Skip to main content
VISO TRUST uses AI to help you collect security evidence, understand vendor risk, and complete assessment tasks. It combines large language models with your program’s data, supported product actions, and a configured risk model. You review the findings and decide how to respond.

​
Where you use AI

Available capabilities depend on your permissions and your organization’s configuration.

​
How the pieces work together

A large language model, or LLM, interprets language and generates responses. VISO TRUST supplies relevant information and instructions for a particular task, such as finding evidence in a security report or summarizing assessment results. An AI agent combines that language capability with tools that can retrieve information or perform supported actions. An agentic workflow coordinates multiple steps toward a result. Some workflows start automatically when you upload evidence or run an assessment. Others begin with a request in chat. For example, when you upload a security report, VISO TRUST can:
  1. Identify the document type and extract relevant information.
  2. Find evidence that relates to the controls being assessed.
  3. Produce structured findings.
  4. Use the evidence and relationship context in your configured risk calculation.
  5. Summarize the results for your review and any follow-up action.
Different tasks use different combinations of these steps. An answer to a document question does not require a new assessment, and an assessment may include an additional auditor review.

​
A shared LLM gateway

VISO TRUST connects its AI capabilities to language models through an LLM gateway. The gateway provides a consistent connection to supported model providers and centralizes model access and usage monitoring. This lets VISO TRUST use models suited to different tasks and improve the models behind a capability over time. You use the same product workflows as those underlying models evolve. The AI system can also use alternative configured models for certain temporary service failures.

​
Supported model providers

VISO TRUST supports language models from Anthropic, Google, and OpenAI. The providers available to a particular capability can vary by deployment, region, and service configuration. Search and retrieval across your artifacts use Amazon Titan embedding models on Amazon Bedrock. Support for a provider does not mean every request is sent to that provider or that every provider is available in every region. Contact your VISO TRUST representative for information about the services applicable to your organization.

​
How evidence becomes a result

For document-based questions, VISO TRUST retrieves relevant evidence and uses it to generate an answer. Depending on the feature, you can review source documents, quoted passages, or page references alongside the result. Public research and advisories may instead reference a public source. Three different concepts help you interpret what you see:
  • Answer confidence indicates how strongly the available evidence supports a generated answer. It is not a guarantee of correctness.
  • Evidence assurance describes the strength of the evidence used to support a control, including factors such as document type and validity.
  • Risk scores are calculated using your configured risk model, relationship context, and control evidence. They are distinct from an LLM’s confidence in an answer.
Not every result has a quoted document passage. A presumed certification can reflect a public claim without an underlying report. An answer you write or edit yourself is treated differently from an AI answer with citations. See Risk Analysis for how to read findings and Control Domains & Artifact Types for how assurance affects control credit.

​
Your role in the workflow

AI helps prepare information and carry out supported tasks. Your team remains responsible for reviewing findings and recording risk decisions.
  • Background processing: Activities such as document analysis and configured questionnaire answering can run automatically. Results become available as processing finishes.
  • Actions in chat: Creating relationships, applying suggested context, and starting assessments use proposals that you can review and approve. For bulk actions, review the selected relationships and shared settings before proceeding.
  • Questionnaire responses: Review supporting sources and any answers that need attention before using or sharing the output.
  • Auditor review: Assessments configured with AI Assessment + Auditor Review include an additional human review of relevant artifacts. This is separate from your team’s decision to accept risk or request follow-up.
Where enabled, Chat with support can help investigate an issue, propose supported artifact corrections for your approval, or send the issue to a human support team.

​
Data access and privacy

AI-assisted tasks use the information available to the relevant workflow, such as evidence on a vendor relationship or documents in your organization’s Knowledge base. Your permissions govern access to platform information and actions. Public research can also use information available on the web. Chat can use conversation history and saved context to support follow-up conversations. See Security & Privacy for the platform’s published data-use information. Contact your VISO TRUST representative for questions about AI processing, applicable providers, retention, or deletion.

​
When a result needs a closer look

AI-generated results can be incorrect or incomplete, even when the source data is correct. Missing evidence, outdated documents, ambiguous wording, or an incorrect interpretation can affect an answer. A lack of supporting evidence does not by itself prove a control is absent. Before acting on a result:
  1. Check that the source relates to the right vendor, product, time period, and question.
  2. Review the supporting evidence and any exceptions or conflicting findings.
  3. Add or replace documentation when evidence is missing or outdated, then follow the relevant assessment or questionnaire update process.
  4. Correct an editable answer or contact support if the result still does not match the evidence.
For specific steps, see Tips for Better Answers, Answer Inbound Questionnaires, or Troubleshooting & FAQ.