tiers use the same schema and these six configured scenario families:

• Unencrypted backups
• Legacy TLS endpoints
• Critical exposed vulnerability
• Missing privileged MFA
• Out-of-region backup retention
• Prior exposure with incomplete corrective evidence

More rows provide additional synthetic variants, not 100,000 independent real-world cases or additional workflow families.

Free versus paid

The paid package suits a larger set of workflow fixtures and use under the existing commercial terms. Evaluate the free preview first; a larger record count alone does not prove better model performance. This purchase covers one selected dataset.

Quality evidence and limits

Both tiers scored 94/100 in the project's automated audit on 13 October 2026. The paired verification found zero exact record or ID overlap between the free and paid tiers. Similarity checks are bounded. The score is an internal record-quality measure.

The current records contain High and Critical findings; Low, Medium, and benign cases are not included. This is not a balanced risk-classification dataset. Ratings are configured labels, not calibrated breach probabilities. Records are not authentic SOC 2 reports, compliance certifications, or a complete vendor-control database. They do not establish GRC-model accuracy.

Read the public quality audit. Inspect fit before buying. No independent train/test benchmark or real-world transfer result is provided.

How purchase and delivery work

1. Open this dataset's commercial access page.
2. Enter your Hugging Face username. A Hugging Face account is required for private repository delivery; create an account if needed.
3. Pay through Lemon Squeezy. The existing fulfillment flow grants access to the matching private repository after payment.

For delivery questions, contact xomohappy on Discord. Review terms, privacy, and refund policy before purchase.