When a vendor's profile is missing key details, Drata now looks up the vendor using public sources and uses what it finds as additional evidence for the inherent risk recommendation. Details already in the profile always come first.
What new
- If a vendor's profile is missing Provided services, Data accessed or processed, Operational impact, or Access to environments, Drata researches the vendor publicly and combines what it finds with the profile to recommend a risk level, using your own risk levels and rules.
- The analysis summary shows "Based on public sources. Complete the profile to refine." so it's clear when a recommendation didn't come only from what you entered.
- While the evaluation runs, each research step appears in the loader (for example, "Researching public sources," "Analyzing data access").
- If there's nothing public to go on, the recommendation is Unscored, with a note that there isn't enough information. Drata won't default to the lowest tier to fill the gap.
- Vendors added through a procurement connection now get inherent risk calculated automatically.
What to know
- This applies at the add-vendor step, on the vendor profile's inherent risk card, and in the Settings preview.
- Public sources are a starting point. You can override any recommendation, and filling in the profile gives a more confident result.
- Coming next: automatic scoring when a vendor is added manually or by import.
Learn more at: Configure inherent risk