Artifact Intelligence

Artifact Intelligence is VISO TRUST’s AI document analysis engine. It reads security and compliance documents, extracts evidence of security controls, and maps findings to your risk framework automatically. It does this in a fraction of the time a human analyst would take. Every artifact processed in VISO TRUST (whether uploaded by you, submitted by a vendor, or discovered from public sources) passes through Artifact Intelligence. For the wider AI workflow, supported model providers, and your role in reviewing results, see How VISO TRUST Uses AI.

​

What Artifact Intelligence does

When an artifact is submitted, Artifact Intelligence:

1. Classifies the document — identifies the artifact type (SOC 2 Type II, ISO 27001, penetration test, DPA, etc.)
2. Extracts evidence — reads the document and identifies language that describes security controls and practices
3. Maps to controls — matches extracted evidence to the relevant controls in your risk framework
4. Assigns assurance — rates the confidence level of each detection based on the artifact type and evidence quality
5. Identifies gaps — flags in-scope controls that the submitted evidence doesn’t address

This process happens in seconds for most documents. The results appear directly in the assessment’s risk analysis as credited controls, coverage metrics, and any remaining gaps.

​

Assurance levels

Not all documents carry equal weight. Artifact Intelligence assigns an assurance level to each artifact based on how rigorous and trustworthy the evidence is. VISO TRUST shows the level as a three-dot meter: three dots for Strong, two for Moderate, and one for Weak. Each artifact type’s own level is listed in-platform under Glossary → Artifact Types. See Assurance levels for the numeric ranges. Assurance is also refined at the individual detection level. Evidence that only describes a control without testing it, evidence from an expired artifact, or evidence an auditor has manually downgraded all fall back to Weak assurance. The meter turns red for these, labeled Expired artifact or Reduced. Evidence from a presumed artifact is discounted below the level the real report would carry, because no document backs it. The risk analysis labels the reason next to the detection.

​

AI assessment + auditor review

For assessments using the AI Assessment + Auditor Review method, a VISO TRUST analyst supplements Artifact Intelligence with a focused review of high-assurance artifacts. Auditors look for things that require human judgment:

• Qualified opinions or exceptions in SOC 2 reports
• Open critical or high findings in penetration test reports
• HITRUST validity dates and certification scope
• Subservice organizations and CUECs (complementary user entity controls) in SOC 2 reports
• Password-protected or confidential artifacts that require manual handling

Auditor findings supplement AI detections. They don’t replace them. If the AI detects a control as Present, an auditor may downgrade it to Not Present based on a qualified opinion. If the AI misses a relevant control, an auditor may add it.

​

What happens after analysis

Once analysis is complete:

• Credited controls appear as Present in the risk analysis with the artifact as supporting evidence
• Control gaps appear as No Information, making them primary candidates for follow-up questionnaires or additional document requests
• The residual risk score updates to reflect the new evidence
• The artifact appears in the Artifacts tab with its classification, assurance level, and validity period

If control gaps remain after analysis, VISO TRUST surfaces a follow-up questionnaire recommendation. This lets you ask the vendor directly about specific controls that submitted documents didn’t address.

​

Artifact validity

Every artifact has a validity period reflecting how long the document is considered current. SOC 2 reports typically cover a 12-month audit period. ISO 27001 certificates are valid for 3 years. Artifact Intelligence identifies the validity window during analysis and tracks expiration. When an artifact expires:

• Its assurance drops to Weak, the meter shows Expired artifact, and detections from it are labeled Artifact expired
• VISO TRUST surfaces Pending Changes on the relationship
• If lifecycle management is enabled, VISO TRUST can automatically request a renewal from the vendor

​

Managing artifacts

All artifacts for a relationship are visible in the Artifacts tab of the relationship detail page. From here you can:

• View artifact classification, source, assurance level, and validity period
• Download artifacts
• Delete artifacts (subject to your role’s permissions)
• Add new artifacts at any time, even on an active or completed assessment
• Exclude artifacts from the risk analysis, or re-include ones previously excluded

To correct a misclassified artifact type, contact support@visotrust.com.

​

Excluding artifacts from risk analysis

Not every collected artifact belongs in the risk analysis. A document may be superseded by a newer one, duplicated, incomplete or unreadable, or irrelevant to the vendor or the assessment scope. Select the artifact in the Artifacts tab and click Exclude from analysis to remove it. Excluding an artifact removes its detections from the risk analysis, which can affect control coverage and risk calculations. The exclude dialog asks for a reason and an optional comment. Both are posted to the relationship’s activity feed, under Activity → All activity, so your team can see who excluded the artifact and why. Excluded artifacts are also left out of the assessment summary. The existing summary doesn’t update on its own. Regenerate the assessment summary after excluding an artifact to see it removed there. Excluded artifacts stay in the artifact list. Use the Excluded artifacts visibility filter to find them, and click Include in analysis to bring one back into the risk analysis.

​

Artifact sources

The Source column in the artifact list labels each artifact as Public or Private:

• Public — discovered by VISO TRUST through public research (trust pages, websites, other public sources)
• Private — everything else: artifacts uploaded by your team, submitted by the vendor through the collection portal, or sourced from VISO TRUST’s own evidence

The icon, tooltip, and Source filter all reflect this same Public/Private distinction. Private artifacts show a lock icon. Sorting the Source column still groups artifacts by who provided them, so vendor-submitted and team-uploaded artifacts stay separated even though both are labeled Private.

​

Submitted by

On a relationship’s Artifacts tab, the Submitted by column shows who provided each artifact. Use it to tell vendor-submitted and team-uploaded artifacts apart, since the Source column labels both as Private.

• Vendor submissions: the email address the vendor used when submitting the assessment
• Team uploads: the email address of the user in your organization who uploaded the artifact
• Public, presumed, and Trust Center artifacts: -. These artifacts are shared across every organization with a relationship to the vendor, so VISO TRUST doesn’t record who submitted them.

The artifact detail view and the PDF viewer’s Uploaded by field follow the same rules.

​

Presumed artifacts

When a vendor claims a compliance certification but VISO TRUST hasn’t collected the actual document, VISO TRUST creates a presumed artifact. A presumed artifact is a placeholder for that certification (for example, Presumed SOC 2 Type 2). Presumed artifacts give the claimed certification partial credit in the risk analysis until the real document arrives. In the artifact list, presumed artifacts:

• Appear for all roles alongside regular artifacts, subject to the same filters
• Match the Presumed option in the Type filter menu, and only that option, so file artifact type filters like Third Party Audit exclude them
• Can’t be opened or downloaded, because there is no document behind them
• Show a Source tooltip identifying them as presumed from compliance certifications in the vendor’s Trust Center
• Show a discounted assurance level reflecting the partial credit the claimed certification earns in scoring. For example, a presumed SOC 2 Type 2 shows Weak assurance, below the level the real report would carry.

The discounted level appears everywhere the artifact’s assurance is shown: the artifact list, the risk analysis, Trust Center, and report exports. It matches the assurance the risk model actually applies when scoring controls. In risk analysis, detections from a presumed artifact are titled with the audit report type followed by Attestation (for example, SOC 2 Type 2 Attestation). The card shows no quoted passage. Its Compliance attestation badge carries a tooltip explaining that the control is likely present based on evidence of compliance certification. The assurance meter labels the downgrade Presumed certification. If the artifact is also expired or manually reduced, that stronger reason is shown instead. When a real artifact of the same audit type is added, it supersedes the presumed artifact automatically. If that real artifact is later removed, the presumed artifact is restored.

​

If a presumed artifact is missing

Presumed artifacts are created automatically from compliance certifications in the vendor’s Trust Center. You can’t add one manually. If a vendor claims a certification but no presumed artifact appears in the artifact list:

1. Check the Type filter in the Artifacts tab and select Presumed. File artifact type filters like Third Party Audit exclude presumed artifacts.
2. Request the actual certification report through a collection request, or upload the document yourself from the Artifacts tab. A real artifact gives full credit and doesn’t depend on a presumed placeholder. See Attestations for how claimed certifications are upgraded to validated evidence.
3. If the vendor’s certification is publicly verifiable and the presumed artifact still doesn’t appear, contact support@visotrust.com.