Most security ratings are single-signal — outside-in scans only — and most of them sit between refreshes for weeks at a time. A score that moves the day after the breach is a score that didn't help.
The rating is the head of the funnel. REX produces the score from continuous external scanning. ARIA layers in the vendor's own evidence. TARA decides what a drop should actually trigger.
A rating that's continuously, not occasionally, calibrated. REX's Outside-In Scanner refreshes daily for customers and weekly for vendors — and the Continuous Monitoring sub-agent watches the time-series for material changes around the clock.
A rating, joined to the vendor's own evidence. ARIA pairs REX's external score with the vendor's questionnaires, certs and trust centre — so the rating reflects both what we can see and what's been attested.
A drop that triggers the right action automatically. When a rating moves materially, TARA decides what it means — for that vendor's tier, against the regulatory frameworks in scope, and what the SLA-bound remediation should be.
The number stops being a thing you check on a dashboard and starts being something the agents act on while you sleep.
Continuous Monitoring catches material rating changes in real time, not at the next refresh window.
Click any rating and you get the underlying signals — scan data, breach findings, attested evidence — joined together.
When a vendor scores well externally but the questionnaire suggests otherwise, ARIA flags it before you investigate.
A material rating change opens a TARA-led remediation track without waiting for someone to spot it on a dashboard.
The combined-signal model is the difference. We stopped arguing about whose rating was 'right' — we started looking at the score and the evidence together.
Book a 30-minute call and we'll have NOVA, ARIA and REX produce a complete posture report on one of your live vendors inside 24 hours.