List every vendor from: invoices + the SSO app list + DNS/SaaS discovery (+ the AI inventory from Gatorbyte #004). DNS always finds the tools nobody mentioned.
Row each one. Fill Q1 from knowledge; score Q2 and Q3 honestly — 🟡 is not 🟢, and a blank breach-notice window is a 🔴.
Sort by Overall. The 🔴 High-criticality corner is your next quarterly-review conversation — and the remediation quotes that follow.
🎯 First pass is supposed to look ugly. An ugly count you can name beats a clean one you can't.