Skip to main content

Monitor continuously

A vendor's risk doesn't freeze the day you onboard it. SolveGRC keeps watching after go-live: it collects external intelligence about the vendor, flags drift in your own records, and tells you which vendors are due for another look. Most of this happens on the vendor's detail page.

External signals​

Every Monday, SolveGRC collects external (OSINT) signals about each vendor's internet footprint: exposure, breaches, credential leaks, disclosures, and more. It covers every vendor with a known domain, taken from the vendor's website or a contact email; a vendor with neither is skipped. Public companies also get a quarterly check of their SEC filings. Each signal is linked to the vendor and shown on its OSINT Signals item. To collect for every vendor right away, click Refresh OSINT (All) on the Vendors page.

A vendor's Signals item showing normalized signal counts and recent signals with type and severity
A vendor's Signals item: normalized-signal KPIs, including the reassessment queue count (labelled Reassessment Priority in the current UI), and the recent external signals — breach disclosures, incident notifications, exposed services — each typed, scored, and severity-rated.

To collect for one vendor right away, click Run OSINT now on the vendor's Intelligence item. It fans out the collectors and refreshes the vendor's signals in place.

Triage repricing risk in real time​

Work each signal with confirm, dismiss, or re-open (dismissing needs a short reason). The moment you triage a signal, SolveGRC recomputes that vendor's inherent risk, so your judgment is reflected in the score immediately rather than waiting for the next collection run.

Where the evidence supports it, signals are also turned into inferred weaknesses, mapped to ATT&CK techniques and CWE categories. These are sent to the Risk Register as risk signals for the risk team to triage (see Promote from signals). They have no other screen in the app.

Drift in your own records​

The Drift Events item surfaces changes on your side that quietly erode assurance: evidence that has expired or is about to, risk acceptances lapsing, assessments going stale, and SLA breaches. Each drift event has an Acknowledge and a Resolve button. You can resolve an event without acknowledging it first.

A vendor's Drift Events item with severity counters and events carrying acknowledge and resolve buttons
A vendor's Drift Events item: active-event counters, severity filters, and each drift event — an expiring risk acceptance, a breached SLA — with its acknowledge and resolve actions.

Which vendors need another look​

The Reassessment Queue on the OSINT dashboard ranks vendors for reassessment, refreshed daily. Click Schedule to create a draft assessment for a vendor, or Defer to postpone it. Nothing issues a reassessment automatically, so someone has to act on the queue.

What runs on a schedule

Drift detection and reassessment scoring run daily, so the Drift Events item and the Reassessment Queue stay current without anyone pressing a button. OSINT collection runs every Monday; click Run OSINT now or Refresh OSINT (All) when you want fresh signals sooner.

The last stage is turning all of this into something you can hand to a stakeholder. Continue to Report out.