AI Vendor Risk Network | mysimulator.uk

Portfolio

Vendors under contract 20

Audit cadence (days) 30

Weight: inherent posture vs. staleness 50%

Risk tolerance threshold 0.55

Live Readouts

Avg risk score

0.00

Above threshold

Avg staleness

0 d

Audit Log

— no audits yet —

How it works

Each connected AI vendor/model carries a fixed inherent posture gap g (security controls, contractual protections) and data sensitivity d — both in [0,1] and set when the vendor joins the portfolio. Confidence in that posture decays the longer it goes unverified:

staleness(t) = 1 − e^(−staleDays / 30)
inherent      = 0.6·g + 0.4·d
risk(t)       = w·inherent + (1−w)·staleness(t)

w is the inherent-vs-staleness weight slider — a governance program that trusts point-in-time assessments sets w high; one that treats "no recent evidence" as risk in itself sets w low. Every simulated day without an audit pushes staleness toward 1 along that exponential curve, exactly as confidence in a certification or SOC 2 report erodes with time.

Audit cadence — a scheduled audit fires automatically on this interval and resets the currently stalest vendor's staleDays to 0.
Run audit now — forces an out-of-cycle audit of whichever vendor currently has the longest staleness, mirroring a risk-triggered review.
Risk tolerance threshold — vendors whose risk score crosses it are flagged (colored red in the scene and counted in the readout) as needing escalation.
Node size encodes data sensitivity (how much of your data or model IP that vendor touches); connector color encodes live risk score from green (low) through amber to red (high).

This is the same shape of model used by real third-party/vendor risk programs: a fixed inherent-risk score combined with an evidence-recency decay, re-scored continuously and pulled back down only by the next audit.

Low risk Elevated Above threshold

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.