Automated Vendor Security Risk Audit with n8n + OpenAI

Automated vendor security risk audits with n8n + OpenAI

This n8n workflow automatically audits a vendor’s security posture on a schedule—checking website security signals and domain details, pulling Have I Been Pwned breach data, and using OpenAI (gpt-4o-mini) to generate a structured risk rating. Results are logged to Google Sheets and escalated via Slack and Gmail when risk is High or Critical.

What this workflow does

• Schedules and collects audit inputs: sets the vendor name, website, contact email, data access level, and audit date.
• Performs security checks: fetches the vendor website response headers and page content to compute a security header score, runs a privacy-policy keyword check, and queries RDAP to estimate domain age.
• Enriches breach context: pulls the Have I Been Pwned breaches list for the vendor domain and counts relevant breaches.
• Generates a structured risk assessment: sends a compiled summary (header score, estimated domain age, breach count, keyword check) to an OpenAI gpt-4o-mini agent to return an overall risk score, risk tier, executive summary, and recommendations.
• Tracks results in a risk register: calculates the next audit date based on the risk tier and appends/updates the vendor record in a Google Sheet titled Vendor Risk Register.
• Escalates critical findings: if risk tier is High or Critical, posts a Slack alert and sends an email via Gmail to the security team.
• Failure visibility: if the workflow fails or the AI agent errors, it posts an error alert to Slack.

Use cases

• Vendor onboarding: run recurring vendor security risk audits before granting data access.
• Third-party monitoring: detect changes in security headers, domain age signals, and breach exposure over time.
• Security operations: maintain a centralized risk register and trigger targeted reviews for High/Critical vendors.

Technical details

• n8n nodes/actions: if, set, code, gmail, slack, sticky note
• Integrations: OpenAI (gpt-4o-mini), Google Sheets (OAuth2), Slack, Gmail
• Data sources: website header/content checks, RDAP domain age lookup, and Have I Been Pwned breach list