Skip to main content
Risk Advisories are alerts generated when something risk-relevant happens to a vendor in your portfolio: a breach, regulatory action, software vulnerability, or other material event. VISO TRUST monitors your vendors continuously and surfaces advisories automatically, so you’re informed the same day an event is published rather than at your next review cycle.

​
What a risk advisory contains

Clicking an advisory opens a detail panel with:
  • Title and published date
  • Type — the category of event, shown as a chip (see below)
  • Source — a link out to the original reporting
  • The affected organization — its name and description, labelled Your vendor or Subservicer so you can tell at a glance whether the advisory hits a direct relationship or something further down the chain
  • Network exposure — a count of the organizations in your risk network touched by the advisory; clicking it opens the network graph
  • Summary — an AI-written summary of what happened
Vulnerability advisories are listed with their CVE identifier and a Severity score rather than an affected organization, since they describe a flaw rather than an incident at a specific company.

​
Advisory types

​
Materiality

VISO TRUST assesses every advisory for materiality: whether a reasonable stakeholder would consider the event important in evaluating the vendor’s risk profile. The assessment is automated with human oversight. Materiality is a yes/no determination, not a score, and it decides what you can do from the advisory. A material advisory against a vendor or subservicer offers two extra actions in the detail panel:
  • Take action — opens VISO Chat Agent scoped to that advisory, so you can ask what it means for your portfolio or have it draft vendor outreach
  • Generate impact report — produces a written impact analysis. This one is limited to nth-party advisories, where the exposure path through your portfolio isn’t obvious.
Advisories still under review, and advisories that don’t affect a vendor in your network, don’t offer these actions.

​
Where to find advisories

Portfolio level: Navigate to Monitoring in the left sidebar to see all advisories across your entire vendor portfolio. Switch between the Risk Advisories and Vulnerabilities tabs to view each feed. Within each tab, a row of toggles scopes the list: Relationship level: Open any vendor relationship and go to the Monitoring tab to see advisories specific to that vendor and their nth parties. Nth-party visibility: VISO TRUST surfaces advisories not just for your direct vendors, but for their subservicers and technology providers. This gives you visibility into supply chain risk beyond your immediate vendor list.

​
Requesting a vendor response

When a high-impact advisory affects multiple vendors, you can send a targeted collection request directly from the advisory. The request asks affected vendors to confirm their exposure and provide evidence of their response.
1

Open the advisory

Navigate to Monitoring, open the Risk Advisories tab, and click the advisory you want to act on.
2

Select Request vendor response

At the bottom of the advisory, click Request vendor response.
3

Select affected relationships

Use filters (tiers, tags, business units, business cases, data types) to identify the relevant vendor relationships. Select individual vendors or bulk-select your entire portfolio.
Relationships without a third-party contact cannot be included. Add a contact to the relationship first.
4

Define your questions

Add specific questions for vendors to answer, tailored to the advisory rather than generic requests. VISO Chat Agent can help you draft context-specific questions based on the advisory details.
5

Configure and send

Use Advanced Settings to define collection timelines, non-response behavior, and follow-up options. Send the request. Each vendor’s contact receives a targeted collection request.
Track vendor responses in the relationship’s artifact list under the Questionnaire artifact type.

​
Continuous monitoring

VISO TRUST continuously scans OSINT feeds, regulatory filings, security disclosures, and news sources to surface advisories as they emerge. There’s no manual setup required. Once a relationship exists and the vendor is onboarded, monitoring is active. Point-in-time assessments capture risk at a single moment. Continuous monitoring keeps that picture current between assessment cycles, giving you the ability to react to material events before they affect your risk posture.