Skip to main content

What runs automatically

A lot of GRC work is not a project you finish — it is a state you maintain. Evidence ages, cloud configurations drift, vendors have bad weeks, new findings appear. SolveGRC does a standing amount of this upkeep on its own, between your logins, so the platform you open in the morning already reflects what changed overnight. This page is the plain-language version of what happens while you are not looking.

As you work — right away​

Some things happen the moment you act, without a schedule:

  • A document you upload is extracted, chunked, embedded, registered as evidence, and quality-scored — usually within moments, so it is immediately searchable and citable.
  • A questionnaire you import is parsed into individual questions, ready to answer or route to the AI.
  • An answer you approve is registered as evidence, unless you approved it over an open check, and becomes reference wording for the AI's drafts over the next year.

You do not trigger any of this separately. Feeding the platform is the trigger.

Every few hours — the cloud keeps itself current​

If you have connected a cloud account (read-only), SolveGRC re-syncs it every six hours. Each sync:

  • Pulls the current inventory and findings. Findings from your provider's security service (AWS Security Hub, Microsoft Defender for Cloud, or Google Security Command Center) arrive mapped to compliance standards.
  • Redraws topology and attack paths from the live state.
  • Records new attack paths under Attack surface changes. If email is turned on, organization administrators get one when a new high- or critical-risk attack path appears.

The effect is that your cloud does its own paperwork. You are not exporting configs and diffing them by hand; the platform is doing that continuously and only interrupting you when it matters.

Every few minutes — risks stay matched and priced​

  • Signal matching. Every five minutes, new risk signals are matched to your existing risks, and a strong match is linked automatically.
  • Loss estimates. Every 15 minutes, each open risk gets an updated annual loss estimate from its scores, threat base rates, and linked business services.

Every night — the quiet maintenance pass​

Overnight, SolveGRC runs the housekeeping that keeps yesterday's conclusions honest today:

  • Freshness. Evidence quality is re-scored, and items registered more than 292 days ago are flagged stale.
  • Vendor monitoring. Vendor drift detection runs, vendor risk is snapshotted, and vendors are ranked for reassessment.
  • Recompute. Compliance scores and control assurance scores are recalculated from the latest evidence and assessments, so the number you see in the morning reflects last night's state, not last week's.
  • Vendor findings and acceptances. Open vendor findings past their due date are flagged SLA Breached, and a risk acceptance that reaches its expiry date expires and reopens its finding.
  • For MSPs. Upcoming client reviews are scheduled once they fall inside their prep window, and evidence batches still queued after a week are cancelled.

Every week​

  • Vendor intelligence. Every Monday, external signals are collected for every vendor with a known domain, and public companies get a quarterly check of their SEC filings.
  • Contract deadlines. Every Monday, expiry, notice-period and obligation deadlines are recalculated for active contracts.

When you start them​

Two checks run only when someone starts them: control drift detection (Run drift detection now) and the freshness-SLA check (Run stale-evidence detection now), both on the Assurance Dashboard.

Why it works this way​

Continuous, scheduled upkeep is what separates a compliance snapshot from a compliance program. A once-a-year scramble tells you where you stood on one day. A platform that re-checks freshness, scores, and vendor drift every night tells you where you stand right now, and hands you the short list of things that changed. That standing awareness is the product.

What this means for you​

  • Trust the morning view. What you see at login already accounts for overnight changes — you are not looking at a stale board.
  • Watch your inbox for the cloud change feed. The alerts SolveGRC sends are the ones worth interrupting you for; the rest is handled quietly.
  • Run the checks that are yours to start. Drift detection and the freshness-SLA check put their results on the Assurance Dashboard and the Findings tab, ready to work.
What we don't expose

You can see what the platform checked and what changed, including the thresholds drift detection uses, which each drift event's drawer shows. The rules behind vendor scoring stay internal, which keeps those signals reliable and hard to game.