Your Vendor Questionnaire Is Security Theater
I have filled out hundreds of vendor security questionnaires, and I have sent out hundreds more. I can tell you with confidence that the process, as practiced almost everywhere, proves nothing about whether a vendor is safe to trust. It proves the vendor can answer a questionnaire.
Three hundred questions, a spreadsheet, a due date. The vendor’s sales engineer fills it in, mostly “yes” and “in place,” attaches a SOC 2 nobody will read past the cover page, and the deal moves forward. Both sides know it’s a ritual. We do it anyway, because it produces an artifact, and the artifact is what protects us — not from the vendor, but from blame.
Self-attestation measures honesty, not security
A questionnaire asks the vendor to grade their own homework. The answers correlate with how mature their sales process is, not how secure their product is. The sketchiest vendor and the strongest one both write “yes, data is encrypted at rest.” One means it. You can’t tell which from the spreadsheet, and the spreadsheet is the only thing you looked at.
Worse, the questionnaire creates false precision. Two hundred fields of green make risk feel quantified when nothing was actually verified. You didn’t assess the vendor. You assessed their willingness to type “yes.”
Assess the exposure, not the paperwork
Start from a different question: what does this vendor actually touch? A tool that ingests your customer data and holds the keys is a fundamentally different risk than one that renders a widget in an iframe. Most questionnaires ask all vendors the same three hundred questions and learn the same nothing from each. Tier by blast radius first, then spend your scrutiny where a compromise would actually hurt.
For the vendors that matter, replace faith with evidence. Read the actual SOC 2 exceptions, not the logo. Ask for a pentest summary and read what they found. Test the integration yourself — what scopes does that OAuth grant really request? Where does the data physically go? A single afternoon poking at the real integration tells you more than three hundred self-graded rows.
The relationship is the control
The questionnaire is a snapshot at the worst possible moment — the day they most want your signature. Real third-party risk is continuous: how they handle a vulnerability disclosure, whether they tell you about an incident before you read it in the news, how quickly they respond when you report something. You learn none of that from onboarding paperwork. You learn it from how they behave once you’re their customer.
Keep a short questionnaire if you need one for the record. Just don’t confuse the record with the assessment. The spreadsheet protects you on paper. Understanding what the vendor can actually reach is what protects you in fact.