Continuous vetting is the practice of reviewing a person's background on an ongoing basis, instead of once at hiring or again at a fixed reinvestigation date. In the U.S. government it is the model behind Trusted Workforce 2.0, under which cleared personnel are enrolled in automated, recurring record checks rather than waiting years for a periodic reinvestigation. Outside government the same idea usually goes by continuous monitoring. Either way, the premise is the same: a background check is only true the day it ran.
How continuous vetting works in the federal system
For decades, a security clearance was granted after an investigation and then revisited through a periodic reinvestigation, typically every five years for Top Secret and every ten for Secret. Between those dates, the government largely relied on the cleared person to report problems themselves. Trusted Workforce 2.0, the government-wide overhaul of personnel vetting, replaces that cycle with continuous vetting: enrolled individuals are checked against criminal, terrorism, financial, and other government and commercial records on a recurring, automated basis, and relevant alerts go to adjudicators as they appear. For the Department of Defense and many other agencies, the Defense Counterintelligence and Security Agency (DCSA) runs the program.
Continuous vetting does not remove the individual's own obligations. Cleared employees still have reporting requirements, such as foreign travel and certain foreign contacts, and security officers at cleared contractors still relay information they learn. What changes is that the government no longer waits for the calendar to find out.
What a point-in-time check actually captures
A point-in-time check, whether it is a traditional background check or a one-time due diligence report, answers "what does the record show right now." It is accurate the day it runs and says nothing about the day after. That is not a flaw in any particular vendor's process; it is the structural limit of a report rather than a feed. Courts, HR systems, and public databases are queried once, the results are compiled, and the report is filed.
What changes after day one
Risk does not hold still after a report is filed. A candidate who screened clean can be impersonated, have their home address posted, or become the target of someone trying to exploit their access, months into a role. A vendor that passed due diligence at signing can change ownership, acquire a sanctioned subsidiary, or appear in adverse media a year into the contract. An executive who screened clean before a promotion becomes a materially different target the moment their public profile and visibility increase. None of that shows up anywhere until someone happens to run another check, which in most organizations means it never gets caught at all.
Continuous vetting outside the clearance system
Most of the people who can hurt an organization will never hold a clearance: the executive whose home address is one search away, the contractor with access to customer data, the new owner of a key supplier. Private employers cannot enroll those people in the federal program, and most still run a background check once at hiring and never again.
There is also a difference in what gets watched. Federal continuous vetting is built around records: arrests, financial delinquencies, terrorism databases. Those matter, but they are not the exposure an adversary sees. Prae applies the same always-current model to publicly available information, the open internet, social media, the dark web, and public records, resolving each signal to the right person with entity resolution and re-scoring their risk as it changes. Prae's monitoring is not a consumer report and is not used for eligibility decisions; any decision about someone's employment still runs through an FCRA-compliant check, the same as a check at hiring.
Who actually needs continuous vetting
Not every relationship needs it. A short, low-risk engagement with no ongoing access or exposure is usually well served by a one-time check. Continuous vetting earns its cost where the exposure window is long and the stakes are high:
- Regulated and high-trust roles, where a changed risk profile can carry licensing or compliance consequences.
- Executives, board members, and VIPs, who need ongoing overwatch as their public visibility and exposure shift.
- Active third-party relationships under due diligence, where ownership and reputational risk can change well after signing.
- Insider threat programs, where the entire premise is that risk builds gradually and needs to be caught before it escalates, not discovered after the fact.
What continuous vetting is not
It is not endpoint surveillance, and it is not access to private communications. Prae works only from publicly available information, using the same entity resolution that powers a point-in-time check, run continuously instead of once. It requires no intrusive endpoint agents and no access to sensitive HR data, and it measures exposure rather than policing behavior that was never public to begin with.
Quick answers
What is continuous vetting?
Continuous vetting is an ongoing review of a person's background, run on a recurring, automated basis instead of once at hiring or at a fixed reinvestigation date. It is the model the U.S. government adopted under Trusted Workforce 2.0 for cleared personnel, and the same approach is used commercially under the name continuous monitoring.
Does continuous vetting replace periodic reinvestigations?
For enrolled federal personnel, largely yes. Under Trusted Workforce 2.0, automated, recurring checks take the place of the traditional five- and ten-year reinvestigation cycle, though individuals keep their self-reporting obligations and agencies can still open an investigation when an alert warrants it.
Isn't continuous vetting just surveillance?
No. Prae monitors publicly available information only: the open internet, social media, the dark web, and public records. It requires no intrusive endpoint agents and no access to sensitive HR data, and it measures exposure rather than watching someone's private activity or communications.
Who needs continuous vetting outside the clearance system?
Anyone whose risk exposure can change after a one-time check: people in regulated or high-trust roles, executives and VIPs who need overwatch, and third parties in an active supplier, partner, or customer relationship. A short, low-risk engagement may not need it.