Introducing Outreach Campaigns in Lema

When a vulnerability or breach affects your vendors, you need to know which ones are exposed and what they're doing about it.

Outreach Campaigns in Lema lets you send one questionnaire to hundreds of vendors at once and track every response in one place, without opening individual assessments. It's available today to all Lema customers.

See it in Action

Why we built it

When a critical vulnerability is disclosed, security teams need to confirm which vendors are affected, whether they've patched their systems, and what they're doing if they haven't.

Regular vendor assessments aren't built for this kind of outreach. Teams end up sending the same questions to dozens or hundreds of vendors, tracking answers in spreadsheets, and manually following up with those who haven't responded.

Outreach Campaigns gives TPRM teams a faster way to collect answers when circumstances change, without reopening individual vendor assessments. Teams can reach relevant vendors, see who still needs to respond, and manage follow-ups in one place.

What’s included

• Target the right vendors.
  Select vendors based on inherent risk, data access, AI posture, custom tags, or monitoring findings.
• Send questionnaires in bulk.
  Build a questionnaire, select your vendors, and send it to all of them at once, outside the regular assessment process.
• Automatically generate outreach emails.
  Lema prepares the email subject and body based on your questionnaire, which you can review and edit before sending.
• Set deadlines and reminders.
  Choose when vendors should respond and let Lema automatically remind those who haven't.
• Track every response.
  See which vendors have received the questionnaire, who has responded, and who's still pending, all in one place.
• Add vendors as needed.
  Add missing contacts during setup or include additional vendors after the campaign has started.

Use Case

When PHP2Shell was disclosed, Outreach Campaigns provided customers with a ready-to-use response workflow.

Customers received:

• A prepared PHP2Shell questionnaire asking vendors about their exposure, remediation status, and any evidence of exploitation.
• A suggested campaign with the questionnaire, email, deadline, and reminders already configured.
• Monitoring alerts identifying potentially exposed vendors, including affected hosts and PHP versions, with a dedicated exposure field that can be used to select recipients.

This meant customers could start contacting relevant vendors immediately, without building the campaign from scratch. The monitoring findings could also help them decide whom to contact first.