Until now, a test showed At Risk after it had already failed, during a grace period set by its tolerance window. That meant At Risk arrived too late to act on. With this change, At Risk means "due soon": upload tests with an interval show At Risk for a set period before their due date, while their evidence is still valid, so you have time to upload new evidence before anything fails.
At a glance:
At Risk is now a heads-up, not a failure. It counts as passing for audit readiness, the public Trust Center, and headline passing percentages.
No more grace period after a test fails. Every test, including platform and integration tests, shows Failing as soon as it fails.
The tolerance window is replaced by the At Risk Window. It applies only to upload tests with an interval, and must be shorter than the test interval.
Note: The At Risk Window is rolling out first to a small group of Early Access companies, then to every customer. Your customer success manager will reach out before it's turned on for your company.
What At Risk means now
An upload test with an interval shows At Risk once it enters its At Risk Window before its due date. Its evidence is still valid, and it stays At Risk until you upload new evidence or the due date passes. Once the due date passes, it shows Failing.
Status | Before this change | After this change |
Passing | Evidence is valid | Evidence is valid and not due soon |
At Risk | The test failed and is in its grace period (tolerance window) | Evidence is valid, but due soon (within the At-Risk Window) |
Failing | The test failed and its grace period ended | The test failed, or its due date passed |
Example: An annual test with a 1-month At Risk Window has evidence due on June 15. It shows At Risk from May 15, then Failing after June 15 unless new evidence is uploaded.
At Risk counts as passing
Because an At Risk test's evidence is still valid, it's treated as passing:
Audit readiness: an At Risk test counts as ready in the Audit Module. Evidence and scope checks still apply.
Public Trust Center: a control stays visible while its tests are At Risk.
Headline passing percentages: a single passing percentage, such as "% Tests passing" on a framework card, includes At Risk tests.
Controls, requirements, and frameworks
A control, requirement, or framework shows the worst status among its tests. That means it shows At Risk while any of its tests are due soon, even though their evidence is still valid.
Passing and At Risk are still shown separately
Wherever Passing, At Risk, and Failing appear side by side, they stay separate and add up to the total. This includes:
"X of Y tests passing" and "X of Y tests at risk" on a control's health tag and in the controls table
Passing, At Risk, and Failing segments in charts and bars, such as framework cards and the dashboard Testing widget
The Passing filter on the Tests page, which lists only tests that are not At Risk
For example, a control with 12 tests (7 Passing, 3 At Risk, 2 Failing) shows "7 of 12 tests passing" and "3 of 12 tests at risk" on its health tag.
Note: Tests that pass because of an override, such as an upload justification or ignored failing results, stay Passing. They don't show At Risk or get a "due soon" warning.
No more grace period after a test fails
A test that fails now shows Failing right away. This applies to every test, including platform and integration tests, which previously could show At Risk for a while after failing.
On the night it's turned on: tests that are in their grace period today move from At Risk to Failing. These tests were already failing, so this corrects their status rather than reflecting a new problem.
Trust Center: a control with a failing test is hidden from your Trust Center as soon as the test fails. The 30-day grace period is gone.
Integrations: if an integration is disabled, tests that depend on it move straight to Failing.
The At Risk Window setting
The At Risk Window is how long before its due date a test shows At Risk. It replaces the tolerance window, but the two work differently:
| Tolerance window (old) | At Risk Window (new) |
What it is | A grace period after a test fails | A warning before the due date, while the test still passes |
Which tests | Upload, platform, and integration tests | Upload tests with an interval only |
Limits | None | Must be shorter than the test interval |
Setting the At Risk Window
You can set the At Risk Window on an individual upload test, or on many at once with bulk edit on the Tests page.
The window must be shorter than the test interval. Options that are too long are disabled in the dropdown.
With bulk edit, only tests with an interval longer than the chosen window are updated. Other selected tests are skipped.
Both the At Risk Window and the test interval have a new 2-month option (shown as "Every 2 months" for the interval).
Changing a test's interval
Because the At Risk Window must be shorter than the interval, the interval dropdown disables any interval that isn't longer than the test's current At Risk Window. To pick one of those, shorten the At Risk Window first, then change the interval.
What happens to your existing tolerance windows
Existing tolerance windows on upload tests with an interval carry over as their starting At Risk Window, with these exceptions:
If the test… | Its At Risk Window becomes… |
Had a window as long as or longer than its interval, and its interval is longer than 1 month | 1 month |
Had a window as long as or longer than its interval, and its interval is 1 month or shorter | None (you can set a shorter one yourself) |
Is a library upload test that was added with no window | 1 month, or none if its interval is 1 month or shorter |
Had its window set to "None" by your team | None (unchanged) |
Platform and integration tests no longer use a window setting, and any value set on them stops applying. If your company set a custom value on these tests, your customer success manager will reach out before the change is turned on.
Notifications
Going forward
Notification | When it's sent | Where you'll see it |
Test at risk | Once per due date, when a test enters its At Risk Window | In the app, in Slack if you've set up real-time alerts, and as a row in your status-change email and Slack digest |
Test failing | Right away, when a test fails | In the app, in Slack if you've set up real-time alerts, and as a row in your status-change email and Slack digest |
On the night it's turned on for your company
We update your test statuses quietly, so you won't get a separate notification for each test that changed.
Tests moving from At Risk to Failing: these were already failing in their grace period, so this is a correction. No notification is sent.
Tests moving from Passing to At Risk: this is the new "due soon" meaning. Most change quietly and appear in your next email or digest. A few tests that re-run that night before the update reaches your company may send a "Test at risk" notification in the app, and in Slack if you've set up real-time alerts.
Your next status-change email lists every test whose status changed. Tests that moved from At Risk to Failing show as "Now failing, was: At Risk".
Slack channels with a test status digest get the same changes in their next scheduled digest: up to 10 tests listed, with the full count and a link to the rest.
Because the update is quiet, a test that's already due soon on the night it's turned on won't send a "Test at risk" notification in the app or in real-time Slack for that due date. It will only appear in your next email or digest.
Emails, exports, and test lists
Passing counts in emails and exports
These passing counts include tests that are At Risk because they're due soon:
The "X of Y Test(s) Passing" line in the Here's what you own email
The passing count in the Your compliance summary email
The Implementation Status column in the ISMS Statement of Applicability export
Test lists sort Failing first
The Tests page, Test activity, Gap Assessment, and test mapping now list tests in this order: Failing, then At Risk, then Passing. This keeps failing tests at the top, above tests that are only due soon. This sort order goes live before the rest of the change.
REST API changes
If your team uses the Secureframe REST API, these changes take effect when the At Risk Window is turned on for your company.
Field or value | What changes |
| Deprecated. You can still read and write it, but its value no longer means anything or affects any test. |
| New. Read and set a test's At Risk Window, and filter tests by it. It is not a direct replacement for |
| Now means passing with evidence due soon, not failing in a grace period. |
| Unchanged. Counts Passing tests only, not At Risk tests. |
| Now counts tests that are passing with evidence due soon, not tests about to fail. |
Passing, At Risk, and Failing counts still add up to the total.
Setting the window or interval: the API returns an error if you set an At Risk Window that isn't shorter than the test interval, or an interval that isn't longer than the test's At Risk Window.
Note: The deprecation of tolerance_window_seconds takes effect on the date the At Risk Window is turned on for your company, which may be less than 30 days after this notice. If you have scripts or integrations that rely on it, update them to use at_risk_window_seconds.
Frequently Asked Questions (FAQ)
Why did some of my tests move to Failing overnight? Those tests had already failed and were in their grace period, which showed as At Risk. With the grace period removed, they now show their actual status: Failing.
Why is a control At Risk when its evidence is still valid? A control shows the worst status among its tests. If one of its tests is due soon, the control shows At Risk until new evidence is uploaded for that test.
Will At Risk tests affect my audit or Trust Center? No. At Risk tests count as ready in the Audit Module, and controls stay visible on your public Trust Center while their tests are At Risk.
Why do the passing percentage and the Passing count look different? A headline passing percentage includes At Risk tests, because their evidence is still valid. Counts and charts that show Passing and At Risk side by side keep them separate.
Can I turn off the At Risk Window for a test? Yes. Set its At Risk Window to "None". The test will go straight from Passing to Failing when its due date passes.
Why can't I choose a shorter test interval? The interval must be longer than the test's At Risk Window. Shorten the At Risk Window first, then change the interval.
Why can't I set an At Risk Window on a platform or integration test? The At Risk Window only applies to upload tests with an interval, since those are the tests with a due date.
Why didn't I get a "Test at risk" notification for a test that's now At Risk? On the night the change is turned on, statuses update quietly to avoid flooding your notifications. Those tests appear in your next status-change email and Slack digest instead. From then on, you'll get a "Test at risk" notification each time a test enters its At Risk Window.
Who can I contact with questions? Reach out to your customer success manager or our support team.