Bitsight Third Party Cyber Risk for Coupa

Bitsight Third Party Cyber Risk is an app built by AcquisLink for Coupa. It displays Bitsight security ratings on Coupa supplier records, so users can view a supplier’s cyber risk in Coupa without logging in to Bitsight. The app matches suppliers to their Bitsight profiles, refreshes overall ratings and risk vector grades once a day, and displays live risk vector grades on demand.

Table of Contents

• What is Bitsight Third Party Cyber Risk for Coupa?
• Onboarding Instructions
• Frequently Asked Questions

What is Bitsight Third Party Cyber Risk for Coupa?

AcquisLink connects Coupa supplier records to Bitsight. The integration runs as three separate automated workflows.

How the three integrations work together

The workflows are designed to run in sequence on a schedule:

• Integration 1 runs first: this integration links any new suppliers in Coupa to their Bitsight company profiles. This only needs to happen once per supplier, but the workflow runs regularly to catch newly added suppliers.
• Integration 2 refreshes the security scores on every linked supplier's Coupa profile.
• Integration 3 simultaneously pushes the same Bitsight scores into the structured Risk Aware module for reporting and dashboards.

Integration 1: Subscribe New Suppliers to Bitsight

What it does: This workflow runs periodically and looks for Coupa suppliers that have not yet been linked to a Bitsight company. This is an onboarding step that allows Bitsight scores to flow into Coupa and allows the data in the other two integrations (2 and 3) to keep current automatically. 

For each unlinked subscriber, the integration:

1. Searches Bitsight using the supplier’s website domain
2. Compares the Coupa supplier name to the best match in Bitsight using a similarity score
   • If the match has a confidence score >80%, the company is subscribed in Bitsight for continuous monitoring and the unique Bitsight identify is written back to the supplier record in Coupa
   • If the match is below the threshold, the supplier record is flagged in Coupa with a note of top candidates for human review.
   • If Bitsight returns no results at all: the supplier is marked with a “No Potential Match Found” note.

What counts as a confident match? 

The Integration 1 workflow calculates a fuzzy name-match score between the Coupa supplier name and the best Bitsight search result. It is currently configured so that 75% or above defines a match and the supplier is subscribed in Bitsight and linked automatically. Below that, the Bitsight company note is populated instead showing the top three closest matches for manual review.

What happens when Bitsight returns more than one possible match? 

When the match score falls below the threshold, Coupa's Bitsight Company Note field is populated with "Manual Review Required" plus the name and GUID of the top two Bitsight search results, so a reviewer can pick the correct company by hand and set the Bitsight Company ID manually.

Integration 2: Sync Security Ratings to Supplier Records

What it does: This workflow runs for suppliers that are already linked to Bitsight (i.e., they have a Bitsight company ID stored in Coupa). This integration refreshes the overall Bitsight Risk Rating and the configured risk vector grades on each Coupa supplier record.

For each linked supplier, the integration:

1. Retrieves the latest security data from Bitsight
2. Maps each individual risk score to a corresponding risk vector rating on the Coupa supplier record.
3. Updates the Coupa record so the data is visible to procurement and risk teams.

Custom fields updated in Coupa on each refresh:

• Overall Bitsight Risk Rating: Numeric score (250–900)
• Botnet Infections: Grade (A–F)
• Spam Propagation: Grade (A–F)
• Malware Servers: Grade (A–F)
• Unsolicited Communications: Grade (A–F)
• Potentially Exploited: Grade (A–F)
• SPF Domains: Grade (A–F)
• DKIM Records: Grade (A–F)
• TLS/SSL Certificates: Grade (A–F)
• TLS/SSL Configurations: Grade (A–F)

Integration 3: Sync Security Ratings to Risk Aware Feed 

What it does: This workflow mirrors Bitsight data into the Risk Aware module, so no manual data entry is required.. Risk Aware is the structured, reportable home for supplier risk data inside Coupa.

For each linked supplier, the integration:

1. Checks whether the supplier already has a Risk Aware entry in Coupa and creates a new Risk Aware entry if none exists.
2. Retrieves the latest security rating from Bitsight.
3. Updates the Risk Aware entry with the Bitsight overall score so it feeds into any Risk Aware dashboards and reports configured in Coupa.

Onboarding Instructions

Complete these steps once for each client before you set up the integrations. They create the credentials and custom fields that the integrations read from and write to.

Before you begin

• Acquire the app through the Coupa App Marketplace.
• An active Bitsight Continuous Monitoring subscription is required.

This integration must be purchased, please contact your Bitsight sales representative.

Step 1: Create Coupa OAuth credentials

AcquisLink authenticates to the client’s Coupa instance with an OAuth 2.0 client. This must be created once per client.

1. As a Coupa admin, open the Bitsight Third Party Cyber Risk listing in the Coupa App Marketplace.
2. Click Get Started.
3. Complete the form.
4. After you submit the form, click Install Now to obtain the OAuth client and the Panel App in your Coupa instance.
5. Record the client ID and client secret generated. Send both to AcquisLink through a secure channel.

Step 2: Create a Bitsight API token

A Bitsight API token scoped to the client’s Bitsight organization is required. AcquisLink uses the token to search, subscribe, and pull ratings for suppliers.

1. Log in to the Bitsight portal as an administrator for the client’s account.
2. Go to Settings > API Tokens, and generate a new token.
3. Record the token. Send it to AcquisLink through a secure channel.

Step 3: Create the Bitsight Admin content group

This content group restricts who can view and edit the metadata Bitsight fields in Coupa.

1. In Coupa, go to Setup > Security > Content Groups.
2. Create a new content group named Bitsight Admin.
3. Assign the content group to the roles and users who support the flow of Bitsight data to Coupa (i.e. the integration team and risk/security admins)

Step 4: Create supplier custom fields

Create the following custom fields on the Coupa Supplier object. These fields are populated by Integration 1 (matching) and Integration 2 (rating sync)

1. In Coupa, go to Setup > Custom Fields.
2. Create the field listed in the table below:

Step 5: Create supplier Risk Aware custom fields

Risk Aware requires its own feed and field definitions, separate from the supplier custom fields you create in Step 4.

1. In Coupa, go to Setup > Custom Fields.
2. Create the Bitsight Risk Score field.

Frequently Asked Questions