How to run a lightweight, no-outreach assessment across a portfolio of vendors, read the score it produces, and decide which vendors are worth a full review.
For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
Zero Touch Assessments are an optional module. If you do not see Zero Touch in the left navigation, ask your Coverbase representative to turn it on.
A Zero Touch Assessment answers one question cheaply: is anything obviously wrong with this vendor?It is an ordinary assessment on the ordinary pipeline, with the same controls, issues and evidence. Three differences make it a triage tool rather than a review:
Nobody is contacted
No document request, no questionnaire, no waiting on a vendor to reply. A run completes against public research and whatever evidence is already on file.
It runs without you
Launch it across a batch and walk away. Nothing is assigned to a reviewer and nothing waits on a reply, so covering a long tail of vendors takes no ongoing effort.
It produces one number
A single Zero Touch Score, so a batch of vendors can be ranked rather than read one by one.
Zero Touch is a filter, not a replacement for a full assessment. It is the right tool when:
A new vendor arrives and you need to know whether to spend a real review on it.
You have inherited a portfolio and have no idea which vendors are risky.
A renewal is coming up and you want a cheap re-check since the last review.
Someone asks “are we exposed to this vendor?” and you need an answer today.
It is the wrong tool when you need assurance you can show an auditor. A run has never spoken to the vendor, so it cannot confirm a control is operating. It can only tell you whether public evidence supports it.
1 Pick one vendor or many. 2 Search and filter the vendor list. 3 Selected vendors carry to the next step.
1
Pick your vendors
On the Zero Touch page, click Launch zero-touch assessment and choose one vendor or many. You can also start from a vendor’s own page, or select rows in the vendors table and launch the whole selection at once.
2
Choose the question set
Pick the template the run evaluates. Zero Touch Comprehensive is the default and covers everything public evidence can settle; the lighter and industry-specific templates are there when that is more than you need.
Choosing a template changes what every future run evaluates, not only this one. It is an organization-level setting, reachable from the wizard. Your earlier runs keep the scope they were launched with, and each run records which template it used.
3
Confirm
The last step has no inputs. What feeds the score and where the score goes are configured once for your organization, so every run stays comparable with every other run on the same template.
4
Come back to the runs table
Runs complete on their own. The module page sorts by score by default, which is the order to work them in.
The confirm step. Nothing to configure, because scope and scoring are set once for the organization.
1 Search, saved views and filters. 2 Composite score and band. 3 Per-component scores. 4 Row selection for bulk actions.
This is the same table as the vendors and assessments lists, so everything you already know about those works here. Sort by any column, filter on any field, choose which columns to show and in what order, and save the whole arrangement as a view you can come back to or share with your team. Sorting by score is only the default; sort by when a run happened to watch a batch finish.Two details specific to scoring:
Score columns read down, not across. Every score sits in the same place in every row, so you can scan a column rather than read each row.
A dash is not a zero. It means the component did not resolve for that vendor, and it was left out of the composite rather than counted against them.
Not scored means no component resolved. The report lists the reason for each component: public evidence scored no control, the run found no data, your settings turn the component off, or the launcher left it out of the run. To get a score, add evidence (for example, the vendor’s financial statements) and run the assessment again.
Select rows with the checkboxes, then act on the whole selection at once. Click a checkbox to toggle that row. Hold Shift and click another to take everything in between.
1 Click a checkbox to toggle a row, Shift-click another to take the range. 2 The footer counts your selection against every run, not only this page. 3 Approve, escalate or archive the whole selection at once.
1
Approve
Records your approval against every selected run. Each one gets its own entry in its own audit trail, exactly as if you had opened it and approved it there.
2
Escalate
Flags the selection for a full assessment. Escalating does not start one. Starting a full assessment is a separate step, because it commits your team and the vendor to work.
3
Archive
Removes the selected runs from the module. This one asks for confirmation, because it is the only action here you cannot undo from this page.
If a run in your selection has been archived by someone else since the page loaded, it is reported as skipped and the rest still go through.
Open any run to read it as a report. The summary comes first: who the vendor
is, the composite and the five components it is made of, the spread of control
outcomes, and three short lists of what is in good shape, the key gaps, and the
checks still open. The evidence follows, and every control the run evaluated
sits in an appendix at the end. Use the rail on the left to jump straight to a
section.
The top of a finished run: the vendor, the composite and its components, the control outcomes, and the summary lists.
A section that produced nothing says so in place. That is not a failing grade;
it means nothing public settled it, and its share of the score moved to the
sections that did report.
The whole report, from the summary through the appendix and sources to Revisions, Activity and Notes.
Prefer the stacked stage cards? Actions > Use previous layout switches back. The choice is saved in your browser, and Try the new report layout returns to the report.
Read it in this order:
1
Who the vendor is
The page opens with the company itself: what it sells, the industry it operates in, what an organization would typically use it for, its services and where it is headquartered. This is for the common case where you know a vendor is in use but not what it does.Everything here is researched from public sources, never asked of the vendor. Two separate confidence markers sit beside it, and they mean different things:
Identity confidence: how sure the run is that it profiled the right company. Low when the name is generic or several companies share it.
Risk tier confidence: how sure it is about the exposure. A run can be certain which company this is and still be unsure how much risk it represents.
2
The risk tier
A triage read of how much exposure the vendor typically creates (critical, high, moderate, low or minimal) with a one-line reason and the full argument underneath.
This is its own scale, not your organization’s risk levels. Those are calibrated against a completed questionnaire; this is judged from the outside. It does not touch a vendor’s inherent risk unless your organization turns that on, and even then it stands down if the composite score is already being written there.
3
What turned up against the vendor's name
Reputation follows the risk tier (the previous layout calls it Reputational Risk). It gathers everything the run found said about the vendor into one place: adverse media on its leadership, open watchlist matches if your organization screens, and the reputation controls the run evaluated. See Reading the reputational section below.
4
The composite, then what it is made of
The headline number combines up to five independently-sourced components: the control evaluation, the vendor’s Financial Health Score, its outside-in security rating, its corporate registration standing, and its leadership dossier. Each is scored 0-100 on its own before anything is combined.
5
Check which components resolved
A component with no data is left out, never counted as zero. A vendor with no filed financials has not failed the financial component. It has no financial component, and the remaining weights are redistributed across what did resolve. The card tells you both the weight it was configured with and the share it carried.
This is the most common misreading. A vendor scoring 78 on one component is not comparable to a vendor scoring 78 on three. Check the composition before ranking two vendors against each other.
6
Work the controls
Control Results by Area shows how each area of the control sets fared, and Issues Raised lists the open issues, most material first. Every control, with what it found and where, is in the Appendix. See Working the controls below.
7
Work the issues
Each open issue carries the evidence behind it and the control set that raised it. This is the part that tells you what is wrong, as opposed to how much.
8
Check the sources
Every place the run drew evidence from is listed, grouped by kind: web research, registries and filings, vendor infrastructure, and documents already on file. If a conclusion looks wrong, this is where you check its provenance.
Reputational evidence arrives from three places, and the Reputation section (Reputational Risk in the previous layout) puts all
three in one place so you do not have to go looking:
Source
What it contributes
Adverse media
Negative news tied to the company or a named executive, from the vendor’s leadership dossier
Watchlist screening
Open sanctions, PEP, criminal and legal matches, if your organization has screening turned on
Reputation controls
The ZT-REP-* controls the run evaluated itself: breach history, regulatory action, sanctions, adverse media, litigation and customer sentiment
The section opens with an overall standing, then reports five dimensions, each with
its own standing:
Media and customer sentiment: controversy in the press, breach coverage, what customers say publicly.
Litigation exposure: suits naming the company or its principals.
Regulatory and enforcement: regulator decisions, enforcement action, insolvency proceedings.
Executive conduct and stability: matters attached to a named individual, and leadership churn.
Sanctions and association: watchlist and financial-crime adjacency.
Each dimension reads one of four ways. The distinction that matters most is the last
two, because they look similar and mean opposite things:
Standing
What it means
Adverse findings
A material matter was found. Read it.
Watch
Something was found, but nothing material: low severity, informational, disputed, or a matter the subject was cleared of.
Clear
Something searched this dimension and found nothing.
Not screened
Nothing searched this dimension. It says nothing about the vendor.
Not screened is never evidence of a clean record. A dimension reads that way when
the template you ran carries no control for it, the vendor has no leadership dossier
yet, or your organization does not screen the relevant watchlist feed. The section
lists every unscreened dimension under the standing, so a short findings list is
never mistaken for a clean vendor.
A finding is material when it counts against the vendor. A matter the subject was
cleared of, or one a reviewer has already dispositioned, is still listed, because it
is part of the record of what the run read. It is not counted as material, and it does
not deduct from the score.The findings list is ordered material first, then by severity, so the row you need is
at the top.
Every control the run evaluated is listed in the report’s Appendix, grouped into sections (Security, Privacy, Company and identity, and so on) with its identifier, the question that was put to the research, the answer, and the evidence behind it.
A Zero Touch run reads public evidence and nothing else, so pass/fail is not enough to describe the result. Each control lands in one of four states:
Outcome
What it means
Compliant
Public evidence was found, and it meets the expectation.
Partially compliant
Evidence was found, but it is thin or indirect enough that the run is not certain.
Issue
Evidence was found, and it does not meet the expectation.
Not settled
Nothing public settles it.
These four words are the only vocabulary the page uses for a control’s state: the badge on the row, the view that lists it, and the compliance band over the whole set all say it the same way. A control whose question does not apply to this vendor reads Not applicable; it is listed with the unsettled controls and left out of its area’s total.
Not settled is not a finding against the vendor. It says the question cannot be answered from outside, which is what a full assessment is for. Treating it as a failure is the most common way to misread one of these runs, which is why it has its own view rather than being folded in with the issues.
A control carrying an issue shows its decisions on the row. A control that came back compliant or unsettled folds the same decisions behind Actions.
1
Confirm
You agree with what the run concluded. The control stays as it is.
2
Dismiss
You disagree, or the issue does not apply to how you use this vendor. The control is marked resolved and drops out of the open issues.
3
Add note
Leave context for whoever reads the run next: why you accepted a thin answer, or what you checked separately.
4
Create findings
Raise findings from a control. This is the same finding creation the assessment page uses, so the result is an ordinary finding that behaves like any other.
To decide several at once, tick their checkboxes: the selection bar appears at the foot of the page with the same Confirm, Dismiss and Create findings actions, exactly as it does on the other lists in the product. Changing view clears the selection, so a bulk decision only ever lands on controls you could see.Verdicts are recorded on the control itself, not in a Zero Touch-only place, so the assessment page and the Excel export show the same thing you decided here.Once a result has been revised, by an analyst or by the automated review, its control outcomes come from the revised version and the verdict actions are hidden. To change an outcome after that, revise the assessment again. See Revising a result.
Every template card carries a What does this control set assess for? link listing all of its controls by section: the identifier, the question, and what the run treats as a pass. Read it before you commit a portfolio to a template.
A run can only read what is public, so it will sometimes miss something you
know: the registry match is a different company, a vulnerability belongs to
another product with the same name, or the vendor sent you the policy the run
could not find. Revise assessment updates the result from text you paste,
without rerunning it.
1
Paste what you know
Open Actions > Revise assessment and paste analyst notes, evidence the vendor supplied, or a plain correction.
Paste notes, evidence or a correction. Nothing changes until you apply it.
2
Review each proposed change
Propose changes reads the text against the result and lists every change it supports, grouped by section. Each one shows the old value, the new one, why, how confident it is, and the words from your text it rests on. Untick any you do not want. The score preview on the right recomputes from the changes you keep.
Each change shows what it replaces and the quote it rests on. The preview moves as you accept or reject.
3
Apply
Applying saves the result as a new version. Every value you changed is marked Analyst revised in the report and in the PDF export.
Your text is read as evidence, not as instructions. A control only becomes
compliant when your text or a source already on the run supports its
requirement, and anything in the text that reads as an instruction to the
product is set aside and listed as ignored.Some changes leave research resting on the old answer. Unbinding a registry
match, for example, means sanctions were screened against the wrong company.
Those appear as a Rerun that follows from the change above, and after
applying you can rerun that research and then reassess to carry your revision
onto it.
Revisions, near the end of the report, lists every version of the result:
what produced it (the original run, an analyst revision, a restore or a
rescore), its composite, and the changes it applied. Open one to read it, and
Restore to make it current again. A restore is itself a new version, so
nothing in between is lost.
When Check each finished run against the vendor’s own pages is on, every finished run is read a second time. The review reads the vendor’s own website: its home page and the pages it links to, its trust and security pages, its policies, and pages found by a web search limited to the vendor’s site. It applies only the corrections a quote from one of those pages, or from a public record already on the run, supports.The corrections are saved as a new version, labeled Automated review under Revisions, with the quotes it relied on. Read it like any other revision, and Restore the previous version if you disagree. A result you revised while the review was running is left alone.The setting is on by default. Turn it off under Scoring on the module page. A run you complete by hand, and a rescore, are not reviewed.
A result page is a decision point, and there are three reasonable exits:
Accept it
The vendor is low-risk enough that a full review is not warranted right now. The score can be written onto the vendor’s risk score automatically. See below.
Escalate
Create full assessment carries the vendor straight into a normal assessment, with the triage findings already on the record.
Reassess
Financial and security inputs refresh on their own schedule. Reassess recomputes the composite against today’s data without re-running the controls, and takes a correction first if you give one.
A fourth exit, Archive, takes a run out of the working set without deleting it, for a duplicate or a vendor you no longer use. It is confirmed before it applies, because it is the one action here you cannot undo from the page.
Everything you can do to a run sits behind Actions, at the top right of the result page. You can approve the run, create a full assessment from it, reassess it, revise it from notes or evidence, open the full record, export it, switch layout, or archive it.
Approve closes the run. Create full assessment carries it onward. Reassess re-runs it, taking your correction first if you give one. Revise assessment updates it from text you paste.
Approve opens a short dialog. Under Vendor Disposition you can also move the vendor to one of your organization’s final statuses, or leave Keep current status, record no disposition selected, and add a note that prints beside the disposition in the report.Reassess opens a box for a correction before it re-runs. Leave it empty and the run is re-scored against the sources already gathered.The correction box takes plain language, not a form:
This is the wrong company. The vendor we mean is at northwind.example
Zero Touch researches a vendor from public sources with nobody to ask, so it sometimes binds the wrong website, or a different company with a similar name. Describing that in a sentence is faster than finding the field it maps to.What happens when you submit: the correction is read into a short, fixed set of fields, the website and the company name and nothing else. Those are applied to the vendor record, and the run is re-scored against them. Your exact words, the fields that changed, and the score before and after are all written to the audit trail below.
A correction that could not be turned into a concrete change is still recorded, and the entry says so.
Results fill in as they land, so a run is readable long before it finishes. Each stage carries its own state, and the banner at the top is the only place a run can be stopped.
Sections fill in as they land. Cancel stops the run; start over relaunches it, optionally with a correction.
The Actions menu keeps its shape while the run works and grays out what cannot work yet: there is nothing to export, no score to reassess and nothing settled to approve.
The same menu on a run in flight. What is grayed out is what the run has not produced yet.
Every run carries a review status, shown on the result page and as a column in the runs table:
Status
Meaning
Running
The engine is still working. The progress bar shows how far along it is.
Review results
Finished and scored, and nobody has decided on it yet.
Approved
A reviewer accepted the result.
Escalated
A reviewer judged that triage was not enough.
Archived
Out of the working set. Still readable by URL, and its trail is kept.
Failed
The run stopped before it could score, or was canceled. Launch it again to retry.
A run is scored as soon as the engine finishes, before anyone approves it. Approval is a judgement about the result, not what produces it.
Archiving does not overwrite an approval. The status answers “was this result accepted?”; archiving answers “is this still in my working set”. They are different questions, and the trail records both.
Below the result, the Activity section is the same activity log that vendors and assessments use, and it lists every action on the run with who took it, what it changed and what the score did: approvals, escalations, archives, corrections, re-scores and control verdicts alike. Notes sits underneath it for context that is not an action.
The Zero Touch review trail is append-only. Nothing on it can be edited or removed, including by us. A correction that later turns out to be wrong is fixed by making another correction, which appears as a new entry.
This matters because a Zero Touch Score can be written onto a vendor’s real risk score. If a number moved, the trail is what tells you whether the machine found something or a person corrected it.Escalating does not itself launch a full assessment. It records the judgement. Starting the assessment is a separate step, because it puts work in front of your team and your vendor.
Written onto the vendor’s risk score when a run completes.
Service inherent risk score / Service residual risk score
Written onto each service the run covered.
Only the axis you choose is written, so a Zero Touch run can never overwrite an inherent score your team set from an intake questionnaire.
A vendor-scoped run configured to write a service score writes nothing, and says so on the result. Guessing which service was meant would move the wrong number.
Also under Scoring: which signals count, and how heavily.
Toggle the financial health, security, corporate registration and people components on or off for your organization.
Set relative weights. They are not percentages. They are renormalised over whichever components resolve for a given vendor, which is why a vendor missing one component still scores out of a full 100.
Two of the components are derived rather than read from an existing score, and behave differently:
Corporate registration
Scores the registry standing of an identity that was matched to this vendor. A vendor no register matched is unavailable, not zero. Plenty of legitimate private companies appear in none of the free registers. A plausible but unconfirmed match is capped well below a confirmed one. A dissolved company scores above an unfound one, because being on record and wound up is better evidenced than never being found.
People
Starts from how much of the leadership is on record and deducts for adverse-media findings, capped so a long tail cannot dominate a triage number. Informational items such as a departure or a disputed report are shown, and carry no weight.If adverse-media screening never ran, nothing is deducted at all. A screening that did not happen cannot establish the clean record a zero deduction would imply, so the component scores leadership visibility alone and labels itself Adverse media not screened.
Under Scoring, or as a step in the launch wizard, you can switch which set of questions Zero Touch runs evaluate. Seven ship with the product:
Template
Questions
Best for
Zero Touch Comprehensive(default)
49
Everything public evidence can settle, across every domain
Zero Touch Essentials
12
Triaging a long tail fast, when you mostly need to know who to look at
Zero Touch for SaaS and Cloud
30
Vendors that host or process your data
Zero Touch for Healthcare
21
Vendors that may touch PHI
Zero Touch for Financial Services
29
Regulated financial-sector supply chains
Zero Touch for Services and Suppliers
25
Professional services, staffing and physical suppliers
Zero Touch for Open Source Software
24
An open-source project, library or self-hosted product you adopt rather than buy
The first six draw on the same catalog of 49 questions about a company, spread across eleven domains: company and identity, security, privacy, compliance, technical operations, resilience, financial health, ethics, ESG, reputation and AI governance. A template is a selection from that catalog, not a separate set of questions, so a control means the same thing and is scored the same way whichever template you run. The open-source template asks its questions of a project instead of a company, and borrows only the sanctions and adverse media questions from the company catalog.A question earns its place in the catalog only if public evidence can settle it. Anything that needs the vendor to answer would come back unevaluated on every run and make the vendor look worse than they are.
Zero Touch Comprehensive: 49 questions (the default)
Every question in the catalog. This is the widest picture open-source research can produce, and the right starting point when you do not yet know what your portfolio looks like.It is also the most sensitive to a thin vendor. A small supplier with no certifications, no filings and no security page will leave a lot of questions unevaluated, and the score reflects what could be checked rather than everything asked. If most of your tail looks like that, one of the narrower templates will read better.
Zero Touch Essentials: 12 questions
The twelve questions that most often decide whether a vendor needs a full review: is this a real, standing company, is there any security posture on record, has anything gone publicly wrong, and is anyone accountable.Fastest to run and cheapest to read. Use it when the goal is to sort a long list into “look at this” and “leave it”, rather than to characterize any one vendor in depth. It is the best choice for a first pass over hundreds of vendors.
Zero Touch for SaaS and Cloud: 30 questions
Weighted towards what matters when the vendor holds your data: SOC 2 and ISO 27001, sub-processor disclosure, hosting and region, encryption and TLS, MFA and SSO, vulnerability disclosure, status and incident history, exit and portability, and whether customer data is used to train models.Drops most of the physical-supply and labour questions, which rarely apply and would otherwise sit unevaluated.
Zero Touch for Healthcare: 21 questions
For vendors that may touch PHI. Adds weight to breach history, data retention and regulatory action, because healthcare enforcement is unusually well documented in public sources. HHS breach reporting in particular means a real incident is usually findable.Narrower than the SaaS template on infrastructure detail, deeper on what happens to records and what regulators have said.
Zero Touch for Financial Services: 29 questions
For regulated financial-sector supply chains. Emphasises operational resilience, regulatory standing, sanctions exposure and corporate transparency: who ultimately owns this company, and is that ownership traceable in a register.This is the template most likely to surface a corporate-structure problem, which is often the finding that matters in a financial supply chain.
Zero Touch for Services and Suppliers: 25 questions
For professional services, staffing and physical suppliers, where the technical surface is small and the real questions are ethics, labour practices, continuity and financial standing.Use this rather than Comprehensive for vendors with little or no online product. Asking a staffing agency about sub-processors and TLS configuration produces a page of unevaluated controls and a score that says more about the questions than the vendor.
Zero Touch for Open Source Software: 24 questions
For open-source software your organization adopts rather than buys as a service. It asks what the license obliges you to do, who maintains and funds the project, how releases are verified and vulnerabilities handled, and what the software sends out of your environment.Launch it on a record for the project itself: name the record after the project and use its home page or source repository as the website. Run against a company record, it fails the project identity question and leaves the other project questions unevaluated.
If a lot of your runs come back with many unevaluated controls, that is usually a sign the template is wrong for the kind of vendor rather than a sign the vendor is bad. Switch to a narrower template and re-run.
Switching template applies to future runs. Past runs keep the scope they were launched with, and each run records which template it used, so if you compare two runs, check they answered the same questions.
If your organization runs a control set of its own rather than one of these, no template is highlighted and the picker says so.
Select runs in the table and choose Export as Excel from the selection bar. One row per run, carrying the score, band, the reputational standing and its material finding count, and the profile fields including the risk tier and its reasoning. Export PDF on the same bar gives a portfolio report of the selected runs, with the score each reached and where it stands in review.
2
A single run
From Actions on a result page, Export spreadsheet gives a summary sheet, a Reputational Risk sheet, a Notes sheet when the run has notes, and sheets for the score components, control-set coverage, every control, the issues raised and the sources cited, plus one sheet per intelligence surface the vendor has. Export PDF gives a letter-sized report laid out like the page itself. Both layouts open the same export dialog Vendor Intelligence uses. In the report layout the cover always prints; untick any other section to leave it out. Under Vendor Intelligence Detail Pages you can also add the full corporate registrations, people, security posture and financial health pages for the surfaces this run covered, and they print after the report in the same file.
3
Finding the reputational read quickly
In the spreadsheet it is in two places: on the summary sheet under the score, one line per dimension, and on the Reputational Risk sheet, which is the second tab and carries one row per finding with its publisher, date and link. In the PDF it follows the summary and the risk tier reasoning, in the same order as the page. The previous layout’s PDF puts it second, straight after the vendor profile, and lets you drop it along with any other section if a reader does not need it.
Why is my runs table empty right after a bulk launch?
It should not be. In-flight runs appear immediately and sort below scored ones. If it is genuinely empty, no Zero Touch runs exist yet for this organization.
Do Zero Touch runs show up in my normal assessments list?
Yes. A Zero Touch run is an assessment. The vendor’s Assessments tab splits into Full Assessments and Zero Touch Assessments, and the full list excludes triage runs so a first pass is never mistaken for a completed review. The Zero Touch list shows the vendor’s runs by date, each with how many controls it evaluated and how many issues it found, and offers Start full assessment when you hover a run.
A reputational dimension says Not screened. Is the vendor clean?
No. Not screened means nothing looked at that dimension, so it carries no information about the vendor at all. Clear means something searched and found nothing. Switching to a template that carries the missing control, or turning on the watchlist feed for that dimension, is what changes it.
Why did a control come back unevaluated?
Because no public evidence spoke to it. That is a real result, not a failure. It tells you the question can only be answered by asking the vendor, which is what a full assessment is for.
Does a re-run use fresh intelligence, or what was gathered last time?
Fresh. Launching a run re-gathers the vendor’s registration, security and people research before scoring, so a composite is never a mix of today’s controls and research from months ago. The controls are re-evaluated every time regardless.
Why does a control show a code like ZT-SEC-04?
That is the control’s identifier, and it is stable, so you can quote it in a ticket or match it against an export. Codes are numbered within their section, so the letters tell you the area.
Can I re-run a vendor?
Yes. Re-run a vendor whenever something changes or new evidence lands. Every run is its own row in the runs table, so search or filter by vendor to compare them, and the vendor’s Zero Touch Assessments tab lists them all by date.
The profile describes the wrong company. Can I fix it?
Yes. Open Actions > Revise assessment and say what is wrong in your own words, for example the right company name and website. It proposes changes to the profile fields for you to accept or reject, and applying them saves a new version of the result. To correct the vendor record itself, use Actions > Reassess with the same correction. Reassessing re-scores the run but keeps the existing profile.
Does the risk tier change my vendor's risk score?
Not unless your organization turns that on, and it is off by default. Even when on, it stands down if the composite score is already configured to write to vendor inherent risk, so two things never fight over the same field.
