Vendor drift is the gradual change in a supplier’s security posture, controls, or exposure over time. A vendor may meet requirements during onboarding, then later introduce a vulnerability, change its services, or alter how it protects data. The term describes this evolving risk, not necessarily a single security incident.
It matters because a questionnaire or assessment captures only a point in time. Attackers may exploit newly exposed systems or weaknesses at a supplier to reach its customers or data. Defenders use ongoing monitoring, periodic reassessments, and alerts about meaningful changes to spot drift and decide whether to investigate, adjust access, or revisit the business relationship. Monitoring signals should be reviewed in context: external ratings can help prioritize attention, but they do not replace direct evidence or human judgment.