AI Vendor Risk Heatmap: Staleness Decay & Audit Timeline

Portfolio

Vendors under contract 20

Audit cadence (days) 30

Weight: inherent posture vs. staleness 50%

Risk tolerance threshold 0.55

Sim speed (days/sec) 4

Live Readouts

Avg risk score

0.00

Above threshold

Avg staleness

0 d

Audits run

Sim day

Audit Log

— no audits yet —

How it works

Same governance-risk math as the 3D vendor network, rendered as a 2D dashboard instead of an orbiting scene. Each vendor carries a fixed inherent posture gap g and data sensitivity d — both in [0,1] — set when it joins the portfolio. Confidence decays the longer a vendor goes unaudited:

staleness(t) = 1 − e^(−staleDays / 30)
inherent      = 0.6·g + 0.4·d
risk(t)       = w·inherent + (1−w)·staleness(t)

The top panel is a scrolling risk-history heatmap — one row per vendor, one column per simulated day, colored green→amber→red by that day's risk score — so decay-then-audit sawtooth patterns are visible directly as pixel rows instead of camera-dependent node colors. Click a row to audit that specific vendor on demand.

The bottom-left panel is a phase plot of inherent risk vs. staleness with the live threshold boundary drawn as w·inherent+(1−w)·staleness = threshold; drag to pan, scroll/pinch to zoom. The bottom-right panel is a live risk-score histogram across the whole portfolio.

Audit cadence — a scheduled audit fires automatically on this interval and resets the currently stalest vendor's staleDays to 0.
Run audit now / row click — forces an out-of-cycle audit, mirroring a risk-triggered review.
Risk tolerance threshold — vendors whose risk score crosses it are flagged red and counted in the readout.

This is the same shape of model used by real third-party/vendor risk programs: a fixed inherent-risk score combined with an evidence-recency decay, re-scored continuously and pulled back down only by the next audit.

Low risk Elevated Above threshold

Click heatmap row = audit vendor · drag/scroll phase plot = pan/zoom