Censinet

Artificial intelligence is a layer on a risk platform whose value stands without it. Censinet RiskOps is a healthcare risk management platform built around shared assessments of vendors and products, a risk register, workflows and peer benchmarking.

Its AI features are named on the third-party risk page: "Automated rapid inherent risk scoring", early identification of concentrated exposure, and "Automated vendor engagement, document review, action plan and assessment report authoring", which describe a language model reading documents and drafting reports; AI Telemetry classifies each product in a customer's inventory as AI-enabled, not AI-enabled or unknown, with its reasoning. The company says the AI reduces time on key assessment workflows by up to 66 percent. Assessments, the exchange, the risk register and benchmarking work without it.

Human decision is stated as the rule; the review step for AI-drafted work is not described. The third-party risk page says "Censinet uses AI to support risk assessors, not replace their judgment. People remain in control of the assessment and every final risk decision", and AI evaluations are routed automatically to the relevant stakeholders for review.

At the same time vendor engagement, document review, action plans and assessment reports can be produced automatically, inherent risk scores are set before any assessment, and "AI-generated insight flows directly into the Risk Register". Nothing says whether an AI-drafted report or register entry is reviewed before a vendor or stakeholder sees it, or what happens when one is wrong.

What the AI does is described; nothing about how it works is identified. Censinet describes inherent risk scores calculated "from what Censinet knows about the product rather than from a completed questionnaire", AI status classification drawn first from assessment responses and intake questionnaires and then from public sources, with the reasoning shown, and automated document review and report authoring.

No model, method, training data, version or update practice is published for any of these, and nothing says how the inherent risk score is derived or validated. The frameworks the platform maps to (NIST CSF, the NIST AI Risk Management Framework, HIPAA) are named.

The model layer is stated to stay inside Censinet: "All AI processing runs within Censinet's private network, no data leaves Censinet infrastructure, and customer data is never used to train AI models." That describes a chain in which customer data does not pass to an outside model provider, though the models themselves are not named.

The security statement says application data is hosted "with leading SaaS and IaaS vendors" in geographically dispersed data centers, without naming them, and no subprocessor list is published. The exchange shares assessment data between healthcare organizations and vendors, constrained to parties connected in the platform.

Named customers, and a vendor figure without method. Case studies are published for Intermountain Health, Emory Healthcare (June 2025) and Tower Health (May 2025), describing automated vendor assessments, standardized processes and higher assessment throughput; Baystate Health's CISO is quoted on the ServiceNow integration. The company says its AI reduces time on key assessment workflows "by up to 66%" and that it monitors more than 40,000 vendors and products. No baseline, sample or method stands behind the time figure, and no independent evaluation of the inherent risk score or AI Telemetry classification is published.

Categorical commitments on AI are published; retention is not. The third-party risk page states that all AI processing runs within Censinet's private network, that no data leaves Censinet infrastructure, and that "customer data is never used to train AI models". The terms of use say benchmarking data is de-identified, anonymized and combined with other organizations' data before it is shared with other subscribers, and treat assessment materials as the customer's confidential information. No retention period or deletion commitment for assessment data is published, and nothing covers guardrails on AI-drafted reports or how an AI error is handled as a safety event.

Privacy documents reach the service; no business associate position is taken. Censinet's privacy policy (effective 1 October 2021) covers personal information submitted through its services, and its terms of use (effective 12 November 2024) govern the platform, treat assessment materials as confidential and describe how benchmarking data is de-identified.

Neither states whether Censinet acts as a business associate, whether protected health information can enter assessments or intake questionnaires, or offers an agreement, and the security statement does not address it.

A recognized audit is named with its auditor and date, without the report. The Why Censinet page says the company "achieved SOC 2 Type 2 compliance in February 2026, following an independent audit by A-LIGN covering access management, system monitoring, change management, incident response, and vendor security practices".

The security statement describes role-based access, multi-factor authentication, encryption in transit and at rest, change and patch management, and a secure development lifecycle that includes penetration testing, and says Censinet assesses its own vendors on its platform. No report, portal or penetration test summary is published; a SOC 2 Type 2 report conventionally covers about a year from its period.

No device claim; the product works health sector regulation for its customers without stating its own position. Censinet RiskOps is risk management software with no FDA clearance and none needed. It assesses third party products including medical devices, aligns its workflows to the NIST Cybersecurity Framework and HIPAA, and runs AI evaluations aligned to the NIST AI Risk Management Framework for customers' AI governance committees. No page states an intended purpose or regulatory position for the platform itself.

Responsible use of its own AI is stated as policy, with no evaluation behind it. Censinet says its AI supports assessors rather than replacing them, that people make every final risk decision, and that AI is used "while maintaining governance and human oversight".

Its AI governance module helps customers evaluate other vendors' AI against the NIST AI Risk Management Framework, covering bias, transparency, model safety and human oversight, but that is material for judging other products, not an evaluation of Censinet's own models.

No evaluation of the inherent risk score or AI status classification is published, overall or by vendor size, product type or data source, which is where a score built from public information is most likely to misjudge a small vendor.

Mechanisms let an assessor check AI output; nothing stands behind it. Each product's AI status comes "with the reasoning behind it", findings flow into a risk register that keeps "a complete history", and people make every final risk decision. The terms of use provide the services as is and disclaim any warranty that "content or recommendations provided through the Services will be current or accurate". No accuracy figure for inherent risk scores, AI status or AI-drafted reports is published, and no route is described for a vendor whose risk score or AI classification is wrong to correct it.

It has no clinical record surface; its integration is with the IT service and GRC systems a health system already runs. The Censinet Workflow Connector for ServiceNow, announced in September 2022 and listed in the ServiceNow Store, is described as a two-way integration: assessments launch from ServiceNow, status updates flow back as the assessment progresses, and vendor and product inventories in ServiceNow are updated automatically.

Baystate Health's CISO is quoted as a customer of both products at launch. No other procurement, contract or asset system is named, and the connector's compatibility list names ServiceNow releases from 2022.

A single hosted service with its location implied. Censinet RiskOps is a cloud platform; the security statement says application data is hosted "with leading SaaS and IaaS vendors" in "world-class data centers that are geographically dispersed", and the third-party risk page says AI processing stays within Censinet's private network. No provider, region, residency commitment or tenant separation is stated.

Customers can run the platform themselves, co-managed with Censinet's risk management services, or through the on-demand Censinet One service, which are ways of staffing the work rather than places the data rests.

No price, and the way it is sold is discoverable. Censinet sells RiskOps as a platform the customer runs, a co-managed arrangement with its risk management services, or Censinet One, an on-demand managed service, and runs a peer benchmarking offering that organizations join by contributing data. No price, tier or unit of charge is published, and the site routes to a demo request.

Healthcare delivery organizations are named as the setting, with named health systems behind it. Censinet builds its platform "specifically for healthcare" for hospitals and health systems, covering third-party risk across medical devices, cloud software, robotics and consulting services, enterprise risk, systemic risk and AI governance.

Case studies from Intermountain Health, Emory Healthcare and Tower Health, and Baystate Health's quote on the ServiceNow connector, show the product in use at health systems of different sizes. The vendors being assessed also take part through the exchange.