Continuous monitoring, because an annual assessment is a photograph

A point-in-time assessment describes a vendor on the day it was completed. Every day after that, the assessment is a claim about the past being used as a statement about the present. A vendor assessed in March that exposes a database in July is, on your register, still a March vendor until next March.

Continuous monitoring closes that gap with evidence that does not depend on the vendor answering anything: what their estate exposes to the internet, how quickly known vulnerabilities are patched, whether certificates and DNS are maintained, and whether their credentials or data appear in breach corpora. It is deliberately outside-in, which is both its strength — no cooperation needed, so it works on vendors who ignore you — and its limit.

Outside-in signal sees the perimeter. It does not see access management, staff vetting, change control, encryption of data at rest, or whether a documented incident process is ever rehearsed. Those need the vendor to tell you, and to show you — which is what questionnaires and evidence collection are for.

The two are complements, and reading them together is where the useful signal is: a vendor that scores well on paper while its external estate degrades is telling you something no single source would. At RiskXchange, REX runs the outside-in side and ARIA the questionnaire and document side, and the combined read is deliberately produced by both rather than by either alone.