Right now, people on security and GRC teams are spending their entire workday answering security questionnaires. At some companies it is a full-time role: a GRC analyst or compliance manager who arrives, opens a laptop, and works through these forms until they go home, two or three hundred of them in a year. I’ve heard the stories. The dinner missed, left a kid’s game at halftime, lost the weekend to a form asking whether the company still keeps tape backups. They do it because the questionnaire sits on the path to revenue. If the form stalls, the deal stalls with it.
There is a double standard built into the process. The same team buried under those questionnaires also sends them out to the company’s own vendors, collects the answers, and files them as proof those vendors are safe to trust. They know how little the answers are worth when they fill them out, because they have watched how little scrutiny the yeses get under deadline. They rely on them anyway when a vendor sends them back, because for a long time there was nothing better to rely on.
The same form, distrusted going out and trusted coming in
Step back and look at the whole exchange. Company A wants to sell to Company B. Before the deal closes, B sends A a questionnaire and a stack of security terms to sign: a security addendum, a data processing agreement, and now an AI addendum. Company A answers the questions, signs the commitments, and the deal proceeds. But A buys software too, so it runs its own vendors through the same exercise and weighs their answers to decide whom to trust. The form Company A knew was soft when it answered becomes, when A sits on the buyer’s side, its basis for trusting someone else. Every company in the chain is doing both at once.
Good programs already know the questionnaire is weak, which is why they also ask for a SOC 2 report, an ISO certificate, a penetration test, and sometimes an outside security rating. But look at where the weight still sits. The questionnaire is still what gates the deal and lands in the file as the record of due diligence. We have surrounded it with supplements and left it at the center. Trust between businesses runs, more than we like to admit, on a self-report: a vendor’s own account of its security, taken largely on the vendor’s word.
Why a self-reported answer stopped being evidence
An answer is not a control. A vendor writing yes does not make the thing true, and it was not true because your own team wrote yes when the roles were reversed. A questionnaire captures an intention, or a setting that was accurate on the day someone typed it, and then everyone moves on while the environment keeps changing.
If this model were working, third-party breaches should be getting rarer. They are not. Verizon’s 2025 Data Breach Investigations Report found the share of breaches involving a third party doubled in a single year, from 15 percent to 30 percent. They are not cheap, either. In IBM’s 2025 Cost of a Data Breach report, third-party and supply-chain compromise was one of the most expensive vectors at roughly $4.9 million per incident, above the global average, in a year when the overall average breach cost fell for the first time in five years. So the vendor-borne breach is getting more common and staying more costly even as breaches overall ease.
The clearest illustration is also one of the most studied breaches in the industry. Target was certified compliant with the Payment Card Industry Data Security Standard in September 2013. That December it disclosed a breach of 40 million payment cards. The certificate was real. It was also beside the point. A passing assessment tells you a vendor cleared a bar in one day. It does not tell you the vendor is secure, and that conflation is how thoroughly certified companies still end up writing breach notifications.
Stop trading promises, start trading proof
The market has started to act on this, and so have regulators. In an October 2025 industry letter, the New York Department of Financial Services (NYDFS) clarified what it expects of the firms it oversees: vet vendors up front, reassess them on a risk basis over time, obtain independent audit reports rather than rely on a vendor’s own say-so, and recognize that compliance cannot be handed off to the vendor. Stop exchanging assertions and start exchanging things the other party does not get to author. What that looks like depends on which chair you are in.
When you are assessing a vendor, start with what they cannot write for you. Before the questionnaire goes out, look at what is observable from the outside, none of which is self-reported:
- Exposed infrastructure and the state of their public-facing systems
- Breach and incident history
- Leaked or exposed credentials
It is not perfect. Anyone who has used security ratings knows the noise, the stale IP address, the subdomain that was never theirs. But it is harder to dress up than a self-graded form, and it is a better starting point than the vendor’s own account of itself. From there, concentrate your real effort on the few vendors who hold enough of your data or access to cause meaningful damage, and ask the rest for proof rather than prose: a report, a test result, or an attestation signed by someone who is not on the sales team.
When you are the one being assessed, the same principle holds. The security and data processing terms in your contracts are specific and binding in a way the questionnaire is not, and a customer is entitled to ask you to show, not assert, that you are meeting them. In practice that means being able to:
- Answer “show me you are doing what this clause requires” with current evidence
- Produce that evidence on demand, rather than re-typing the same three hundred answers into every customer’s form
- Stand behind the words as an accurate description of what is actually running, not what was true when someone last typed them
You put the promises in writing. Be able to back them the same way.
What trust between two companies should rest on
The questionnaire made sense when there was no other way to size up a vendor you couldn’t see inside. Mailing everyone a form was better than flying blind. That constraint is gone. You can observe a company from the outside, and you can produce real evidence behind your own commitments, neither of which existed at scale a decade ago.
So stop letting a self-report be the decision. Keep the questionnaire if it helps you start a conversation, but make the evidence, yours and theirs, the thing that actually settles whether there is trust. Businesses were never safe taking each other’s word for it. For a long time that was the only option. It is not anymore.
