Skip to main content
    Five scenario labs - three new

    TPRM Labs: practise real vendor work, not a quiz

    Each lab puts you inside a live third-party engagement as the analyst on the file. You work the case through every stage, decide where each fact belongs, and finish with a defensible recommendation - the way the job is actually done. Free for every registered learner, and every completion earns a verifiable Lab Certification.

    Start the Beginner Lab Try the newest lab

    Decisions, not answers

    Every step is a judgement call you drag into place. No multiple choice, no hints under the cards.

    Five full scenarios

    Seven connected stages in every lab - 350 analyst decisions across the library.

    Verifiable credential

    Finish any lab and receive a Lab Certification with a public verification link you can share.

    Five labs across the full vendor lifecycle

    Work them in order or pick the one that matches the work in front of you: a first full assessment, an onboarding against a deadline, a noisy monitoring queue, a renewal and exit, or a live crisis.

    Beginner 35-50 minutes · 70 decisions

    Beginner Lab: Acme Cloud Payroll Review

    Your company has just acquired a business and payroll for 3,200 US and UK employees has to move to a new cloud provider. The VP of People Operations wants Acme Cloud approved. You are the TPRM Analyst on the file: names, tax IDs, salaries and bank details are in scope, and the platform connects straight into the HRIS. Assess it properly and give a recommendation you can defend.

    • 1Vendor intake and business context
    • 2Inherent-risk classification
    • 3Due diligence and evidence collection
    • 4Risk assessment and findings
    • 5Remediation planning
    • 6Residual-risk evaluation
    • 7Approval and ongoing monitoring
    Open the lab

    Sign-in required. Free forever. Start here if you are new to TPRM.

    Practitioner 45-60 minutes · 70 decisions

    Practitioner Lab: Rapid vendor onboarding under a deadline

    An eleven-site healthcare group has already picked a clinical AI documentation vendor and announced the go-live date. You have three weeks, an incomplete intake form and a vendor security contact who answers one email in three. Scope it, tier it, chase only what matters, design compensating controls you operate yourself, and land a conditional approval that names its conditions.

    • 1Intake triage and scoping under time pressure
    • 2Inherent risk tiering before any evidence arrives
    • 3Due diligence with an unresponsive vendor
    • 4Findings, not concerns
    • 5Remediation plan against a fixed go-live date
    • 6Residual risk and what the business is accepting
    • 7Approval, contract safeguards and ongoing oversight
    Open the lab

    Sign-in required. Free forever. The onboarding case as it actually arrives.

    Practitioner 45-60 minutes · 70 decisions

    Practitioner Lab: Continuous monitoring and issue management

    412 active vendors, 38 of them Tier 1, and an overnight monitoring queue with more than sixty alerts across ratings, expiring attestations, breach news, financial distress and sanctions screening. The governance forum meets on Thursday. Decide what is noise, what becomes an issue you own, how severe it really is for your services, and what the forum must actually decide.

    • 1Alert triage: signal, noise and context
    • 2Event or issue: what enters the register
    • 3Severity on our exposure, not their score
    • 4Ownership, dates and escalation path
    • 5Verifying what the vendor tells you
    • 6Closing issues properly
    • 7Programme improvement and the forum pack
    Open the lab

    Sign-in required. Free forever. Where most programmes quietly fail.

    Professional 55-70 minutes · 70 decisions

    Professional Lab: Contract renewal, offboarding and exit

    A card processor auto-renews in 74 days unless notice is served. The last full reassessment was four years ago, the agreement predates your clause standard, the vendor changed ownership and moved region, and it holds six years of transaction records. Commercial wants the discount. Decide the renewal, plan a dual-run exit, and evidence data return and certified destruction.

    • 1Reassessment at renewal: what has changed in six years
    • 2Contract gap analysis before you can decide anything
    • 3Renewal decision and the notice clock
    • 4Building the exit and transition plan
    • 5Termination execution and data destruction evidence
    • 6Obligations that survive termination
    • 7Programme lessons and clause standard uplift
    Open the lab

    Sign-in required. Free forever. The lifecycle half most training skips.

    Professional 60-75 minutes · 70 decisions

    Professional Lab: Advanced vendor crisis

    A regulated bank discovers a live compromise inside its credit-decisioning chain, and it did not start at the vendor: it started at a fourth party that was never disclosed. You are the Senior TPRM Manager. The assurance file contradicts what the vendor is telling you, three services rest on the same downstream provider, reporting clocks are running and the board Risk Committee meets in 48 hours.

    • 1Incident triage and factual baseline
    • 2Fourth-party and concentration analysis
    • 3Assurance evidence challenge
    • 4Regulatory and contractual notification judgement
    • 5Containment, remedies and enforcement
    • 6Board and risk-committee reporting
    • 7Post-incident control uplift and exit readiness
    Open the lab

    Sign-in required. Free forever. Our hardest scenario.

    Lab Certification, verifiable by anyone

    Completing any lab issues a certificate in the same design language as our Warrior Beginner and Professional certifications, carrying the lab scenario you completed and a unique certificate ID. Employers can confirm it on our public verification page, exactly as they do for exam certificates.

    Verify a certificate
    Safe Security - founding sponsor of LearnTPRM.comFounding Sponsor
    For CISOs, TPRM leads and vendor risk program owners

    Autonomous TPRM. 90% less manual effort.

    Now see the same case run by AI agents

    The lab put you inside a real vendor file: intake, inherent risk, diligence, findings, remediation, residual risk, approval. Every judgement you made is a step the SAFE TPRM AI Co-Worker executes autonomously - which is why practitioners who finish these labs tend to bring it to their employer.

    This is for you if you own a third-party risk program - roughly 100+ vendors, quarterly reassessments, DORA / NIS2 / OCC pressure and no new headcount coming. The link opens Safe Security's platform page, not a gated form.

    Trusted by 10% of the Fortune 500, and named a Leader in Liminal's TPRM Link Index.

    Zero-touch due diligenceContinuous monitoring across 5 dimensionsAI-powered risk scoring workflows
    • Intake and inherent risk scored instantly, with scope and relationship context mapped for you.
    • Findings become context-rich remediation tasks with evidence, business impact and clear guidance.
    • The Risk Validation agent confirms risk actually dropped before closure.
    Evaluate SAFE for my organization

    For security and risk leaders assessing a TPRM platform. Opens safe.security in a new tab.

    25+

    AI agents

    90%

    Less manual effort

    None

    Additional headcount

    200+

    Organizations globally

    End to end

    Intake to offboarding

    Just here to learn? Read how Safe Security sponsors LearnTPRM