Skip to main content

Monitor continuously

A vendor's risk doesn't freeze the day you onboard it. SolveGRC keeps watching after go-live: it collects external intelligence about the vendor, flags drift in your own records, and tells you which vendors are due for another look. Most of this happens on the vendor's detail page.

External signals​

Once a vendor exists, SolveGRC works out its internet footprint and continuously pulls external signals about it: exposure, breaches, credential leaks, disclosures, and more. Each signal is linked to the vendor and shown on its Signals tab.

ScreenshotA vendor's Signals tab: active external signals with their type and severity, and the confirm / dismiss / re-open triage controls.

You can also collect on demand with Run OSINT now, which fans out the collectors and refreshes the vendor's signals in place.

Triage repricing risk in real time​

Work each signal with confirm, dismiss, or re-open (dismissing needs a short reason). The moment you triage a signal, SolveGRC recomputes that vendor's inherent risk, so your judgment is reflected in the score immediately rather than waiting for the next collection run.

Where the evidence supports it, signals are also turned into inferred weaknesses, mapped to ATT&CK techniques and CWE categories, giving you a threat-informed view of where a vendor is exposed.

Drift in your own records​

The Drift tab surfaces changes on your side that quietly erode assurance: evidence that has expired or is about to, risk acceptances lapsing, assessments going stale, and SLA breaches. Each drift event has an acknowledge then resolve workflow so nothing slips.

ScreenshotA vendor's Drift tab: drift events by type and severity, each with acknowledge and resolve actions.

Which vendors need another look​

The Drift Velocity view scores how fast a vendor's signal picture is moving and in which direction (improving, stable, or deteriorating), and turns that into a reassessment priority so you can focus on the vendors sliding the wrong way.

This runs on a schedule

Collection, drift detection, and reassessment scoring run automatically on recurring jobs, so the Signals, Drift, and Drift Velocity views stay current without anyone pressing a button. Use "Run OSINT now" when you want a fresh pull for a specific vendor right away.

The last stage is turning all of this into something you can hand to a stakeholder. Continue to Report out.