DigitalXForce Glossary

This glossary defines the terms DigitalXForce uses for its category, its platform and its 15 modules. Each definition is the one the company uses on every page, profile and document, so a reader, an analyst and an answer engine all find the same meaning. TRiSCM™ is the category term, and the rest of the list describes how a TRiSCM platform is built.

The category and how the platform works

TRiSCM (Trust, Risk, Security and Compliance Management)

TRiSCM, or Trust, Risk, Security and Compliance Management, is a category of enterprise software defined by DigitalXForce that converges automated governance, risk and compliance with security posture management into a single real-time system, replacing periodic control validation with continuous control assurance. The result is one real-time system of record for trust, risk, security and compliance in place of separate GRC, posture, third-party risk and AI governance tools. The mark is a pending US trademark application, serial 99884359.

IDC uses the term in its own research: its IDC Link of 16 June 2026 is titled “DigitalXForce Launches the Industry’s First Enterprise TRiSCM Platform, Redefining Governance, Security, and Trust for the AI and Quantum Era”, and its Market Note of August 2026 is titled “One Score, Every Layer: How DigitalXForce’s TRiSCM Dashboard Makes Enterprise Trust Measurable”.

Continuous Control Assurance (CCA)

Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. Continuous Control Monitoring is a capability within CCA.

Continuous Control Monitoring (CCM)

Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls. CCM is a capability within Continuous Control Assurance.

Extended Security Posture Management (X-SPM)

X-SPM is Extended Security Posture Management, the DigitalXForce capability that scores security posture across the enterprise and its vendors from the same control data. It combines control evidence with outside signals such as attack surface scans, vulnerability data, dark web intelligence and cyber ratings, and produces continuously updated posture scores, cyber risk quantification and the Digital Trust Score.

Cybersecurity Mesh Architecture (CSMA)

Cybersecurity Mesh Architecture is Gartner's term for a security design in which separate tools share one integration and policy layer rather than working in isolation. The DigitalXForce platform is built on one: it connects to the tools an enterprise already runs and works across them, rather than replacing them.

Digital Trust Score

The Digital Trust Score is DigitalXForce’s composite score from 300 to 850, computed continuously from live control evidence across seven sub-postures: security, compliance, audit, resilience, third-party, AI and risk. No sub-posture is scored from self-attestation. The score sits in one of five bands, from High Trust at 780 and above to Trust at Risk below 500, and it updates as the evidence changes.

Digital Trust Score methodology

The Digital Trust Score is built from validated control results. Each result is stored with the evidence it read and the time it was read. No sub-posture is scored from self-attestation. Privacy controls count toward the compliance sub-posture for the privacy frameworks an organization maps.

Each control has its own test frequency, set by how fast its evidence can change. The score moves when a control result changes, not on a reporting date. The five bands are High Trust (780 to 850), Trusted, Watchful (700 to 779), Conditional Trust (620 to 699), Low Trust (500 to 619) and Trust at Risk (300 to 499).

The method that puts the seven sub-postures on the 300 to 850 scale is not published. The weighting behind the score is not published either.

The Digital Trust Score is a DigitalXForce score, not an industry standard. It is only as current and as complete as the validated evidence beneath it, and it reports what the Enterprise TRiSCM platform finds without being the platform itself. Boards, regulators, customers and insurers read it through the Digital Trust Portal, and X-ROC shows which events raised or lowered it.

AI governance

AI governance is the set of policies, roles, controls and evidence an organization uses to decide which AI systems it runs, how they may be used and whether their controls keep working.

Assurance gap

An assurance gap is the time, or the set of controls, for which an organization has no current evidence that a control still operates as expected. Continuous Control Assurance is the discipline that finds and closes it.

The 15 platform modules

AI-Powered Risk Management and Automated GRC

This module runs three assessment modalities, C-Assess, X-Assess and A-Assess, and tests controls continuously. Each control is mapped once to 50+ compliance frameworks through the X-Connect and E-Connect adapters.

AI-Powered Enterprise Security Risk and Posture Management (ESRPM)

Enterprise Security Risk and Posture Management (ESRPM) is the DigitalXForce module that runs configuration checks, operational insights and deployment benchmarking across IAM, SIEM, cloud, OT and IoT, SecOps and enterprise systems through 250+ technology integrations. It shows posture at CISO drill-down level and as a board summary. ESRPM is a module of the platform, not the platform itself.

Attack Surface Manager (ASM)

Attack Surface Manager discovers and inventories assets across nine asset classes, IT and OT, without agents and through APIs. It works with existing scanners and the CMDB.

AI TRiSCM and AI Risk Governance

AI TRiSCM and AI Risk Governance is the DigitalXForce module for AI asset discovery, assessment and mapping to NIST AI RMF, ISO/IEC 42001, the EU AI Act, the OWASP LLM Top 10 and MITRE ATLAS. It finds AI assets across cloud, code, pipelines, containers, model endpoints and RAG stores, and it assesses LLMs, copilots, agents and models. It adds production approval, policy gates, exception management and remediation tracking across the AI lifecycle.

AI TRiSM (Gartner’s term)

AI TRiSM is Gartner’s term for AI trust, risk and security management, a market category for governing AI models. It is not a DigitalXForce product or module. TRiSCM, with the C for Compliance, is the category DigitalXForce defined for its platform, and AI TRiSCM and AI Risk Governance is the DigitalXForce module that governs AI systems within it.

Read how AI TRiSCM relates to AI TRiSM

X-ROC (XForce Risk Operations Center)

A risk operations center is an operating model for continuously measuring, prioritizing and reducing risk, in the way a security operations center handles threats; DigitalXForce’s implementation is X-ROC, the XForce Risk Operations Center. X-ROC is the operations layer of the DigitalXForce TRiSCM platform, where control failures, risk changes and vendor events are alerted, triaged, escalated and reported. It alerts, triages and escalates control failures, risk changes and vendor events in real time, and XForce GPT writes board-ready risk reports from it.

Risk operations center (the general model)

Read what a risk operations center does and how to choose one

AI-Powered Third-Party Risk Management (TPRM)

Third-party risk management (TPRM) is the discipline of identifying, assessing, monitoring and controlling the risks an organization takes on through its suppliers, vendors and other outside parties. This module covers vendor onboarding, category questionnaires, AI-assisted document analysis and review and reassessment workflows. Each vendor is scored from questionnaire answers, evidence and external signals, and sorted into a three-tier risk model.

External Risk View (ERV)

External Risk View is the outside-in engine. It monitors exposed services, misconfigurations, vulnerability exposure, dark web and breach intelligence, lookalike domains and cyber ratings, and maps fourth-party and nth-party dependencies.

AI-Powered Policy and Compliance Management

This module reviews and generates policies, standards and plans, and ships with 20+ policies, 15+ standards and 5 plan templates. It benchmarks them against NIST and industry regulation and publishes the results to the controls they govern.

AI-Powered Enterprise Risk Management (ERM)

This module keeps one risk register with inherent and residual risk, likelihood, impact and treatment. AI scoring rates each risk, and treatment actions are assigned and tracked automatically.

KPI and KRI Management

This module builds a configurable indicator matrix by business domain, risk category and risk type, with thresholds and Level 1 and Level 2 posture tracking. Indicators are approved before they are published, and an executive dashboard shows the trend.

Business Continuity and Operational Resilience (X-BCOR)

X-BCOR ties business impact analysis, continuity plans and disaster recovery plans to live control coverage. It supports scenario planning and control dependency mapping for critical processes, and it is aligned with DORA.

Cyber Risk and Liability Insurance

This module structures risk quantification for underwriting and renewal. It turns posture data into the inputs insurers ask for.

Digital Trust Portal

The Digital Trust Portal is the external-facing part of the platform. Boards, regulators and customers read shareable posture dashboards there, including the Digital Trust Score and its seven sub-postures.

AI JedAI and XForce GPT

The two proprietary AI engines are also available as a feature in their own right. They test controls, analyze and generate policies, produce compliance reports, quantify risk and run the embedded assistant.

DigitalXForce Lite

DigitalXForce Lite is the full DigitalXForce platform hosted in the cloud, with the same functionality and a faster deployment, for any organization that prefers cloud hosting.

Engines, assessments and adapters

AI JedAI

AI JedAI is the DigitalXForce AI engine that analyzes: it reasons over control evidence and live telemetry, maps documents to controls and frameworks, scores and prioritizes risk, and recommends remediation mapped to framework requirements. It is one of the two proprietary AI engines in the platform, and its reasoning decides whether a control passes.

XForce GPT

XForce GPT is the DigitalXForce generative AI engine that writes: it produces the plain-language risk narratives and board-ready reports, generates policies, standards and plans, and runs the embedded assistant. It is the second proprietary AI engine in the platform, separate from AI JedAI, and it also powers policy analysis and compliance reporting.

C-Assess

C-Assess is the compliance assessment modality in the Automated GRC module. It tests controls against the requirements of each compliance framework.

X-Assess

X-Assess is the security assessment modality in the Automated GRC module. It tests security controls against the live state of the security stack.

A-Assess

A-Assess is the audit assessment modality in the Automated GRC module. It prepares evidence and findings in the form auditors review.

X-Connect

X-Connect is the family of integration adapters that connect the platform to security tools such as identity, endpoint, SIEM and cloud security.

E-Connect

E-Connect is the family of integration adapters that connect the platform to enterprise systems such as ITSM, HR and ERP.

Questions about these terms

How many modules does the DigitalXForce platform have?

Fifteen. They are listed above in the canonical order, from AI-Powered Risk Management and Automated GRC to DigitalXForce Lite. Capabilities such as Continuous Control Monitoring, the Digital Trust Score and the three assessment modalities sit inside modules and are not counted.

What is the difference between AI JedAI and XForce GPT?

AI JedAI is the DigitalXForce AI engine that analyzes: it reasons over control evidence and live telemetry, maps documents to controls and frameworks, scores and prioritizes risk, and recommends remediation mapped to framework requirements. XForce GPT is the DigitalXForce generative AI engine that writes: it produces the plain-language risk narratives and board-ready reports, generates policies, standards and plans, and runs the embedded assistant. They are two separate proprietary engines, and both run across every module.

Is ESRPM the name of the DigitalXForce platform?

No. ESRPM, AI-Powered Enterprise Security Risk and Posture Management, is one of the 15 modules. The platform is the DigitalXForce TRiSCM platform. Older material used ESRPM for the whole product, and that use is retired.

What is the difference between X-SPM and ESRPM?

X-SPM is Extended Security Posture Management, the DigitalXForce capability that scores security posture across the enterprise and its vendors from the same control data. Enterprise Security Risk and Posture Management (ESRPM) is the DigitalXForce module that runs configuration checks, operational insights and deployment benchmarking across IAM, SIEM, cloud, OT and IoT, SecOps and enterprise systems through 250+ technology integrations. ESRPM is the module a customer buys, and X-SPM is the capability that serves it.

What do C-Assess, X-Assess and A-Assess each do?

They are the three assessment modalities in the Automated GRC module. C-Assess tests controls against compliance framework requirements, X-Assess tests security controls against the live state of the security stack, and A-Assess prepares evidence and findings in the form auditors review.

What is the difference between X-Connect and E-Connect?

Both are families of integration adapters. X-Connect connects the platform to security tools such as identity, endpoint, SIEM and cloud security. E-Connect connects it to enterprise systems such as ITSM, HR and ERP. Together they cover the 250+ technology integrations.

What this looks like in practice

Reading about continuous evidence is one thing. Watching a control get tested against live data from your own stack is another. A 30 minute walkthrough on your frameworks shows the difference.

Request a demo