On 30 September 2026, Nudge Security launched Adaptive Risk Management, a capability designed to keep reassessing SaaS and AI application risk after approval. According to Nudge, risk scores update automatically as usage, access, integrations, AI agents, vendor security posture and business criticality change. That challenges the traditional model of annual or point-in-time vendor reviews, and it is a useful marker for where the wider market is moving.
Nudge’s own launch write-up describes scores built from more than 30 factors, recalculated without waiting for vendor participation or manual input. It also cites the 2026 Verizon Data Breach Investigations Report, which attributes 48% of breaches to third-party involvement, and argues that roughly 90% of new applications enter organizations outside IT channels. Those are vendor-reported claims, but they describe a problem every risk leader recognises: the approved-vendor list and the real vendor estate are no longer the same thing.
Crest.Digital’s TPRM platform pairs vendor intelligence with continuous monitoring, so change in a supplier’s profile is detected and acted on between reviews.
Explore the TPRM PlatformWhat Changed: Scores That Move With the Vendor
The launch is notable less for any single feature than for its premise. Rather than treating the vendor assessment as the system of record, it treats the assessment as a baseline and lets live signals move the score. Signals named in the announcement include internal usage patterns and data sensitivity, access grants and approval status, integration and AI agent connections, OAuth grant freshness and authentication methods, the vendor’s external security posture, and business criticality.
One customer quote in the announcement captures the operational benefit: the ability to flag when risk moves from medium to critical, whether the change happened on the company’s side or the vendor’s. That distinction matters. Vendor risk changes for two reasons, because the vendor changed or because your use of the vendor changed, and a questionnaire only ever sees the first, and only once a year.
Watch: Adaptive Risk Management in Action
Why Point-in-Time Vendor Reviews Age Quickly
As applications gain more users, reach more sensitive data, connect to other systems or introduce new subprocessors and AI capabilities, the original risk assessment becomes outdated. A tool approved for a pilot team can become business-critical within a quarter. An integration granted with broad scopes can quietly expand what a supplier can read. An AI feature added in a product update can change where data is processed. None of this requires a failed control; it only requires time.
At Crest.Digital, we see this as the direction TPRM is moving: from onboarding and periodic assessment toward continuous third-party intelligence, change detection and risk-based reassessment. We have made related arguments about why the questionnaire is the least interesting part of TPRM, how shadow AI creates unassessed vendors and why permission reviews are becoming continuous controls. The Nudge launch is another data point on the same curve, and it is strongest in the SaaS and AI application layer, which is where fast-moving, employee-driven adoption is hardest to govern.
A broader TPRM program has to cover more than application usage. Ownership and director changes, sanctions and adverse media, certificate and contract expiry, financial and operational signals, and fourth-party dependencies all move risk too. Mature programs combine internal usage signals with external vendor intelligence so the score reflects both how you use a supplier and what is happening to it. Where AI agents are involved, the same logic extends to your own estate, as we describe in building an AI agent register.
The Continuous Flow: Approved to Action
The operating model reduces to a loop that repeats for the life of the relationship: Approved → Change Event → Reassess → Alert → Review → Action. Each stage should have an owner, a defined trigger and an evidence record.
Approved
The vendor passes onboarding and receives an initial risk tier, owner and control requirements. This is the baseline, not the finish line.
Change Event
Monitoring detects a trigger: user growth, a new integration or AI agent connection, a posture change, a breach or a shift in business criticality.
Reassess
The risk score and tier are recalculated automatically against the new facts, without waiting for a questionnaire cycle.
Alert
The relationship owner and risk team are notified with the specific change, the old and new rating and the evidence behind them.
Review
A named reviewer validates the change, requests vendor input where needed and decides whether the existing controls still fit.
Action
Controls are tightened, access is narrowed, remediation is tracked to closure or the relationship is escalated, with the outcome logged for audit.
Crest.Digital’s agentic workflows handle monitoring, vendor outreach and evidence follow-up, while risk teams review conclusions. Explore the agents or our wider Agentic GRC practice.
Two design principles keep the loop credible. First, automatic rescoring does not mean automatic decisions: material changes should reach a named reviewer, who confirms the rating, approves exceptions and records the rationale. Second, the score must be explainable. An auditor or regulator should be able to see which event moved a vendor from medium to high, when, and what was done next. That audit trail is what turns continuous monitoring from a dashboard into a defensible control.
What do you think: should a vendor’s risk score automatically change when its usage, access or exposure changes? We would argue yes, with people deciding what to do about it.
Crest Perspective
Risk programmes that treat third-party governance as a compliance checkbox are consistently underprepared when a material vendor incident occurs. The programmes that withstand regulatory scrutiny are not necessarily the most technologically sophisticated — they are the ones where risk tiering is documented, escalation paths are tested before they are needed, and the board receives accurate, timely information about the organisation’s most critical vendor dependencies.
Frequently Asked Questions
Adaptive vendor risk management is an approach in which a vendor’s risk score and required controls are recalculated automatically whenever relevant conditions change, rather than being fixed at onboarding and revisited annually. Triggers include growth in users or data access, new integrations or AI agent connections, changes in the vendor’s security posture, policies or subprocessors, and shifts in the business criticality of the service. The goal is to keep the risk picture aligned with how a vendor is actually used today, so that reassessment, alerting and remediation happen when risk moves and not when the calendar says so.
An annual review captures a single moment. Between reviews, a vendor can gain thousands of new users, connect to sensitive systems through OAuth or APIs, introduce AI features, change subprocessors or suffer a breach, and none of that appears in a questionnaire completed months earlier. Verizon’s 2026 Data Breach Investigations Report, as cited by Nudge Security, attributes 48% of breaches to third-party involvement, so the exposure is material. Point-in-time reviews remain useful as a baseline, but they need a continuous change-detection layer on top to stay reliable.
Practical triggers fall into four groups. Usage events include rapid growth in users, new departments adopting the service or new categories of data being processed. Access events include new OAuth grants, API keys, integrations to core systems and AI agent connections. Vendor events include breaches, ownership or director changes, sanctions or adverse media, certificate expiry, new subprocessors and material policy or feature changes. Business events include a change in how critical the service is to operations. Each trigger should map to a defined action, such as an automatic rescore, an alert to the relationship owner or a targeted question to the vendor.
Yes for the score, with human judgment on the response. Automatic rescoring keeps the risk register current and removes the lag between a change and its recognition. What should not be automatic is the final decision on material findings: a named reviewer should confirm significant rating changes, approve exceptions and decide on remediation or exit. This human-in-the-loop design preserves accountability and gives auditors a clear record of what changed, who was alerted and what was decided.
Crest.Digital’s TPRM platform combines vendor intelligence, continuous monitoring, adverse media, screening and AI-assisted questionnaire and evidence workflows, with a full audit trail for every change and decision. AI agents handle monitoring, outreach and follow-up, while risk and procurement teams review and approve conclusions. For organizations that also need to monitor internal controls and non-human identities, Crest’s Agentic Risk and Continuous Assurance practice extends the same change-detection logic across ERP, access and compliance data.